Merge WebKit at r78450: Initial merge by git.

Change-Id: I6d3e5f1f868ec266a0aafdef66182ddc3f265dc1

1413 files changed, 50651 insertions, 22948 deletions

diff --git a/Source/WebCore/Android.jscbindings.mk b/Source/WebCore/Android.jscbindings.mk
index bd5dfbd..4248b9f 100644
--- a/Source/WebCore/Android.jscbindings.mk
+++ b/Source/WebCore/Android.jscbindings.mk
@@ -40,10 +40,9 @@ BINDING_C_INCLUDES := \
 	$(JAVASCRIPTCORE_PATH)/parser \
 	$(JAVASCRIPTCORE_PATH)/jit \
 	$(JAVASCRIPTCORE_PATH)/interpreter \
-	$(JAVASCRIPTCORE_PATH)/pcre \
 	$(JAVASCRIPTCORE_PATH)/profiler \
 	$(JAVASCRIPTCORE_PATH)/runtime \
-	$(JAVASCRIPTCORE_PATH)/wrec \
+	$(JAVASCRIPTCORE_PATH)/yarr \
 	$(JAVASCRIPTCORE_PATH)/ForwardingHeaders \
 	\
 	$(WEBCORE_INTERMEDIATES_PATH)/bindings/js \
@@ -152,6 +151,7 @@ LOCAL_SRC_FILES += \
 	bindings/js/JSLazyEventListener.cpp \
 	bindings/js/JSLocationCustom.cpp \
 	bindings/js/JSMainThreadExecState.cpp \
+	bindings/js/JSMemoryInfoCustom.cpp \
 	bindings/js/JSMessageChannelCustom.cpp \
 	bindings/js/JSMessageEventCustom.cpp \
 	bindings/js/JSMessagePortCustom.cpp \
diff --git a/Source/WebCore/Android.mk b/Source/WebCore/Android.mk
index a222521..cec49fd 100644
--- a/Source/WebCore/Android.mk
+++ b/Source/WebCore/Android.mk
@@ -131,6 +131,7 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	dom/DocumentFragment.cpp \
 	dom/DocumentMarkerController.cpp \
 	dom/DocumentParser.cpp \
+	dom/DocumentOrderedMap.cpp \
 	dom/DocumentType.cpp \
 	dom/DynamicNodeList.cpp \
 	dom/EditingText.cpp \
@@ -387,12 +388,15 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	html/parser/HTMLParserScheduler.cpp \
 	html/parser/HTMLPreloadScanner.cpp \
 	html/parser/HTMLScriptRunner.cpp \
+	html/parser/HTMLSourceTracker.cpp \
 	html/parser/HTMLTokenizer.cpp \
 	html/parser/HTMLTreeBuilder.cpp \
 	html/parser/HTMLViewSourceParser.cpp \
 	html/parser/TextDocumentParser.cpp \
 	html/parser/TextViewSourceParser.cpp \
+	html/parser/XSSFilter.cpp \
 	\
+	html/shadow/MediaControls.cpp \
 	html/shadow/SliderThumbElement.cpp \
 	\
 	inspector/ScriptArguments.cpp \
@@ -456,7 +460,9 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	page/Chrome.cpp \
 	page/Connection.cpp \
 	page/Console.cpp \
+	page/ContentSecurityPolicy.cpp \
 	page/ContextMenuController.cpp \
+	page/Crypto.cpp \
 	page/DOMSelection.cpp \
 	page/DOMTimer.cpp \
 	page/DOMWindow.cpp \
@@ -494,7 +500,6 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	page/UserContentURLPattern.cpp \
 	page/WindowFeatures.cpp \
 	page/WorkerNavigator.cpp \
-	page/XSSAuditor.cpp \
 	\
 	page/android/DragControllerAndroid.cpp \
 	page/android/EventHandlerAndroid.cpp \
@@ -646,6 +651,7 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 
 ifeq ($(ENABLE_SVG), true)
 LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
+	platform/graphics/filters/DistantLightSource.cpp \
 	platform/graphics/filters/FEBlend.cpp \
 	platform/graphics/filters/FEColorMatrix.cpp \
 	platform/graphics/filters/FEComponentTransfer.cpp \
@@ -660,7 +666,9 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	platform/graphics/filters/FESpecularLighting.cpp \
 	platform/graphics/filters/FETile.cpp \
 	platform/graphics/filters/FETurbulence.cpp \
-	platform/graphics/filters/LightSource.cpp
+	platform/graphics/filters/LightSource.cpp \
+	platform/graphics/filters/PointLightSource.cpp \
+	platform/graphics/filters/SpotLightSource.cpp
 endif
 
 LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
@@ -732,7 +740,12 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	\
 	platform/text/Base64.cpp \
 	platform/text/BidiContext.cpp \
+<<<<<<< HEAD
 	platform/text/LineEnding.cpp \
+=======
+	platform/text/Hyphenation.cpp \
+	platform/text/LocalizedNumberNone.cpp \
+>>>>>>> webkit.org at r78450
 	platform/text/RegularExpression.cpp \
 	platform/text/SegmentedString.cpp \
 	platform/text/String.cpp \
@@ -742,6 +755,7 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	platform/text/TextCodecICU.cpp \
 	platform/text/TextCodecLatin1.cpp \
 	platform/text/TextCodecUTF16.cpp \
+	platform/text/TextCodecUTF8.cpp \
 	platform/text/TextCodecUserDefined.cpp \
 	platform/text/TextEncoding.cpp \
 	platform/text/TextEncodingDetectorICU.cpp \
@@ -790,6 +804,7 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	rendering/RenderBox.cpp \
 	rendering/RenderBoxModelObject.cpp \
 	rendering/RenderButton.cpp \
+	rendering/RenderCombineText.cpp \
 	rendering/RenderCounter.cpp \
 	rendering/RenderDetails.cpp \
 	rendering/RenderDetailsMarker.cpp \
diff --git a/Source/WebCore/CMakeLists.txt b/Source/WebCore/CMakeLists.txt
index 95d8790..2873d8a 100644
--- a/Source/WebCore/CMakeLists.txt
+++ b/Source/WebCore/CMakeLists.txt
@@ -73,14 +73,13 @@ SET(WebCore_INCLUDE_DIRECTORIES
     "${JAVASCRIPTCORE_DIR}/interpreter"
     "${JAVASCRIPTCORE_DIR}/jit"
     "${JAVASCRIPTCORE_DIR}/parser"
-    "${JAVASCRIPTCORE_DIR}/pcre"
     "${JAVASCRIPTCORE_DIR}/profiler"
     "${JAVASCRIPTCORE_DIR}/runtime"
     "${JAVASCRIPTCORE_DIR}/wtf"
     "${JAVASCRIPTCORE_DIR}/wtf/unicode"
+    "${JAVASCRIPTCORE_DIR}/yarr"
     "${DERIVED_SOURCES_DIR}"
     "${CMAKE_SOURCE_DIR}"
-    "${CMAKE_SOURCE_DIR}/Source"
     "${CMAKE_BINARY_DIR}"
 )
 
@@ -320,6 +319,7 @@ SET(WebCore_IDL_FILES
     page/BarInfo.idl
     page/Console.idl
     page/Coordinates.idl
+    page/Crypto.idl
     page/DOMSelection.idl
     page/DOMWindow.idl
     page/EventSource.idl
@@ -422,146 +422,6 @@ SET(WebCore_IDL_FILES
     xml/XSLTProcessor.idl
 )
 
-IF (ENABLE_SVG)
-    LIST(APPEND WebCore_IDL_FILES
-        svg/SVGAElement.idl
-        svg/SVGAltGlyphElement.idl
-        svg/SVGAngle.idl
-        svg/SVGAnimateColorElement.idl
-        svg/SVGAnimateElement.idl
-        svg/SVGAnimateTransformElement.idl
-        svg/SVGAnimatedAngle.idl
-        svg/SVGAnimatedBoolean.idl
-        svg/SVGAnimatedEnumeration.idl
-        svg/SVGAnimatedInteger.idl
-        svg/SVGAnimatedLength.idl
-        svg/SVGAnimatedLengthList.idl
-        svg/SVGAnimatedNumber.idl
-        svg/SVGAnimatedNumberList.idl
-        svg/SVGAnimatedPreserveAspectRatio.idl
-        svg/SVGAnimatedRect.idl
-        svg/SVGAnimatedString.idl
-        svg/SVGAnimatedTransformList.idl
-        svg/SVGAnimationElement.idl
-        svg/SVGCircleElement.idl
-        svg/SVGClipPathElement.idl
-        svg/SVGColor.idl
-        svg/SVGComponentTransferFunctionElement.idl
-        svg/SVGCursorElement.idl
-        svg/SVGDefsElement.idl
-        svg/SVGDescElement.idl
-        svg/SVGDocument.idl
-        svg/SVGElement.idl
-        svg/SVGElementInstance.idl
-        svg/SVGElementInstanceList.idl
-        svg/SVGEllipseElement.idl
-        svg/SVGException.idl
-        svg/SVGFEBlendElement.idl
-        svg/SVGFEColorMatrixElement.idl
-        svg/SVGFEComponentTransferElement.idl
-        svg/SVGFECompositeElement.idl
-        svg/SVGFEConvolveMatrixElement.idl
-        svg/SVGFEDiffuseLightingElement.idl
-        svg/SVGFEDisplacementMapElement.idl
-        svg/SVGFEDistantLightElement.idl
-        svg/SVGFEFloodElement.idl
-        svg/SVGFEFuncAElement.idl
-        svg/SVGFEFuncBElement.idl
-        svg/SVGFEFuncGElement.idl
-        svg/SVGFEFuncRElement.idl
-        svg/SVGFEGaussianBlurElement.idl
-        svg/SVGFEImageElement.idl
-        svg/SVGFEMergeElement.idl
-        svg/SVGFEMergeNodeElement.idl
-        svg/SVGFEMorphologyElement.idl
-        svg/SVGFEOffsetElement.idl
-        svg/SVGFEPointLightElement.idl
-        svg/SVGFESpecularLightingElement.idl
-        svg/SVGFESpotLightElement.idl
-        svg/SVGFETileElement.idl
-        svg/SVGFETurbulenceElement.idl
-        svg/SVGFilterElement.idl
-        svg/SVGFontElement.idl
-        svg/SVGFontFaceElement.idl
-        svg/SVGFontFaceFormatElement.idl
-        svg/SVGFontFaceNameElement.idl
-        svg/SVGFontFaceSrcElement.idl
-        svg/SVGFontFaceUriElement.idl
-        svg/SVGForeignObjectElement.idl
-        svg/SVGGElement.idl
-        svg/SVGGlyphElement.idl
-        svg/SVGGradientElement.idl
-        svg/SVGHKernElement.idl
-        svg/SVGImageElement.idl
-        svg/SVGLength.idl
-        svg/SVGLengthList.idl
-        svg/SVGLineElement.idl
-        svg/SVGLinearGradientElement.idl
-        svg/SVGMarkerElement.idl
-        svg/SVGMaskElement.idl
-        svg/SVGMatrix.idl
-        svg/SVGMetadataElement.idl
-        svg/SVGMissingGlyphElement.idl
-        svg/SVGNumber.idl
-        svg/SVGNumberList.idl
-        svg/SVGPaint.idl
-        svg/SVGPathElement.idl
-        svg/SVGPathSeg.idl
-        svg/SVGPathSegArcAbs.idl
-        svg/SVGPathSegArcRel.idl
-        svg/SVGPathSegClosePath.idl
-        svg/SVGPathSegCurvetoCubicAbs.idl
-        svg/SVGPathSegCurvetoCubicRel.idl
-        svg/SVGPathSegCurvetoCubicSmoothAbs.idl
-        svg/SVGPathSegCurvetoCubicSmoothRel.idl
-        svg/SVGPathSegCurvetoQuadraticAbs.idl
-        svg/SVGPathSegCurvetoQuadraticRel.idl
-        svg/SVGPathSegCurvetoQuadraticSmoothAbs.idl
-        svg/SVGPathSegCurvetoQuadraticSmoothRel.idl
-        svg/SVGPathSegLinetoAbs.idl
-        svg/SVGPathSegLinetoHorizontalAbs.idl
-        svg/SVGPathSegLinetoHorizontalRel.idl
-        svg/SVGPathSegLinetoRel.idl
-        svg/SVGPathSegLinetoVerticalAbs.idl
-        svg/SVGPathSegLinetoVerticalRel.idl
-        svg/SVGPathSegList.idl
-        svg/SVGPathSegMovetoAbs.idl
-        svg/SVGPathSegMovetoRel.idl
-        svg/SVGPatternElement.idl
-        svg/SVGPoint.idl
-        svg/SVGPointList.idl
-        svg/SVGPolygonElement.idl
-        svg/SVGPolylineElement.idl
-        svg/SVGPreserveAspectRatio.idl
-        svg/SVGRadialGradientElement.idl
-        svg/SVGRect.idl
-        svg/SVGRectElement.idl
-        svg/SVGRenderingIntent.idl
-        svg/SVGSVGElement.idl
-        svg/SVGScriptElement.idl
-        svg/SVGSetElement.idl
-        svg/SVGStopElement.idl
-        svg/SVGStringList.idl
-        svg/SVGStyleElement.idl
-        svg/SVGSwitchElement.idl
-        svg/SVGSymbolElement.idl
-        svg/SVGTRefElement.idl
-        svg/SVGTSpanElement.idl
-        svg/SVGTextContentElement.idl
-        svg/SVGTextElement.idl
-        svg/SVGTextPathElement.idl
-        svg/SVGTextPositioningElement.idl
-        svg/SVGTitleElement.idl
-        svg/SVGTransform.idl
-        svg/SVGTransformList.idl
-        svg/SVGUnitTypes.idl
-        svg/SVGUseElement.idl
-        svg/SVGViewElement.idl
-        svg/SVGVKernElement.idl
-        svg/SVGZoomEvent.idl
-    )
-ENDIF()
-
 SET(WebCore_SOURCES
     ${DERIVED_SOURCES_DIR}/JSWebSocket.cpp
 
@@ -598,6 +458,8 @@ SET(WebCore_SOURCES
     bindings/js/GCController.cpp
     bindings/js/IDBBindingUtilities.cpp
     bindings/js/JSAttrCustom.cpp
+    bindings/js/JSArrayBufferCustom.cpp
+    bindings/js/JSDataViewCustom.cpp
     bindings/js/JSCDATASectionCustom.cpp
     bindings/js/JSCSSFontFaceRuleCustom.cpp
     bindings/js/JSCSSImportRuleCustom.cpp
@@ -646,6 +508,7 @@ SET(WebCore_SOURCES
     bindings/js/JSEventTarget.cpp
     bindings/js/JSExceptionBase.cpp
     bindings/js/JSFileReaderCustom.cpp
+    bindings/js/JSFloat32ArrayCustom.cpp
     bindings/js/JSGeolocationCustom.cpp
     bindings/js/JSHTMLAllCollectionCustom.cpp
     bindings/js/JSHTMLAppletElementCustom.cpp
@@ -670,12 +533,16 @@ SET(WebCore_SOURCES
     bindings/js/JSIDBKeyCustom.cpp
     bindings/js/JSImageConstructor.cpp
     bindings/js/JSImageDataCustom.cpp
+    bindings/js/JSInt16ArrayCustom.cpp
+    bindings/js/JSInt32ArrayCustom.cpp
+    bindings/js/JSInt8ArrayCustom.cpp
     bindings/js/JSInjectedScriptHostCustom.cpp
     bindings/js/JSInspectorFrontendHostCustom.cpp
     bindings/js/JSJavaScriptCallFrameCustom.cpp
     bindings/js/JSLazyEventListener.cpp
     bindings/js/JSLocationCustom.cpp
     bindings/js/JSMainThreadExecState.cpp
+    bindings/js/JSMemoryInfoCustom.cpp
     bindings/js/JSMessageChannelCustom.cpp
     bindings/js/JSMessageEventCustom.cpp
     bindings/js/JSMessagePortCustom.cpp
@@ -701,6 +568,9 @@ SET(WebCore_SOURCES
     bindings/js/JSTouchCustom.cpp
     bindings/js/JSTouchListCustom.cpp
     bindings/js/JSTreeWalkerCustom.cpp
+    bindings/js/JSUint16ArrayCustom.cpp 
+    bindings/js/JSUint32ArrayCustom.cpp
+    bindings/js/JSUint8ArrayCustom.cpp
     bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp
     bindings/js/JSWebKitCSSKeyframesRuleCustom.cpp
     bindings/js/JSWebKitCSSMatrixCustom.cpp
@@ -839,6 +709,7 @@ SET(WebCore_SOURCES
     dom/DocumentMarkerController.cpp
     dom/DocumentFragment.cpp
     dom/DocumentParser.cpp
+    dom/DocumentOrderedMap.cpp
     dom/DocumentType.cpp
     dom/DOMImplementation.cpp
     dom/DOMStringList.cpp
@@ -1123,12 +994,22 @@ SET(WebCore_SOURCES
     html/ValidityState.cpp
     html/WeekInputType.cpp
 
+    html/canvas/ArrayBuffer.cpp
+    html/canvas/ArrayBufferView.cpp
     html/canvas/CanvasGradient.cpp
     html/canvas/CanvasPattern.cpp
     html/canvas/CanvasPixelArray.cpp
     html/canvas/CanvasRenderingContext.cpp
     html/canvas/CanvasRenderingContext2D.cpp
     html/canvas/CanvasStyle.cpp
+    html/canvas/DataView.cpp
+    html/canvas/Float32Array.cpp
+    html/canvas/Int16Array.cpp
+    html/canvas/Int32Array.cpp
+    html/canvas/Int8Array.cpp
+    html/canvas/Uint16Array.cpp
+    html/canvas/Uint32Array.cpp
+    html/canvas/Uint8Array.cpp
 
     html/parser/CSSPreloadScanner.cpp
     html/parser/HTMLConstructionSite.cpp
@@ -1142,17 +1023,21 @@ SET(WebCore_SOURCES
     html/parser/HTMLMetaCharsetParser.cpp
     html/parser/HTMLPreloadScanner.cpp
     html/parser/HTMLScriptRunner.cpp
+    html/parser/HTMLSourceTracker.cpp
     html/parser/HTMLTokenizer.cpp
     html/parser/HTMLTreeBuilder.cpp
     html/parser/HTMLViewSourceParser.cpp
     html/parser/TextDocumentParser.cpp
     html/parser/TextViewSourceParser.cpp
+    html/parser/XSSFilter.cpp
 
+    html/shadow/MediaControls.cpp
     html/shadow/SliderThumbElement.cpp
 
     inspector/ConsoleMessage.cpp
     inspector/InjectedScript.cpp
     inspector/InjectedScriptHost.cpp
+    inspector/InspectorAgent.cpp
     inspector/InspectorApplicationCacheAgent.cpp
     inspector/InspectorBrowserDebuggerAgent.cpp
     inspector/InspectorCSSAgent.cpp
@@ -1165,20 +1050,17 @@ SET(WebCore_SOURCES
     inspector/InspectorDatabaseAgent.cpp
     inspector/InspectorDatabaseResource.cpp
     inspector/InspectorDebuggerAgent.cpp
-    inspector/InspectorFileSystemAgent.cpp
     inspector/InspectorFrontendClientLocal.cpp
     inspector/InspectorFrontendHost.cpp
     inspector/InspectorInstrumentation.cpp
     inspector/InspectorProfilerAgent.cpp
     inspector/InspectorResourceAgent.cpp
     inspector/InspectorRuntimeAgent.cpp
-    inspector/InspectorSettings.cpp
     inspector/InspectorState.cpp
     inspector/InspectorStyleSheet.cpp
     inspector/InspectorTimelineAgent.cpp
     inspector/InspectorValues.cpp
     inspector/ScriptArguments.cpp
-    inspector/ScriptBreakpoint.cpp
     inspector/ScriptCallFrame.cpp
     inspector/ScriptCallStack.cpp
     inspector/TimelineRecordFactory.cpp
@@ -1246,7 +1128,9 @@ SET(WebCore_SOURCES
     page/BarInfo.cpp
     page/Chrome.cpp
     page/Console.cpp
+    page/ContentSecurityPolicy.cpp
     page/ContextMenuController.cpp
+    page/Crypto.cpp
     page/DOMSelection.cpp
     page/DOMTimer.cpp
     page/DOMWindow.cpp
@@ -1284,7 +1168,6 @@ SET(WebCore_SOURCES
     page/UserContentURLPattern.cpp
     page/WindowFeatures.cpp
     page/WorkerNavigator.cpp
-    page/XSSAuditor.cpp
 
     page/animation/AnimationBase.cpp
     page/animation/AnimationController.cpp
@@ -1359,6 +1242,7 @@ SET(WebCore_SOURCES
     platform/graphics/StringTruncator.cpp
     platform/graphics/WidthIterator.cpp
 
+    platform/graphics/filters/DistantLightSource.cpp
     platform/graphics/filters/FEBlend.cpp
     platform/graphics/filters/FEColorMatrix.cpp
     platform/graphics/filters/FEComponentTransfer.cpp
@@ -1377,6 +1261,8 @@ SET(WebCore_SOURCES
     platform/graphics/filters/FETurbulence.cpp
     platform/graphics/filters/FilterEffect.cpp
     platform/graphics/filters/LightSource.cpp
+    platform/graphics/filters/PointLightSource.cpp
+    platform/graphics/filters/SpotLightSource.cpp
     platform/graphics/filters/SourceAlpha.cpp
     platform/graphics/filters/SourceGraphic.cpp
 
@@ -1427,6 +1313,7 @@ SET(WebCore_SOURCES
     platform/text/Base64.cpp
     platform/text/BidiContext.cpp
     platform/text/LineEnding.cpp
+    platform/text/LocalizedNumberNone.cpp
     platform/text/Hyphenation.cpp
     platform/text/RegularExpression.cpp
     platform/text/SegmentedString.cpp
@@ -1435,6 +1322,7 @@ SET(WebCore_SOURCES
     platform/text/TextCodec.cpp
     platform/text/TextCodecLatin1.cpp
     platform/text/TextCodecUTF16.cpp
+    platform/text/TextCodecUTF8.cpp
     platform/text/TextCodecUserDefined.cpp
     platform/text/TextEncoding.cpp
     platform/text/TextEncodingRegistry.cpp
@@ -1468,6 +1356,7 @@ SET(WebCore_SOURCES
     rendering/RenderBox.cpp
     rendering/RenderBoxModelObject.cpp
     rendering/RenderButton.cpp
+    rendering/RenderCombineText.cpp
     rendering/RenderCounter.cpp
     rendering/RenderDataGrid.cpp
     rendering/RenderDetails.cpp
@@ -1992,6 +1881,144 @@ IF (ENABLE_SVG)
         svg/properties/SVGPathSegListPropertyTearOff.cpp
     )
 
+    LIST(APPEND WebCore_IDL_FILES
+        svg/SVGAElement.idl
+        svg/SVGAltGlyphElement.idl
+        svg/SVGAngle.idl
+        svg/SVGAnimateColorElement.idl
+        svg/SVGAnimateElement.idl
+        svg/SVGAnimateTransformElement.idl
+        svg/SVGAnimatedAngle.idl
+        svg/SVGAnimatedBoolean.idl
+        svg/SVGAnimatedEnumeration.idl
+        svg/SVGAnimatedInteger.idl
+        svg/SVGAnimatedLength.idl
+        svg/SVGAnimatedLengthList.idl
+        svg/SVGAnimatedNumber.idl
+        svg/SVGAnimatedNumberList.idl
+        svg/SVGAnimatedPreserveAspectRatio.idl
+        svg/SVGAnimatedRect.idl
+        svg/SVGAnimatedString.idl
+        svg/SVGAnimatedTransformList.idl
+        svg/SVGAnimationElement.idl
+        svg/SVGCircleElement.idl
+        svg/SVGClipPathElement.idl
+        svg/SVGColor.idl
+        svg/SVGComponentTransferFunctionElement.idl
+        svg/SVGCursorElement.idl
+        svg/SVGDefsElement.idl
+        svg/SVGDescElement.idl
+        svg/SVGDocument.idl
+        svg/SVGElement.idl
+        svg/SVGElementInstance.idl
+        svg/SVGElementInstanceList.idl
+        svg/SVGEllipseElement.idl
+        svg/SVGException.idl
+        svg/SVGFEBlendElement.idl
+        svg/SVGFEColorMatrixElement.idl
+        svg/SVGFEComponentTransferElement.idl
+        svg/SVGFECompositeElement.idl
+        svg/SVGFEConvolveMatrixElement.idl
+        svg/SVGFEDiffuseLightingElement.idl
+        svg/SVGFEDisplacementMapElement.idl
+        svg/SVGFEDistantLightElement.idl
+        svg/SVGFEFloodElement.idl
+        svg/SVGFEFuncAElement.idl
+        svg/SVGFEFuncBElement.idl
+        svg/SVGFEFuncGElement.idl
+        svg/SVGFEFuncRElement.idl
+        svg/SVGFEGaussianBlurElement.idl
+        svg/SVGFEImageElement.idl
+        svg/SVGFEMergeElement.idl
+        svg/SVGFEMergeNodeElement.idl
+        svg/SVGFEMorphologyElement.idl
+        svg/SVGFEOffsetElement.idl
+        svg/SVGFEPointLightElement.idl
+        svg/SVGFESpecularLightingElement.idl
+        svg/SVGFESpotLightElement.idl
+        svg/SVGFETileElement.idl
+        svg/SVGFETurbulenceElement.idl
+        svg/SVGFilterElement.idl
+        svg/SVGFontElement.idl
+        svg/SVGFontFaceElement.idl
+        svg/SVGFontFaceFormatElement.idl
+        svg/SVGFontFaceNameElement.idl
+        svg/SVGFontFaceSrcElement.idl
+        svg/SVGFontFaceUriElement.idl
+        svg/SVGForeignObjectElement.idl
+        svg/SVGGElement.idl
+        svg/SVGGlyphElement.idl
+        svg/SVGGradientElement.idl
+        svg/SVGHKernElement.idl
+        svg/SVGImageElement.idl
+        svg/SVGLength.idl
+        svg/SVGLengthList.idl
+        svg/SVGLineElement.idl
+        svg/SVGLinearGradientElement.idl
+        svg/SVGMarkerElement.idl
+        svg/SVGMaskElement.idl
+        svg/SVGMatrix.idl
+        svg/SVGMetadataElement.idl
+        svg/SVGMissingGlyphElement.idl
+        svg/SVGNumber.idl
+        svg/SVGNumberList.idl
+        svg/SVGPaint.idl
+        svg/SVGPathElement.idl
+        svg/SVGPathSeg.idl
+        svg/SVGPathSegArcAbs.idl
+        svg/SVGPathSegArcRel.idl
+        svg/SVGPathSegClosePath.idl
+        svg/SVGPathSegCurvetoCubicAbs.idl
+        svg/SVGPathSegCurvetoCubicRel.idl
+        svg/SVGPathSegCurvetoCubicSmoothAbs.idl
+        svg/SVGPathSegCurvetoCubicSmoothRel.idl
+        svg/SVGPathSegCurvetoQuadraticAbs.idl
+        svg/SVGPathSegCurvetoQuadraticRel.idl
+        svg/SVGPathSegCurvetoQuadraticSmoothAbs.idl
+        svg/SVGPathSegCurvetoQuadraticSmoothRel.idl
+        svg/SVGPathSegLinetoAbs.idl
+        svg/SVGPathSegLinetoHorizontalAbs.idl
+        svg/SVGPathSegLinetoHorizontalRel.idl
+        svg/SVGPathSegLinetoRel.idl
+        svg/SVGPathSegLinetoVerticalAbs.idl
+        svg/SVGPathSegLinetoVerticalRel.idl
+        svg/SVGPathSegList.idl
+        svg/SVGPathSegMovetoAbs.idl
+        svg/SVGPathSegMovetoRel.idl
+        svg/SVGPatternElement.idl
+        svg/SVGPoint.idl
+        svg/SVGPointList.idl
+        svg/SVGPolygonElement.idl
+        svg/SVGPolylineElement.idl
+        svg/SVGPreserveAspectRatio.idl
+        svg/SVGRadialGradientElement.idl
+        svg/SVGRect.idl
+        svg/SVGRectElement.idl
+        svg/SVGRenderingIntent.idl
+        svg/SVGSVGElement.idl
+        svg/SVGScriptElement.idl
+        svg/SVGSetElement.idl
+        svg/SVGStopElement.idl
+        svg/SVGStringList.idl
+        svg/SVGStyleElement.idl
+        svg/SVGSwitchElement.idl
+        svg/SVGSymbolElement.idl
+        svg/SVGTRefElement.idl
+        svg/SVGTSpanElement.idl
+        svg/SVGTextContentElement.idl
+        svg/SVGTextElement.idl
+        svg/SVGTextPathElement.idl
+        svg/SVGTextPositioningElement.idl
+        svg/SVGTitleElement.idl
+        svg/SVGTransform.idl
+        svg/SVGTransformList.idl
+        svg/SVGUnitTypes.idl
+        svg/SVGUseElement.idl
+        svg/SVGViewElement.idl
+        svg/SVGVKernElement.idl
+        svg/SVGZoomEvent.idl
+    )
+
     LIST(APPEND WebCore_CSS_PROPERTY_NAMES
         ${WEBCORE_DIR}/css/SVGCSSPropertyNames.in
     )
@@ -2091,7 +2118,7 @@ FOREACH (_file ${WebCore_IDL_FILES})
     ADD_CUSTOM_COMMAND(
         OUTPUT  ${DERIVED_SOURCES_DIR}/JS${_name}.cpp ${DERIVED_SOURCES_DIR}/JS${_name}.h
         MAIN_DEPENDENCY ${_file}
-        DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${_file}
+        DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${WEBCORE_DIR}/bindings/scripts/CodeGeneratorJS.pm ${_file}
         COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --generator JS ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" ${WEBCORE_DIR}/${_file}
         VERBATIM)
     LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/JS${_name}.cpp)
@@ -2102,7 +2129,7 @@ ENDFOREACH ()
 ADD_CUSTOM_COMMAND(
     OUTPUT ${DERIVED_SOURCES_DIR}/InspectorBackendDispatcher.cpp ${DERIVED_SOURCES_DIR}/InspectorBackendDispatcher.h ${DERIVED_SOURCES_DIR}/InspectorFrontend.cpp ${DERIVED_SOURCES_DIR}/InspectorFrontend.h
     MAIN_DEPENDENCY inspector/Inspector.idl
-    DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} inspector/Inspector.idl
+    DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${WEBCORE_DIR}/inspector/CodeGeneratorInspector.pm inspector/Inspector.idl
     COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts -I${WEBCORE_DIR}/inspector ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --generator Inspector ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" ${WEBCORE_DIR}/inspector/Inspector.idl
     VERBATIM)
 LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/InspectorBackendDispatcher.cpp ${DERIVED_SOURCES_DIR}/InspectorFrontend.cpp)
@@ -2247,6 +2274,7 @@ WEBKIT_WRAP_SOURCELIST(${WebCore_IDL_FILES} ${WebCore_SOURCES})
 ADD_DEFINITIONS(-DBUILDING_WebCore)
 INCLUDE_DIRECTORIES(${WebCore_INCLUDE_DIRECTORIES})
 ADD_LIBRARY(${WebCore_LIBRARY_NAME} ${WebCore_LIBRARY_TYPE} ${WebCore_SOURCES})
+ADD_DEPENDENCIES(${WebCore_LIBRARY_NAME} ${JavaScriptCore_LIBRARY_NAME})
 TARGET_LINK_LIBRARIES(${WebCore_LIBRARY_NAME} ${WebCore_LIBRARIES})
 
 IF (WebCore_LINK_FLAGS)
diff --git a/Source/WebCore/CMakeListsEfl.txt b/Source/WebCore/CMakeListsEfl.txt
index 2ff8c4e..d9b387e 100644
--- a/Source/WebCore/CMakeListsEfl.txt
+++ b/Source/WebCore/CMakeListsEfl.txt
@@ -131,16 +131,6 @@ IF (WTF_USE_SOUP)
     platform/network/soup/ResourceResponseSoup.cpp
     platform/network/soup/SocketStreamHandleSoup.cpp
     platform/network/soup/SoupURIUtils.cpp
-
-    platform/network/soup/cache/soup-directory-input-stream.c
-    platform/network/soup/cache/soup-http-input-stream.c
-    platform/network/soup/cache/soup-request-data.c
-    platform/network/soup/cache/soup-request-file.c
-    platform/network/soup/cache/soup-request-http.c
-    platform/network/soup/cache/soup-request.c
-    platform/network/soup/cache/soup-requester.c
-
-    platform/network/soup/cache/webkit/soup-cache.c
   )
 ENDIF ()
 
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index d523cdb..8078751 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,17180 @@
+2011-02-13  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        <rdar://problem/8995490> WebCoreAuthenticationClientAsChallengeSender doesn't implement some necessary methods.
+
+        * platform/network/mac/AuthenticationMac.mm:
+        (-[WebCoreAuthenticationClientAsChallengeSender performDefaultHandlingForAuthenticationChallenge:]):
+        (-[WebCoreAuthenticationClientAsChallengeSender rejectProtectionSpaceAndContinueWithChallenge:]):
+
+2011-02-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Andreas Kling.
+
+        Repeating gradients drawn incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=53502
+        
+        The 'forward-fill' logic for repeating gradients used the wrong
+        starting stop index (0 rather than the original first index), which
+        resulted in incorrect gradients if backwards-fill had already been
+        applied.
+
+        Test: fast/gradients/css3-repeating-end-fill.html
+
+        * css/CSSGradientValue.cpp:
+        (WebCore::CSSGradientValue::addStops):
+
+2011-02-13  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        Unused variable result in RenderBlock::addOverflowFromFloats()
+        https://bugs.webkit.org/show_bug.cgi?id=54363
+
+        Remove the unused variable.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addOverflowFromFloats):
+
+2011-02-13  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        WebCore fails to build with Clang's -Woverloaded-virtual
+        https://bugs.webkit.org/show_bug.cgi?id=54367
+
+        * loader/PingLoader.h:
+        (WebCore::PingLoader::didReceiveData): Change the method signature to match the signature
+        in the base class.
+
+2011-02-13  Nico Weber  <thakis@chromium.org>
+
+        Reviewed by Anders Carlsson.
+
+        RenderBR::width() tries but fails to override RenderText::width()
+        https://bugs.webkit.org/show_bug.cgi?id=54301
+
+        The superclass method's signature changed, e.g. in
+        http://trac.webkit.org/changeset/57215, but the subclass was not
+        updated.
+
+        * rendering/RenderBR.h:
+        (WebCore::RenderBR::width):
+
+2011-02-13  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Dirk Schulze.
+
+        Canvas: 2d.fillStyle.parse.system.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=39168
+
+        Based on previous work by Julien Chaffraix <jchaffraix@codeaurora.org>
+        and Jan Erik Hanssen <jhanssen@sencha.com>
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseColor): Changed the function to better match our
+        early return policy. Also we now return false when we don't parse the color.
+        This is needed for createFromString to fallback to using parseSystemColor.
+
+        (WebCore::CSSParser::parseSystemColor): Made use of the RenderTheme to get
+        the system colors.
+
+        * css/CSSParser.h: Added the new parseSystemColor method.
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setStrokeColor): Pass the document to createFromString.
+        (WebCore::CanvasRenderingContext2D::setFillColor): Ditto.
+
+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::parseColor):
+        (WebCore::parseColorOrCurrentColor):
+        (WebCore::CanvasStyle::createFromString): Try to parse the color using CSSParser::parseColor
+        and fall back to parseSystemColor if it did not work.
+
+        * html/canvas/CanvasStyle.h: Added the new Document* parameter to createFromString.
+
+2011-02-13  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add a compile-time option to completely disable WebArchive support.
+        https://bugs.webkit.org/show_bug.cgi?id=52712
+
+        Add an ENABLE(WEB_ARCHIVE) compile-time setting and use it for all WebArchive code.
+
+        ArchiveResource and ArchiveResourceCollection are notably still compiled in. They are used
+        in Safari for functionality such as "Save Image As" and Image copy & paste independent of
+        WebArchive support.
+
+        Ports Affected:
+            WebArchive support is currently enabled for all ports that define PLATFORM(CF) apart from Qt.
+            This patch preserves this behavior except that it also disables support in the Chromium port.
+
+        No behavior changes so no new tests.
+
+        * WebCore.gyp/WebCore.gyp: Don't compile LegacyWebArchive.cpp and friends.
+        * WebCore.pro: Don't compile ArchiveFactory.cpp in Qt port.
+        * loader/DocumentLoader.cpp: Surround WebArchive code with #ifdef.
+        (WebCore::DocumentLoader::commitLoad):
+        (WebCore::DocumentLoader::setupForReplaceByMIMEType):
+        (WebCore::DocumentLoader::archiveResourceForURL):
+        * loader/DocumentLoader.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURLIntoChildFrame):
+        (WebCore::FrameLoader::stopAllLoaders):
+        (WebCore::FrameLoader::finishedLoadingDocument):
+        * loader/FrameLoader.h:
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::start):
+        * loader/archive/ArchiveFactory.cpp: Remove #ifdef since feature is now enabled/disabled wholesale.
+        (WebCore::archiveMIMETypes):
+        * page/Settings.cpp:
+        * page/Settings.h:
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedNonImageMimeTypes):
+
+2011-02-13  Aparna Nandyal  <aparna.nand@wipro.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] QtWebKit does not properly handle D&D of a percent-encoded URL.
+        https://bugs.webkit.org/show_bug.cgi?id=53320
+
+        The encoding that was done is corrected in the fix.  
+        Replaced the KURL encoding function with QUrl API.
+
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::asURL):
+
+2011-02-13  Leo Yang  <leo.yang.c@gmail.com>
+
+        Reviewed by Andreas Kling.
+
+        Unnecessary call of containingBlock() in RenderBoxModelObject::relativePositionOffsetX()
+        https://bugs.webkit.org/show_bug.cgi?id=54351
+
+        We were calling containingBlock() twice if the left is not auto. We only need to call it
+        once because we can use 'cb' variable in the following line.
+
+        No functionality change, no new tests.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::relativePositionOffsetX):
+
+2011-02-13  Jarred Nicholls  <jarred@sencha.com>
+
+        Reviewed by Simon Fraser.
+
+        getComputedStyle returns wrong value for margin-right
+        https://bugs.webkit.org/show_bug.cgi?id=13343
+        
+        Matching IE, Firefox, and Opera behavior by returning the computed margin
+        values as specified, rather than the used/auto values (calculated via RenderBox).
+        Also CSS 2.1+ compliant by returning margin percentage as specified, if applicable.
+        Note: Firefox and Opera return calculated fixed lengths for percentage margins, IE
+        returns the specified percentage.
+
+        Tests: fast/css/getComputedStyle/getComputedStyle-margin-auto.html
+               fast/css/getComputedStyle/getComputedStyle-margin-length.html
+               fast/css/getComputedStyle/getComputedStyle-margin-percentage.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+2011-02-13  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        crypto.getRandomValues should throw TYPE_MISMATCH_ERR
+        https://bugs.webkit.org/show_bug.cgi?id=54346
+
+        As requested by Sam.
+
+        * page/Crypto.cpp:
+        (WebCore::Crypto::getRandomValues):
+
+2011-02-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=54349
+        Inline some accessors in PrintContext
+
+        No change in behavior, so no tests.
+
+        * WebCore.exp.in:
+        * page/PrintContext.cpp:
+        * page/PrintContext.h:
+        (WebCore::PrintContext::pageCount):
+        (WebCore::PrintContext::pageRect):
+        Inline pageCount() and pageRect() to match pageRects().
+
+2011-02-13  Sam Weinig  <sam@webkit.org>
+
+        Roll r78424 [Extra scrolling required when scrolling with a scroll wheel (Mighty Mouse)] back
+        in with fixes to make it work with render layers.
+
+        * platform/mac/ScrollAnimatorMac.h:
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::scrollToOffsetWithoutAnimation):
+        (WebCore::ScrollAnimatorMac::adjustScrollXPositionIfNecessary):
+        (WebCore::ScrollAnimatorMac::adjustScrollYPositionIfNecessary):
+        (WebCore::ScrollAnimatorMac::adjustScrollPositionIfNecessary):
+        (WebCore::ScrollAnimatorMac::immediateScrollToPoint):
+        (WebCore::ScrollAnimatorMac::immediateScrollByDeltaX):
+        (WebCore::ScrollAnimatorMac::immediateScrollByDeltaY):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::contentsSize):
+        (WebCore::RenderLayer::visibleHeight):
+        (WebCore::RenderLayer::visibleWidth):
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+        * rendering/RenderLayer.h:
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::visibleHeight):
+        (WebCore::RenderListBox::visibleWidth):
+        * rendering/RenderListBox.h:
+
+2011-02-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Some Scrollbar functions assume an attached ScrollableArea but can be called without one
+        https://bugs.webkit.org/show_bug.cgi?id=54262
+
+        Make sure that all calls to the scrollable area are null checked.
+
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::autoscrollPressedPart):
+        (WebCore::Scrollbar::moveThumb):
+        (WebCore::Scrollbar::mouseMoved):
+
+2011-02-13  Sam Weinig  <sam@webkit.org>
+
+        Roll out r78424. It broke a bunch of tests.
+
+        * platform/mac/ScrollAnimatorMac.h:
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::scrollToOffsetWithoutAnimation):
+        (WebCore::ScrollAnimatorMac::immediateScrollToPoint):
+        (WebCore::ScrollAnimatorMac::immediateScrollByDeltaX):
+        (WebCore::ScrollAnimatorMac::immediateScrollByDeltaY):
+        * rendering/RenderLayer.cpp:
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::contentsSize):
+        * rendering/RenderListBox.cpp:
+        * rendering/RenderListBox.h:
+
+2011-02-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        WK2: Extra scrolling required when scrolling with a scroll wheel (Mighty Mouse)
+        <rdar://problem/8984760> 
+
+        When going down the smooth scroll path, constrained scrolls (such as those from a
+        Mighty Mouse) were being correctly constrained at the ScrollView level, but the 
+        duplicate values being stored by the animator were not being constrained correctly.
+
+        In order to implement the constraint at this level, more of the ScrollableArea's API
+        needed to be filled in for RenderLayer and RenderListBox.
+
+        * platform/mac/ScrollAnimatorMac.h:
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::scrollToOffsetWithoutAnimation): Call immediateScrollToPoint to stay
+        consistent and get the desired behavior.
+
+        (WebCore::ScrollAnimatorMac::adjustScrollXPositionIfNecessary):
+        (WebCore::ScrollAnimatorMac::adjustScrollYPositionIfNecessary):
+        (WebCore::ScrollAnimatorMac::adjustScrollPositionIfNecessary):
+        (WebCore::ScrollAnimatorMac::immediateScrollToPoint):
+        (WebCore::ScrollAnimatorMac::immediateScrollByDeltaX):
+        (WebCore::ScrollAnimatorMac::immediateScrollByDeltaY):
+        Ensure that the scroll animators view of the current scroll position is the
+        same as the scrollable areas by correctly clamping the value.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::contentsSize): Correct implementation
+        to use the scroll size, not the visible size.
+        (WebCore::RenderLayer::visibleHeight):
+        (WebCore::RenderLayer::visibleWidth):
+        * rendering/RenderLayer.h:
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::visibleHeight):
+        (WebCore::RenderListBox::visibleWidth):
+        * rendering/RenderListBox.h:
+        Add implementations for visibleHeight/visibleWidth.
+
+2011-02-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        crypto.getRandomValues should support all integer array types
+        https://bugs.webkit.org/show_bug.cgi?id=54342
+
+        As discussed on whatwg, we should support all the integer array types.
+
+        Test: security/crypto-random-values-types.html
+
+        * page/Crypto.cpp:
+        (WebCore::Crypto::getRandomValues):
+
+2011-02-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Use /dev/urandom as the OSRandomSource on OS(DARWIN)
+        https://bugs.webkit.org/show_bug.cgi?id=54279
+
+        Update the ifdef.  OS(UNIX) includes OS(DARWIN), so this change is
+        should be a NOP.
+
+        * config.h:
+
+2011-02-11  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Allow turning off multisampling through web preference settings
+        https://bugs.webkit.org/show_bug.cgi?id=54321
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::create): Disable multisampling in WebGL if web reference says so.
+        * page/Settings.cpp: Add a flag for multisampling preference.
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setOpenGLMultisamplingEnabled):
+        * page/Settings.h: Ditto.
+        (WebCore::Settings::openGLMultisamplingEnabled):
+
+2011-02-12  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Tony Chang.
+
+        Deploy EditingStyle in applyBlockStyle and applyInlineStyle
+        https://bugs.webkit.org/show_bug.cgi?id=53911
+
+        Deployed EditingStyle in ApplyStyleCommand::applyBlockStyle and ApplyStyleCommand::applyInlineStyle.
+        Extracted EditingStyle::extractAndRemoveTextDirection from applyInlineStyle.
+        Also added propertiesToInclude to the argument list of EditingStyle's constructor that takes Node*
+        so that splitAncestorsWithUnicodeBidi can call EditingStyle::textDirection to obtain the text direction.
+
+        No new tests are added since this is a refactoring.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::doApply): Passes EditingStyle* to applyBlockStyle and applyInlineStyle.
+        (WebCore::ApplyStyleCommand::applyBlockStyle): Takes EditingStyle*.
+        (WebCore::ApplyStyleCommand::splitAncestorsWithUnicodeBidi): Changed the type of allowedDirection
+        from int to WritingDirection. Uses EditingStyle's textDirection to obtain the writing direction.
+        (WebCore::ApplyStyleCommand::applyInlineStyle): Takes EditingStyle*.
+        (WebCore::ApplyStyleCommand::removeInlineStyleFromElement): Allows style to be null; exit early instead.
+        (WebCore::ApplyStyleCommand::removeImplicitlyStyledElement): Asserts that style is not null.
+        (WebCore::ApplyStyleCommand::removeInlineStyle): Allows style to be null.
+        * editing/ApplyStyleCommand.h: Includes WritingDirection.h; prototype changes.
+        * editing/EditingStyle.cpp:
+        (WebCore::EditingStyle::EditingStyle): Added PropertiesToInclude to the argument.
+        (WebCore::EditingStyle::init): Supports PropertiesToInclude.
+        (WebCore::EditingStyle::extractAndRemoveTextDirection): Extracted from applyInlineStyle.
+        * editing/EditingStyle.h:
+        (WebCore::EditingStyle::create): Supports PropertiesToInclude.
+
+2011-02-12  Jochen Eisinger  <jochen@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        Implement IDBObjectStore::clear
+        https://bugs.webkit.org/show_bug.cgi?id=54193
+
+        Test: storage/indexeddb/objectstore-clear.html
+
+        * storage/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::clear):
+        * storage/IDBObjectStore.h:
+        * storage/IDBObjectStore.idl:
+        * storage/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::clear):
+        (WebCore::doDelete):
+        (WebCore::IDBObjectStoreBackendImpl::clearInternal):
+        * storage/IDBObjectStoreBackendImpl.h:
+        * storage/IDBObjectStoreBackendInterface.h:
+
+2011-02-12  Adam Barth  <abarth@webkit.org>
+
+        Another attempt to fix the EFL build.  Looks like we're missing one
+        more file.
+
+        * CMakeLists.txt:
+
+2011-02-12  Adam Barth  <abarth@webkit.org>
+
+        Attempt to fix the EFL build.  Apparently the CMake build had no
+        concept of ArrayBuffers.
+
+        * CMakeLists.txt:
+
+2011-02-12  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Unreviewed build fix.
+
+        * dom/Range.cpp:
+        (WebCore::lengthOfContentsInNode): Replaced static const unsigned LengthOfContentsInNode.
+        (WebCore::Range::processContents):
+        (WebCore::Range::processContentsBetweenOffsets):
+
+2011-02-12  Adam Barth  <abarth@webkit.org>
+
+        CPP files belong in SOURCES not in HEADERS.  There are more errors like
+        this for other disabled features, but I'm not fixing them in this
+        patch.
+
+        * WebCore.pro:
+
+2011-02-12  Adam Barth  <abarth@webkit.org>
+
+        Apparently lines in .pro files need to be \-terminated.
+
+        * WebCore.pro:
+
+2011-02-11  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Extract a function to process contents for one node from Range::processContents
+        https://bugs.webkit.org/show_bug.cgi?id=54282
+
+        Extracted Range::processContentsBetweenOffsets, which process contents of a node
+        between two offsets. This function is used for the simple case where the start
+        and the end containers are of the same node, and to process start and end containers
+        in the complex case.
+
+        When the function takes a non-null fragment (simple case), it appends the processed
+        contents to the fragment; character data and processing instruction's contents are copied
+        between the offsets, and descendants are copied for node of other types (not node itself).
+
+        When the fragment is null (complex case), the function copies contents of character data,
+        processing instruction, and node of other types (including node itself).
+
+        No new tests are added since this is a refactoring.
+
+        * dom/Range.cpp:
+        (WebCore::highestAncestorUnderCommonRoot): Added.
+        (WebCore::Range::processContents): Calls highestAncestorUnderCommonRoot and
+        processContentsBetweenOffsets.
+        (WebCore::Range::processContentsBetweenOffsets): Added.
+        * dom/Range.h:
+
+2011-02-12  Adam Barth  <abarth@webkit.org>
+
+        Attempt to fix the Qt Windows build.
+
+        * WebCore.pro:
+
+2011-02-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Kenneth Russell.
+
+        Enable ArrayBuffers by default
+        https://bugs.webkit.org/show_bug.cgi?id=54310
+
+        As discussed on webkit-dev, ArrayBuffers are used by a bunch of
+        different APIs, implemented by Firefox, and appear to be stable.
+        Keeping them conditional is a large mantainance burden than it's worth.
+
+        * DerivedSources.cpp:
+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setWebGLEnabled):
+        * bindings/js/JSArrayBufferCustom.cpp:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDataViewCustom.cpp:
+        * bindings/js/JSFloat32ArrayCustom.cpp:
+        * bindings/js/JSInt16ArrayCustom.cpp:
+        * bindings/js/JSInt32ArrayCustom.cpp:
+        * bindings/js/JSInt8ArrayCustom.cpp:
+        * bindings/js/JSUint16ArrayCustom.cpp:
+        * bindings/js/JSUint32ArrayCustom.cpp:
+        * bindings/js/JSUint8ArrayCustom.cpp:
+        * bindings/v8/custom/V8ArrayBufferCustom.cpp:
+        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
+        * bindings/v8/custom/V8DataViewCustom.cpp:
+        * bindings/v8/custom/V8Float32ArrayCustom.cpp:
+        * bindings/v8/custom/V8Int16ArrayCustom.cpp:
+        * bindings/v8/custom/V8Int32ArrayCustom.cpp:
+        * bindings/v8/custom/V8Int8ArrayCustom.cpp:
+        * bindings/v8/custom/V8Uint16ArrayCustom.cpp:
+        * bindings/v8/custom/V8Uint32ArrayCustom.cpp:
+        * bindings/v8/custom/V8Uint8ArrayCustom.cpp:
+        * html/canvas/ArrayBuffer.cpp:
+        * html/canvas/ArrayBuffer.idl:
+        * html/canvas/ArrayBufferView.cpp:
+        * html/canvas/ArrayBufferView.idl:
+        * html/canvas/DataView.cpp:
+        * html/canvas/DataView.idl:
+        * html/canvas/Float32Array.cpp:
+        * html/canvas/Float32Array.idl:
+        * html/canvas/Int16Array.cpp:
+        * html/canvas/Int16Array.idl:
+        * html/canvas/Int32Array.cpp:
+        * html/canvas/Int32Array.idl:
+        * html/canvas/Int8Array.cpp:
+        * html/canvas/Int8Array.idl:
+        * html/canvas/Uint16Array.cpp:
+        * html/canvas/Uint16Array.idl:
+        * html/canvas/Uint32Array.cpp:
+        * html/canvas/Uint32Array.idl:
+        * html/canvas/Uint8Array.cpp:
+        * html/canvas/Uint8Array.idl:
+        * page/Crypto.cpp:
+        (WebCore::Crypto::getRandomValues):
+        * page/Crypto.h:
+        * page/Crypto.idl:
+        * page/DOMWindow.idl:
+        * workers/WorkerContext.idl:
+
+2011-02-11  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Background image positioning on RTL text
+        https://bugs.webkit.org/show_bug.cgi?id=32862
+
+        When the style of InlineFlowBox is right-to-left, the strips should be rearranged in reverse order.
+
+        Tests: fast/inline/inline-box-background-long-image.html
+               fast/inline/inline-box-background-repeat-x.html
+               fast/inline/inline-box-background-repeat-y.html
+               fast/inline/inline-box-background.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintFillLayer):
+
+2011-02-11  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r78044.
+        http://trac.webkit.org/changeset/78044
+        https://bugs.webkit.org/show_bug.cgi?id=54318
+
+        Broke Safari extensions (Requested by eseidel on #webkit).
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::parse):
+
+2011-02-11  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for <rdar://problem/8976456> Scrollbars for overflow
+        areas never appear for WKScrollbarPainter scrollers
+
+        Call ScrollableArea::didAddVerticalScrollbar() and 
+        ScrollableArea::willRemoveVerticalScrollbar() when
+        appropriate for RenderLayers.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::setHasHorizontalScrollbar):
+        (WebCore::RenderLayer::setHasVerticalScrollbar):
+
+2011-02-11  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        KURL should remove default port numbers when cannonicalizing urls (to match every other browser)
+        https://bugs.webkit.org/show_bug.cgi?id=54090
+
+        * platform/KURL.cpp:
+        (WebCore::isDefaultPortForScheme):
+        (WebCore::KURL::parse):
+
+2011-02-11  Mike Reed  <reed@google.com>
+
+        Reviewed by James Robinson.
+
+        Need makeContextCurrent() called in prepareForSoftwareDraw(), in the case that skia's backend
+        is the gpu. This matches the pattern in GraphicsContext3DOpenGL.cpp
+
+        No new tests. All existing canvas layouttests exercise this code path
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::prepareForSoftwareDraw):
+
+2011-02-11  Adam Klein  <adamk@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Check for empty scheme before accessing URLSchemeMaps in SchemeRegistry
+        https://bugs.webkit.org/show_bug.cgi?id=54304
+
+        This avoids potential crashes in HashMap, as WTF's StringHash doesn't
+        accept empty Strings.
+
+        * platform/SchemeRegistry.cpp:
+        (WebCore::SchemeRegistry::shouldTreatURLSchemeAsNoAccess):
+        (WebCore::SchemeRegistry::shouldTreatURLSchemeAsSecure):
+        (WebCore::SchemeRegistry::shouldLoadURLSchemeAsEmptyDocument):
+
+2011-02-11  Adam Klein  <adamk@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [fileapi] Add support for filesystem: URI handling
+        https://bugs.webkit.org/show_bug.cgi?id=53529
+
+        There are two major parts to this patch: one is to add an
+        implementation of Entry.toURI to the FileSystem API.
+        The other is to implement security origin checking for this
+        new scheme.
+
+        All changes are guarded by the FILE_SYSTEM feature. An accompanying
+        Chromium change, to support loading of filesystem: URIs, has recently
+        been submitted as Chromium r74082.
+
+        Spec:
+          http://dev.w3.org/2009/dap/file-system/file-dir-sys.html#methods-2
+        Proposed URI format, and discussion of security origin issues:
+          http://lists.w3.org/Archives/Public/public-webapps/2011JanMar/0218.html
+
+        Tests: fast/filesystem/directory-entry-to-uri.html
+               fast/filesystem/file-entry-to-uri.html
+               fast/filesystem/filesystem-uri-origin.html
+               http/tests/security/filesystem-iframe-from-remote.html
+
+        * fileapi/Entry.cpp:
+        (WebCore::Entry::toURI):
+        * fileapi/Entry.h:
+        * fileapi/Entry.idl:
+        - Added toURI method to the IDL, omitting the MIME type argument
+          specified in the spec as it will soon be removed.
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        - crack the filesystem: URI to get at the origin of the site
+        (WebCore::SecurityOrigin::canDisplay):
+        - canDisplay for filesystem: URIs is equivalent to canRequest
+        * platform/AsyncFileSystem.cpp:
+        (WebCore::AsyncFileSystem::create):
+        (WebCore::AsyncFileSystem::openFileSystem):
+        * platform/AsyncFileSystem.h:
+        (WebCore::AsyncFileSystem::type):
+        - Exposed filesystem type to allow toURI to use it as part of the
+          path.
+        (WebCore::AsyncFileSystem::AsyncFileSystem):
+        * platform/SchemeRegistry.cpp:
+        (WebCore::canDisplayOnlyIfCanRequestSchemes):
+        (WebCore::SchemeRegistry::canDisplayOnlyIfCanRequest):
+        (WebCore::SchemeRegistry::registerAsCanDisplayOnlyIfCanRequest):
+        - Generalized canDisplayOnlyIfCanRequest as it applies to both
+          filesystem: and blob: URIs.
+        * platform/SchemeRegistry.h:
+
+2011-02-11  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/8961061> CrashTracer: [USER] 
+        1 crash at com.apple.WebCore: 
+        -[ScrollbarPainterControllerDelegate scrollerImpPair:updateScrollerStyleForNewRecommendedScrollerStyle:] + 62
+
+        Must check for null _animator.
+        * platform/mac/ScrollAnimatorMac.mm:
+        (-[ScrollbarPainterControllerDelegate scrollAnimatorDestroyed]):
+        (-[ScrollbarPainterControllerDelegate contentAreaRectForScrollerImpPair:]):
+        (-[ScrollbarPainterControllerDelegate inLiveResizeForScrollerImpPair:]):
+        (-[ScrollbarPainterControllerDelegate mouseLocationInContentAreaForScrollerImpPair:]):
+        (-[ScrollbarPainterControllerDelegate scrollerImpPair:convertContentPoint:toScrollerImp:]):
+        (-[ScrollbarPainterControllerDelegate scrollerImpPair:updateScrollerStyleForNewRecommendedScrollerStyle:]):
+        (WebCore::ScrollAnimatorMac::~ScrollAnimatorMac):
+
+2011-02-11  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Throw exception when AudioContext's createBuffer() fails to properly decode audio file data
+        https://bugs.webkit.org/show_bug.cgi?id=54158
+
+        No new tests since audio API is not yet implemented.
+
+        * bindings/js/JSAudioContextCustom.cpp:
+        (WebCore::JSAudioContextConstructor::constructJSAudioContext):
+        (WebCore::JSAudioContext::createBuffer):
+        * bindings/v8/custom/V8AudioContextCustom.cpp:
+        (WebCore::V8AudioContext::createBufferCallback):
+        * platform/audio/chromium/AudioBusChromium.cpp:
+        (WebCore::createBusFromInMemoryAudioFile):
+        * webaudio/AudioContext.idl:
+
+2011-02-11  Mike Reed  <reed@google.com>
+
+        Reviewed by James Robinson.
+
+        Fix toDataURL() to use device->readPixels() if need be, rather than always dereferencing
+        the address returned by getPixels() (as the device may not be backed by a CPU bitmap)
+        https://bugs.webkit.org/show_bug.cgi?id=54224
+
+        No new tests. Existing canvas tests exercise this...
+        fast/canvas/script-tests/canvas-createPattern-fillRect-shadow.html
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::toDataURL):
+
+2011-02-11  Andrew Wason  <rectalogic@rectalogic.com>
+
+        Reviewed by David Levin.
+
+        Files missing ENABLE_VIDEO #ifdef
+        https://bugs.webkit.org/show_bug.cgi?id=53390
+
+        No new tests.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+          Wrap methods and declarations that use HTMLVideoElement
+          with #if ENABLE(VIDEO).
+
+2011-02-11  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r78331.
+        http://trac.webkit.org/changeset/78331
+        https://bugs.webkit.org/show_bug.cgi?id=54295
+
+        This patch broke 11 tests in GTK bots (Requested by svillar on
+        #webkit).
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_name):
+        (webkit_accessible_detach):
+
+2011-02-11  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GDOM] Video element needs proper wrapping
+        https://bugs.webkit.org/show_bug.cgi?id=54231
+
+        Use the same strategy as the one used for the audio tag to wrap
+        video as well. No layout tests because this only adds API.
+
+        * bindings/gobject/GNUmakefile.am:
+        * bindings/gobject/WebKitHTMLElementWrapperFactory.cpp:
+        (WebKit::createVideoWrapper):
+        (WebKit::createHTMLElementWrapper):
+
+2011-02-11  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        SVGStyledElement::fillAttributeToPropertyTypeMap triggers a clang warning (-Woverloaded-virtual)
+        https://bugs.webkit.org/show_bug.cgi?id=54259
+
+        Renamed fillAttributeToPropertyTypeMap with passed map to fillPassedAttributeToPropertyTypeMap to
+        avoid overloading a virtual function.
+
+        No change of functionality. Just fixing a build warning, so no new tests.
+
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGAltGlyphElement.cpp:
+        (WebCore::SVGAltGlyphElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGCircleElement.cpp:
+        (WebCore::SVGCircleElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGEllipseElement.cpp:
+        (WebCore::SVGEllipseElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEBlendElement.cpp:
+        (WebCore::SVGFEBlendElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEColorMatrixElement.cpp:
+        (WebCore::SVGFEColorMatrixElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEComponentTransferElement.cpp:
+        (WebCore::SVGFEComponentTransferElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFECompositeElement.cpp:
+        (WebCore::SVGFECompositeElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEConvolveMatrixElement.cpp:
+        (WebCore::SVGFEConvolveMatrixElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEDisplacementMapElement.cpp:
+        (WebCore::SVGFEDisplacementMapElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEFloodElement.cpp:
+        (WebCore::SVGFEFloodElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEGaussianBlurElement.cpp:
+        (WebCore::SVGFEGaussianBlurElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEMergeElement.cpp:
+        (WebCore::SVGFEMergeElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEMorphologyElement.cpp:
+        (WebCore::SVGFEMorphologyElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEOffsetElement.cpp:
+        (WebCore::SVGFEOffsetElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFETileElement.cpp:
+        (WebCore::SVGFETileElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFETurbulenceElement.cpp:
+        (WebCore::SVGFETurbulenceElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::fillPassedAttributeToPropertyTypeMap):
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+        * svg/SVGFontElement.cpp:
+        (WebCore::SVGFontElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGGlyphElement.cpp:
+        (WebCore::SVGGlyphElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::fillPassedAttributeToPropertyTypeMap):
+        * svg/SVGGradientElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGLineElement.cpp:
+        (WebCore::SVGLineElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGLinearGradientElement.cpp:
+        (WebCore::SVGLinearGradientElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGMissingGlyphElement.cpp:
+        (WebCore::SVGMissingGlyphElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGPolyElement.cpp:
+        (WebCore::SVGPolyElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGRectElement.cpp:
+        (WebCore::SVGRectElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGStopElement.cpp:
+        (WebCore::SVGStopElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::fillPassedAttributeToPropertyTypeMap):
+        * svg/SVGStyledElement.h:
+        * svg/SVGStyledTransformableElement.cpp:
+        (WebCore::SVGStyledTransformableElement::fillPassedAttributeToPropertyTypeMap):
+        * svg/SVGStyledTransformableElement.h:
+        * svg/SVGSwitchElement.cpp:
+        (WebCore::SVGSwitchElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGTSpanElement.cpp:
+        (WebCore::SVGTSpanElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::fillPassedAttributeToPropertyTypeMap):
+        * svg/SVGTextContentElement.h:
+        * svg/SVGTextElement.cpp:
+        (WebCore::SVGTextElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGTextPositioningElement.cpp:
+        (WebCore::SVGTextPositioningElement::fillPassedAttributeToPropertyTypeMap):
+        * svg/SVGTextPositioningElement.h:
+        * svg/SVGTitleElement.cpp:
+        (WebCore::SVGTitleElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::fillAttributeToPropertyTypeMap):
+
+2011-02-11  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [REGRESSION] click on error message in console doesn't scroll into view
+        https://bugs.webkit.org/show_bug.cgi?id=54089
+
+        * inspector/front-end/Drawer.js:
+        (WebInspector.Drawer.prototype.show.animationFinished):
+        (WebInspector.Drawer.prototype.show):
+        (WebInspector.Drawer.prototype.hide):
+        (WebInspector.Drawer.prototype.resize):
+        (WebInspector.Drawer.prototype.immediatelyFinishAnimation):
+        (WebInspector.Drawer.prototype._cancelAnimationIfNeeded):
+        (WebInspector.Drawer.prototype._animateDrawerHeight.animationFinished):
+        (WebInspector.Drawer.prototype._animateDrawerHeight):
+        (WebInspector.Drawer.prototype._statusBarDragging):
+        * inspector/front-end/inspector.js:
+        (WebInspector.animateStyle):
+        (WebInspector.animateStyle.forceComplete):
+        (WebInspector.animateStyle.cancel):
+        (WebInspector.showSourceLine):
+
+2011-02-10  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Make DocumentWriter a member of DocumentLoader
+        instead of FrameLoader.
+        https://bugs.webkit.org/show_bug.cgi?id=50489
+
+        Refactor, no new tests.
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::explicitClose):
+        (WebCore::Document::lastModified):
+        (WebCore::Document::initSecurityContext):
+        (WebCore::Document::updateURLForPushOrReplaceState):
+        * dom/Document.h:
+        (WebCore::Document::setDocumentLoader):
+        (WebCore::Document::loader):
+        * html/MediaDocument.cpp:
+        (WebCore::MediaDocument::replaceMediaElementTimerFired):
+        * html/PluginDocument.cpp:
+        (WebCore::PluginDocumentParser::createDocumentStructure):
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::DocumentLoader):
+        (WebCore::DocumentLoader::finishedLoading):
+        (WebCore::DocumentLoader::commitData):
+        (WebCore::DocumentLoader::setupForReplaceByMIMEType):
+        (WebCore::DocumentLoader::setFrame):
+        * loader/DocumentLoader.h:
+        (WebCore::DocumentLoader::writer):
+        * loader/DocumentWriter.cpp:
+        (WebCore::DocumentWriter::begin):
+        * loader/DocumentWriter.h:
+        (WebCore::DocumentWriter::setFrame):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::init):
+        (WebCore::FrameLoader::clear):
+        (WebCore::FrameLoader::receivedFirstData):
+        (WebCore::FrameLoader::transitionToCommitted):
+        (WebCore::FrameLoader::open):
+        (WebCore::FrameLoader::finishedLoadingDocument):
+        (WebCore::FrameLoader::addExtraFieldsToRequest):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::notifier):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+
+2011-02-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: make InspectorAgent own sub-agents, align agent creation/deletion routines.
+        https://bugs.webkit.org/show_bug.cgi?id=54227
+
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing):
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::restoreInspectorStateFromCookie):
+        (WebCore::InspectorAgent::setFrontend):
+        (WebCore::InspectorAgent::disconnectFrontend):
+        (WebCore::InspectorAgent::releaseFrontendLifetimeAgents):
+        (WebCore::InspectorAgent::didCommitLoad):
+        (WebCore::InspectorAgent::domContentLoadedEventFired):
+        (WebCore::InspectorAgent::loadEventFired):
+        (WebCore::InspectorAgent::startTimelineProfiler):
+        (WebCore::InspectorAgent::stopTimelineProfiler):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorCSSAgent.cpp:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::startListening):
+        (WebCore::InspectorDOMAgent::stopListening):
+        (WebCore::InspectorDOMAgent::mainDOMContentLoaded):
+        (WebCore::InspectorDOMAgent::loadEventFired):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::create):
+        * inspector/InspectorDOMStorageAgent.cpp:
+        (WebCore::InspectorDOMStorageAgent::~InspectorDOMStorageAgent):
+        * inspector/InspectorDOMStorageAgent.h:
+        (WebCore::InspectorDOMStorageAgent::create):
+        * inspector/InspectorDOMStorageResource.h:
+        * inspector/InspectorDatabaseAgent.cpp:
+        (WebCore::InspectorDatabaseAgent::~InspectorDatabaseAgent):
+        (WebCore::InspectorDatabaseAgent::executeSQL):
+        (WebCore::InspectorDatabaseAgent::selectDatabase):
+        (WebCore::InspectorDatabaseAgent::InspectorDatabaseAgent):
+        * inspector/InspectorDatabaseAgent.h:
+        (WebCore::InspectorDatabaseAgent::FrontendProvider::create):
+        (WebCore::InspectorDatabaseAgent::FrontendProvider::~FrontendProvider):
+        (WebCore::InspectorDatabaseAgent::FrontendProvider::frontend):
+        (WebCore::InspectorDatabaseAgent::FrontendProvider::clearFrontend):
+        (WebCore::InspectorDatabaseAgent::FrontendProvider::FrontendProvider):
+        (WebCore::InspectorDatabaseAgent::create):
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::InspectorDatabaseResource):
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorDatabaseResource.h:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::domContentLoadedEventFiredImpl):
+        (WebCore::InspectorInstrumentation::loadEventFiredImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::domContentLoadedEventFired):
+        (WebCore::InspectorInstrumentation::loadEventFired):
+        * inspector/InspectorState.cpp:
+        (WebCore::InspectorState::InspectorState):
+        (WebCore::InspectorState::mute):
+        (WebCore::InspectorState::updateCookie):
+        * inspector/InspectorState.h:
+        (WebCore::InspectorState::~InspectorState):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::restore):
+        (WebCore::InspectorTimelineAgent::~InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::didCommitLoad):
+        (WebCore::InspectorTimelineAgent::setFrontend):
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::InspectorTimelineAgent::create):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchLoadEvent):
+
+2011-02-11  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: command line API $0 regressed.
+        https://bugs.webkit.org/show_bug.cgi?id=54283
+
+        * inspector/InjectedScriptSource.js:
+
+2011-02-11  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt][S60] Vertical borders of buttons and frames are misaligned
+        https://bugs.webkit.org/show_bug.cgi?id=51169
+
+        Force anti-aliasing for lines and rects when using OpenVG backend on Symbian.
+        OpenVG cannot guarantee rendering to be on pixel in floating point co-ordinates
+        without anti-aliasing. Patch idea by Laszlo Agocs.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+
+2011-02-11  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] events missing when a document is (re)loaded
+        https://bugs.webkit.org/show_bug.cgi?id=25831
+
+        Make sure webArea returns a proper name and that a signal
+        'state-change::defunct' is emitted when detaching the wrapper.
+
+        Test: platform/gtk/accessibility/document-reload-events.html
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_name): Returns the current document's title
+        as fallback mechanism for webArea objects.
+        (webkit_accessible_detach): Emit 'state-change::defunct' function
+        as soon as the wrapper is detached from the related core object.
+
+2011-02-11  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: command line's API inspect() is broken.
+        https://bugs.webkit.org/show_bug.cgi?id=54275
+
+        Test: inspector/command-line-api.html
+
+        * inspector/InjectedScriptSource.js:
+
+2011-02-11  Adam Barth  <abarth@webkit.org>
+
+        Turns out window.crypto is supposed to be readonly.
+
+        * page/DOMWindow.idl:
+
+2011-02-11  Adam Barth  <abarth@webkit.org>
+
+        Actually add Crypto.cpp to the Windows build.  I'm terrible.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2011-02-11  Adam Barth  <abarth@webkit.org>
+
+        Attempt to fix the Windows build.  Apparently we don't support
+        conditional attributes on functions.  This patch makes the whole Crypto
+        interface conditional on ArrayBuffer support.
+
+        * page/DOMWindow.idl:
+        * page/Crypto.cpp:
+        * page/Crypto.h:
+        * page/Crypto.idl:
+
+2011-02-10  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Enable ancestor identifier filtering for tree building
+        https://bugs.webkit.org/show_bug.cgi?id=54241
+        
+        Call CSSStyleSelector::push/popParent() during tree building too, fix up the parent
+        element stack as needed.
+        
+        This roughly halves the remaining time in style matching over a typical page load.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::pushParentStackFrame):
+        (WebCore::CSSStyleSelector::popParentStackFrame):
+        (WebCore::CSSStyleSelector::pushParent):
+        (WebCore::CSSStyleSelector::popParent):
+        * css/CSSStyleSelector.h:
+        (WebCore::CSSStyleSelector::ParentStackFrame::ParentStackFrame):
+        * dom/Document.h:
+        (WebCore::Document::styleSelectorIfExists):
+        * dom/Element.cpp:
+        (WebCore::Element::beginParsingChildren):
+        (WebCore::Element::finishParsingChildren):
+        * dom/Element.h:
+
+2011-02-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebKit should have a cryptographic RNG
+        https://bugs.webkit.org/show_bug.cgi?id=22049
+
+        Add crypto.getRandomValues.  Yes, all these diffs are required to
+        expose a single function to the DOM.
+
+        Test: security/crypto-random-values.html
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * ForwardingHeaders/wtf/CryptographicallyRandomNumber.h: Added.
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pri:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * config.h:
+        * page/Crypto.cpp: Added.
+        (WebCore::Crypto::Crypto):
+        (WebCore::Crypto::getRandomValues):
+        * page/Crypto.h: Added.
+        (WebCore::Crypto::create):
+        * page/Crypto.idl: Added.
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::clear):
+        (WebCore::DOMWindow::crypto):
+        * page/DOMWindow.h:
+        (WebCore::DOMWindow::optionalCrypto):
+        * page/DOMWindow.idl:
+
+2011-02-11  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Unreviewed build fix.
+
+        [GTK] Build break with 2.18.3
+        https://bugs.webkit.org/show_bug.cgi?id=54057
+
+        * platform/gtk/ScrollbarThemeGtk2.cpp: Include GtkVersioning.h
+
+2011-02-11  Cosmin Truta  <ctruta@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Templatize KURLGooglePrivate::init
+        https://bugs.webkit.org/show_bug.cgi?id=53749
+
+        No new tests. Refactoring.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURLGooglePrivate::init):
+        * platform/KURLGooglePrivate.h:
+
+2011-02-10  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Convert ContainerNode::firstElementChild() to a free function.
+        https://bugs.webkit.org/show_bug.cgi?id=54269
+
+        No new tests. No change in behavior.
+        
+        It seemed incorrect to have a method on ContainerNode that had the
+        concept of an Element but couldn't return an Element*, but a method on
+        Element could not be called by holders of ContainerNodes or other
+        non-Element ContainerNode subclasses. A free function can both return
+        an Element* and be called by anyone with a ContainerNode*.
+
+        * dom/ContainerNode.h:
+        (WebCore::ContainerNode::lastChild):
+        (WebCore::Node::lastChild):
+        * dom/Document.cpp:
+        (WebCore::Document::cacheDocumentElement):
+        * dom/Element.cpp:
+        (WebCore::Element::firstElementChild):
+        * dom/Element.h:
+        (WebCore::firstElementChild):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::FragmentParsingContext::finished):
+
+2011-02-10  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        [V8] Don't crash on exception getting event handler function
+        https://bugs.webkit.org/show_bug.cgi?id=54216
+
+        Check for exceptions when attempting to get the handleEvent property
+        of an event-handler object.
+
+        Test: fast/dom/exception-getting-event-handler.html
+
+        * bindings/v8/V8EventListener.cpp:
+        (WebCore::V8EventListener::getListenerFunction):
+
+2011-02-10  Naoki Takano  <takano.naoki@gmail.com>
+
+        Reviewed by James Robinson.
+
+        [Chromium] Layout Test canvas/philip/tests/2d.composite.globalAlpha.fill.html with --accelerated-2d-canvas.
+        https://bugs.webkit.org/show_bug.cgi?id=53857
+
+        globalAlpha is not applied to fillPath() and fillRect().
+
+        Test: fast/canvas/2d.composite.globalAlpha.fillPath.html and canvas/philip/tests/2d.composite.globalAlpha.fill.html with --accelerated-2d-canvas.
+
+        * platform/graphics/chromium/GLES2Canvas.cpp:
+        (WebCore::GLES2Canvas::State::applyAlpha): Append a new function to apply global alpha when fillRect() and fillPath() are called.
+        (WebCore::GLES2Canvas::fillRect): Global alpha is applied to m_fillColor.
+        (WebCore::GLES2Canvas::fillPath): Global alpha is applied to m_fillColor.
+
+2011-02-10  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Remove an unneeded argument from HTMLDocument::create().
+        https://bugs.webkit.org/show_bug.cgi?id=54268
+        
+        Now that HTMLTreeBuilder no longer uses a dummy HTMLDocument for
+        fragment parsing, there isn't a need to explicitly specify a baseURL
+        when constructing an HTMLDocument. We can remove the unneeded argument.
+        
+        Also fix some style issues in Document.h and HTMLDocument.h caught by
+        check-webkit-style.
+
+        No new tests. No change in behavior.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::HTMLDocument):
+        * html/HTMLDocument.h:
+        (WebCore::HTMLDocument::create):
+
+2011-02-10  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Cached JavaScript Parser Data Being Left in Memory Cache
+        https://bugs.webkit.org/show_bug.cgi?id=54245
+
+        Added logic in CachedScript to clear SourceProviderCache data in
+        destroyDecodedData().  Added and changed CachedScript timeout to
+        act similar to CachedImage.  Changed didAddClient to call super
+        class method instead of duplicating the logic in the derived
+        classes.
+
+        * loader/cache/CachedImage.cpp:
+        (WebCore::CachedImage::didAddClient):
+        * loader/cache/CachedScript.cpp:
+        (WebCore::CachedScript::didAddClient):
+        (WebCore::CachedScript::allClientsRemoved):
+        (WebCore::CachedScript::script):
+        (WebCore::CachedScript::destroyDecodedData):
+        * loader/cache/CachedScript.h:
+
+2011-02-10  Cosmin Truta  <ctruta@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix style in KURLGooglePrivate
+        https://bugs.webkit.org/show_bug.cgi?id=54228
+
+        Replace occurrences of NULL with 0, '\0' or null (as applicable),
+        to appease check-webkit-style.
+
+        No new tests. This is a style fix.
+
+        * platform/KURLGoogle.cpp:
+        * platform/KURLGooglePrivate.h:
+
+2011-02-10  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Darin Adler.
+
+        HTML5 TreeBuilder regressed a Peacekeeper DOM test by 40%
+        https://bugs.webkit.org/show_bug.cgi?id=48719
+        
+        The HTML5 fragment parsing algorithm specifies that a new Document
+        should be created to serve as the temporary parent of fragment nodes
+        during parsing. Document creation is expensive and accounts for ~38% of
+        the Peacekeeper DOM performance regression. Avoid the cost of creating
+        a dummy document by using the already-created DocumentFragment as the
+        root node during fragment parsing.
+        
+        With this patch, the regression in Peacekeeper from Safari 5.0.3 to ToT
+        is ~24%.
+
+        Test: fast/parser/fragment-parser-doctype.html
+
+        * dom/ContainerNode.h:
+        (WebCore::ContainerNode::firstElementChild): Add a method that returns
+        the first element-typed child from a ContainerNode.
+        * dom/Document.cpp:
+        (WebCore::Document::cacheDocumentElement): Call
+        ContainerNode::firstElementChild() to retrieve and cache the document
+        element.
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::HTMLConstructionSite::HTMLConstructionSite): Initialize the
+        root ContainerNode.
+        (WebCore::HTMLConstructionSite::detach): Clear the reference to the
+        root ContainerNode.
+        (WebCore::HTMLConstructionSite::insertHTMLHtmlStartTagBeforeHTML):
+        Attach the new element to the root ContainerNode.
+        (WebCore::HTMLConstructionSite::insertDoctype): Ditto.
+        (WebCore::HTMLConstructionSite::insertCommentOnDocument): Ditto.
+        * html/parser/HTMLConstructionSite.h: Store a pointer to a
+        ContainerNode that will be used as the root node for document parsing.
+        This node might or might not be the same as m_document.
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::HTMLTreeBuilder): Initialize the
+        HTMLConstructionSite with the correct root ContainerNode based on
+        whether or not we're parsing a fragment.
+        (WebCore::HTMLTreeBuilder::FragmentParsingContext::FragmentParsingContext):
+        Remove m_dummyDocumentForFragmentParsing.
+        (WebCore::HTMLTreeBuilder::FragmentParsingContext::finished): If the
+        fragment has a context element, store only the children of the root
+        element (HTML5 Section 10.4, Step 7).
+        * html/parser/HTMLTreeBuilder.h:
+
+2011-02-10  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Speculative fix for <rdar://problem/8971107> CrashTracer: 6 crashes
+        in WebProcess at com.apple.AppKit: 
+        -[NSAnimation(NSInternal) _advanceTimeWithTimer:] + 154
+
+        * platform/mac/ScrollAnimatorMac.mm:
+        (-[ScrollbarPartAnimation scrollAnimatorDestroyed]):
+
+2011-02-09  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        IndexedDB event targets need to ensure their wrappers aren't garbage collected
+        https://bugs.webkit.org/show_bug.cgi?id=54144
+
+        hasActivityPending should return true as long as it's possible that we'll
+        fire more event listeners on our event targets. It is still possible for
+        user generated events to run into problems, but I'm not sure how to address
+        that yet (or how big of a deal it is).
+
+        There's really no way to test this deterministically. Testing by hand makes
+        it seem like this patch works as expected though.
+
+        * storage/IDBCursorBackendImpl.cpp:
+        * storage/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::IDBDatabase):
+        (WebCore::IDBDatabase::~IDBDatabase):
+        (WebCore::IDBDatabase::hasPendingActivity):
+        (WebCore::IDBDatabase::stop):
+        * storage/IDBDatabase.h:
+        * storage/IDBRequest.cpp:
+        (WebCore::IDBRequest::IDBRequest):
+        (WebCore::IDBRequest::hasPendingActivity):
+        (WebCore::IDBRequest::dispatchEvent):
+        (WebCore::IDBRequest::enqueueEvent):
+        * storage/IDBRequest.h:
+        * storage/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::finished):
+        (WebCore::IDBTransaction::hasPendingActivity):
+        (WebCore::IDBTransaction::dispatchEvent):
+        (WebCore::IDBTransaction::canSuspend):
+        (WebCore::IDBTransaction::contextDestroyed):
+        (WebCore::IDBTransaction::enqueueEvent):
+        * storage/IDBTransaction.h:
+
+2011-02-10  Ademar de Souza Reis Jr  <ademar.reis@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] create pkg-config files for mingw
+        https://bugs.webkit.org/show_bug.cgi?id=54238
+
+        (mingw is mostly the same as unix)
+
+        This change was applied in the Qt repository (qt/src/3rdparty/webkit),
+        so we should do the same here in QtWebKit.
+
+        Patch by Mark Brand <mabrand@mabrand.nl>, reviewed (there) by
+        Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
+        45fe2dddc3a0677b9ec9fce09f07cd4129e37afa
+
+        * WebCore.pro:
+
+2011-02-10  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Antti Koivisto.
+
+        RenderStyle: Remove duplicate comparison of InheritedFlags::_text_transform
+        https://bugs.webkit.org/show_bug.cgi?id=54246
+
+        * rendering/style/RenderStyle.h:
+
+2011-02-10  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        SVG animation avoid unnecessary adjust for currentColor
+        https://bugs.webkit.org/show_bug.cgi?id=54243
+
+        At the moment we try to adjust every animation value for currentColor - independent of the animation type.
+        Since the value is a string and the target element may needs to get called by getElementById, this could
+        be an expensive and unnecessary operation. Also after we adjust for currentColor, we save the result back
+        as a string and parse it to Color afterwards again.
+        With the patch we just adjust an animation value, if we use color animation. The color won't get saved and
+        parsed as a string again.
+
+        No change of functionality, no new tests.
+
+        * svg/SVGAnimateElement.cpp:
+        (WebCore::adjustForCurrentColor):
+        (WebCore::SVGAnimateElement::calculateFromAndToValues):
+        (WebCore::SVGAnimateElement::calculateFromAndByValues):
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::currentValuesForValuesAnimation):
+        (WebCore::SVGAnimationElement::startedActiveInterval):
+
+2011-02-10  Ademar de Souza Reis Jr  <ademar.reis@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Remove the use of deprecated qFindChildren()
+        https://bugs.webkit.org/show_bug.cgi?id=54232
+
+        This was applied on the Qt repository and affects QtWebKit there.
+        (13833beb641289c45faed337848d37280195aadc)
+
+        The side effect of this change is that we won't be able to build
+        QtWebKit with MSVC 6, as it doesn't support member template functions
+        (not sure if that's possible today anyway).
+
+        Original patch from Olivier Goffart <olivier.goffart@nokia.com>, with
+        review reported as being from the mailing list.
+
+        The changes are result of the following commands:
+
+            git grep -O"sed -i 's/qF\(indChildr*e*n*<[^>]*>\)(this,* */f\\1(/'" qFindChild
+            git grep -O"sed -i 's/qF\(indChildr*e*n*<[^>]*>\)(&\([^\(),]*\),* */\\2.f\\1(/'" qFindChild
+            git grep -O"sed -i 's/qF\(indChildr*e*n*<[^>]*>\)(\([^\(),]*()\),* */\\2->f\\1(/'" qFindChild
+            git grep -O"sed -i 's/qF\(indChildr*e*n*<[^>]*>\)(\([^\(),]*\):\([^\(),]*\),* */(\\2:\\3)->f\\1(/'" qFindChild
+            git grep -O"sed -i 's/qF\(indChildr*e*n*<[^>]*>\)(\([^\(),]*\),* */\\2->f\\1(/'" qFindChild
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivatePhonon::MediaPlayerPrivatePhonon):
+
+2011-02-10  Ademar de Souza Reis Jr  <ademar.reis@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Rename build target from "embedded" to "qpa"
+        https://bugs.webkit.org/show_bug.cgi?id=54233
+
+        This flag is used by Qt's configure script to enable a QPA build
+        ("QPA is a window system agnostic implementation of Qt" --
+        previously known as lighthouse).
+
+        On the Qt repository, this was changed by two commits:
+
+        13a0b4935900093607f2b3b7688e1452d22770fd
+        (from embedded to embedded_lite)
+
+        9716e12e0f5590ebc23ad9fb7ba75c6a3c5aadab
+        (from embedded_lite to qpa)
+
+        * WebCore.pro:
+
+2011-02-10  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by James Robinson.
+
+        Incorporate algorithm for processing paths into GPU-renderable triangle meshes
+        https://bugs.webkit.org/show_bug.cgi?id=45521
+
+        Adding an implementation of Loop and Blinn's GPU accelerated path
+        rendering algorithm from GPU Gems 3. This implementation pays
+        particular attention to the efficiency of the curve subdivision
+        phase needed for correct rendering. It utilizes the OpenGL utility
+        library tessellator for triangulation of the interior of the
+        shape. The regions handled by Loop and Blinn's algorithm are
+        handled by the local triangulator previously incorporated.
+
+        No tests yet; pixel tests will eventually be used to verify this
+        algorithm and prevent regressions.
+
+        * platform/graphics/gpu/LoopBlinnPathProcessor.cpp: Added.
+        (WebCore::LoopBlinnPathProcessorImplementation::Segment::Segment):
+        (WebCore::LoopBlinnPathProcessorImplementation::Segment::setup):
+        (WebCore::LoopBlinnPathProcessorImplementation::Segment::kind):
+        (WebCore::LoopBlinnPathProcessorImplementation::Segment::getPoint):
+        (WebCore::LoopBlinnPathProcessorImplementation::Segment::next):
+        (WebCore::LoopBlinnPathProcessorImplementation::Segment::prev):
+        (WebCore::LoopBlinnPathProcessorImplementation::Segment::setNext):
+        (WebCore::LoopBlinnPathProcessorImplementation::Segment::setPrev):
+        (WebCore::LoopBlinnPathProcessorImplementation::Segment::contour):
+        (WebCore::LoopBlinnPathProcessorImplementation::Segment::subdivide):
+        (WebCore::LoopBlinnPathProcessorImplementation::Segment::boundingBox):
+        (WebCore::LoopBlinnPathProcessorImplementation::Segment::numCrossingsForXRay):
+        (WebCore::LoopBlinnPathProcessorImplementation::Segment::numberOfTriangles):
+        (WebCore::LoopBlinnPathProcessorImplementation::Segment::getTriangle):
+        (WebCore::LoopBlinnPathProcessorImplementation::Segment::numberOfInteriorVertices):
+        (WebCore::LoopBlinnPathProcessorImplementation::Segment::getInteriorVertex):
+        (WebCore::LoopBlinnPathProcessorImplementation::Segment::markedForSubdivision):
+        (WebCore::LoopBlinnPathProcessorImplementation::Segment::setMarkedForSubdivision):
+        (WebCore::LoopBlinnPathProcessorImplementation::Segment::toString):
+        (WebCore::LoopBlinnPathProcessorImplementation::Segment::computeBoundingBox):
+        (WebCore::LoopBlinnPathProcessorImplementation::Contour::Contour):
+        (WebCore::LoopBlinnPathProcessorImplementation::Contour::add):
+        (WebCore::LoopBlinnPathProcessorImplementation::Contour::subdivide):
+        (WebCore::LoopBlinnPathProcessorImplementation::Contour::begin):
+        (WebCore::LoopBlinnPathProcessorImplementation::Contour::end):
+        (WebCore::LoopBlinnPathProcessorImplementation::Contour::isOrientedCounterClockwise):
+        (WebCore::LoopBlinnPathProcessorImplementation::Contour::setIsOrientedCounterClockwise):
+        (WebCore::LoopBlinnPathProcessorImplementation::Contour::boundingBox):
+        (WebCore::LoopBlinnPathProcessorImplementation::Contour::fillSide):
+        (WebCore::LoopBlinnPathProcessorImplementation::Contour::setFillSide):
+        (WebCore::LoopBlinnPathProcessorImplementation::Segment::triangulate):
+        (WebCore::LoopBlinnPathProcessor::LoopBlinnPathProcessor):
+        (WebCore::LoopBlinnPathProcessor::~LoopBlinnPathProcessor):
+        (WebCore::LoopBlinnPathProcessor::process):
+        (WebCore::LoopBlinnPathProcessor::buildContours):
+        (WebCore::LoopBlinnPathProcessor::allSegmentsOverlappingY):
+        (WebCore::LoopBlinnPathProcessor::determineSidesToFill):
+        (WebCore::LoopBlinnPathProcessor::determineOrientation):
+        (WebCore::SweepData::SweepEvent::SweepEvent):
+        (WebCore::SweepData::SweepEvent::setup):
+        (WebCore::SweepData::SweepEvent::x):
+        (WebCore::SweepData::SweepEvent::entry):
+        (WebCore::SweepData::SweepEvent::interval):
+        (WebCore::SweepData::SweepEvent::operator<):
+        (WebCore::SweepData::trianglesOverlap):
+        (WebCore::LoopBlinnPathProcessor::subdivideCurves):
+        (WebCore::LoopBlinnPathProcessor::conditionallySubdivide):
+        (WebCore::LoopBlinnPathProcessor::subdivideCurvesSlow):
+        (WebCore::TessellationState::vertexCallback):
+        (WebCore::TessellationState::combineCallback):
+        (WebCore::TessellationState::edgeFlagCallback):
+        (WebCore::LoopBlinnPathProcessor::tessellateInterior):
+        * platform/graphics/gpu/LoopBlinnPathProcessor.h: Added.
+
+2011-02-10  Ademar de Souza Reis Jr  <ademar.reis@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Remove the use of deprecated qVariant*
+        https://bugs.webkit.org/show_bug.cgi?id=54229
+
+        This was applied on the Qt repository and affects QtWebKit there.
+        (633f3f45e5420663cf4ceadea79e62fea44cd2eb)
+
+        The side effect of this change is that we won't be able to build
+        QtWebKit with MSVC 6, as it doesn't support member template functions
+        (not sure if it's possible today anyway).
+
+        Original patch from Olivier Goffart <olivier.goffart@nokia.com>, with
+        review reported as being from the mailing list.
+
+        The changes are result of the following commands:
+
+            git grep -O"sed -i 's/qVariantValue</qvariant_cast</'" qVariantValue
+            git grep -O"sed -i 's/qVariantSetValue(\([^&*\(),]*\), */\\1.setValue(/'" qVariantSetValue
+            git grep -O"sed -i 's/qVariantSetValue *<\([^>]*\)> *(\([^&*\(),]*\), */\\2.setValue<\\1>(/'" qVariantSetValue
+            git grep -O"sed -i 's/qVariantCanConvert *<\([^>]*\)> *(\([^&*\(),]*\))/\\2.canConvert<\\1>()/g'" qVariantCanConvert
+            git grep -O"sed -i 's/qVariantCanConvert *<\([^>]*\)> *(\([^&*\(),]*([^&*\(),]*)\))/\\2.canConvert<\\1>()/g'" qVariantCanConvert
+            git grep -O"sed -i 's/qVariantFromValue\( *[(<]\)/QVariant::fromValue\\1/'" qVariantFromValue
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivateQt::commitLoad):
+
+2011-02-10  Nico Weber  <thakis@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix clang warning "WebCore::HTMLAreaElement::getRect' hides overloaded virtual function [-Woverloaded-virtual]"
+        https://bugs.webkit.org/show_bug.cgi?id=54221
+
+        The method name conflicts with ContainerNode::getRect() so rename it to
+        computeRect(). Rename getPath() to computePath() for consistency as
+        well.
+
+        No intended functionality change, covered by existing tests.
+
+        * accessibility/AccessibilityImageMapLink.cpp:
+        (WebCore::AccessibilityImageMapLink::elementRect):
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::computePath):
+        (WebCore::HTMLAreaElement::computeRect):
+        * html/HTMLAreaElement.h:
+        * page/SpatialNavigation.cpp:
+        (WebCore::virtualRectForAreaElementAndDirection):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintFocusRing):
+
+2011-02-10  Alexis Menard  <alexis.menard@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Default focus ring is too wide
+        https://bugs.webkit.org/show_bug.cgi?id=51854
+
+        We now respect the outline property and html.css defines the outline of the focus
+        ring to be 5px. This is propagated until GraphicsContext::drawFocusRing which uses
+        it as the pen size. We should ignore the size and keep a default one. I also
+        reverted the SolidLine to DotLine so that the selection looks nicer. Chromium Skia,
+        CG Win, Haiku, WinCE ports also ignore the width.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::drawFocusRingForPath):
+        (WebCore::GraphicsContext::drawFocusRing):
+
+2011-02-10  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Soup] ResourceHandleSoup does not ever call didSendData for file uploads
+        https://bugs.webkit.org/show_bug.cgi?id=52090
+
+        Call didSendData as body data is uploaded to the server. This is necessary
+        for XHR upload events to function properly.
+
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal): Add two new members.
+        One to track the total amount of body data and one to track the total amount of
+        body data sent so far.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::wroteBodyDataCallback): Added.
+        (WebCore::addFormElementsToSoupMessage): Split this out into a helper function.
+        Will now now sum the total amount of body data.
+        (WebCore::startHttp): Attach a wrote-body-data signal handler.
+
+2011-02-10  Bill Budge  <bbudge@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add fields to ResourceRequest and ResourceResponse in preparation for adding CORS support to AssociatedURLLoader.
+        https://bugs.webkit.org/show_bug.cgi?id=53925
+
+        * platform/network/chromium/ResourceRequest.cpp:
+        (WebCore::ResourceRequest::doPlatformCopyData):
+        (WebCore::ResourceRequest::doPlatformAdopt):
+        * platform/network/chromium/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::downloadToFile):
+        (WebCore::ResourceRequest::setDownloadToFile):
+        * platform/network/chromium/ResourceResponse.cpp:
+        (WebCore::ResourceResponse::doPlatformCopyData):
+        (WebCore::ResourceResponse::doPlatformAdopt):
+        * platform/network/chromium/ResourceResponse.h:
+        (WebCore::ResourceResponse::downloadFilePath):
+        (WebCore::ResourceResponse::setDownloadFilePath):
+
+2011-02-10  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVGAnimateElement needs information about the animated attribute type
+        https://bugs.webkit.org/show_bug.cgi?id=53442
+
+        For animations, we need to know the SVG property type for a XML attribute. A global static mapping between
+        attribute name and a type is not possible, since one attribute name can be bound to different property types:
+        x can be a SVGNumberList, a SVGNumber or a SVGLength. So we have to ask every target element, if it supports
+        the animated attribute and of which type it is. Just for CSS properties we can share an explicit mapping between
+        the name and the type. This is done in a static map in SVGStyledElement. All other mappings are stored in local static
+        HashMaps for all SVG elements with animated properties. These maps get filled once with the fillAttributeToPropertyTypeMap function
+        that needs to be included in every SVG element. The function is not virtual in base classes for performance reasons.
+
+        No change of functionality, so no new test cases.
+
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::attributeToPropertyTypeMap):
+        (WebCore::SVGAElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGAElement.h:
+        * svg/SVGAltGlyphElement.cpp:
+        (WebCore::SVGAltGlyphElement::attributeToPropertyTypeMap):
+        (WebCore::SVGAltGlyphElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGAltGlyphElement.h:
+        * svg/SVGAnimateElement.cpp:
+        (WebCore::SVGAnimateElement::determinePropertyType):
+        * svg/SVGCircleElement.cpp:
+        (WebCore::SVGCircleElement::attributeToPropertyTypeMap):
+        (WebCore::SVGCircleElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGCircleElement.h:
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::attributeToPropertyTypeMap):
+        (WebCore::SVGClipPathElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGClipPathElement.h:
+        * svg/SVGComponentTransferFunctionElement.cpp:
+        (WebCore::SVGComponentTransferFunctionElement::attributeToPropertyTypeMap):
+        (WebCore::SVGComponentTransferFunctionElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGComponentTransferFunctionElement.h:
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::attributeToPropertyTypeMap):
+        (WebCore::SVGCursorElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGCursorElement.h:
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::attributeToPropertyTypeMap):
+        (WebCore::SVGElement::animatedPropertyTypeForAttribute):
+        * svg/SVGElement.h:
+        (WebCore::SVGElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGEllipseElement.cpp:
+        (WebCore::SVGEllipseElement::attributeToPropertyTypeMap):
+        (WebCore::SVGEllipseElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGEllipseElement.h:
+        * svg/SVGFEBlendElement.cpp:
+        (WebCore::SVGFEBlendElement::attributeToPropertyTypeMap):
+        (WebCore::SVGFEBlendElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEBlendElement.h:
+        * svg/SVGFEColorMatrixElement.cpp:
+        (WebCore::SVGFEColorMatrixElement::attributeToPropertyTypeMap):
+        (WebCore::SVGFEColorMatrixElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEColorMatrixElement.h:
+        * svg/SVGFEComponentTransferElement.cpp:
+        (WebCore::SVGFEComponentTransferElement::attributeToPropertyTypeMap):
+        (WebCore::SVGFEComponentTransferElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEComponentTransferElement.h:
+        * svg/SVGFECompositeElement.cpp:
+        (WebCore::SVGFECompositeElement::attributeToPropertyTypeMap):
+        (WebCore::SVGFECompositeElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFECompositeElement.h:
+        * svg/SVGFEConvolveMatrixElement.cpp:
+        (WebCore::SVGFEConvolveMatrixElement::attributeToPropertyTypeMap):
+        (WebCore::SVGFEConvolveMatrixElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEConvolveMatrixElement.h:
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::attributeToPropertyTypeMap):
+        (WebCore::SVGFEDiffuseLightingElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEDiffuseLightingElement.h:
+        * svg/SVGFEDisplacementMapElement.cpp:
+        (WebCore::SVGFEDisplacementMapElement::attributeToPropertyTypeMap):
+        (WebCore::SVGFEDisplacementMapElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEDisplacementMapElement.h:
+        * svg/SVGFEFloodElement.cpp:
+        (WebCore::SVGFEFloodElement::attributeToPropertyTypeMap):
+        (WebCore::SVGFEFloodElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEGaussianBlurElement.cpp:
+        (WebCore::SVGFEGaussianBlurElement::attributeToPropertyTypeMap):
+        (WebCore::SVGFEGaussianBlurElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEGaussianBlurElement.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::attributeToPropertyTypeMap):
+        (WebCore::SVGFEImageElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFELightElement.cpp:
+        (WebCore::SVGFELightElement::attributeToPropertyTypeMap):
+        (WebCore::SVGFELightElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFELightElement.h:
+        * svg/SVGFEMergeElement.cpp:
+        (WebCore::SVGFEMergeElement::attributeToPropertyTypeMap):
+        (WebCore::SVGFEMergeElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEMergeElement.h:
+        * svg/SVGFEMergeNodeElement.cpp:
+        (WebCore::SVGFEMergeNodeElement::attributeToPropertyTypeMap):
+        (WebCore::SVGFEMergeNodeElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEMergeNodeElement.h:
+        * svg/SVGFEMorphologyElement.cpp:
+        (WebCore::SVGFEMorphologyElement::attributeToPropertyTypeMap):
+        (WebCore::SVGFEMorphologyElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEMorphologyElement.h:
+        * svg/SVGFEOffsetElement.cpp:
+        (WebCore::SVGFEOffsetElement::attributeToPropertyTypeMap):
+        (WebCore::SVGFEOffsetElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFEOffsetElement.h:
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::attributeToPropertyTypeMap):
+        (WebCore::SVGFESpecularLightingElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFESpecularLightingElement.h:
+        * svg/SVGFETileElement.cpp:
+        (WebCore::SVGFETileElement::attributeToPropertyTypeMap):
+        (WebCore::SVGFETileElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFETileElement.h:
+        * svg/SVGFETurbulenceElement.cpp:
+        (WebCore::SVGFETurbulenceElement::attributeToPropertyTypeMap):
+        (WebCore::SVGFETurbulenceElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFETurbulenceElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::attributeToPropertyTypeMap):
+        (WebCore::SVGFilterElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFilterElement.h:
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::fillAttributeToPropertyTypeMap):
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+        * svg/SVGFontElement.cpp:
+        (WebCore::SVGFontElement::attributeToPropertyTypeMap):
+        (WebCore::SVGFontElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGFontElement.h:
+        (WebCore::SVGFontElement::rendererIsNeeded):
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::attributeToPropertyTypeMap):
+        (WebCore::SVGForeignObjectElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGForeignObjectElement.h:
+        * svg/SVGGlyphElement.cpp:
+        (WebCore::SVGGlyphElement::attributeToPropertyTypeMap):
+        (WebCore::SVGGlyphElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGGlyphElement.h:
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGGradientElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::attributeToPropertyTypeMap):
+        (WebCore::SVGImageElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGImageElement.h:
+        * svg/SVGLineElement.cpp:
+        (WebCore::SVGLineElement::attributeToPropertyTypeMap):
+        (WebCore::SVGLineElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGLineElement.h:
+        * svg/SVGLinearGradientElement.cpp:
+        (WebCore::SVGLinearGradientElement::attributeToPropertyTypeMap):
+        (WebCore::SVGLinearGradientElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGLinearGradientElement.h:
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::attributeToPropertyTypeMap):
+        (WebCore::SVGMPathElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGMPathElement.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::attributeToPropertyTypeMap):
+        (WebCore::SVGMarkerElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::attributeToPropertyTypeMap):
+        (WebCore::SVGMaskElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGMaskElement.h:
+        * svg/SVGMissingGlyphElement.cpp:
+        (WebCore::SVGMissingGlyphElement::attributeToPropertyTypeMap):
+        (WebCore::SVGMissingGlyphElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGMissingGlyphElement.h:
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::attributeToPropertyTypeMap):
+        (WebCore::SVGPathElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGPathElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::attributeToPropertyTypeMap):
+        (WebCore::SVGPatternElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGPatternElement.h:
+        * svg/SVGPolyElement.cpp:
+        (WebCore::SVGPolyElement::attributeToPropertyTypeMap):
+        (WebCore::SVGPolyElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGPolyElement.h:
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::attributeToPropertyTypeMap):
+        (WebCore::SVGRadialGradientElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGRadialGradientElement.h:
+        * svg/SVGRectElement.cpp:
+        (WebCore::SVGRectElement::attributeToPropertyTypeMap):
+        (WebCore::SVGRectElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGRectElement.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::attributeToPropertyTypeMap):
+        (WebCore::SVGSVGElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGSVGElement.h:
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::attributeToPropertyTypeMap):
+        (WebCore::SVGScriptElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGScriptElement.h:
+        * svg/SVGStopElement.cpp:
+        (WebCore::SVGStopElement::attributeToPropertyTypeMap):
+        (WebCore::SVGStopElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGStopElement.h:
+        * svg/SVGStyledElement.cpp:
+        (WebCore::cssPropertyToTypeMap):
+        (WebCore::SVGStyledElement::animatedPropertyTypeForCSSProperty):
+        (WebCore::SVGStyledElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGStyledElement.h:
+        * svg/SVGStyledTransformableElement.cpp:
+        (WebCore::SVGStyledTransformableElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGStyledTransformableElement.h:
+        * svg/SVGSwitchElement.cpp:
+        (WebCore::SVGSwitchElement::attributeToPropertyTypeMap):
+        (WebCore::SVGSwitchElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGSwitchElement.h:
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::attributeToPropertyTypeMap):
+        (WebCore::SVGSymbolElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGSymbolElement.h:
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::attributeToPropertyTypeMap):
+        (WebCore::SVGTRefElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGTRefElement.h:
+        * svg/SVGTSpanElement.cpp:
+        (WebCore::SVGTSpanElement::attributeToPropertyTypeMap):
+        (WebCore::SVGTSpanElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGTSpanElement.h:
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGTextContentElement.h:
+        * svg/SVGTextElement.cpp:
+        (WebCore::SVGTextElement::attributeToPropertyTypeMap):
+        (WebCore::SVGTextElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGTextElement.h:
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::attributeToPropertyTypeMap):
+        (WebCore::SVGTextPathElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGTextPathElement.h:
+        * svg/SVGTextPositioningElement.cpp:
+        (WebCore::SVGTextPositioningElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGTextPositioningElement.h:
+        * svg/SVGTitleElement.cpp:
+        (WebCore::SVGTitleElement::attributeToPropertyTypeMap):
+        (WebCore::SVGTitleElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGTitleElement.h:
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::attributeToPropertyTypeMap):
+        (WebCore::SVGUseElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGUseElement.h:
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::attributeToPropertyTypeMap):
+        (WebCore::SVGViewElement::fillAttributeToPropertyTypeMap):
+        * svg/SVGViewElement.h:
+
+2011-02-10  Alexis Menard  <alexis.menard@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        Fix a Warning after removing FileSystem support for the inspector.
+
+        * WebCore.pro:
+
+2011-02-10  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        AX: AX needs to stop using WebCoreViewFactory
+        https://bugs.webkit.org/show_bug.cgi?id=54153
+
+        WebKit2 no longer uses WebCoreViewFactory, which means that accessibility code needs
+        to get off of it and use WebCoreSystemInterface, like other clients.
+
+        * WebCore.exp.in:
+        * accessibility/AXObjectCache.h:
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        * accessibility/mac/AccessibilityObjectWrapper.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper unregisterUniqueIdForUIElement]):
+        (CFAutoreleaseHelper):
+        (AXObjectIsTextMarker):
+        (AXObjectIsTextMarkerRange):
+        (AXTextMarkerRange):
+        (AXTextMarkerRangeStart):
+        (AXTextMarkerRangeEnd):
+        (textMarkerForVisiblePosition):
+        (-[AccessibilityObjectWrapper textMarkerForVisiblePosition:]):
+        (visiblePositionForTextMarker):
+        (-[AccessibilityObjectWrapper visiblePositionForTextMarker:]):
+        (visiblePositionForStartOfTextMarkerRange):
+        (visiblePositionForEndOfTextMarkerRange):
+        (textMarkerRangeFromMarkers):
+        (AXAttributeStringSetElement):
+        (-[AccessibilityObjectWrapper doAXAttributedStringForTextMarkerRange:]):
+        (textMarkerRangeFromVisiblePositions):
+        (-[AccessibilityObjectWrapper textMarkerRangeFromVisiblePositions:endPosition:]):
+        (-[AccessibilityObjectWrapper visiblePositionRangeForTextMarkerRange:]):
+        (-[AccessibilityObjectWrapper textMarkerRangeForSelection]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
+        * editing/mac/SelectionControllerMac.mm:
+        (WebCore::accessibilityConvertScreenRect):
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2011-02-10  Alexis Menard  <alexis.menard@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] In trunk with Qt Multimedia the full screen mode doesn't work.
+        https://bugs.webkit.org/show_bug.cgi?id=54201
+
+        Add files for the fullscreen video playback handling. It also fix
+        a missing header.
+
+        * WebCore.pro:
+
+2011-02-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Remove FileSystem support from the inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=50695
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/Inspector.idl:
+        * inspector/InspectorApplicationCacheAgent.cpp:
+        (WebCore::InspectorApplicationCacheAgent::InspectorApplicationCacheAgent):
+        (WebCore::InspectorApplicationCacheAgent::getApplicationCaches):
+        * inspector/InspectorApplicationCacheAgent.h:
+        * inspector/InspectorFileSystemAgent.cpp: Removed.
+        * inspector/InspectorFileSystemAgent.h: Removed.
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::identifierForInitialRequestImpl):
+        (WebCore::InspectorInstrumentation::willSendRequestImpl):
+        (WebCore::InspectorInstrumentation::markResourceAsCachedImpl):
+        (WebCore::InspectorInstrumentation::didLoadResourceFromMemoryCacheImpl):
+        (WebCore::InspectorInstrumentation::didReceiveResourceResponseImpl):
+        (WebCore::InspectorInstrumentation::didReceiveContentLengthImpl):
+        (WebCore::InspectorInstrumentation::didFinishLoadingImpl):
+        (WebCore::InspectorInstrumentation::didFailLoadingImpl):
+        (WebCore::InspectorInstrumentation::resourceRetrievedByXMLHttpRequestImpl):
+        (WebCore::InspectorInstrumentation::scriptImportedImpl):
+        (WebCore::InspectorInstrumentation::networkStateChangedImpl):
+        (WebCore::InspectorInstrumentation::updateApplicationCacheStatusImpl):
+        (WebCore::InspectorInstrumentation::retrieveResourceAgent):
+        * inspector/front-end/FileSystemView.js: Removed.
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2011-02-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r78219.
+        http://trac.webkit.org/changeset/78219
+        https://bugs.webkit.org/show_bug.cgi?id=54215
+
+        breaks editing/style/iframe-onload-crash.html on GTK 64-bit
+        Debug (Requested by philn-tp on #webkit).
+
+        * dom/Document.h:
+        * dom/DocumentFragment.h:
+        * dom/Element.h:
+        * dom/Node.h:
+        * dom/Text.h:
+        * editing/htmlediting.cpp:
+        (WebCore::editingIgnoresContent):
+        (WebCore::canHaveChildrenForEditing):
+        * editing/htmlediting.h:
+        * html/HTMLBRElement.h:
+        * html/HTMLButtonElement.h:
+        * html/HTMLDataGridElement.h:
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFrameElementBase.h:
+        * html/HTMLHRElement.h:
+        * html/HTMLImageElement.h:
+        * html/HTMLMeterElement.h:
+        * html/HTMLOutputElement.h:
+        * html/HTMLPlugInElement.h:
+        * html/HTMLProgressElement.h:
+        * wml/WMLBRElement.h:
+        * wml/WMLDoElement.h:
+        * wml/WMLImageElement.h:
+        * wml/WMLInputElement.h:
+        * wml/WMLSelectElement.h:
+
+2011-02-10  Andras Becsi  <abecsi@webkit.org>
+
+        Rubber-stamped by Csaba Osztrogonác.
+
+        [Qt][V8] Fix the build.
+
+        No new tests needed.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp: add missing CString header.
+        * loader/cache/CachedScript.h: do not use extra qualification for base class enum.
+
+2011-02-10  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: [STYLES] Suggest CSS property values once Up/Down is pressed with an empty input
+        https://bugs.webkit.org/show_bug.cgi?id=54205
+
+        * inspector/front-end/CSSCompletions.js:
+        (WebInspector.CSSCompletions):
+        (WebInspector.CSSCompletions.prototype._firstIndexOfPrefix):
+        * inspector/front-end/CSSKeywordCompletions.js:
+        (WebInspector.CSSKeywordCompletions.forProperty):
+        * inspector/front-end/StylesSidebarPane.js:
+        ():
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.complete):
+
+2011-02-10  Renata Hodovan  <reni@webkit.org>
+
+        Reviewed by Dirk Schulze.
+
+        SVGFESpecularLightingElement doesn't support dynamic invalidation, when attributes change.
+        https://bugs.webkit.org/show_bug.cgi?id=54186
+
+        The dynamic changes are captured by the svgAttributeChange function, and invalidate the filter primitive if necessary.
+
+        Tests: svg/dynamic-updates/SVGFESpecularLightingElement-dom-in-attr.html
+               svg/dynamic-updates/SVGFESpecularLightingElement-dom-specularConstant-attr.html
+               svg/dynamic-updates/SVGFESpecularLightingElement-dom-specularExponent-attr.html
+               svg/dynamic-updates/SVGFESpecularLightingElement-dom-suraceScale-attr.html
+               svg/dynamic-updates/SVGFESpecularLightingElement-svgdom-in-prop.html
+               svg/dynamic-updates/SVGFESpecularLightingElement-svgdom-specularConstant-prop.html
+               svg/dynamic-updates/SVGFESpecularLightingElement-svgdom-specularExponent-prop.html
+               svg/dynamic-updates/SVGFESpecularLightingElement-svgdom-suraceScale-prop.html
+
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::svgAttributeChanged):
+        * svg/SVGFESpecularLightingElement.h:
+
+2011-02-10  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Error messages are not displayed for the last line in a script
+        https://bugs.webkit.org/show_bug.cgi?id=54204
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.addMessage):
+        (WebInspector.SourceFrame.prototype._addMessageToSource):
+        (WebInspector.SourceFrame.prototype._createConditionElement):
+
+2011-02-10  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Make canHaveChildrenForEditing more efficient
+        https://bugs.webkit.org/show_bug.cgi?id=53564
+
+        Improved the performance (1-2% in release and 20% in debug) by adding virtual member function
+        canContainRangeEndPoint to Node. It returns true whenever the associated node can have be a container
+        node for a position.
+
+        As of this revision, canContainRangeEndPoint returns true on Document, DocumentFragment, Text nodes
+        and any elements except:
+
+        HTML: applet, br, button, datagrid, embed, frame, frameset, hr, img, input,
+              meter, object, output, progress, and select.
+
+        WML: br, do, img, input, and select.
+
+        No new tests are added since this change cannot be tested directly.
+
+        * dom/Document.h:
+        (WebCore::Document::canContainRangeEndPoint): Added; returns false.
+        * dom/DocumentFragment.h:
+        (WebCore::DocumentFragment::canContainRangeEndPoint): Added; returns true.
+        * dom/Element.h:
+        (WebCore::Element::canContainRangeEndPoint): Ditto.
+        * dom/Node.h:
+        (WebCore::Node::canContainRangeEndPoint): Added; returns false.
+        * dom/Text.h:
+        (WebCore::Text::canContainRangeEndPoint): Added; returns true.
+        * editing/htmlediting.cpp: Removed editingIgnoresContent and canHaveChildrenForEditing.
+        * editing/htmlediting.h:
+        (WebCore::editingIgnoresContent): Moved from htmlediting.cpp; made it inline.
+        (WebCore::canHaveChildrenForEditing): Ditto.
+        * html/HTMLBRElement.h:
+        (WebCore::HTMLBRElement::canContainRangeEndPoint): Added; returns false.
+        * html/HTMLButtonElement.h:
+        (WebCore::HTMLButtonElement::canContainRangeEndPoint): Ditto.
+        * html/HTMLDataGridElement.h:
+        (WebCore::HTMLDataGridElement::canContainRangeEndPoint): Ditto.
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElementWithState::canContainRangeEndPoint): Ditto.
+        * html/HTMLFrameElementBase.h:
+        (WebCore::HTMLFrameElementBase::canContainRangeEndPoint): Ditto.
+        * html/HTMLHRElement.h:
+        (WebCore::HTMLHRElement::canContainRangeEndPoint): Ditto.
+        * html/HTMLImageElement.h:
+        (WebCore::HTMLImageElement::canContainRangeEndPoint): Ditto.
+        * html/HTMLMeterElement.h:
+        (WebCore::HTMLMeterElement::canContainRangeEndPoint): Ditto.
+        * html/HTMLOutputElement.h:
+        (WebCore::HTMLOutputElement::canContainRangeEndPoint): Ditto.
+        * html/HTMLPlugInElement.h:
+        (WebCore::HTMLPlugInElement::canContainRangeEndPoint): Ditto.
+        * html/HTMLProgressElement.h:
+        (WebCore::HTMLProgressElement::canContainRangeEndPoint): Ditto.
+        * wml/WMLBRElement.h:
+        (WebCore::WMLBRElement::canContainRangeEndPoint): Ditto.
+        * wml/WMLDoElement.h:
+        (WebCore::WMLDoElement::canContainRangeEndPoint): Ditto.
+        * wml/WMLImageElement.h:
+        (WebCore::WMLImageElement::canContainRangeEndPoint): Ditto.
+        * wml/WMLInputElement.h:
+        (WebCore::WMLInputElement::canContainRangeEndPoint): Ditto.
+        * wml/WMLSelectElement.h:
+        (WebCore::WMLSelectElement::canContainRangeEndPoint): Ditto.
+
+2011-02-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: define interface per domain in Inspector.idl.
+        https://bugs.webkit.org/show_bug.cgi?id=54135
+
+        * inspector/CodeGeneratorInspector.pm:
+        * inspector/Inspector.idl:
+
+2011-02-10  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [regression] Fix syncing heights of the gutter and main panel lines, and add 2px padding-left
+        https://bugs.webkit.org/show_bug.cgi?id=54098
+
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer):
+        (WebInspector.TextViewer.prototype._updatePanelOffsets):
+        (WebInspector.TextViewer.prototype._syncScroll):
+        (WebInspector.TextViewer.prototype._syncDecorationsForLine):
+        (WebInspector.TextEditorChunkedPanel.prototype._totalHeight):
+        (WebInspector.TextEditorChunkedPanel.prototype.resize):
+        (WebInspector.TextEditorGutterPanel):
+        (WebInspector.TextEditorGutterChunk.prototype.set expanded):
+        (WebInspector.TextEditorGutterChunk.prototype.get height):
+        (WebInspector.TextEditorMainChunk.prototype.get height):
+        * inspector/front-end/textViewer.css:
+        (.webkit-line-content):
+
+2011-02-10  takano takumi  <takano@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        A full-width character rotated leftward 90 degrees in text-combine
+        https://bugs.webkit.org/show_bug.cgi?id=54169
+
+        * rendering/RenderCombineText.cpp:
+        (WebCore::RenderCombineText::combineText):
+        - Fixed by resetting font's orientation to horizontal when we decided to make combined text.
+        Otherwise the text will be unexpectedly rotated in showGlyphsWithAdvances() in FontMac.mm.
+
+2011-02-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=50306
+        <rdar://problem/8976152> REGRESSION: WebChromeClient::shouldReplaceWithGeneratedFileForUpload()
+        uses an initialized result value (breaks form submission with clang-built WebKit)
+
+        No new test, because I can't reproduce the observable effect with my gcc build.
+
+        * platform/network/FormData.cpp: (WebCore::FormData::appendKeyValuePairItems): Restore an
+        empty path check - an empty path was causing an exception in Foundation.
+
+2011-02-09  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Network & Resource panels make multiple requests for images with no content
+        https://bugs.webkit.org/show_bug.cgi?id=54085
+
+        - Added success parameter to resourceContent
+        - NetworkManager.requestContent() now returns empty for zero-length resources, null for errors
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::resourceData):
+        (WebCore::InspectorResourceAgent::resourceContent):
+        * inspector/InspectorResourceAgent.h:
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkManager.prototype.requestContent):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype.requestContent):
+        (WebInspector.Resource.prototype._contentURL):
+
+2011-02-10  Renata Hodovan  <reni@webkit.org>
+
+        Reviewed by Dirk Schulze.
+
+        Move the light source implementations into their own files.
+        https://bugs.webkit.org/show_bug.cgi?id=53996
+
+        Splitting LightSource.cpp into 3 files.
+
+        No new tests are added since this is a refactoring.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/DistantLightSource.cpp: Added.
+        (WebCore::DistantLightSource::initPaintingData):
+        (WebCore::DistantLightSource::updatePaintingData):
+        (WebCore::DistantLightSource::setAzimuth):
+        (WebCore::DistantLightSource::setElevation):
+        (WebCore::DistantLightSource::externalRepresentation):
+        * platform/graphics/filters/LightSource.cpp:
+        * platform/graphics/filters/PointLightSource.cpp: Added.
+        (WebCore::PointLightSource::initPaintingData):
+        (WebCore::PointLightSource::updatePaintingData):
+        (WebCore::PointLightSource::setX):
+        (WebCore::PointLightSource::setY):
+        (WebCore::PointLightSource::setZ):
+        (WebCore::operator<<):
+        (WebCore::PointLightSource::externalRepresentation):
+        * platform/graphics/filters/SpotLightSource.cpp: Added.
+        (WebCore::SpotLightSource::initPaintingData):
+        (WebCore::SpotLightSource::updatePaintingData):
+        (WebCore::SpotLightSource::setX):
+        (WebCore::SpotLightSource::setY):
+        (WebCore::SpotLightSource::setZ):
+        (WebCore::SpotLightSource::setPointsAtX):
+        (WebCore::SpotLightSource::setPointsAtY):
+        (WebCore::SpotLightSource::setPointsAtZ):
+        (WebCore::SpotLightSource::setSpecularExponent):
+        (WebCore::SpotLightSource::setLimitingConeAngle):
+        (WebCore::operator<<):
+        (WebCore::SpotLightSource::externalRepresentation):
+
+2011-02-10  Avi Drissman  <avi@google.com>
+
+        Reviewed by Darin Fisher.
+
+        <option> should implement the dir attribute. Mac Chromium version, followup to r76983, r77654.
+        https://bugs.webkit.org/show_bug.cgi?id=50969
+
+        Use manual test Source/WebCore/manual-tests/pop-up-alignment-and-direction.html added in r76983.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::updateFromElement):
+        * platform/chromium/PopupMenuChromium.h:
+
+2011-02-10  Hans Wennborg  <hans@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        IndexedDB: Update the semantics of put()
+        https://bugs.webkit.org/show_bug.cgi?id=54102
+
+        Update the semantics of put: For object stores with auto increment,
+        it should be allowed to provide an explicit key, or an in-line key,
+        overriding the key generator mechanism.
+
+        This reflects the spec changes suggested here:
+        http://www.w3.org/Bugs/Public/show_bug.cgi?id=11976
+
+        Extracting key-selection logic into its own function
+        to make it a bit easier on the eyes.
+
+        * storage/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::selectKeyForPut):
+        (WebCore::IDBObjectStoreBackendImpl::putInternal):
+        * storage/IDBObjectStoreBackendImpl.h:
+        (WebCore::IDBObjectStoreBackendImpl::resetAutoIncrementKeyCache):
+
+2011-02-09  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=54103
+        Implement fast path for matching simple selectors
+        
+        Implement a fast path for single and descendant selectors consisting
+        of id, class and tag selectors only.
+        
+        Selectors like this are marked on style selector initialization. When 
+        encountered during style matching they are resolved using a fast path.
+        
+        Since selectors like this are very common this speeds up style matching
+        quite a bit (up to 50% on some sites according to Shark).
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::RuleData::hasFastCheckableSelector):
+        (WebCore::RuleData::hasMultipartSelector):
+        (WebCore::RuleData::hasTopSelectorMatchingHTMLBasedOnRuleHash):
+        (WebCore::CSSStyleSelector::matchRulesForList):
+        (WebCore::CSSStyleSelector::checkSelector):
+        (WebCore::selectorTagMatches):
+        (WebCore::isFastCheckableSelector):
+        (WebCore::CSSStyleSelector::SelectorChecker::fastCheckSelector):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        (WebCore::isSelectorMatchingHTMLBasedOnRuleHash):
+        (WebCore::RuleData::RuleData):
+        * css/CSSStyleSelector.h:
+
+2011-02-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r77101) box-shadow sometimes renders incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=54160
+        
+        Fix an issue when ShadowBlur had a cached image buffer
+        that was larger than that of the current shadow being drawn,
+        and the current shadow was partially clipped out.
+        
+        In that situation endShadowLayer() would clip to the image
+        buffer, using the size of the buffer (as it must), but failed
+        to take into account the fact that we'd only cleared and painted
+        into a smaller section of the buffer. So we need to additionally
+        constrain the clip to cover only the valid part of the buffer.
+
+        Test: fast/box-shadow/shadow-buffer-partial.html
+
+        * platform/graphics/ShadowBlur.cpp:
+        (WebCore::ShadowBlur::endShadowLayer):
+
+2011-02-09  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix for <rdar://problem/8977051> CrashTracer: 8 crashes 
+        in WebProcess at com.apple.WebCore: 
+        -[ScrollbarPartAnimation setCurrentProgress:] + 364
+
+        The ScrollbarPartAnimation must be sent by reference!
+        * platform/mac/ScrollAnimatorMac.mm:
+        (-[ScrollbarPainterDelegate setUpAnimation:scrollerPainter:part:WebCore::animateAlphaTo:duration:]):
+
+2011-02-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(r76107): Crash in VisibleSelection::toNormalizedRange
+        https://bugs.webkit.org/show_bug.cgi?id=54053
+
+        The bug was caused by RenderBlock::positionForPoint's improperly returning a shadow node inside
+        RenderFileUploadControl for hit testing and VisibleSelection::toNormalizedRange's always assuming
+        the position variable "s" is not null.
+
+        Fixed the bug by always returning a null position from RenderFileUploadControl::positionForPoint,
+        and also exiting early when either "s" or "e" is null in VisibleSelection::toNormalizedRange.
+
+        Test: fast/forms/file-input-hit-test.html
+
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::toNormalizedRange):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::positionForPoint):
+        * rendering/RenderFileUploadControl.h:
+
+2011-02-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Overlay scrollbars crash used with a RenderListBox.
+
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::layout):
+        (WebCore::RenderListBox::contentsSize):
+        (WebCore::RenderListBox::currentMousePosition):
+        (WebCore::RenderListBox::setHasVerticalScrollbar):
+        * rendering/RenderListBox.h:
+        Implement enough of the ScrollableArea interface to get things generally
+        working.
+
+2011-02-09  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for <rdar://problem/8966868> ScrollbarPainterDelegate 
+        must return a layer if layer-backed to avoid crashing
+
+        New virtual function scrollbarWillRenderIntoCompositingLayer()
+        on ScrollableArea.
+        * page/FrameView.h:
+        * platform/ScrollableArea.h:
+        (WebCore::ScrollableArea::scrollbarWillRenderIntoCompositingLayer):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::scrollbarWillRenderIntoCompositingLayer):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::scrollbarWillRenderIntoCompositingLayer):
+        * rendering/RenderListBox.h:
+
+        Clean up unnecessary method declarations and call 
+        scrollbarWillRenderIntoCompositingLayer() to deterine if 
+        we need to return a layer.
+        * platform/mac/ScrollAnimatorMac.mm:
+        (-[ScrollbarPainterDelegate layer]):
+
+2011-02-09  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Replace static_cast<HTMLElement*> with toHTMLElement
+        https://bugs.webkit.org/show_bug.cgi?id=54117
+
+        No new tests since no new functionality was introduced.
+
+        * accessibility/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::addChildren):
+        * accessibility/AccessibilityMenuListPopup.cpp:
+        (WebCore::AccessibilityMenuListPopup::addChildren):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::accessibleNameForNode):
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_name):
+        (webkit_accessible_get_description):
+        * bindings/gobject/WebKitDOMBinding.cpp:
+        (WebKit::createWrapper):
+        (WebKit::kit):
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
+        (WebCore::JSHTMLFrameSetElement::nameGetter):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::createWrapperInline):
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::toV8):
+        * dom/Document.cpp:
+        (WebCore::Document::body):
+        * dom/Element.cpp:
+        (WebCore::Element::deprecatedCreateContextualFragment):
+        * dom/Range.cpp:
+        (WebCore::Range::createContextualFragment):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyBlockStyle):
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
+        (WebCore::ApplyStyleCommand::splitAncestorsWithUnicodeBidi):
+        (WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange):
+        (WebCore::ApplyStyleCommand::removeStyleFromRunBeforeApplyingStyle):
+        (WebCore::ApplyStyleCommand::highestAncestorWithConflictingInlineStyle):
+        (WebCore::ApplyStyleCommand::applyInlineStyleToPushDown):
+        (WebCore::ApplyStyleCommand::pushDownInlineStyleAroundNode):
+        (WebCore::ApplyStyleCommand::removeInlineStyle):
+        (WebCore::ApplyStyleCommand::shouldSplitTextElement):
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::enclosingDeletableElement):
+        (WebCore::DeleteButtonController::show):
+        * editing/Editor.cpp:
+        (WebCore::Editor::setBaseWritingDirection):
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::mergeWithNeighboringLists):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::negateStyleRulesThatAffectAppearance):
+        (WebCore::ReplaceSelectionCommand::handleStyleSpans):
+        (WebCore::ReplaceSelectionCommand::copyStyleToChildren):
+        * editing/SelectionController.cpp:
+        (WebCore::scanForForm):
+        (WebCore::SelectionController::currentForm):
+        * editing/htmlediting.cpp:
+        (WebCore::enclosingList):
+        (WebCore::enclosingListChild):
+        (WebCore::embeddedSublist):
+        (WebCore::appendedSublist):
+        * editing/markup.cpp:
+        (WebCore::StyledMarkupAccumulator::appendElement):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::checkForNameMatch):
+        (WebCore::HTMLCollection::updateNameCache):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::setOuterHTML):
+        (WebCore::HTMLElement::shadowAncestorOwnerForm):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::formElementIndex):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setOption):
+        (WebCore::HTMLSelectElement::setLength):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getOuterHTML):
+        (WebCore::InspectorDOMAgent::setOuterHTML):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        * rendering/RenderMeter.cpp:
+        (WebCore::RenderMeter::createPart):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::createSubtreeIfNeeded):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::createSubtreeIfNeeded):
+
+2011-02-09  Mike Reed  <reed@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Use Skia's device->readPixels() when its bitmap claims to have no pixels, as this
+        handles the case when the device is backed by the GPU.
+        Patch developed by bsalomon@google.com
+
+        No new tests. Existing canvas tests suffice
+        e.g. LayoutTests/canvas/philip/... 
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+
+2011-02-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        document.close shouldn't affect non-script-created parsers
+        https://bugs.webkit.org/show_bug.cgi?id=53689
+
+        Tests: fast/frames/document-write-in-iframe-onload-3.html
+               fast/parser/iframe-onload-document-close-with-external-script-2.html
+               fast/parser/iframe-onload-document-close-with-external-script-3.html
+               fast/parser/iframe-onload-document-close-with-external-script.html
+               fast/parser/setTimeout-open.html
+
+        Move our implementation of document.close closer to the spec by
+        introducing the notion of a script-created parser.  This area of our
+        code is somewhat hairy.  It might take a few more iterations before we
+        fully come up to spec.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setContent):
+        (WebCore::Document::open):
+        (WebCore::Document::cancelParsing):
+        (WebCore::Document::close):
+            - Over time, this method should converge to the spec.
+        (WebCore::Document::explicitClose):
+            - I'm not in love with this name.  Somehow we want to differentiate
+              between Document closing itself and the document.close DOM
+              method.
+        (WebCore::Document::removePendingSheet):
+        * dom/Document.h:
+        * dom/ScriptableDocumentParser.cpp:
+        (WebCore::ScriptableDocumentParser::ScriptableDocumentParser):
+        * dom/ScriptableDocumentParser.h:
+        (WebCore::ScriptableDocumentParser::setWasCreatedByScript):
+        (WebCore::ScriptableDocumentParser::wasCreatedByScript):
+            - General nonsense to keep track of whether the parser was created
+              by script.
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::hasInsertionPoint):
+            - I'm not sure whether this part of the change is 100% correct.  I
+              think our notion of the EOF character might be subtly different
+              from the notion in the spec.
+        * html/parser/HTMLInputStream.h:
+        (WebCore::HTMLInputStream::hasInsertionPoint):
+            - Remove FIXME because we're fixing that!
+
+2011-02-09  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by James Robinson.
+
+        [Chromium] Issue 72387: Integer bounds crash in LayerTilerChromium::resizeLayer
+        https://bugs.webkit.org/show_bug.cgi?id=54132
+ 
+        * platform/graphics/chromium/LayerTilerChromium.cpp:
+        (WebCore::LayerTilerChromium::resizeLayer):
+
+2011-02-09  Xiyuan Xia  <xiyuan@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [Chromium] Use #f7f7f7 for select popup background on chromium/linux
+        https://bugs.webkit.org/show_bug.cgi?id=54115
+
+        No new tests since no behavior change.
+
+        * css/themeChromiumLinux.css:
+        (select[size="1"] option):
+
+2011-02-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION(HTML 5): HTMLDocumentParser does not report html parse errors to the console
+        https://bugs.webkit.org/show_bug.cgi?id=41187
+
+        Wire up a basic HTML parse error message.  There's a lot of room for
+        improvement in this area, but this is a start.
+
+        No tests!  See https://bugs.webkit.org/show_bug.cgi?id=54134
+
+        * html/parser/HTMLDocumentParser.h:
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::parseError):
+        * html/parser/HTMLTreeBuilder.h:
+
+2011-02-09  Naoki Takano  <takano.naoki@gmail.com>
+
+        Reviewed by Kenneth Russell.
+
+        [Chromium] Issue 58536: Fix Layout Test canvas/philip/tests/2d.imageData.put.alpha.html with --accelerated-2d-canvas.
+        https://bugs.webkit.org/show_bug.cgi?id=53757
+
+          This fix is for 2d.imageData.put.alpha.html with --accelerated-2d-canvas. No new tests.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::putUnmultipliedImageData): needs to call syncSoftwareCanvas() to sync between hardware and software.
+        (WebCore::ImageBuffer::putPremultipliedImageData): needs to call syncSoftwareCanvas() to sync between hardware and software.
+
+
+2011-02-09  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Fix scaling and thread safety of FFTFrameFFTW
+        https://bugs.webkit.org/show_bug.cgi?id=54045
+
+        No new tests since audio API is not yet implemented.
+
+        * platform/audio/FFTFrame.h:
+        * platform/audio/fftw/FFTFrameFFTW.cpp:
+        (WebCore::FFTFrame::FFTFrame):
+        (WebCore::FFTFrame::doFFT):
+        (WebCore::FFTFrame::doInverseFFT):
+        (WebCore::FFTFrame::initialize):
+        (WebCore::FFTFrame::cleanup):
+        (WebCore::FFTFrame::realData):
+        (WebCore::FFTFrame::imagData):
+        (WebCore::FFTFrame::fftwPlanForSize):
+        * platform/audio/mac/FFTFrameMac.cpp:
+        (WebCore::FFTFrame::initialize):
+        * platform/audio/mkl/FFTFrameMKL.cpp:
+        (WebCore::FFTFrame::initialize):
+        * webaudio/AudioContext.cpp:
+        (WebCore::AudioContext::AudioContext):
+
+2011-02-09  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        AX: accessibilityShouldUseUniqueId doesn't need to be in the core AX object
+        https://bugs.webkit.org/show_bug.cgi?id=54126
+
+        This is a Mac-only accessibility API concept and doesn't belong in the core AX object.
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::node):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityShouldUseUniqueId]):
+
+2011-02-09  Nebojsa Ciric  <cira@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Implements Locale object of JavaScript internationalization API proposal, as an
+        v8 extension. Extension code is hosted in v8 project (src/extensions/experimental/i18n-extension.{cc,h})
+        and in this patch we just provide flags, tests and build rules for chromium port.
+        https://bugs.webkit.org/show_bug.cgi?id=49414
+
+        Test: fast/js/i18n-bindings-locale.html
+
+        * WebCore.gyp/WebCore.gyp:
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        (WebCore::RuntimeEnabledFeatures::experimentalI18NAPIEnabled):
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setExperimentalI18NAPIEnabled):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::createNewContext):
+
+2011-02-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(r71934): Shadow DOM nodes leak via relatedTarget
+        https://bugs.webkit.org/show_bug.cgi?id=52065
+
+        * dom/Node.cpp:
+        (WebCore::pullOutOfShadow): Added a helper to move a node to the outermost
+            boundary of shadow DOM.
+        (WebCore::Node::dispatchMouseEvent): Changed to use pullOutOfShadow.
+
+2011-02-09  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Add convenience method toHTMLElement(Node*)
+        https://bugs.webkit.org/show_bug.cgi?id=54105
+
+        No new tests since no new functionality introduced.
+
+        * html/HTMLElement.h:
+        (WebCore::toHTMLElement):
+
+2011-02-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fixed positioned elements at very top or bottom of page remain fixed but clip during rubber-banding
+        <rdar://problem/7615997>
+        https://bugs.webkit.org/show_bug.cgi?id=54054
+
+        Take the overhang into account when calculating position for elements with position: fixed.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollXForFixedPosition):
+        (WebCore::ScrollView::scrollYForFixedPosition):
+        (WebCore::ScrollView::scrollOffsetForFixedPosition):
+        * platform/ScrollView.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::mapLocalToContainer):
+        (WebCore::RenderView::mapAbsoluteToLocalPoint):
+        (WebCore::RenderView::computeRectForRepaint):
+
+2011-02-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dirk Schulze.
+
+        Enhance ShadowBlur to tile inset box shadows
+        https://bugs.webkit.org/show_bug.cgi?id=51567
+        
+        Add a tiling code path to ShadowBlur for rendering inset
+        box-shadows.
+
+        Test: fast/box-shadow/inset-box-shadows.html
+        
+        * platform/graphics/ShadowBlur.cpp:
+        (WebCore::computeSliceSizesFromRadii): Compute the slice sizes
+        for the eight-piece shadow template.
+        (WebCore::ShadowBlur::templateSize): Compute the size of the template,
+        given the slice sizes.
+        (WebCore::ShadowBlur::drawRectShadow): Bail early if layerRect is empty
+        (which probably means we're clipped out). Call templateSize() and use
+        the result to decide whether to tile.
+        (WebCore::ShadowBlur::drawInsetShadow): New method for inset shadows.
+        (WebCore::ShadowBlur::drawRectShadowWithoutTiling): Code moved.
+        (WebCore::ShadowBlur::drawInsetShadowWithoutTiling): The non-tiling code
+        path for inset shadows.
+        (WebCore::ShadowBlur::drawInsetShadowWithTiling): Fill the shadow template
+        buffer, paint the non-blurred area of the destination, and then call drawLayerPieces()
+        to paint the eight-piece template image.
+        (WebCore::ShadowBlur::drawRectShadowWithTiling): Refactored code, now
+        shares the blurring code via blurAndColorShadowBuffer(), and the tiled template
+        drawing via drawLayerPieces().
+        (WebCore::ShadowBlur::drawLayerPieces): Draw an eight-piece image from the
+        shadow template to the destination.
+        (WebCore::ShadowBlur::blurAndColorShadowBuffer): Blur the pixels in the image
+        buffer, and colorize them using the CompositeSourceIn operation.
+        * platform/graphics/ShadowBlur.h:
+
+2011-02-09  Jochen Eisinger  <jochen@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Disable script elements when a CSP header is present
+        https://bugs.webkit.org/show_bug.cgi?id=53867
+
+        Tests: http/tests/security/contentSecurityPolicy/no-policy.html
+               http/tests/security/contentSecurityPolicy/script-src-in-iframe.html
+               http/tests/security/contentSecurityPolicy/script-src-none.html
+               http/tests/security/contentSecurityPolicy/script-src-redirect.html
+
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::shouldLoadExternalScriptFromSrc):
+        * html/parser/HTMLScriptRunner.cpp:
+        (WebCore::HTMLScriptRunner::requestPendingScript):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::didBeginDocument):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveResponse):
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::ContentSecurityPolicy):
+        (WebCore::ContentSecurityPolicy::didReceiveHeader):
+        (WebCore::ContentSecurityPolicy::canLoadExternalScriptFromSrc):
+        * page/ContentSecurityPolicy.h:
+
+2011-02-09  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r78047.
+
+        ContextMenu.cpp and ContextMenuItem.cpp have a USE(CROSS_PLATFORM_CONTEXT_MENUS),
+        so they shouldn't cause problems with correct preprocessor defines.
+
+        * CMakeLists.txt:
+
+2011-02-09  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: InspectorAgent should know nothing about InspectorController instance.
+
+        https://bugs.webkit.org/show_bug.cgi?id=54100
+
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::restoreInspectorStateFromCookie):
+        (WebCore::InspectorAgent::disconnectFrontend):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::disconnectFrontend):
+        (WebCore::InspectorController::restoreInspectorStateFromCookie):
+
+2011-02-09  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: source frame scroll position is not restored.
+        https://bugs.webkit.org/show_bug.cgi?id=54101
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._scriptSourceChanged):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.show):
+        (WebInspector.SourceFrame.prototype.hide):
+        (WebInspector.SourceFrame.prototype.get scrollTop):
+        (WebInspector.SourceFrame.prototype.set scrollTop):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype.get scrollTop):
+        (WebInspector.TextViewer.prototype.set scrollTop):
+        (WebInspector.TextViewer.prototype.get scrollLeft):
+        (WebInspector.TextViewer.prototype.set scrollLeft):
+
+2011-02-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: follow up on InspectorAgent split -
+        removing unnecessary methods from InspectorController.
+        https://bugs.webkit.org/show_bug.cgi?id=54093
+
+        * WebCore.exp.in:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::stopUserInitiatedProfiling):
+        (WebCore::InspectorAgent::showAndEnableDebugger):
+        (WebCore::InspectorAgent::enabled):
+        (WebCore::InspectorAgent::showConsole):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::didClearWindowObjectInWorld):
+        (WebCore::InspectorController::showConsole):
+        (WebCore::InspectorController::enabled):
+        (WebCore::InspectorController::inspectedPage):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontendClientLocal.cpp:
+
+2011-02-07  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        LayoutTests/animations/play-state.html has wrong behavior with accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=53513
+
+        The PlatformCAAnimation::create() function which took a pointer to another
+        PlatformCAAnimation was supposed to make a copy of that passed object.
+        But it was doing completely the wrong thing on Mac and was leaking an object
+        to boot. And the notion of copying an object using a static creation function
+        is wrong in the first place. So I changed it to a member copy() function
+        which would create a new PlatformCAAnimation which was a copy of 'this' and
+        return it. I changed the implementation on both Mac and Win to match.
+
+        This problem was not caught by DRT, even there is a specific test for it.
+        That test just verifies that the higher level logic is working 
+        properly, which it is. There's no practical way to find out if the
+        layer is currently animating. There is no logic which probes that
+        deeply into the layer mechanics.
+        
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        * platform/graphics/ca/PlatformCAAnimation.h:
+        * platform/graphics/ca/mac/PlatformCAAnimationMac.mm:
+        * platform/graphics/ca/win/PlatformCAAnimationWin.cpp:
+
+2011-02-09  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
+
+        Unreviewed build fix.
+
+        [EFL] Remove double definition of ContextMenu.
+        https://bugs.webkit.org/show_bug.cgi?id=50762
+
+        When building with SHARED_CORE enabled, the symbols of ContextMenu
+        were both in webkit and webcore. This removes them from webcore and
+        shall be put back once the CROSS_PLATFORM_CONTEXT_MENUS is implemented
+        in EFL port.
+
+        No new tests because no new functionality.
+
+        * CMakeLists.txt:
+
+2011-02-09  Adam Roben  <aroben@apple.com>
+
+        Windows Production build fix
+
+        * WebCore.vcproj/QTMovieWinCommon.vsprops: Link against
+        WebKitSystemInterface$(WebKitConfigSuffix).lib, not just WebKitSystemInterface.lib, so we
+        pick up the _debug variant when appropriate.
+
+2011-02-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Hostnames should cannonicalize to lowercase (to match every other browser)
+        https://bugs.webkit.org/show_bug.cgi?id=54084
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::parse):
+
+2011-02-09  Peter Varga  <pvarga@webkit.org>
+
+
+        Reviewed by Gavin Barraclough.
+
+        Replace PCRE with Yarr in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=53496
+
+        No new tests needed.
+
+        * Android.jscbindings.mk:
+        * CMakeLists.txt:
+        * ForwardingHeaders/pcre/pcre.h: Removed.
+        * ForwardingHeaders/yarr/Yarr.h: Added.
+        * ForwardingHeaders/yarr/YarrInterpreter.h: Added.
+        * ForwardingHeaders/yarr/YarrPattern.h: Added.
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/copyForwardingHeaders.cmd:
+        * platform/text/RegularExpression.cpp:
+        (WebCore::RegularExpression::Private::create):
+        (WebCore::RegularExpression::Private::Private):
+        (WebCore::RegularExpression::Private::compile):
+        (WebCore::RegularExpression::match):
+
+2011-02-09  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Eric Seidel.
+
+        [EFL] Add dummy functions for HTML5 Video's control UI
+        https://bugs.webkit.org/show_bug.cgi?id=53906
+
+        In WebKit EFL, there are no implementations for HTML5 control UI.
+        First, dummy functions are added.
+
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::extraMediaControlsStyleSheet):
+        (WebCore::RenderThemeEfl::formatMediaControlsCurrentTime):
+        (WebCore::RenderThemeEfl::paintMediaFullscreenButton):
+        (WebCore::RenderThemeEfl::paintMediaMuteButton):
+        (WebCore::RenderThemeEfl::paintMediaPlayButton):
+        (WebCore::RenderThemeEfl::paintMediaSeekBackButton):
+        (WebCore::RenderThemeEfl::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeEfl::paintMediaSliderTrack):
+        (WebCore::RenderThemeEfl::paintMediaSliderThumb):
+        (WebCore::RenderThemeEfl::paintMediaVolumeSliderContainer):
+        (WebCore::RenderThemeEfl::paintMediaVolumeSliderTrack):
+        (WebCore::RenderThemeEfl::paintMediaVolumeSliderThumb):
+        (WebCore::RenderThemeEfl::paintMediaCurrentTime):
+        * platform/efl/RenderThemeEfl.h:
+
+2011-02-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Make WebKit's fragment cannonicalization match other browsers
+        https://bugs.webkit.org/show_bug.cgi?id=53850
+
+        This doesn't make us match perfectly, but it brings us closer.
+
+        * platform/KURL.cpp:
+        (WebCore::appendEscapingBadChars):
+        (WebCore::escapeAndAppendFragment):
+        (WebCore::KURL::parse):
+
+2011-02-09  Hans Wennborg  <hans@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        IndexedDB: Cursors should skip deleted entries
+        https://bugs.webkit.org/show_bug.cgi?id=53690
+
+        Add test to check that the cursor skips deleted entries.
+
+        Test: storage/indexeddb/cursor-skip-deleted.html
+
+        * storage/IDBCursorBackendImpl.cpp:
+        (WebCore::IDBCursorBackendImpl::currentRowExists):
+        (WebCore::IDBCursorBackendImpl::continueFunctionInternal):
+        * storage/IDBCursorBackendImpl.h:
+
+2011-02-08  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: script formatter should not create a worker for each script.
+        https://bugs.webkit.org/show_bug.cgi?id=54010
+
+        * inspector/front-end/ScriptFormatter.js:
+        (WebInspector.ScriptFormatter):
+        (WebInspector.ScriptFormatter.prototype._formatScript):
+        (WebInspector.ScriptFormatter.prototype._handleMessage):
+        (WebInspector.ScriptFormatter.prototype._handleError):
+
+2011-02-08  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: sync uglifyjs parser files.
+        https://bugs.webkit.org/show_bug.cgi?id=54003
+
+        * inspector/front-end/UglifyJS/parse-js.js:
+        * inspector/front-end/UglifyJS/process.js:
+
+2011-02-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(71556,68059): queryCommandValue screws up background color at collapsed cursor
+        https://bugs.webkit.org/show_bug.cgi?id=53196
+
+        The bug was caused by Editor::selectionComputedStyle's modifying typing style without making a copy,
+        and its removing non-inheritable properties from the typing style. Fixed the bug by making a copy
+        before making the modification and not removing non-inheritable properties.
+
+        Also fixed a bug in selectionStartCSSPropertyValue that it doesn't handle xx-small to -webkit-xxx-large
+        by extracting a function from StyleChange::extractTextStyles and calling it in both extractTextStyles
+        and selectionStartCSSPropertyValue.
+
+        Test: editing/style/query-typing-style.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::legacyFontSizeFromCSSValue): Extracted from StyleChange::extractTextStyles.
+        (WebCore::StyleChange::extractTextStyles): Calls legacyFontSizeFromCSSValue; this fixes the bug that
+        CSS values from xx-small through -webkit-xxx-large are not accounted.
+        * editing/ApplyStyleCommand.h:
+        * editing/Editor.cpp:
+        (WebCore::Editor::selectionStartCSSPropertyValue): Calls legacyFontSizeFromCSSValue.
+        (WebCore::Editor::selectionComputedStyle): Makes a copy before modifying typing style.
+        No longer calls removeNonEditingProperties on the copied typing style so that background-color property
+        is included when merged into the style.
+
+2011-02-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        REGRESSION (r76831): Subframes are printed blank
+        <rdar://problem/8945867>
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintOverhangAreas):
+        Don't paint overhangs when printing.
+
+2011-02-07  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        Events should propagate through IDBDatabase (for IDBRequest and IDBTransaction)
+        https://bugs.webkit.org/show_bug.cgi?id=53975
+
+        The third change in the series of overhauling IndexedDB's event model to match
+        the spec (at least the version in our heads and bugs).
+
+        Test: storage/indexeddb/transaction-event-propagation.html
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * dom/Event.cpp:
+        (WebCore::Event::isIDBAbortEvent):
+        (WebCore::Event::isIDBCompleteEvent):
+        * dom/Event.h:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toIDBDatabase):
+        * dom/EventTarget.h:
+        * storage/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::create):
+        (WebCore::IDBDatabase::IDBDatabase):
+        (WebCore::IDBDatabase::scriptExecutionContext):
+        (WebCore::IDBDatabase::eventTargetData):
+        (WebCore::IDBDatabase::ensureEventTargetData):
+        * storage/IDBDatabase.h:
+        (WebCore::IDBDatabase::toIDBDatabase):
+        (WebCore::IDBDatabase::refEventTarget):
+        (WebCore::IDBDatabase::derefEventTarget):
+        * storage/IDBDatabase.idl:
+        * storage/IDBRequest.cpp:
+        (WebCore::IDBRequest::onSuccess):
+        (WebCore::IDBRequest::dispatchEvent):
+        * storage/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::backend):
+        (WebCore::IDBTransaction::db):
+        (WebCore::IDBTransaction::objectStore):
+        (WebCore::IDBTransaction::scriptExecutionContext):
+        (WebCore::IDBTransaction::dispatchEvent):
+        (WebCore::IDBTransaction::enqueueEvent):
+        * storage/IDBTransaction.h:
+        (WebCore::IDBTransaction::dispatchEvent):
+
+2011-02-08  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by James Robinson.
+
+        Add cache for GPU-accelerated path processing results
+        https://bugs.webkit.org/show_bug.cgi?id=45519
+
+        Adding a cache which holds the results of processing a path into
+        interior and exterior triangle meshes, according to the path
+        rendering algorithm from GPU Gems 3. No tests yet; will be tested
+        in conjunction with later code.
+
+        * platform/graphics/gpu/LoopBlinnPathCache.cpp: Added.
+        (WebCore::LoopBlinnPathCache::LoopBlinnPathCache):
+        (WebCore::LoopBlinnPathCache::~LoopBlinnPathCache):
+        (WebCore::LoopBlinnPathCache::addVertex):
+        (WebCore::LoopBlinnPathCache::clear):
+        (WebCore::LoopBlinnPathCache::addInteriorVertex):
+        (WebCore::LoopBlinnPathCache::numberOfInteriorEdgeVertices):
+        (WebCore::LoopBlinnPathCache::interiorEdgeVertices):
+        (WebCore::LoopBlinnPathCache::addInteriorEdgeVertex):
+        * platform/graphics/gpu/LoopBlinnPathCache.h: Added.
+        (WebCore::LoopBlinnPathCache::numberOfVertices):
+        (WebCore::LoopBlinnPathCache::vertices):
+        (WebCore::LoopBlinnPathCache::texcoords):
+        (WebCore::LoopBlinnPathCache::numberOfInteriorVertices):
+        (WebCore::LoopBlinnPathCache::interiorVertices):
+
+2011-02-08  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Rename GraphicsContext3D::WebGLEnumType
+        https://bugs.webkit.org/show_bug.cgi?id=45708
+
+        * html/canvas/WebGLProgram.cpp:
+        (WebCore::WebGLProgram::getAttachedShader):
+        * html/canvas/WebGLProgram.h:
+        * platform/graphics/GraphicsContext3D.h:
+
+2011-02-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r77980.
+        http://trac.webkit.org/changeset/77980
+        https://bugs.webkit.org/show_bug.cgi?id=54043
+
+        "Crashes on Windows and Linux..." (Requested by leviw on
+        #webkit).
+
+        * WebCore.exp.in:
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::visiblePositionForTextMarkerData):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::startOfStyleRange):
+        (WebCore::endOfStyleRange):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::visiblePositionForIndex):
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (objectAndOffsetUnignored):
+        * dom/Position.cpp:
+        (WebCore::Position::upstream):
+        (WebCore::Position::downstream):
+        * dom/Range.cpp:
+        (WebCore::Range::editingStartPosition):
+        * editing/Editor.cpp:
+        (WebCore::Editor::canDeleteRange):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::selectFrameElementInParentIfFullySelected):
+        (WebCore::SelectionController::setSelectedRange):
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::shouldRepresentNodeOffsetZero):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed):
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::VisiblePosition):
+        (WebCore::VisiblePosition::leftVisuallyDistinctCandidate):
+        (WebCore::VisiblePosition::rightVisuallyDistinctCandidate):
+        (WebCore::VisiblePosition::canonicalPosition):
+        (WebCore::VisiblePosition::characterAfter):
+        (WebCore::VisiblePosition::localCaretRect):
+        (WebCore::makeRange):
+        (WebCore::startVisiblePosition):
+        (WebCore::endVisiblePosition):
+        (WebCore::setStart):
+        (WebCore::setEnd):
+        (WebCore::isFirstVisiblePositionInNode):
+        (WebCore::isLastVisiblePositionInNode):
+        * editing/VisiblePosition.h:
+        * editing/htmlediting.cpp:
+        (WebCore::firstInSpecialElement):
+        (WebCore::lastInSpecialElement):
+        (WebCore::visiblePositionBeforeNode):
+        (WebCore::visiblePositionAfterNode):
+        * editing/visible_units.cpp:
+        (WebCore::startPositionForLine):
+        (WebCore::endPositionForLine):
+        (WebCore::previousLinePosition):
+        (WebCore::nextLinePosition):
+        (WebCore::startOfParagraph):
+        (WebCore::endOfParagraph):
+        (WebCore::endOfBlock):
+        (WebCore::startOfDocument):
+        (WebCore::endOfDocument):
+        (WebCore::logicalStartPositionForLine):
+        (WebCore::logicalEndPositionForLine):
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::collapse):
+        (WebCore::DOMSelection::setBaseAndExtent):
+        (WebCore::DOMSelection::setPosition):
+        (WebCore::DOMSelection::extend):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createVisiblePosition):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::visiblePositionForIndex):
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::selectSubString):
+
+2011-02-08  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Darin Adler.
+
+        VisibleSelection::setWithoutValidation() should allow caret selection.
+        https://bugs.webkit.org/show_bug.cgi?id=53943
+
+        Test: editing/undo/undo-paste-when-caret-is-not-in-range.html
+
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::setWithoutValidation):
+
+2011-02-08  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Remove the last remnants of the Mozilla theme drawing code
+        https://bugs.webkit.org/show_bug.cgi?id=54035
+
+        Remove all Mozilla theme drawing code.
+
+        No new tests. This change only removes dead code.
+
+        * GNUmakefile.am: Remove Mozilla files from the source list.
+        * platform/gtk/RenderThemeGtk.h: Remove Mozilla-theme-drawing-related methods
+        and add m_colormap to hold the current colormap of the widgets.
+        * platform/gtk/RenderThemeGtk2.cpp: Remove Mozilla code.
+        (WebCore::RenderThemeGtk::platformInit): Ditto.
+        (WebCore::RenderThemeGtk::~RenderThemeGtk): Ditto.
+        (WebCore::RenderThemeGtk::gtkContainer): Ditto.
+        * platform/gtk/ScrollbarThemeGtk2.cpp: Ditto.
+        * platform/gtk/WidgetRenderingContext.cpp: Ditto.
+        (WebCore::WidgetRenderingContext::WidgetRenderingContext): Ditto.
+        * platform/gtk/WidgetRenderingContext.h: Ditto.
+        * platform/gtk/gtk2drawing.c: Removed.
+        * platform/gtk/gtkdrawing.h: Removed.
+
+2011-02-08  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        Crash when logging into gmail.com with frame flattening turned on.
+        https://bugs.webkit.org/show_bug.cgi?id=52449
+
+        Frame flattening algorithm requires that layout always starts from the main frame, since layout of
+        subframes impacts the layout of their parents. 
+        There are places in the code that call view->layout() not on the main frame.
+        Instead of changing all the callsites, I changed FrameView::layout()
+        to force layout from the main frame if frame flattening is enabled.
+        In addition, postLayoutTasks can trigger relayout, so make it use the timer even more.
+        Move the call to SelectionController::updateAppearance() to performPostLayoutTasks(), 
+        because calling the from layout() leads to a crash in pages that have a selection in an iframe.
+
+        Tests: fast/frames/flattening/iframe-flattening-crash.html
+               fast/frames/flattening/iframe-flattening-selection-crash.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::performPostLayoutTasks):
+
+2011-02-08  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/8913952> REGRESSION (r76301): 'plaintext-only' must be
+        a supported contentEditable mode.
+        https://bugs.webkit.org/show_bug.cgi?id=54041
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::setContentEditable): Setting the contentEditable
+        attribute to 'plaintext-only' should not throw an exception.
+
+2011-02-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        RenderRubyRun::m_beingDestroyed is redundant
+        https://bugs.webkit.org/show_bug.cgi?id=54042
+
+        * rendering/RenderRubyRun.cpp:
+        (WebCore::RenderRubyRun::RenderRubyRun): Removed intialization of m_beingDestroyed.
+        (WebCore::RenderRubyRun::removeChild): Use the base class beingDestroyed(). 
+        * rendering/RenderRubyRun.h:
+
+2011-02-08  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Stop instantiating legacy editing Positions in VisiblePosition
+        https://bugs.webkit.org/show_bug.cgi?id=52919
+
+        Changing VisiblePosition completely away from legacy positions.
+
+        No new tests since this is functionaly equivalent.
+
+        * WebCore.exp.in: Removing the legacy VisiblePosition constructor and
+        adding the PositionIsOffsetInAnchor symbol. If we must create VisiblePositions
+        outside of WebCore, they should be parent anchored.
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::visiblePositionForTextMarkerData):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::startOfStyleRange):
+        (WebCore::endOfStyleRange):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::visiblePositionForIndex):
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (objectAndOffsetUnignored):
+        * dom/Position.cpp:
+        (WebCore::Position::upstream): Fixed to correctly respect PositionIsAfterAnchor
+        (WebCore::Position::downstream): ditto
+        * dom/Range.cpp:
+        (WebCore::Range::editingStartPosition):
+        * editing/Editor.cpp:
+        (WebCore::Editor::canDeleteRange):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::selectFrameElementInParentIfFullySelected):
+        (WebCore::SelectionController::setSelectedRange):
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::shouldRepresentNodeOffsetZero):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed):
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::leftVisuallyDistinctCandidate):
+        (WebCore::VisiblePosition::rightVisuallyDistinctCandidate):
+        (WebCore::VisiblePosition::canonicalPosition):
+        (WebCore::VisiblePosition::characterAfter):
+        (WebCore::VisiblePosition::localCaretRect):
+        (WebCore::makeRange):
+        (WebCore::startVisiblePosition):
+        (WebCore::endVisiblePosition):
+        (WebCore::setStart):
+        (WebCore::setEnd):
+        (WebCore::isFirstVisiblePositionInNode):
+        (WebCore::isLastVisiblePositionInNode):
+        * editing/VisiblePosition.h:
+        (WebCore::VisiblePosition::VisiblePosition):
+        * editing/htmlediting.cpp:
+        (WebCore::firstInSpecialElement):
+        (WebCore::lastInSpecialElement):
+        (WebCore::visiblePositionBeforeNode):
+        (WebCore::visiblePositionAfterNode):
+        * editing/visible_units.cpp:
+        (WebCore::startPositionForLine):
+        (WebCore::endPositionForLine):
+        (WebCore::previousLinePosition):
+        (WebCore::nextLinePosition):
+        (WebCore::startOfParagraph):
+        (WebCore::endOfParagraph):
+        (WebCore::endOfBlock):
+        (WebCore::startOfDocument):
+        (WebCore::endOfDocument):
+        (WebCore::logicalStartPositionForLine):
+        (WebCore::logicalEndPositionForLine):
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::collapse):
+        (WebCore::DOMSelection::setBaseAndExtent):
+        (WebCore::DOMSelection::setPosition):
+        (WebCore::DOMSelection::extend):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createVisiblePosition):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::visiblePositionForIndex):
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::selectSubString):
+
+2011-02-08  Michael Saboff  <msaboff@apple.com>
+
+        JSC::Bindings m_rootObject->isValid() assert fails when running layout tests
+        https://bugs.webkit.org/show_bug.cgi?id=53716
+
+        Changed ASSERT to be an if for the case where the RuntimeObject was
+        GC'ed before RootObject::invalidate is called.  In that case there is 
+        no need to remove the RuntimeObject from the RootObject.  The isValid()
+        call will be false in this case, but the RuntimeObject has already
+        been removed from the RootObject.  Added similar defensive code
+        in RootObject::removeRuntimeObject().
+
+        * bridge/jsc/BridgeJSC.cpp:
+        (JSC::Bindings::Instance::willDestroyRuntimeObject):
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::removeRuntimeObject):
+
+2011-02-08  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/8953365> CrashTracer: 14 
+        crashes in WebProcess at com.apple.WebCore: 
+        -[ScrollKnobAnimation setCurrentProgress:] + 258
+
+        This crash seems to happen when the animation is running
+        and a window is closed. If the ScrollAnimator is destroyed,
+        delegate calls for the animation can still run, so we have 
+        to make sure we inform the delegates when the ScrollAnimator 
+        is gone, and then we have to null-check it before we do 
+        anything with it.
+
+        Remove scrollbarPainterDelegate() since it's not used anymore.
+        * platform/mac/ScrollAnimatorMac.h:
+        * platform/mac/ScrollAnimatorMac.mm:
+        
+        Add null-checks for _animator
+        (-[ScrollbarPartAnimation setCurrentProgress:]):
+        (-[ScrollbarPartAnimation scrollAnimatorDestroyed]):
+        (-[ScrollbarPainterDelegate scrollerImp:animateKnobAlphaTo:duration:]):
+        (-[ScrollbarPainterDelegate scrollerImp:animateTrackAlphaTo:duration:]):
+        (-[ScrollbarPainterDelegate scrollerImp:overlayScrollerStateChangedTo:]):
+        
+        New function to inform the delegates that the ScrollAnimator
+        is being destroyed.
+        (-[ScrollbarPainterDelegate scrollAnimatorDestroyed]):
+        (WebCore::ScrollAnimatorMac::~ScrollAnimatorMac):
+
+2011-02-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove orphan code from old parser
+        https://bugs.webkit.org/show_bug.cgi?id=53984
+
+        This code appears to be unused.
+
+        * html/HTMLParserErrorCodes.cpp:
+        * html/HTMLParserErrorCodes.h:
+        * html/HTMLParserQuirks.h:
+        * loader/EmptyClients.h:
+        * page/ChromeClient.h:
+
+2011-02-08  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] Move scrollbar rendering out of gtk2drawing.c
+        https://bugs.webkit.org/show_bug.cgi?id=52836
+
+        Replace gtk2drawing.c scrollbar rendering with our own version. This
+        is the last use of the Mozilla theme drawing code.
+
+        No new tests. This should not change the rendering of the default
+        theme.
+
+        * platform/gtk/GtkVersioning.h: Add some more backported allocation setters.
+        * platform/gtk/RenderThemeGtk.h: Add a getter for the scrollbar widgets.
+        * platform/gtk/RenderThemeGtk2.cpp:  Initialize and add getters for scrollbar widgets.
+        (WebCore::RenderThemeGtk::platformInit): Ditto.
+        (WebCore::RenderThemeGtk::gtkHScrollbar): Ditto.
+        (WebCore::RenderThemeGtk::gtkVScrollbar): Ditto.
+        * platform/gtk/ScrollbarThemeGtk.cpp: 
+        (WebCore::ScrollbarThemeGtk::paint): We only repaint the scrolled
+        window background if we are repainting a button or the thumb. In that
+        case also repaint the track rect.
+        * platform/gtk/ScrollbarThemeGtk2.cpp: Port to WidgetRenderingContext.
+        (WebCore::ScrollbarThemeGtk::ScrollbarThemeGtk): Ditto.
+        (WebCore::ScrollbarThemeGtk::updateThemeProperties): Ditto.
+        (WebCore::getWidgetForScrollbar): Ditto.
+        (WebCore::ScrollbarThemeGtk::paintTrackBackground): Ditto.
+        (WebCore::ScrollbarThemeGtk::paintScrollbarBackground): Ditto.
+        (WebCore::ScrollbarThemeGtk::paintThumb): Ditto.
+        (WebCore::ScrollbarThemeGtk::paintButton): Ditto.
+        * platform/gtk/WidgetRenderingContext.cpp: Ditto.
+        (WebCore::WidgetRenderingContext::gtkPaintBox): Added an option which
+        also adjusts a widget allocation according to the paint rect. This is
+        necessary to properly draw scrollbar buttons.
+        * platform/gtk/WidgetRenderingContext.h: Ditto.
+
+2011-02-08  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Inset shadow with large offset renders incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=53882
+        
+        Fix an issue with inset shadows, when the shadow offset
+        was larger than the box size. In this case we'd fail to
+        fill the box with the shadow color.
+
+        Test: fast/box-shadow/inset-shadow-large-offset.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::areaCastingShadowInHole): Return a rect that covers the area
+        which contributes to the inset shadow.
+        
+        (WebCore::RenderBoxModelObject::paintBoxShadow): Use areaCastingShadowInHole()
+        to compute the outerRect.
+
+2011-02-08  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        drawElements should check if a buffer is bound to ELEMENT_ARRAY_BUFFER
+        https://bugs.webkit.org/show_bug.cgi?id=54017
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::drawElements):
+
+2011-01-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Change the rest of HTMLMediaElement shadow DOM parts to use shadowPseudoId.
+        https://bugs.webkit.org/show_bug.cgi?id=53190
+
+        This is the second part of refactoring the HTMLMediaElement to use new
+        shadow DOM. The changes are mainly mechanical, except for needing to
+        add a new method to RenderTheme, which indicates whether or not status
+        display is being used by it. Previously, we relied on existence of a cached
+        pseudo style.
+
+        Refactoring, covered by existing tests.
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::pseudoId): Removed now-unused enum values.
+        (WebCore::nameToPseudoTypeMap): Ditto.
+        (WebCore::CSSSelector::extractPseudoType): Ditto.
+        * css/CSSSelector.h: Ditto.
+        * html/shadow/MediaControls.cpp:
+        (WebCore::MediaControls::createPanel): Changed to use the newly-added MediaControlPanelElement.
+        (WebCore::MediaControls::createCurrentTimeDisplay): Changed to use the newly-added
+            MediaControlCurrentTimeDisplayElement.
+        (WebCore::MediaControls::createTimeRemainingDisplay): Changed to use the newly-added
+                MediaControlTimeRemainingDisplayElement.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlShadowRootElement::updateStyle): Changed to use the
+            standard style resolution.
+        (WebCore::MediaControlShadowRootElement::shadowPseudoId): Added.
+        (WebCore::MediaControlElement::MediaControlElement): Removed the switch statement
+            that is no longer necessary.
+        (WebCore::MediaControlElement::styleForElement): Changed to use the standard
+            style resolution.
+        (WebCore::MediaControlPanelElement::MediaControlPanelElement): Added.
+        (WebCore::MediaControlPanelElement::create): Added.
+        (WebCore::MediaControlPanelElement::displayType): Added.
+        (WebCore::MediaControlPanelElement::shadowPseudoId): Added.
+        (WebCore::MediaControlTimelineContainerElement::MediaControlTimelineContainerElement):
+            Removed PseudoId constructor arg.
+        (WebCore::MediaControlTimelineContainerElement::rendererIsNeeded):
+            Changed to use the newly-plumbed usesMediaControlStatusDisplay helper.
+        (WebCore::MediaControlTimelineContainerElement::displayType): Added.
+        (WebCore::MediaControlTimelineContainerElement::shadowPseudoId): Added.
+        (WebCore::MediaControlVolumeSliderContainerElement::MediaControlVolumeSliderContainerElement):
+            Removed PseudoId constructor arg.
+        (WebCore::MediaControlVolumeSliderContainerElement::displayType): Added.
+        (WebCore::MediaControlVolumeSliderContainerElement::shadowPseudoId): Added.
+        (WebCore::MediaControlStatusDisplayElement::MediaControlStatusDisplayElement):
+            Removed PseudoId constructor arg.
+        (WebCore::MediaControlStatusDisplayElement::rendererIsNeeded): Changed to
+            use the newly-plumbed usesMediaControlStatusDisplay helper.
+        (WebCore::MediaControlStatusDisplayElement::displayType): Added.
+        (WebCore::MediaControlStatusDisplayElement::shadowPseudoId): Added.
+        (WebCore::MediaControlTimeDisplayElement::MediaControlTimeDisplayElement):
+            Removed PseudoId constructor arg.
+        (WebCore::MediaControlTimeRemainingDisplayElement::create): Added.
+        (WebCore::MediaControlTimeRemainingDisplayElement::MediaControlTimeRemainingDisplayElement): Added.
+        (WebCore::MediaControlTimeRemainingDisplayElement::displayType): Added.
+        (WebCore::MediaControlTimeRemainingDisplayElement::shadowPseudoId): Added.
+        (WebCore::MediaControlCurrentTimeDisplayElement::create): Added.
+        (WebCore::MediaControlCurrentTimeDisplayElement::MediaControlCurrentTimeDisplayElement): Added.
+        (WebCore::MediaControlCurrentTimeDisplayElement::displayType): Added.
+        (WebCore::MediaControlCurrentTimeDisplayElement::shadowPseudoId): Added.
+        * rendering/MediaControlElements.h: Added/changed defs accordingly.
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::usesMediaControlStatusDisplay): Added.
+        * rendering/RenderThemeMac.h: Added def.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::usesMediaControlStatusDisplay): Added.
+        * rendering/style/RenderStyleConstants.h: Removed now-unused enum values.
+
+2011-02-08  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix pop-up button text not rendered correctly according to its direction
+        in <option>.
+        https://bugs.webkit.org/show_bug.cgi?id=53642
+ 
+        In adjustInnerStyle(), if m_innerBlock's direction or unicode-bidi 
+        changes, set it needs layout.
+
+        Test: fast/text/international/pop-up-button-text-alignment-and-direction.html
+
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::adjustInnerStyle):
+
+2011-02-08  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed build fix for Qt-minimal.
+
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::hasFrontend):
+
+2011-02-02  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: move InspectorController's methods from InspectorAgent to InspectorController.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53169
+
+        All the Inspector API for WebCore has two parts.
+        The first one is InspectorInstrumentation for WebCore.
+        The second is InspectorController for WebKit.
+        InspectorAgent was produced by renaming original InspectorController.
+        This patch extracts WebKit related methods from InspectorAgent to InspectorController.
+
+        * WebCore.exp.in:
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::createParser):
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::~InspectorAgent):
+        (WebCore::InspectorAgent::restoreInspectorStateFromCookie):
+        (WebCore::InspectorAgent::inspect):
+        (WebCore::InspectorAgent::handleMousePress):
+        (WebCore::InspectorAgent::didClearWindowObjectInWorld):
+        (WebCore::InspectorAgent::setFrontend):
+        (WebCore::InspectorAgent::disconnectFrontend):
+        (WebCore::InspectorAgent::resourceAgent):
+        (WebCore::InspectorAgent::createFrontendLifetimeAgents):
+        (WebCore::InspectorAgent::releaseFrontendLifetimeAgents):
+        (WebCore::InspectorAgent::populateScriptObjects):
+        (WebCore::InspectorAgent::pushDataCollectedOffline):
+        (WebCore::InspectorAgent::restoreProfiler):
+        (WebCore::InspectorAgent::startTimelineProfiler):
+        (WebCore::PostWorkerNotificationToFrontendTask::performTask):
+        (WebCore::InspectorAgent::didOpenDatabase):
+        (WebCore::InspectorAgent::didUseDOMStorage):
+        (WebCore::InspectorAgent::showAndEnableDebugger):
+        (WebCore::InspectorAgent::enableDebugger):
+        (WebCore::InspectorAgent::enabled):
+        * inspector/InspectorAgent.h:
+        (WebCore::InspectorAgent::frontend):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::setInspectorFrontendClient):
+        (WebCore::InspectorController::hasInspectorFrontendClient):
+        (WebCore::InspectorController::didClearWindowObjectInWorld):
+        (WebCore::InspectorController::startTimelineProfiler):
+        (WebCore::InspectorController::stopTimelineProfiler):
+        (WebCore::InspectorController::connectFrontend):
+        (WebCore::InspectorController::disconnectFrontend):
+        (WebCore::InspectorController::disconnectFrontendImpl):
+        (WebCore::InspectorController::show):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::restoreInspectorStateFromCookie):
+        (WebCore::InspectorController::evaluateForTestInFrontend):
+        (WebCore::InspectorController::drawNodeHighlight):
+        (WebCore::InspectorController::inspect):
+        (WebCore::InspectorController::enabled):
+        (WebCore::InspectorController::showPanel):
+        (WebCore::InspectorController::frontendLoaded):
+        (WebCore::InspectorController::timelineProfilerEnabled):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        (WebCore::InspectorController::profilerEnabled):
+        (WebCore::InspectorController::debuggerEnabled):
+        (WebCore::InspectorController::showAndEnableDebugger):
+        (WebCore::InspectorController::disableDebugger):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        (WebCore::InspectorController::isRecordingUserInitiatedProfile):
+        (WebCore::InspectorController::setInspectorExtensionAPI):
+        (WebCore::InspectorController::resume):
+        (WebCore::InspectorController::hideHighlight):
+        (WebCore::InspectorController::dispatchMessageFromFrontend):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::inspectorClient):
+        (WebCore::InspectorController::inspectedPage):
+        (WebCore::InspectorController::hasFrontend):
+        * inspector/InspectorFrontendClientLocal.cpp:
+        (WebCore::InspectorFrontendClientLocal::sendMessageToBackend):
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::setExtensionAPI):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didClearWindowObjectInWorldImpl):
+        (WebCore::InspectorInstrumentation::profilerEnabledImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::hasFrontend):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+
+2011-02-08  George Wright  <gwright@rim.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53949
+
+        Ensure that we pack the colour byte order correctly for Skia using
+        Skia's SkPackARGB32 function.
+
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageFrame::setRGBA):
+
+2011-02-08  George Wright  <gwright@rim.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53951
+
+        Ensure we do not pass (-1, -1) sized rects to ImageBuffer but instead
+        pass the full image dimensions.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawImageBuffer):
+
+2011-02-08  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        [WIN] Add missing includes and forward declarations for DownloadBundle
+        https://bugs.webkit.org/show_bug.cgi?id=53881
+
+        * platform/network/cf/DownloadBundle.h:
+        * platform/network/win/DownloadBundleWin.cpp:
+        (WebCore::DownloadBundle::appendResumeData):
+
+2011-02-08  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        [WIN] Add missing include in WKCAImageQueue
+        https://bugs.webkit.org/show_bug.cgi?id=53890
+
+        * platform/graphics/win/WKCAImageQueue.cpp:
+
+2011-02-08  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        [WIN] Add missing includes and forward declarations for CFNetwork
+        https://bugs.webkit.org/show_bug.cgi?id=53883
+
+        * platform/network/cf/DNSCFNet.cpp:
+        * platform/network/cf/LoaderRunLoopCF.cpp:
+        * platform/network/cf/LoaderRunLoopCF.h:
+        * platform/network/cf/ProxyServerCFNet.cpp:
+        * platform/network/cf/SocketStreamHandle.h:
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+
+2011-02-08  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r77870.
+
+        * platform/DragImage.cpp: Enable createDragImageForLink for WinCE.
+
+2011-02-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: open network resource url in new tab upon double click.
+        https://bugs.webkit.org/show_bug.cgi?id=53930
+
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkDataGridNode.prototype.createCells):
+        (WebInspector.NetworkDataGridNode.prototype._openInNewTab):
+
+2011-02-08  Yonathan Randolph  <yonathan@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: $x: any node should work in optional context parameter.
+        https://bugs.webkit.org/show_bug.cgi?id=50138
+
+        * inspector/InjectedScriptSource.js:
+
+2011-02-08  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r77870.
+
+        Remove the global namespace prefix from GlobalLock/GlobalUnlock.
+
+        * platform/win/ClipboardUtilitiesWin.cpp:
+
+2011-02-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: re-apply r77924.
+
+        Test: inspector/console-api-on-call-frame.html
+
+        * inspector/InjectedScriptSource.js:
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._onEvaluateOnInspectedPage):
+
+2011-02-08  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        REGRESSION(r77312): Unbreak TiledBackingStore.
+
+        Due to an off-by-one error, we were no longer rendering the
+        rightmost column and bottom row of tiles.
+
+        Covered by tst_QGraphicsWebView::widgetsRenderingThroughCache().
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::invalidate):
+        (WebCore::TiledBackingStore::updateTileBuffers):
+        (WebCore::TiledBackingStore::paint):
+        (WebCore::TiledBackingStore::createTiles):
+
+2011-02-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r77924.
+        http://trac.webkit.org/changeset/77924
+        https://bugs.webkit.org/show_bug.cgi?id=53997
+
+        Breaks inspector tests. (Requested by pfeldman on #webkit).
+
+        * inspector/InjectedScriptSource.js:
+        (.):
+        ():
+
+2011-02-08  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [refacotring] merge InspectorAgent::willSendRequest() into InspectorResourceAgent
+        https://bugs.webkit.org/show_bug.cgi?id=53789
+         - perform UserAgent override via InspectorInstrumentation
+         - move adding extra request headers to InspectorResourceAgent
+         - simplified things in InspectorState
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::disconnectFrontend):
+        (WebCore::InspectorAgent::applyUserAgentOverride):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::applyUserAgentOverrideImpl):
+        (WebCore::InspectorInstrumentation::willSendRequestImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::applyUserAgentOverride):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::setExtraHeaders):
+        (WebCore::InspectorResourceAgent::willSendRequest):
+        * inspector/InspectorResourceAgent.h:
+        * inspector/InspectorState.cpp:
+        (WebCore::InspectorState::InspectorState):
+        (WebCore::InspectorState::restoreFromInspectorCookie):
+        (WebCore::InspectorState::updateCookie):
+        (WebCore::InspectorState::setValue):
+        (WebCore::InspectorState::getBoolean):
+        (WebCore::InspectorState::getString):
+        (WebCore::InspectorState::getLong):
+        (WebCore::InspectorState::getObject):
+        * inspector/InspectorState.h:
+        (WebCore::InspectorState::setObject):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::userAgent):
+
+2011-02-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: do not hide scope variables with command line api.
+        https://bugs.webkit.org/show_bug.cgi?id=53497
+
+        Test: inspector/console-api-on-call-frame.html
+
+        * inspector/InjectedScriptSource.js:
+
+2011-02-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: ignore cache upon reload via Ctrl(Cmd)+Shift+R.
+        https://bugs.webkit.org/show_bug.cgi?id=53914
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::reloadPage):
+        * inspector/InspectorAgent.h:
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._onReload):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+
+2011-02-08  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Skip over sibling selectors when collecting descendant selector hashes 
+        https://bugs.webkit.org/show_bug.cgi?id=53987
+        
+        Skip instead of bailing out. This will allow optimizing some sibling selector cases.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::RuleData::RuleData):
+        (WebCore::RuleData::collectIdentifierHashes):
+        (WebCore::RuleData::collectDescendantSelectorIdentifierHashes):
+        * css/CSSStyleSelector.h:
+
+2011-02-07  Cris Neckar  <cdn@chromium.org>
+
+        Reviewed by Jian Li.
+
+        Fix null deref in DOMURL
+        https://bugs.webkit.org/show_bug.cgi?id=53811
+
+        Test: fast/files/domurl-script-execution-context-crash.html
+
+        * html/DOMURL.cpp:
+        (WebCore::DOMURL::DOMURL):
+
+2011-02-07  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 32-bit build.
+
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::didAddVerticalScrollbar): Remove some extraneous characters.
+        (WebCore::ScrollAnimatorMac::didAddHorizontalScrollbar): Ditto.
+
+2011-02-07  Xiyuan Xia  <xiyuan@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [Chromium] Select popup box does not align with select button when appearance is not "menulist".
+        https://bugs.webkit.org/show_bug.cgi?id=53942
+
+        Added manual test select_webkit_appearance_off_popup_alignment.html.
+
+        * manual-tests/select_webkit_appearance_off_popup_alignment.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::layout):
+
+2011-02-07  Aparna Nandyal  <aparna.nand@wipro.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] - Context menu needs "Copy" as well when the selected text is a link.
+        https://bugs.webkit.org/show_bug.cgi?id=40983
+
+        Added copy option for Qt platform if selection is a link. 
+        Added a test in tst_qwebpage.cpp. 
+
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::populate):
+
+2011-02-07  Mike Reed  <reed@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add compile-time flag ENABLE(SKIA_GPU) to use Skia's gpu backend
+        when drawing <canvas>. Disabled by default.
+
+        No new tests. existing canvas layouttests apply
+
+        * platform/graphics/chromium/DrawingBufferChromium.cpp:
+        (WebCore::DrawingBuffer::publishToPlatformLayer):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::GetGlobalGrContext):
+        (WebCore::PlatformContextSkia::isPrinting):
+        (WebCore::PlatformContextSkia::setSharedGraphicsContext3D):
+        (WebCore::PlatformContextSkia::syncSoftwareCanvas):
+
+2011-02-07  Jay Civelli  <jcivelli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Removing unused code from PopupMenuChromium.
+        https://bugs.webkit.org/show_bug.cgi?id=53866
+
+       * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::layout):
+        (WebCore::PopupMenuChromium::show):
+        * platform/chromium/PopupMenuChromium.h:
+
+2011-02-07  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Reviewed by Andreas Kling.
+
+        HTMLOutputElement::childrenChanged() should call its base class childrenChanged()
+        https://bugs.webkit.org/show_bug.cgi?id=53791
+
+        Calls HTMLFormControlElement::childrenChanged() in HTMLOutputElement::childrenChanged().
+
+        Test: fast/dom/HTMLOutputElement/htmloutputelement-children-removed.html
+
+        * html/HTMLOutputElement.cpp:
+        (WebCore::HTMLOutputElement::childrenChanged): Calls super class's
+        childrenChanged().
+
+2011-02-07  Benjamin Poulain  <ikipou@gmail.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] cookiesEnabled could create the cookieJar on the wrong thread.
+        https://bugs.webkit.org/show_bug.cgi?id=52289
+
+        Use the QtNAMThreadSafeProxy to make sure the cookie jar is created
+        in the same thread as the QNetworkAccessManager.
+
+        * platform/network/qt/QtNAMThreadSafeProxy.cpp:
+        (WebCore::QtNAMThreadSafeProxy::QtNAMThreadSafeProxy):
+        (WebCore::QtNAMThreadSafeProxy::hasCookieJar):
+        * platform/network/qt/QtNAMThreadSafeProxy.h:
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::cookiesEnabled):
+
+2011-02-07  Alexey Marinichev  <amarinichev@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Hook up WebGraphicsContext3D::setContextLostCallback.
+        https://bugs.webkit.org/show_bug.cgi?id=53722
+
+        Test: fast/canvas/webgl/context-lost.html, comment out the line with
+        extension.loseContext() and kill the GPU process "Lose context"
+        message shows up.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContextLostCallback::WebGLRenderingContextLostCallback):
+        (WebCore::WebGLRenderingContextLostCallback::onContextLost):
+        (WebCore::WebGLRenderingContextLostCallback::~WebGLRenderingContextLostCallback):
+        (WebCore::WebGLRenderingContext::initializeNewContext):
+        (WebCore::WebGLRenderingContext::~WebGLRenderingContext):
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::ContextLostCallback::~ContextLostCallback):
+        * platform/graphics/mac/GraphicsContext3DMac.mm:
+        (WebCore::GraphicsContext3D::setContextLostCallback): stub
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::setContextLostCallback): stub
+
+2011-02-07  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add missing PaintInfo include in RenderThemeWin.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=53885
+
+        * rendering/RenderThemeWin.cpp:
+
+2011-02-07  Qi Zhang  <qi.2.zhang@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] enum QWebPage::WebAction doesn't have value QWebPage::CopyImageUrl
+        https://bugs.webkit.org/show_bug.cgi?id=52974
+
+        Add ContextMenuItemTagCopyImageUrlToClipboard into standard action but Qt platform specific.
+
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        (WebCore::ContextMenuController::populate):
+        (WebCore::ContextMenuController::checkOrEnableIfNeeded):
+        * platform/ContextMenuItem.h:
+        * platform/LocalizationStrategy.h:
+        * platform/LocalizedStrings.cpp:
+        (WebCore::contextMenuItemTagCopyImageUrlToClipboard):
+        * platform/LocalizedStrings.h:
+
+2011-02-07  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        HTMLFormElement::formElementIndex() returns a bad index into a vector of form associated elements
+        https://bugs.webkit.org/show_bug.cgi?id=53970
+
+        Adds HTMLObjectElement::virtualForm() to make HTMLObjectElement::form()
+        return the right value.
+
+        Test: fast/dom/HTMLObjectElement/form/nested-form-element.html
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::virtualForm): Added.
+        * html/HTMLObjectElement.h: Added virtualForm().
+
+2011-02-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Unreviewed Leopard build fix.
+
+        * WebCore.xcodeproj/project.pbxproj: let XCode have developmentRegion.
+        * platform/mac/DragImageMac.mm:
+        (WebCore::webkit_CGCeiling): Cast the return value of ceil to CGFloat.
+
+2011-02-07  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixing a build break on Mac caused by http://trac.webkit.org/changeset/77874
+
+        When moving code from WebKit to WebCore we needed to move some additional
+        functions previously in NSStringExtras.
+        
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/mac/DragImageMac.mm:
+        (WebCore::fontFromNSFont):
+        (WebCore::canUseFastRenderer):
+        (WebCore::widthWithFont):
+        (WebCore::webkit_CGCeiling):
+        (WebCore::drawAtPoint):
+        (WebCore::drawDoubledAtPoint):
+        (WebCore::createDragImageForLink):
+
+2011-02-07  Lucas Forschler  <lforschler@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Tr #2, Fix the Leopard 32bit debug build.
+        
+        No new tests required.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * accessibility/AccessibilityAllInOne.cpp:
+
+2011-02-07  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for <rdar://problem/8946961> Fix repaint problems
+        with WKScrollbarPainter scrollers while resizing the window
+
+        Remove setPainterForPainterController() and 
+        removePainterFromPainterController() since they aren't
+        used anymore.
+        * platform/mac/ScrollAnimatorMac.h:
+        
+        Return early if they alpha hasn't changed.
+        * platform/mac/ScrollAnimatorMac.mm:
+        (-[ScrollbarPainterDelegate scrollerImp:animateKnobAlphaTo:duration:]):
+        (-[ScrollbarPainterDelegate scrollerImp:animateTrackAlphaTo:duration:]):
+        
+        If we're in a live resize, restore alpha to 1.
+        (WebCore::ScrollAnimatorMac::didAddVerticalScrollbar):
+        (WebCore::ScrollAnimatorMac::didAddHorizontalScrollbar):
+
+2011-02-07  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=53950
+        USE_WK_SCROLLBAR_PAINTER in ScrollbarThemeMac should be in
+        Platform.h instead
+
+        Use hot new USE(WK_SCROLLBAR_PAINTER) from Platform.h rather
+        than the silly, old in-file #define.
+
+        * platform/mac/ScrollbarThemeMac.mm:
+        (+[ScrollbarPrefsObserver appearancePrefsChanged:]):
+        (WebCore::updateArrowPlacement):
+        (WebCore::ScrollbarThemeMac::registerScrollbar):
+        (WebCore::ScrollbarThemeMac::scrollbarThickness):
+        (WebCore::ScrollbarThemeMac::usesOverlayScrollbars):
+        (WebCore::ScrollbarThemeMac::hasThumb):
+        (WebCore::ScrollbarThemeMac::minimumThumbLength):
+        (WebCore::ScrollbarThemeMac::paint):
+
+2011-02-07  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed Adam Roben and Darin Adler.
+
+        WebKit2: drag and drop support on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=52775
+        <rdar://problem/8514409>
+
+        * loader/EmptyClients.h: Removed createDragImageFromLink.
+        * page/DragClient.h: Ditto.
+        * page/DragController.cpp:
+        (WebCore::DragController::startDrag): changed call to createDragImageFromLink.
+        * platform/DragImage.h:
+        * platform/mac/DragImageMac.mm:
+        (WebCore::createDragImageForLink): Moved from DragClient.
+        * platform/win/ClipboardUtilitiesWin.cpp: Added a series of functions
+        to de-serialize the drag data from the map into an IDataObject.
+        (WebCore::getWebLocData):
+        (WebCore::texthtmlFormat):
+        (WebCore::createGlobalData):
+        (WebCore::getFullCFHTML):
+        (WebCore::urlWFormat):
+        (WebCore::urlFormat):
+        (WebCore::filenameWFormat):
+        (WebCore::filenameFormat):
+        (WebCore::htmlFormat):
+        (WebCore::smartPasteFormat):
+        (WebCore::getURL):
+        (WebCore::getPlainText):
+        (WebCore::getTextHTML):
+        (WebCore::ClipboardDataItem::ClipboardDataItem):
+        (WebCore::getStringData):
+        (WebCore::getUtf8Data):
+        (WebCore::getCFData):
+        (WebCore::setUCharData):
+        (WebCore::setCharData):
+        (WebCore::setCFData):
+        (WebCore::getClipboardMap):
+        (WebCore::getClipboardData):
+        (WebCore::setClipboardData):
+        * platform/win/ClipboardUtilitiesWin.h:
+        * platform/win/DragImageWin.cpp: Moved createDragImageForLink from DragClient
+        to a platform specific file in WebCore. It makes a lot more sense here, since
+        the drag image is always created in WebCore for all the other content types
+        except for links.
+        (WebCore::dragLabelFont):
+        (WebCore::createDragImageForLink):
+        * platform/win/WCDataObject.cpp: Added new way to
+        construct a WCDataObject from a DragDataMap.
+        (WebCore::WCDataObject::createInstance):
+        (WebCore::WCDataObject::clearData):
+        * platform/win/WCDataObject.h:
+
+2011-02-07  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r77848.
+        http://trac.webkit.org/changeset/77848
+        https://bugs.webkit.org/show_bug.cgi?id=53963
+
+        caused 6 test failures (Requested by othermaciej on #webkit).
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine):
+
+2011-02-04  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by James Robinson.
+
+        Add shaders for GPU accelerated path rendering
+        https://bugs.webkit.org/show_bug.cgi?id=45520
+
+        Refactored SolidFillShader and TexShader to call new
+        generateVertex() and generateFragment() methods on base Shader
+        class, and added support for the Loop/Blinn shaders. Refactored
+        Loop/Blinn shader classes to derive from Shader.
+
+        Tested these changes with several of the IE9 Testdrive demos with
+        accelerated 2D canvas enabled, as well as a full layout test run
+        with --platform chromium-gpu.
+
+        * platform/graphics/gpu/LoopBlinnShader.cpp: Added.
+        (WebCore::LoopBlinnShader::LoopBlinnShader):
+        (WebCore::LoopBlinnShader::use):
+        * platform/graphics/gpu/LoopBlinnShader.h: Added.
+        * platform/graphics/gpu/LoopBlinnSolidFillShader.cpp: Added.
+        (WebCore::LoopBlinnSolidFillShader::create):
+        (WebCore::LoopBlinnSolidFillShader::LoopBlinnSolidFillShader):
+        (WebCore::LoopBlinnSolidFillShader::use):
+        * platform/graphics/gpu/LoopBlinnSolidFillShader.h: Added.
+        * platform/graphics/gpu/Shader.cpp:
+        (WebCore::Shader::affineTo4x4):
+        (WebCore::Shader::loadShader):
+        (WebCore::Shader::loadProgram):
+        (WebCore::Shader::generateVertex):
+        (WebCore::Shader::generateFragment):
+        * platform/graphics/gpu/Shader.h:
+        * platform/graphics/gpu/SolidFillShader.cpp:
+        (WebCore::SolidFillShader::create):
+        * platform/graphics/gpu/TexShader.cpp:
+        (WebCore::TexShader::TexShader):
+        (WebCore::TexShader::create):
+
+2011-02-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/8946023> REGRESSION (r76674): SVG + BiDi text broken (text-intro-05-t.svg)
+        https://bugs.webkit.org/show_bug.cgi?id=53480
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): m_indexEnd should be an
+        offset into m_characters, not into the run’s characters.
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Ditto.
+
+2011-02-07  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add bundle API to get the background color of a frame
+        <rdar://problem/8962670>
+        https://bugs.webkit.org/show_bug.cgi?id=53952
+
+        * WebCore.exp.in: Add export.
+
+2011-02-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Assertion failure in ~JSGlobalObject when loading apple.com HTML5
+        transitions demo page
+        https://bugs.webkit.org/show_bug.cgi?id=53853
+
+        This was a long-standing bookkeeping bug uncovered by some heap refactoring.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createImageBuffer):
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::notifyFinished):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::dropProtection): Take the JSLock before
+        reporting extra cost to the JavaScriptCore heap, since all use of
+        JavaScriptCore is supposed to be guarded by JSLock.
+
+2011-02-07  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Intermittent crash in fast/files/read-blob-async.html on the GTK+ debug
+        bots
+        https://bugs.webkit.org/show_bug.cgi?id=53104
+
+        Covered by the existing tests.
+
+        * fileapi/FileStreamProxy.cpp:
+        (WebCore::FileStreamProxy::startOnFileThread):
+        * platform/network/BlobRegistryImpl.cpp:
+        (WebCore::BlobRegistryImpl::createResourceHandle):
+        * platform/network/BlobResourceHandle.cpp:
+        (WebCore::BlobResourceHandle::BlobResourceHandle):
+        (WebCore::BlobResourceHandle::cancel):
+        (WebCore::delayedStartBlobResourceHandle):
+        (WebCore::BlobResourceHandle::start): Keep BlobResourceHandle alive
+        till the delay function is called.
+        (WebCore::BlobResourceHandle::doStart):
+        (WebCore::doNotifyFinish):
+        (WebCore::BlobResourceHandle::notifyFinish): Notify the client via the
+        standalone function to prevent the handle from being disposed immediately
+        by the client which will make the calls in the stack that're still bound
+        to the handle suffer.
+        * platform/network/BlobResourceHandle.h:
+        * platform/network/ResourceHandle.h: Change cancel() to virtual so that
+        BlobResourceHandle::cancel will be called when we abort a FileReader.
+
+2011-02-07  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r77845.
+        http://trac.webkit.org/changeset/77845
+        https://bugs.webkit.org/show_bug.cgi?id=53946
+
+        build failure (Requested by lforschler_ on #webkit).
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * accessibility/AccessibilityAllInOne.cpp:
+
+2011-02-07  Darin Adler  <darin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=53939
+        fast/css/text-overflow-ellipsis.html failure after r77818/77819
+
+        * platform/text/TextCodecICU.cpp:
+        (WebCore::TextCodecICU::registerExtendedEncodingNames):
+        Add back the "utf8" synonym for "UTF-8".
+
+2011-02-07  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Remove an unnecessary extra computeLogicalWidth() from line layout.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine):
+
+2011-02-07  Lucas Forschler  <lforschler@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix Leopard Intel Debug Build.
+        <rdar://problem/8953606> REGRESSION: Can't link WebCore on 32-bit Leopard (53681)
+        This could potentially break windows, since I had to change #include <filename> to #include "filename"
+        
+        * WebCore.xcodeproj/project.pbxproj:
+        * accessibility/AccessibilityAllInOne.cpp:
+
+2011-02-07  Sam Weinig  <sam@webkit.org>
+
+        Fix build.
+
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::didAddVerticalScrollbar):
+        (WebCore::ScrollAnimatorMac::willRemoveVerticalScrollbar):
+        (WebCore::ScrollAnimatorMac::didAddHorizontalScrollbar):
+        (WebCore::ScrollAnimatorMac::willRemoveHorizontalScrollbar):
+
+2011-02-07  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Add mechanism to inform the ScrollAnimator when Scrollbars are added 
+        and removed.
+
+        * platform/ScrollAnimator.h:
+        (WebCore::ScrollAnimator::didAddVerticalScrollbar):
+        (WebCore::ScrollAnimator::willRemoveVerticalScrollbar):
+        (WebCore::ScrollAnimator::didAddHorizontalScrollbar):
+        (WebCore::ScrollAnimator::willRemoveHorizontalScrollbar):
+        Make virtual to allow platform specific overrides.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::setHasVerticalScrollbar):
+        Call new ScrollableArea functions.
+
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::didAddVerticalScrollbar):
+        (WebCore::ScrollableArea::willRemoveVerticalScrollbar):
+        (WebCore::ScrollableArea::didAddHorizontalScrollbar):
+        (WebCore::ScrollableArea::willRemoveHorizontalScrollbar):
+        * platform/ScrollableArea.h:
+        Pipe to ScrollAnimator.
+
+        * platform/mac/ScrollAnimatorMac.h:
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::didAddVerticalScrollbar):
+        (WebCore::ScrollAnimatorMac::willRemoveVerticalScrollbar):
+        (WebCore::ScrollAnimatorMac::didAddHorizontalScrollbar):
+        (WebCore::ScrollAnimatorMac::willRemoveHorizontalScrollbar):
+        * platform/mac/ScrollbarThemeMac.h:
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::registerScrollbar):
+        (WebCore::ScrollbarThemeMac::unregisterScrollbar):
+        (WebCore::ScrollbarThemeMac::painterForScrollbar):
+        Move painter delegate registration to the new didAdd/willRemove functions.
+
+2011-02-07  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Missing text match markers with accelerated content
+        https://bugs.webkit.org/show_bug.cgi?id=53934
+
+        When doing the fake paint that recomputes the text match rects, we need to
+        flatten compositing layers, otherwise the rects won't be updated until the next paint call.
+
+        (This worked by accident in WebKit1 because Safari calls -[NSWindow displayIfNeeded] on the containing
+        window before asking for the text match rects).
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::countMatchesForText):
+
+2011-02-07  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Andreas Kling.
+
+        REGRESSION(r77740): CSSStyleSelector accessing deleted memory for svg/dom/use-transform.svg
+        https://bugs.webkit.org/show_bug.cgi?id=53900
+        
+        Ignore link elements in shadow trees.
+
+        * dom/Element.cpp:
+        (WebCore::StyleSelectorParentPusher::StyleSelectorParentPusher):
+        (WebCore::StyleSelectorParentPusher::~StyleSelectorParentPusher):
+                
+            Some asserts to catch cases like this.
+
+        (WebCore::Element::attach):
+        (WebCore::Element::recalcStyle):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::HTMLLinkElement):
+        (WebCore::HTMLLinkElement::process):
+        (WebCore::HTMLLinkElement::insertedIntoDocument):
+        (WebCore::HTMLLinkElement::removedFromDocument):
+        * html/HTMLLinkElement.h:
+
+2011-02-07  Darin Adler  <darin@apple.com>
+
+        Turn UTF-8 decoder off for now so we can look into failing tests
+        without leaving the tree red.
+
+        * platform/text/TextCodecICU.cpp:
+        (WebCore::TextCodecICU::registerBaseEncodingNames): Reverting
+        earlier change so this can handle UTF-8.
+        (WebCore::TextCodecICU::registerBaseCodecs): Ditto.
+        (WebCore::TextCodecICU::registerExtendedEncodingNames): Ditto.
+        (WebCore::TextCodecICU::registerExtendedCodecs): Ditto.
+        * platform/text/TextCodecICU.h: Ditto.
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps): Ditto.
+        (WebCore::extendTextCodecMaps): Ditto.
+        * platform/text/brew/TextCodecBrew.cpp:
+        (WebCore::TextCodecBrew::registerBaseEncodingNames): Ditto.
+        (WebCore::TextCodecBrew::registerBaseCodecs): Ditto.
+        (WebCore::TextCodecBrew::registerExtendedEncodingNames): Ditto.
+        (WebCore::TextCodecBrew::registerExtendedCodecs): Ditto.
+        * platform/text/brew/TextCodecBrew.h: Ditto.
+        * platform/text/gtk/TextCodecGtk.cpp:
+        (WebCore::TextCodecGtk::registerBaseEncodingNames): Ditto.
+        (WebCore::TextCodecGtk::registerBaseCodecs): Ditto.
+        * platform/text/wince/TextCodecWinCE.cpp:
+        (WebCore::TextCodecWinCE::registerBaseEncodingNames): Ditto.
+        (WebCore::TextCodecWinCE::registerBaseCodecs): Ditto.
+        (WebCore::TextCodecWinCE::registerExtendedEncodingNames): Ditto.
+        (WebCore::TextCodecWinCE::registerExtendedCodecs): Ditto.
+        * platform/text/wince/TextCodecWinCE.h: Ditto.
+
+2011-02-07  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Don't exclude overlay scrollers from the page overlay bounds
+        https://bugs.webkit.org/show_bug.cgi?id=53924
+
+        Export ScrollbarTheme::nativeTheme.
+
+        * WebCore.exp.in:
+
+2011-02-07  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Crash in glDrawArrays with NaCl crystal model
+        https://bugs.webkit.org/show_bug.cgi?id=52831
+
+        * html/canvas/WebGLRenderingContext.cpp: Allocate large enough buffer for atttrib0 if it's enabled and not used.
+        (WebCore::WebGLRenderingContext::initVertexAttrib0):
+        (WebCore::WebGLRenderingContext::simulateVertexAttrib0):
+        * html/canvas/WebGLRenderingContext.h:
+
+2011-02-07  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA @aria-sort not exposed on rowheader and columnheader roles.
+        https://bugs.webkit.org/show_bug.cgi?id=53842
+
+        Test: platform/mac/accessibility/aria-sort.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::sortDirection):
+        * accessibility/AccessibilityObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * html/HTMLAttributeNames.in:
+
+2011-02-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Add built-in decoder for UTF-8 for improved performance
+        https://bugs.webkit.org/show_bug.cgi?id=53898
+
+        Correct behavior is covered by existing tests.
+
+        * Android.mk: Added TextCodecUTF8.
+        * CMakeLists.txt: Ditto.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+
+        * platform/text/TextCodecICU.cpp: Removed registration of UTF-8
+        since that's now handled by the built-in UTF-8 codec.
+        (WebCore::TextCodecICU::registerEncodingNames): Renamed to remove
+        the word "extended" since all codecs from ICU are now extended.
+        (WebCore::TextCodecICU::registerCodecs): Ditto.
+        * platform/text/TextCodecICU.h: Ditto.
+
+        * platform/text/TextCodecUTF16.cpp:
+        (WebCore::TextCodecUTF16::decode): Added a FIXME about missing
+        error handling.
+
+        * platform/text/TextCodecUTF8.cpp: Added.
+        * platform/text/TextCodecUTF8.h: Added.
+
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps): Added TextCodecUTF8, and
+        removed TextCodecICU, TextCodecBrew, and TextCodecWinCE.
+        (WebCore::extendTextCodecMaps): Updated names for
+        TextCodecICU and TextCodecWinCE.
+
+        * platform/text/brew/TextCodecBrew.cpp:
+        (WebCore::TextCodecBrew::registerEncodingNames): Renamed to remove
+        the word "extended" since all codecs from Brew are now extended.
+        (WebCore::TextCodecBrew::registerCodecs): Ditto.
+        * platform/text/brew/TextCodecBrew.h: Ditto.
+
+        * platform/text/gtk/TextCodecGtk.cpp:
+        (WebCore::TextCodecGtk::registerBaseEncodingNames): Removed
+        registration of UTF-8. It's questionable whether the other codecs
+        here are really basic. If we think they qualify, then we should
+        register them on other platforms, not just GTK.
+        (WebCore::TextCodecGtk::registerBaseCodecs): Ditto.
+
+        * platform/text/wince/TextCodecWinCE.cpp:
+        (WebCore::getCodePage): Removed special case for UTF-8 since we
+        no longer use this codec for UTF-8.
+        (WebCore::TextCodecWinCE::registerEncodingNames): Renamed to remove
+        the word "extended" since all codecs from WinCE are now extended.
+        (WebCore::TextCodecWinCE::registerCodecs): Ditto.
+        * platform/text/wince/TextCodecWinCE.h: Ditto.
+
+2011-02-07  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] atk_text_get_caret_offset fails for list items
+        https://bugs.webkit.org/show_bug.cgi?id=53436
+
+        Consider list item markers when calculating the offset.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_text_get_caret_offset): Adjust the offset
+        with the item marker's length for list items.
+        (webkit_accessible_text_set_caret_offset): Replace usage of
+        g_utf8_strlen() by calling to markerText.length().
+
+2011-02-07  Yi Shen  <yi.4.shen@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix LayoutTests/media/restore-from-page-cache.html
+        https://bugs.webkit.org/show_bug.cgi?id=53621
+
+        Changed the networkState to MediaPlayer::Loaded when 
+        MediaPlayerPrivateQt has enough data.
+
+        Test: media/restore-from-page-cache.html
+
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivateQt::updateStates):
+
+2011-01-31  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: implement beautification of scripts inlined in html documents.
+        https://bugs.webkit.org/show_bug.cgi?id=52706
+
+        To beautify scripts inlined in html, we need to cut individual scripts, beautify them using UglifyJS library, and
+        finally paste them back to html.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ScriptFormatter.js:
+        (WebInspector.ScriptFormatter): Implement formatting of scripts inlined in html.
+        (WebInspector.ScriptFormatter.prototype.formatContent.didFormatChunks):
+        (WebInspector.ScriptFormatter.prototype.formatContent):
+        (WebInspector.ScriptFormatter.prototype._splitContentIntoChunks):
+        (WebInspector.ScriptFormatter.prototype._formatChunks.didFormat):
+        (WebInspector.ScriptFormatter.prototype._formatChunks):
+        (WebInspector.ScriptFormatter.prototype._buildContentFromChunks):
+        (WebInspector.ScriptFormatter.prototype._formatScript.messageHandler):
+        (WebInspector.ScriptFormatter.prototype._formatScript):
+        * inspector/front-end/ScriptFormatterWorker.js:
+        (onmessage):
+        (buildMapping):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrameContent): Use SourceFrameContent and FormattedSourceFrameContent to perform operations with line numbers.
+        * inspector/front-end/SourceFrameContent.js: Added.
+        (WebInspector.SourceFrameContent): Helper class, holds resource text and scripts layout
+        (WebInspector.SourceFrameContent.prototype.get scriptRanges):
+        (WebInspector.SourceFrameContent.prototype.locationToPosition):
+        (WebInspector.SourceFrameContent.prototype.positionToLocation):
+        (WebInspector.SourceFrameContent.prototype.scriptLocationForLineNumber):
+        (WebInspector.SourceFrameContent.prototype.scriptLocationForRange):
+        (WebInspector.SourceFrameContent.prototype.lineNumberToRange):
+        (WebInspector.SourceFrameContent.prototype._intersectingScriptRange):
+        (WebInspector):
+        (WebInspector.FormattedSourceFrameContent): Helper class, holds original and formatted versions of resource and mapping between them.
+        (WebInspector.FormattedSourceFrameContent.prototype.get text):
+        (WebInspector.FormattedSourceFrameContent.prototype.originalLocationToFormattedLocation):
+        (WebInspector.FormattedSourceFrameContent.prototype.scriptLocationForFormattedLineNumber):
+        (WebInspector.FormattedSourceFrameContent.prototype._convertPosition):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2011-02-07  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: "Reveal in elements panel" does not always work.
+        https://bugs.webkit.org/show_bug.cgi?id=53775
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView):
+        * inspector/front-end/ContextMenu.js:
+        (WebInspector.ContextMenu.prototype.show):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.switchToAndFocus):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._contextMenuEventFired.focusElement):
+        (WebInspector.ElementsTreeOutline.prototype._contextMenuEventFired):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        (WebInspector.ObjectPropertyTreeElement.prototype._contextMenuEventFired):
+        * inspector/front-end/inspector.js:
+        (WebInspector.cancelSearch):
+
+2011-02-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Relative .. in URL paths shouldn't skip adjacent / characters
+        https://bugs.webkit.org/show_bug.cgi?id=53907
+
+        Our new behavior matches Firefox, Chrome, and IE.
+
+        * platform/KURL.cpp:
+        (WebCore::copyPathRemovingDots):
+
+2011-02-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        WebKitTestRunner does not block remote resources or complain about them
+        https://bugs.webkit.org/show_bug.cgi?id=42139
+        <rdar://problem/8183942>
+
+        * Configurations/WebCore.xcconfig: Allow WebKitTestRunner to link
+        WebCore.
+        * WebCore.exp.in: Export a handful of KURL symbols.
+
+2011-02-06  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        OwnArraryPtr.h uses deleteOwnedPtr but doesn’t include OwnPtrCommon.h
+        https://bugs.webkit.org/show_bug.cgi?id=52867
+
+        * ForwardingHeaders/wtf/OwnArrayPtrCommon.h: Removed.
+        * bindings/v8/NPV8Object.cpp:
+        (WebCore::createValueListFromVariantArgs): Returns PassOwnArrayPtr<v8::Handle<v8::Value>> instead of
+        v8::Handle<v8::Value>*.
+        (_NPN_Invoke): Calls createValueListFromVariantArgs.
+        (_NPN_InvokeDefault): createValueListFromVariantArgs.
+        (_NPN_Construct): createValueListFromVariantArgs.
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::call): Calls adoptArrayPtr.
+        (WebCore::ScriptFunctionCall::construct): Ditto.
+        (WebCore::ScriptCallback::call):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::createNewContext): Ditto.
+        * bindings/v8/V8NPObject.cpp:
+        (WebCore::npObjectInvokeImpl): Ditto
+        * bindings/v8/V8NodeFilterCondition.cpp:
+        (WebCore::V8NodeFilterCondition::acceptNode): Ditto,
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::parseMappedAttribute): Calls newCoordsArray.
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute): Calls newLengthArray.
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::getAttachedShaders): Calls adoptArraYptr.
+        (WebCore::WebGLRenderingContext::simulateVertexAttrib0): Ditto.
+        (WebCore::WebGLRenderingContext::LRUImageBufferCache::LRUImageBufferCache): Dito.
+        * platform/Length.cpp:
+        (WebCore::newCoordsArray): Returns PassOwnArrayPtr<Length> instead of Length*.
+        (WebCore::newLengthArray): Returns PassOwnArrayPtr<Length> instead of Length*.
+        * platform/Length.h: Prototype changes.
+        * platform/graphics/ANGLEWebKitBridge.cpp:
+        (WebCore::ANGLEWebKitBridge::validateShaderSource): Calls adoptArrayPtr.
+        * platform/graphics/ca/win/CACFLayerTreeHost.cpp:
+        (WebCore::getDirtyRects): Ditto.
+        * platform/graphics/chromium/ComplexTextControllerLinux.cpp:
+        (WebCore::ComplexTextController::getNormalizedTextRun): Ditto.
+        * platform/graphics/chromium/HarfbuzzSkia.cpp:
+        (WebCore::glyphsToAdvances): Ditto.
+        (WebCore::canRender): Ditto.
+        * platform/graphics/gpu/Texture.cpp:
+        (WebCore::Texture::updateSubRect): Ditto.
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        (WebCore::GraphicsContext3D::paintRenderingResultsToCanvas): Ditto.
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::readbackHardwareToSoftware): Ditto.
+        * platform/graphics/wince/SharedBitmap.cpp:
+        (WebCore::SharedBitmap::to16bit): Ditto.
+        * platform/win/ContextMenuWin.cpp:
+        (WebCore::ContextMenu::getContextMenuItems): Ditto.
+        * platform/win/LoggingWin.cpp:
+        (WebCore::initializeWithUserDefault): Ditto.
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::fetchInfo): Ditto.
+
+2011-02-06  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewed.
+
+        * WebCore.xcodeproj/project.pbxproj: Run sort-xcode-project-file.
+
+2011-02-03  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Convert <keygen> option elements to a shadow DOM
+        https://bugs.webkit.org/show_bug.cgi?id=51379
+
+        Covered by existing tests e.g. fast/html/keygen.html,
+        html5lib/runner.html, etc.
+
+        * css/html.css:
+        (form): Cleanup.
+        (keygen, select): Border radii should match so focus ring looks good.
+        (keygen::-webkit-keygen-select): No margin on the shadow element.
+        (select): Hoisting border radius to keygen, select rule.
+        * dom/SelectElement.cpp:
+        (WebCore::toSelectElement): keygen is no longer a select element.
+        * html/HTMLKeygenElement.cpp: Implements keygen shadow.
+        (WebCore::KeygenSelectElement::create):
+        (WebCore::KeygenSelectElement::shadowPseudoId):
+        (WebCore::KeygenSelectElement::KeygenSelectElement):
+        (WebCore::HTMLKeygenElement::HTMLKeygenElement):
+        (WebCore::HTMLKeygenElement::parseMappedAttribute):
+        (WebCore::HTMLKeygenElement::appendFormData):
+        (WebCore::HTMLKeygenElement::formControlType):
+        (WebCore::HTMLKeygenElement::reset):
+        (WebCore::HTMLKeygenElement::selectShadow):
+        * html/HTMLKeygenElement.h: keygen is no longer a select on C++ side.
+        (WebCore::HTMLKeygenElement::canStartSelection):
+        (WebCore::HTMLKeygenElement::isEnumeratable):
+        (WebCore::HTMLKeygenElement::isResettable):
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::ownerSelectElement): Only owned by selects.
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::HTMLSelectElement): Only 'select' tag name.
+
+2011-02-06  Benjamin Poulain  <ikipou@gmail.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix coding style errors in ClipboardQt.h
+        https://bugs.webkit.org/show_bug.cgi?id=43520
+
+        Fix coding style: order of header and indentation.
+
+        * platform/qt/ClipboardQt.h:
+        (WebCore::ClipboardQt::create):
+        (WebCore::ClipboardQt::clipboardData):
+        (WebCore::ClipboardQt::invalidateWritableData):
+
+2011-02-06  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Use bloom filter for descendant selector filtering
+        https://bugs.webkit.org/show_bug.cgi?id=53880
+        
+        Bloom filter is faster than a hash set in this kind of use.
+        
+        Shark thinks this speeds up style matching by ~30% on sites
+        with lots of descendant selectors.
+
+        * ForwardingHeaders/wtf/BloomFilter.h: Added.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::collectElementIdentifierHashes):
+        (WebCore::CSSStyleSelector::pushParent):
+        (WebCore::CSSStyleSelector::popParent):
+        (WebCore::CSSStyleSelector::fastRejectSelector):
+        (WebCore::RuleData::collectDescendantSelectorIdentifierHashes):
+        * css/CSSStyleSelector.h:
+
+2011-02-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        media/video-document-types.html sometimes crashes the WebProcess
+        https://bugs.webkit.org/show_bug.cgi?id=53884
+
+        No new tests. Already covered by media/video-document-types.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::userCancelledLoad): Stop the load timer
+        when cancelling the load.
+
+2011-02-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        [WIN] Use WCHAR instead of TCHAR
+        https://bugs.webkit.org/show_bug.cgi?id=53863
+
+        We always use the UNICODE versions of windows functions, so
+        the usage of TCHAR makes no sense and mixing them is bad style.
+
+        * platform/graphics/win/IconWin.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/win/QTMovie.cpp:
+        * platform/graphics/win/QTMovieGWorld.cpp:
+        (QTMovieGWorld::fullscreenWndProc):
+        (QTMovieGWorld::enterFullscreen):
+        * platform/graphics/win/SimpleFontDataCGWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        * platform/graphics/wince/SimpleFontDataWinCE.cpp:
+        * platform/win/BString.cpp:
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::filesystemPathFromUrlOrTitle):
+        (WebCore::createGlobalHDropContent):
+        (WebCore::createGlobalImageFileDescriptor):
+        * platform/win/ContextMenuWin.cpp:
+        * platform/win/CursorWin.cpp:
+        (WebCore::loadSharedCursor):
+        * platform/win/FileChooserWin.cpp:
+        (WebCore::FileChooser::basenameForWidth):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenuWin::popupClassName):
+        (WebCore::PopupMenuWin::show):
+        * platform/win/PopupMenuWin.h:
+
+2011-02-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Replace FLT_MAX with std::numeric_limits
+        https://bugs.webkit.org/show_bug.cgi?id=53861
+
+        Also move EFL's userIdleTime from TemporaryLinkStubs into SystemTimeEfl.
+
+        * html/NumberInputType.cpp:
+        * html/parser/HTMLParserIdioms.cpp:
+        (WebCore::parseToDoubleForNumberType):
+        * platform/brew/SystemTimeBrew.cpp:
+        (WebCore::userIdleTime):
+        * platform/efl/SystemTimeEfl.cpp:
+        (WebCore::userIdleTime):
+        * platform/efl/TemporaryLinkStubs.cpp:
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::setupAnimation):
+        * platform/win/SystemTimeWin.cpp:
+        (WebCore::userIdleTime):
+        * platform/wx/SystemTimeWx.cpp:
+        (WebCore::userIdleTime):
+
+2011-02-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [CMake] Add dependencies for Visual Studio projects
+        https://bugs.webkit.org/show_bug.cgi?id=53773
+
+        Add a JavaScriptCore dependecy to WebCore, so CMake can 
+        generate the correct build order for the solution.
+
+        * CMakeLists.txt:
+
+2011-02-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [CMake] Unify ENABLE_SVG sections
+        https://bugs.webkit.org/show_bug.cgi?id=53778
+
+        * CMakeLists.txt:
+
+2011-02-06  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Dirk Schulze.
+
+        Refactor Font::normalizeSpaces() to avoid an extra String copy.
+        https://bugs.webkit.org/show_bug.cgi?id=53871
+
+        Have normalizeSpaces() take UChar*,length arguments instead of a
+        String, since all call sites were creating temporaries from these
+        components anyway.
+
+        Font::normalizeSpaces() now always makes 1 String copy,
+        instead of 1 in the best case and 2 in the worst case.
+
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::normalizeSpaces):
+        * platform/graphics/Font.h:
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::drawTextCommon):
+        (WebCore::Font::floatWidthForSimpleText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::offsetForPositionForSimpleText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        (WebCore::Font::selectionRectForSimpleText):
+        (WebCore::Font::selectionRectForComplexText):
+        * svg/SVGFont.cpp:
+        (WebCore::SVGTextRunWalker::walk):
+
+2011-02-06  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Dirk Schulze.
+
+        Fix potential buffer overrun in SVGTextRunWalker::walk()
+        https://bugs.webkit.org/show_bug.cgi?id=53870
+
+        A new String was created from a UChar* with a 'length' argument
+        that could be greater than the number of UChars available.
+
+        * svg/SVGFont.cpp:
+        (WebCore::SVGTextRunWalker::walk):
+
+2011-02-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove unused parameter related to XSSAuditor
+        https://bugs.webkit.org/show_bug.cgi?id=53862
+
+        * WebCore.exp.in:
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeScript):
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        * bindings/ScriptControllerBase.h:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::executeScriptInWorld):
+        * bindings/js/ScriptController.h:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/v8/ScriptController.h:
+
+2011-02-05  Adam Barth  <abarth@webkit.org>
+
+        Fix Qt build.
+
+        * WebCore.pro:
+
+2011-02-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Delete XSSAuditor
+        https://bugs.webkit.org/show_bug.cgi?id=53859
+
+        The job of the XSSAuditor is now done by the XSSFilter.  In the future,
+        we might rename XSSFilter to XSSAuditor.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        * bindings/ScriptControllerBase.h:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::evaluateInWorld):
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::evaluate):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitOpen):
+        (WebCore::Document::processBaseElement):
+        * dom/ScriptableDocumentParser.cpp:
+        (WebCore::ScriptableDocumentParser::ScriptableDocumentParser):
+        * dom/ScriptableDocumentParser.h:
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::shouldLoadExternalScriptFromSrc):
+        * loader/SubframeLoader.cpp:
+        (WebCore::SubframeLoader::requestObject):
+        (WebCore::SubframeLoader::loadMediaPlayerProxyPlugin):
+        * page/XSSAuditor.cpp: Removed.
+        * page/XSSAuditor.h: Removed.
+
+2011-02-05  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Need a way to resize and scroll the page at the same time
+        https://bugs.webkit.org/show_bug.cgi?id=53814
+        <rdar://problem/8498008>
+
+        Export a function needed by WebKit2.
+
+        * WebCore.exp.in:
+
+2011-02-05  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Use Document::encoding() instead of DocumentWriter::encoding()
+        https://bugs.webkit.org/show_bug.cgi?id=53398
+
+        This change makes the code more readable, when a subresource
+        inherits the character encoding of the document.
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::checkStyleSheet):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElement::scriptCharset):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::process):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::requestPreload):
+        * platform/network/FormDataBuilder.cpp:
+        (WebCore::FormDataBuilder::encodingFromAcceptCharset):
+
+2011-02-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduce URLString to represent a canonicalized URL represented by a string
+        https://bugs.webkit.org/show_bug.cgi?id=53847
+
+        Instead of using String all over the codebase to represent a URL,
+        instead we should have a type to represent a canonicalized URL in the
+        form of a string.  This patch introduces that type.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/KURL.cpp:
+        (WebCore::KURL::KURL):
+        * platform/KURL.h:
+        (WebCore::KURL::urlString):
+
+2011-02-05  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] Style widgets not rendering
+        https://bugs.webkit.org/show_bug.cgi?id=53849
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::hasValidClassId): x-qt-styled-widget is a valid class id too
+
+2011-02-05  Jochen Eisinger  <jochen@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add ContentSecurityPolicy object to Document and pass the X-WebKit-CSP header from the MainResourceLoader.
+        https://bugs.webkit.org/show_bug.cgi?id=53685
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.h:
+        (WebCore::Document::contentSecurityPolicy):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveResponse):
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::didReceiveHeader):
+        * page/ContentSecurityPolicy.h:
+
+2011-02-05  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Safari should lowercase schemes in cannonicalized urls to match every other browser
+        https://bugs.webkit.org/show_bug.cgi?id=53848
+
+        We're clearly the odd man out here.  See results from every browser at:
+        https://github.com/abarth/url-spec/blob/master/tests/gurl-results/by-browser.txt
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::parse):
+         - Just lowercase the scheme when copying.
+
+2011-02-05  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Optimize matching of descendant selectors
+        https://bugs.webkit.org/show_bug.cgi?id=49876
+        <rdar://problem/8772822>
+        
+        During style recalculation, maintain a filter of tags, ids and classes seen in ancestor elements.
+        Use the filter to quickly reject descendant and child selectors when doing style matching.
+
+        This speeds up style recalculations 3-6x on many major web sites.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::RuleData::RuleData):
+        (WebCore::RuleData::descendantSelectorIdentifierHashes):
+        (WebCore::collectElementIdentifiers):
+        (WebCore::CSSStyleSelector::pushParent):
+        (WebCore::CSSStyleSelector::popParent):
+        (WebCore::CSSStyleSelector::fastRejectSelector):
+        (WebCore::CSSStyleSelector::matchRulesForList):
+        (WebCore::RuleData::collectDescendantSelectorIdentifierHashes):
+        * css/CSSStyleSelector.h:
+        (WebCore::CSSStyleSelector::ParentStackFrame::ParentStackFrame):
+        * dom/Element.cpp:
+        (WebCore::StyleSelectorParentPusher::StyleSelectorParentPusher):
+        (WebCore::StyleSelectorParentPusher::push):
+        (WebCore::StyleSelectorParentPusher::~StyleSelectorParentPusher):
+        (WebCore::Element::attach):
+        (WebCore::Element::recalcStyle):
+
+2011-02-05  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Refactor: NotificationCenter shouldn't hold its own copy of the ScriptExecutionContext*
+        when it inherits one from ActiveDOMObject.
+        https://bugs.webkit.org/show_bug.cgi?id=53815
+
+        * bindings/js/JSDesktopNotificationsCustom.cpp:
+        (WebCore::JSNotificationCenter::requestPermission):
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        (WebCore::V8NotificationCenter::requestPermissionCallback):
+        * notifications/NotificationCenter.cpp:
+        (WebCore::NotificationCenter::NotificationCenter):
+        (WebCore::NotificationCenter::checkPermission):
+        (WebCore::NotificationCenter::requestPermission):
+        (WebCore::NotificationCenter::disconnectFrame):
+        * notifications/NotificationCenter.h:
+        (WebCore::NotificationCenter::createHTMLNotification):
+        (WebCore::NotificationCenter::createNotification):
+
+2011-02-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Crash in WebCore::TextEncoding::decode below XSSFilter::init
+        https://bugs.webkit.org/show_bug.cgi?id=53837
+
+        Add missing null check.
+
+        Test: http/tests/security/xssAuditor/non-block-javascript-url-frame.html
+
+        * html/parser/XSSFilter.cpp:
+        (WebCore::XSSFilter::init):
+
+2011-02-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Crashes in ShadowBlur via WebKit2 FindController
+        https://bugs.webkit.org/show_bug.cgi?id=53830
+        
+        Fix a crash cause by re-entering ShadowBlur, and add assertions to
+        detect when it happens.
+        
+        The re-entrancy occurred when drawRectShadowWithTiling() filled
+        the interior of the shadow with fillRect() on the context
+        which still had the shadow state set. This would make another ShadowBlur
+        on the stack and call into the code again, potentially blowing away
+        the image buffer.
+        
+        Fix by turning off shadows in the destination context while we're
+        drawing the tiled shadow. The non-tiled code path already did this.
+
+        Not testable because CSS shadows clip out the inside of the rect
+        being shadowed, and SVG uses fillPath, even for rects.
+
+        * platform/graphics/ShadowBlur.cpp:
+        (WebCore::ScratchBuffer::ScratchBuffer):
+        (WebCore::ScratchBuffer::getScratchBuffer):
+        (WebCore::ScratchBuffer::scheduleScratchBufferPurge):
+        (WebCore::ShadowBlur::ShadowBlur):
+        (WebCore::ShadowBlur::drawRectShadowWithTiling):
+
+2011-02-04  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Don't use a fixed size for search field icons
+        https://bugs.webkit.org/show_bug.cgi?id=50624
+
+        Use the parent input content box to make sure the icon fits in the
+        search field, scaling it down when needed.
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::paintGdkPixbuf):
+        (WebCore::getIconSizeForPixelSize):
+        (WebCore::adjustSearchFieldIconStyle):
+        (WebCore::RenderThemeGtk::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::centerRectVerticallyInParentInputElement):
+        (WebCore::RenderThemeGtk::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeGtk::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeGtk::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeGtk::paintCapsLockIndicator):
+        (WebCore::RenderThemeGtk::paintMediaButton):
+
+2011-02-04  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [chromium] JPEG corruption
+        https://bugs.webkit.org/show_bug.cgi?id=53250
+
+        Same as gray-scale JPEGs, we convert the colors of CMYK JPEGs with color
+        profiles from CMYK to RGB twice and it causes color corruption. This
+        change suppresses the color profiles for CMYK JPEGs same as gray-scale
+        ones.
+
+        Test: fast/images/cmyk-jpeg-with-color-profile.html
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageReader::decode):
+
+2011-02-04  Xiyuan Xia  <xiyuan@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [Chromium] Option text in select popup does not align with menulist button text
+        https://bugs.webkit.org/show_bug.cgi?id=53632
+
+        This makes clientPaddingLeft and  clientPaddingRight return
+        the additional m_innerBlock's padding so that the popup item text
+        aligns with the menulist button text.
+
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::clientPaddingLeft):
+        (WebCore::RenderMenuList::clientPaddingRight):
+
+2011-02-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig and Beth Dakin.
+
+        REGRESSION: Horizontal scrollbar thumbs leave artifacts over page content when scrolling vertically
+        <rdar://problem/8962457>
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        Subtract scrollbars from the scroll view rect if overlay scrollers are enabled.
+        
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::setScrollOffsetFromAnimation):
+        Make sure to invalidate both scrollbars if overlay scrollers are enabled.
+
+2011-02-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        PluginDocuments don't create widgets for plugins on back/forward
+        https://bugs.webkit.org/show_bug.cgi?id=53474
+
+        Long ago, PluginDocument always caused the HTMLEmbedElement to create
+        its widget synchronously during a post-layout task.  Recently, however,
+        some changes to the HistroyController caused layout on back/forward to
+        become slightly more complicated (and added an extra level of recursion
+        to layout).  This extra level of recursion triggered the "I've recursed
+        too many times" condition in the post-layout task queue, causing the
+        FrameView to run the remainder of the tasks asynchronously.
+        Unfortunately, that broke PluginDocument because it needs its the
+        HTMLEmbedElement's updateWidget task to run synchronously.
+
+        This patch adds a mechanism for "kicking off" the pending post-layout
+        tasks synchronously (instead of waiting for the timer to fire).
+        PluginDocument then uses that facility to ensure that the
+        HTMLEmbedElement's updateWidget task happens.
+
+        Test: plugins/plugin-document-back-forward.html
+
+        * html/PluginDocument.cpp:
+        (WebCore::PluginDocumentParser::appendBytes):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::flushAnyPendingPostLayoutTasks):
+        * page/FrameView.h:
+
+2011-02-04  Charlie Reis  <creis@chromium.org>
+
+        Reviewed by Mihai Parparita.
+
+        Crash in WebCore::HistoryController::itemsAreClones
+        https://bugs.webkit.org/show_bug.cgi?id=52819
+
+        Avoids deleting the current HistoryItem while it is still in use.
+        Ensures that provisional items are committed for same document navigations.
+        Ensures that error pages are committed on back/forward navigations.
+        Also removes unneeded sanity checks used for diagnosing the problem.
+
+        * loader/HistoryController.cpp:
+        * loader/HistoryController.h:
+
+2011-02-04  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by David Hyatt.
+
+        Code Changes.
+
+        CSS 2.1 failure: content-*
+        https://bugs.webkit.org/show_bug.cgi?id=52126
+
+        Test: fast/css/counters/content-021.html
+
+        * rendering/CounterNode.cpp:
+        (showCounterTree):
+        Made parameter const because it is supposed to be so.
+        * rendering/RenderCounter.cpp:
+        (WebCore::previousInPreOrder):
+        (WebCore::previousSiblingOrParent):
+        (WebCore::parentElement):
+        (WebCore::areRenderersElementsSiblings):
+        (WebCore::nextInPreOrder):
+        Added these local helper functions to help navigate the DOM tree
+        enriched with :before and :after pseudo elements.
+        (WebCore::planCounter):
+        Fixed bug that would create a repeat counter for second and
+        subsequent renderers associated with the same DOM element.
+        (WebCore::findPlaceForCounter):
+        (WebCore::makeCounterNode):
+        Changed to use the new tree navigation functions described above
+        instead of the Renderer Tree navigation functions.
+        (WebCore::RenderCounter::rendererSubtreeAttached):
+        (WebCore::RenderCounter::rendererStyleChanged):
+        Optimized to not bother about counters until the renderers are
+        finally attached.
+        (showRendererTree):
+        (showNodeTree):
+        Debug helper functions used to debug Counter bugs.
+
+2011-02-04  Dan Bernstein  <mitz@apple.com>
+
+        Typo fix.
+
+        * html/parser/XSSFilter.cpp:
+        (WebCore::HTMLNames::containsJavaScriptURL):
+
+2011-02-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Make an infinite loop introduced in r77454 finite.
+
+        * html/parser/XSSFilter.cpp:
+        (WebCore::HTMLNames::containsJavaScriptURL):
+
+2011-02-04  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Frame accurate seeking isn't always accurate
+        https://bugs.webkit.org/show_bug.cgi?id=52697
+
+        Test: media/video-frame-accurate-seek.html
+
+        Make seeking slightly more accurate by rounding instead of truncating
+        when converting from seconds-in-float to time/timeScale.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivateQTKit::createQTTime):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
+        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::mediaTimeForTimeValue):
+        * platform/graphics/win/QTMovie.cpp:
+        (QTMovie::setCurrentTime):
+
+2011-02-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        Second IndexedDB events overhaul patch
+        https://bugs.webkit.org/show_bug.cgi?id=53813
+
+        If an IDBRequest has a IDBTransaction, it should propogate
+        events through it. In order to do this, IDBRequest needs to
+        hold a transaction frontend object rather than a backend one.
+
+        Test: storage/indexeddb/request-event-propagation.html
+
+        * storage/IDBCursor.cpp:
+        (WebCore::IDBCursor::IDBCursor):
+        * storage/IDBCursor.h:
+        (WebCore::IDBCursor::create):
+        * storage/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::setSetVersionTransaction):
+        (WebCore::IDBDatabase::createObjectStore):
+        (WebCore::IDBDatabase::deleteObjectStore):
+        * storage/IDBDatabase.h:
+        * storage/IDBIndex.cpp:
+        (WebCore::IDBIndex::IDBIndex):
+        (WebCore::IDBIndex::openCursor):
+        (WebCore::IDBIndex::openKeyCursor):
+        (WebCore::IDBIndex::get):
+        (WebCore::IDBIndex::getKey):
+        * storage/IDBIndex.h:
+        (WebCore::IDBIndex::create):
+        * storage/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::IDBObjectStore):
+        (WebCore::IDBObjectStore::get):
+        (WebCore::IDBObjectStore::add):
+        (WebCore::IDBObjectStore::put):
+        (WebCore::IDBObjectStore::deleteFunction):
+        (WebCore::IDBObjectStore::createIndex):
+        (WebCore::IDBObjectStore::deleteIndex):
+        (WebCore::IDBObjectStore::openCursor):
+        * storage/IDBObjectStore.h:
+        (WebCore::IDBObjectStore::create):
+        * storage/IDBRequest.cpp:
+        (WebCore::IDBRequest::create):
+        (WebCore::IDBRequest::IDBRequest):
+        (WebCore::IDBRequest::resetReadyState):
+        (WebCore::IDBRequest::onSuccess):
+        (WebCore::IDBRequest::dispatchEvent):
+        * storage/IDBRequest.h:
+        * storage/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::IDBTransaction):
+        (WebCore::IDBTransaction::objectStore):
+        (WebCore::IDBTransaction::contextDestroyed):
+        (WebCore::IDBTransaction::enqueueEvent):
+        * storage/IDBTransaction.h:
+        * storage/IDBTransaction.idl:
+
+2011-02-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        First step towards event propogation within IndexedDB
+        https://bugs.webkit.org/show_bug.cgi?id=53795
+
+        This is the first step towards implementing
+        http://www.w3.org/Bugs/Public/show_bug.cgi?id=11348
+        within IndexedDB. I've created a method that knows how
+        to capture and bubble (based on Node's dispatchGenericEvent).
+        I've then changed IDBRequest to use it.
+
+        The only functional change is that preventDefault now must
+        be called in error events to prevent the transaction from
+        being aborted. The tests reflect this change and there's one
+        specific test to look at this behavior.
+
+        Test: storage/indexeddb/error-causes-abort-by-default.html
+
+        * storage/IDBAbortEvent.cpp:
+        (WebCore::IDBAbortEvent::create):
+        (WebCore::IDBAbortEvent::IDBAbortEvent):
+        * storage/IDBAbortEvent.h:
+        * storage/IDBCompleteEvent.cpp:
+        (WebCore::IDBCompleteEvent::create):
+        (WebCore::IDBCompleteEvent::IDBCompleteEvent):
+        * storage/IDBCompleteEvent.h:
+        * storage/IDBErrorEvent.cpp:
+        (WebCore::IDBErrorEvent::IDBErrorEvent):
+        * storage/IDBEvent.cpp:
+        (WebCore::IDBEvent::IDBEvent):
+        (WebCore::IDBEvent::dispatch):
+        * storage/IDBEvent.h:
+        * storage/IDBRequest.cpp:
+        (WebCore::IDBRequest::dispatchEvent):
+        * storage/IDBRequest.h:
+        * storage/IDBSuccessEvent.cpp:
+        (WebCore::IDBSuccessEvent::IDBSuccessEvent):
+        * storage/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::onAbort):
+        (WebCore::IDBTransaction::onComplete):
+        * storage/IDBTransaction.h:
+        (WebCore::IDBTransaction::backend):
+        * storage/IDBTransactionBackendImpl.cpp:
+        (WebCore::IDBTransactionBackendImpl::taskTimerFired):
+
+2011-02-04  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Clone WebClipboard to be frame-specific.
+        https://bugs.webkit.org/show_bug.cgi?id=53727
+
+        For drop operations, Chrome currently snapshots the data and copies it
+        into the renderer process. As we add more supported drag data types, the
+        copy will become increasingly expensive. Instead, we'd like to snapshot
+        data in the browser to reduce the amount of data copied and to support
+        Blob in DataTransferItem. In order to allow this, we associated
+        WebClipboard with a frame so it can correctly route its IPCs to the
+        corresponding Chromium host.
+
+        No new tests because no new functionality.
+
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::createReadable):
+        * platform/chromium/ChromiumDataObject.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::create):
+        * platform/chromium/PlatformBridge.h:
+        * platform/chromium/ReadableDataObject.cpp:
+        (WebCore::ReadableDataObject::create):
+        (WebCore::ReadableDataObject::ReadableDataObject):
+        (WebCore::ReadableDataObject::getData):
+        (WebCore::ReadableDataObject::urlTitle):
+        (WebCore::ReadableDataObject::htmlBaseUrl):
+        (WebCore::ReadableDataObject::filenames):
+        (WebCore::ReadableDataObject::ensureTypeCacheInitialized):
+        * platform/chromium/ReadableDataObject.h:
+
+2011-02-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Revert https://bugs.webkit.org/show_bug.cgi?id=53795
+
+        * storage/IDBAbortEvent.cpp:
+        (WebCore::IDBAbortEvent::create):
+        (WebCore::IDBAbortEvent::IDBAbortEvent):
+        * storage/IDBAbortEvent.h:
+        * storage/IDBCompleteEvent.cpp:
+        (WebCore::IDBCompleteEvent::create):
+        (WebCore::IDBCompleteEvent::IDBCompleteEvent):
+        * storage/IDBCompleteEvent.h:
+        * storage/IDBErrorEvent.cpp:
+        (WebCore::IDBErrorEvent::IDBErrorEvent):
+        * storage/IDBEvent.cpp:
+        (WebCore::IDBEvent::IDBEvent):
+        * storage/IDBEvent.h:
+        * storage/IDBRequest.cpp:
+        (WebCore::IDBRequest::dispatchEvent):
+        * storage/IDBRequest.h:
+        * storage/IDBSuccessEvent.cpp:
+        (WebCore::IDBSuccessEvent::IDBSuccessEvent):
+        * storage/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::onAbort):
+        (WebCore::IDBTransaction::onComplete):
+        * storage/IDBTransaction.h:
+        * storage/IDBTransactionBackendImpl.cpp:
+        (WebCore::IDBTransactionBackendImpl::taskTimerFired):
+
+2011-02-04  Martin Galpin  <martin@66laps.com>
+
+        Reviewed by David Levin.
+
+        CORS origin header not set on GET when a preflight request is required.
+        https://bugs.webkit.org/show_bug.cgi?id=50773
+        
+        Test: http/tests/xmlhttprequest/cross-origin-preflight-get.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::preflightSuccess): 
+        Explicitly set the request origin after a preflight request succeeds.
+
+2011-02-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        First step towards event propogation within IndexedDB
+        https://bugs.webkit.org/show_bug.cgi?id=53795
+
+        This is the first step towards implementing
+        http://www.w3.org/Bugs/Public/show_bug.cgi?id=11348
+        within IndexedDB. I've created a method that knows how
+        to capture and bubble (based on Node's dispatchGenericEvent).
+        I've then changed IDBRequest to use it.
+
+        The only functional change is that preventDefault now must
+        be called in error events to prevent the transaction from
+        being aborted. The tests reflect this change and there's one
+        specific test to look at this behavior.
+
+        Test: storage/indexeddb/error-causes-abort-by-default.html
+
+        * storage/IDBAbortEvent.cpp:
+        (WebCore::IDBAbortEvent::create):
+        (WebCore::IDBAbortEvent::IDBAbortEvent):
+        * storage/IDBAbortEvent.h:
+        * storage/IDBCompleteEvent.cpp:
+        (WebCore::IDBCompleteEvent::create):
+        (WebCore::IDBCompleteEvent::IDBCompleteEvent):
+        * storage/IDBCompleteEvent.h:
+        * storage/IDBErrorEvent.cpp:
+        (WebCore::IDBErrorEvent::IDBErrorEvent):
+        * storage/IDBEvent.cpp:
+        (WebCore::IDBEvent::IDBEvent):
+        (WebCore::IDBEvent::dispatch):
+        * storage/IDBEvent.h:
+        * storage/IDBRequest.cpp:
+        (WebCore::IDBRequest::dispatchEvent):
+        * storage/IDBRequest.h:
+        * storage/IDBSuccessEvent.cpp:
+        (WebCore::IDBSuccessEvent::IDBSuccessEvent):
+        * storage/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::onAbort):
+        (WebCore::IDBTransaction::onComplete):
+        * storage/IDBTransaction.h:
+        (WebCore::IDBTransaction::backend):
+        * storage/IDBTransactionBackendImpl.cpp:
+        (WebCore::IDBTransactionBackendImpl::taskTimerFired):
+
+2011-02-04  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt]REGRESSION(r76951): media/controls-without-preload.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=53674
+
+        * css/mediaControlsQt.css:
+
+2011-02-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler and Dave Hyatt.
+
+        <rdar://problem/8902704> Make ruby text size 50% by default
+        https://bugs.webkit.org/show_bug.cgi?id=53723
+
+        * css/html.css:
+        (ruby > rt): Changed the font-size from 60% to 50%.
+
+2011-02-04  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53610
+        Regression: adjacent sibling selector not working as expected
+        <rdar://problem/8960033>
+        
+        https://bugs.webkit.org/show_bug.cgi?id=53574
+        REGRESSION (r76012): :last-child:after not working as expected
+        <rdar://problem/8948643>
+        
+        Test for additional conditions in parent style that prevent sharing.
+
+        Tests: fast/selectors/style-sharing-adjacent-selector.html
+               fast/selectors/style-sharing-last-child.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::parentStylePreventsSharing):
+        (WebCore::CSSStyleSelector::locateSharedStyle):
+
+2011-02-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium GYP build fix.
+
+        When various settings were moved to webcore_prerequisites in r66364,
+        things that should have been direct_dependent_settings were not marked
+        as such. GYP 'defines', for example, make no sense on a 'none'-type
+        target such as webcore_prerequisites. It appears that it was intended
+        for these settings to be pushed to direct dependents, which would make
+        direct_dependent_settings correct.
+
+        Losing the ChromiumWebCoreObjC defines on the Mac, for example, caused
+        http://crbug.com/71537, which at best causes Mac console log spew, and
+        at worst may result in Chromium's copy of WebCore using system
+        definitions of certain Objective-C classes at runtime, or vice-versa.
+
+        The build now includes a postbuild step to prevent
+        http://crbug.com/71537 from regressing again. The build will fail upon
+        regression.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53630
+
+        * WebCore.gyp/WebCore.gyp: Move things in webcore_prerequisites into
+          direct_dependent_settings as needed, add the check_objc_rename
+          postbuild step.
+        * WebCore.gyp/mac/check_objc_rename.sh: Added.
+
+2011-02-04  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Darin Fisher.
+
+        Move chromium iframe shim code to cross-platform file
+        https://bugs.webkit.org/show_bug.cgi?id=52594
+
+        Move Chromium code for identifying and cutting out
+        iframe shims from plugins to cross-platform utility file
+        IFrameShimSupport.cpp.
+        Amend PluginViewQt to use this code to handle shims correctly.
+
+        * WebCore.gypi: Add Chromium support for IFrameShimSupport.cpp
+        * WebCore.pro: Add Qt support for IFrameShimSupport.cpp
+        * plugins/IFrameShimSupport.cpp: Added.
+        (WebCore::getObjectStack):
+        (WebCore::iframeIsAbovePlugin):
+        (WebCore::getPluginOcclusions):
+        * plugins/IFframeShimSupport.h: Added.
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2011-02-04  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by David Levin.
+
+        Implement "<option> should implement the dir attribute" for chromium port after r76983.
+        https://bugs.webkit.org/show_bug.cgi?id=50969
+
+        Use manual test Source/WebCore/manual-tests/pop-up-alignment-and-direction.html
+        added in r76983.
+
+        * platform/chromium/PopupMenuChromium.cpp: Remove directionality hint from
+        <select> drop-down setting.
+        (WebCore::PopupListBox::paintRow): Use <option>'s directionality to paint
+        items in drop-down and pass-in bidi override flag when creating text run.
+        * platform/chromium/PopupMenuChromium.h: Remove directionalityHint from
+        PopupContainerSettings.
+
+2011-02-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Build fix from merge mistake.
+
+        * storage/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::ensureEventTargetData):
+
+2011-02-04  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Remove unneeded function declarations in comments in EditorClient.h
+        https://bugs.webkit.org/show_bug.cgi?id=53745
+
+        Removing unused commented out function declarations. No tests since this is just cleanup.
+
+        * page/EditorClient.h:
+
+2011-02-03  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        Refactor IDBRequest and IDBTransaction a bit
+        https://bugs.webkit.org/show_bug.cgi?id=53565
+
+        There were a lot of subtle issues with the way IDBTransaction
+        and IDBRequest used to be written. This cleans a lot of them up
+        and largely simplifies the logic. Using EventQueue rather than
+        timers is one example of the simplification.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * dom/EventQueue.cpp:
+        (WebCore::EventQueue::enqueueEvent):
+        (WebCore::EventQueue::dispatchEvent):
+        * storage/IDBCursor.cpp:
+        (WebCore::IDBCursor::continueFunction):
+        * storage/IDBRequest.cpp:
+        (WebCore::IDBRequest::create):
+        (WebCore::IDBRequest::IDBRequest):
+        (WebCore::IDBRequest::resetReadyState):
+        (WebCore::IDBRequest::onError):
+        (WebCore::IDBRequest::onSuccess):
+        (WebCore::IDBRequest::dispatchEvent):
+        (WebCore::IDBRequest::enqueueEvent):
+        (WebCore::IDBRequest::eventTargetData):
+        (WebCore::IDBRequest::ensureEventTargetData):
+        * storage/IDBRequest.h:
+        (WebCore::IDBRequest::dispatchEvent):
+        * storage/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::create):
+        (WebCore::IDBTransaction::IDBTransaction):
+        (WebCore::IDBTransaction::objectStore):
+        (WebCore::IDBTransaction::abort):
+        (WebCore::IDBTransaction::onAbort):
+        (WebCore::IDBTransaction::onComplete):
+        (WebCore::IDBTransaction::onTimeout):
+        (WebCore::IDBTransaction::canSuspend):
+        (WebCore::IDBTransaction::stop):
+        (WebCore::IDBTransaction::enqueueEvent):
+        (WebCore::IDBTransaction::eventTargetData):
+        (WebCore::IDBTransaction::ensureEventTargetData):
+        * storage/IDBTransaction.h:
+
+2011-02-01  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        Remove the timeout event from IndexedDB
+        https://bugs.webkit.org/show_bug.cgi?id=53521
+
+        Remove timeout and ontimeout from IDBTransaction per the spec.
+
+        * WebCore.gypi:
+        * storage/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::transaction):
+        * storage/IDBDatabase.h:
+        (WebCore::IDBDatabase::transaction):
+        * storage/IDBDatabase.idl:
+        * storage/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::setVersion):
+        (WebCore::IDBDatabaseBackendImpl::transaction):
+        * storage/IDBDatabaseBackendImpl.h:
+        * storage/IDBDatabaseBackendInterface.h:
+        * storage/IDBTimeoutEvent.cpp: Removed.
+        * storage/IDBTimeoutEvent.h: Removed.
+        * storage/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::IDBTransaction):
+        (WebCore::IDBTransaction::onAbort):
+        (WebCore::IDBTransaction::onComplete):
+        * storage/IDBTransaction.h:
+        * storage/IDBTransaction.idl:
+        * storage/IDBTransactionBackendImpl.cpp:
+        (WebCore::IDBTransactionBackendImpl::create):
+        (WebCore::IDBTransactionBackendImpl::IDBTransactionBackendImpl):
+        * storage/IDBTransactionBackendImpl.h:
+        * storage/IDBTransactionCallbacks.h:
+
+2011-02-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        AX: Can't set accessibility overridden attributes on web objects
+        https://bugs.webkit.org/show_bug.cgi?id=53725
+
+        accessibilitySetOverriddenValue does not work on AX objects from WebCore because 
+        the right method needed to be overridden (accessibilitySupportsOverriddenAttributes).
+        Unfortunately, there's no way to test this from DRT, since AppKit returns the overridden
+        attribute only when an AX client asks for it through the AX frameworks.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilitySupportsOverriddenAttributes]):
+
+2011-02-03  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        REGRESSION(r76147): Slider thumb is not repainted when let go outside of the slider track.
+        https://bugs.webkit.org/show_bug.cgi?id=53691
+
+        Test: fast/repaint/slider-thumb-drag-release.html
+
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::SliderThumbElement::stopDragging): Added dirtying the layout bit to ensure
+            that the thumb is repainted.
+
+2011-02-04  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Add "show more" data grid node and waiting message UI components.
+        https://bugs.webkit.org/show_bug.cgi?id=53763
+
+        - "show more" data grid node is used for on-demand population of
+        data grid contents (similar to DOM tree capability for limiting
+        displayed nodes count);
+
+        - waiting message is used for informing user about long lasting
+        operations (with a possibility to cancel them).
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/PleaseWaitMessage.js: Added.
+        (WebInspector.PleaseWaitMessage):
+        * inspector/front-end/ShowMoreDataGridNode.js: Added.
+        (WebInspector.ShowMoreDataGridNode):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        (.data-grid button):
+        (.please-wait-msg):
+        * inspector/front-end/inspector.html:
+
+2011-02-04  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=53740
+        <rdar://problem/8503629> Allow platforms to specify if the placeholder should be visible when text controls are focused
+
+        Tests:
+        fast/forms/textarea-placeholder-visibility-1.html
+        fast/forms/textarea-placeholder-visibility-2.html
+        fast/forms/input-placeholder-visibility-1.html
+        fast/forms/input-placeholder-visibility-2.html
+        fast/forms/input-placeholder-visibility-3.html
+
+        * html/HTMLFormControlElement.cpp: (WebCore::HTMLTextFormControlElement::placeholderShouldBeVisible):
+        Add a check for shouldShowPlaceholderWhenFocused.
+        * html/HTMLTextAreaElement.cpp: (WebCore::HTMLTextAreaElement::updateValue):
+        Whenever the value is updated, we should also update placeholder visibility.
+        * rendering/RenderTheme.h: (WebCore::RenderTheme::shouldShowPlaceholderWhenFocused):
+        Make the default the same as the existing behavior.
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm: (WebCore::RenderThemeMac::shouldShowPlaceholderWhenFocused):
+        Show placeholder when appropriate. 
+
+2011-02-04  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: evaluate on hover does not work on a breakpoint.
+        https://bugs.webkit.org/show_bug.cgi?id=53768
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._mouseHover):
+
+2011-02-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r77625 and r77626.
+        http://trac.webkit.org/changeset/77625
+        http://trac.webkit.org/changeset/77626
+        https://bugs.webkit.org/show_bug.cgi?id=53765
+
+        It broke Windows builds (Requested by Ossy_ on #webkit).
+
+        * Android.jscbindings.mk:
+        * CMakeLists.txt:
+        * ForwardingHeaders/pcre/pcre.h: Added.
+        * ForwardingHeaders/yarr/Yarr.h: Removed.
+        * ForwardingHeaders/yarr/YarrInterpreter.h: Removed.
+        * ForwardingHeaders/yarr/YarrPattern.h: Removed.
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/copyForwardingHeaders.cmd:
+        * platform/text/RegularExpression.cpp:
+        (WebCore::RegularExpression::Private::regexp):
+        (WebCore::RegularExpression::Private::compile):
+        (WebCore::RegularExpression::Private::Private):
+        (WebCore::RegularExpression::Private::create):
+        (WebCore::RegularExpression::Private::~Private):
+        (WebCore::RegularExpression::match):
+
+2011-02-04  Peter Varga  <pvarga@webkit.org>
+
+        Rubber-stamped by Csaba Osztrogonác.
+
+        Replace PCRE with Yarr in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=53496
+
+        Speculative windows build fix.
+
+        No new tests needed.
+
+        * platform/text/RegularExpression.cpp:
+
+2011-02-04  Peter Varga  <pvarga@webkit.org>
+
+
+        Reviewed by Gavin Barraclough.
+
+        Replace PCRE with Yarr in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=53496
+
+        No new tests needed.
+
+        * Android.jscbindings.mk:
+        * CMakeLists.txt:
+        * ForwardingHeaders/pcre/pcre.h: Removed.
+        * ForwardingHeaders/yarr/Yarr.h: Added.
+        * ForwardingHeaders/yarr/YarrInterpreter.h: Added.
+        * ForwardingHeaders/yarr/YarrPattern.h: Added.
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/copyForwardingHeaders.cmd:
+        * platform/text/RegularExpression.cpp:
+        (WebCore::RegularExpression::Private::create):
+        (WebCore::RegularExpression::Private::Private):
+        (WebCore::RegularExpression::Private::compile):
+        (WebCore::RegularExpression::match):
+
+2011-02-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Network panel filtering is broken.
+        https://bugs.webkit.org/show_bug.cgi?id=53764
+
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkPanel.prototype._sortItems):
+        (WebInspector.NetworkPanel.prototype._sortByTimeline):
+        (WebInspector.NetworkPanel.prototype._filter):
+        (WebInspector.NetworkPanel.prototype._updateOffscreenRows):
+        (WebInspector.NetworkDataGridNode.prototype.isFilteredOut):
+        (WebInspector.NetworkDataGridNode.prototype.get selectable):
+        (WebInspector.NetworkTotalGridNode.prototype.isFilteredOut):
+        (WebInspector.NetworkTotalGridNode.prototype.get selectable):
+
+2011-02-04  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: support overriding user agent strings
+        https://bugs.webkit.org/show_bug.cgi?id=51485
+
+        Test: http/tests/inspector/extensions-useragent.html
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::disconnectFrontend):
+        (WebCore::InspectorController::setUserAgentOverride):
+        (WebCore::InspectorController::userAgentOverride):
+        * inspector/InspectorController.h:
+        * inspector/front-end/ExtensionAPI.js:
+        (WebInspector.injectedExtensionAPI.InspectedWindow.prototype.reload):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._onReload):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::userAgent):
+        (WebCore::FrameLoader::applyUserAgent):
+
+2011-02-04  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: scripts panel displays wrong file name after reload.
+        https://bugs.webkit.org/show_bug.cgi?id=53761
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._resourceLoadingFinished):
+
+2011-02-03  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: remove settings related methods from InspectorClient
+        https://bugs.webkit.org/show_bug.cgi?id=53686
+
+        * WebCore.exp.in:
+        * inspector/CodeGeneratorInspector.pm:
+        * inspector/InspectorClient.h:
+        * inspector/InspectorFrontendClientLocal.cpp:
+        (WebCore::InspectorFrontendClientLocal::InspectorFrontendClientLocal):
+        (WebCore::InspectorFrontendClientLocal::changeAttachedWindowHeight):
+        (WebCore::InspectorFrontendClientLocal::restoreAttachedWindowHeight):
+        * inspector/InspectorFrontendClientLocal.h: ports that provide in-process implementation of the inspector front-end can
+        provide platform-specific settings accessor.
+        (WebCore::InspectorFrontendClientLocal::Settings::Settings):
+        (WebCore::InspectorFrontendClientLocal::Settings::~Settings):
+        (WebCore::InspectorFrontendClientLocal::Settings::inspectorAttachedHeight):
+        (WebCore::InspectorFrontendClientLocal::Settings::storeInspectorAttachedHeight):
+        * loader/EmptyClients.h:
+
+2011-02-03  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [v8] frame several more JS code invocations into v8::TryCatch
+        https://bugs.webkit.org/show_bug.cgi?id=53594
+
+        This patch is preemptive and adjusts v8 bindings code to forthcoming small change
+        in v8::ThrowException---currently sometimes exceptions thrown by this method
+        do not reach surrounding v8::TryCatch handler (see
+        http://code.google.com/p/v8/issues/detail?id=1072 and
+        http://codereview.chromium.org/6397011/).  Therefore the goal of this patch
+        is to make forthcoming v8 roll as smooth as possible (alas, we'll still need
+        one rebaseline as of now.)
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::runScript): Do not rely on empty handle as a signal of exception, wrap into v8::TryCatch instead
+        * bindings/v8/V8WindowErrorHandler.cpp:
+        (WebCore::V8WindowErrorHandler::callListenerFunction): Ditto
+
+2011-02-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        WebKit2: Need WebKit2 equivalent of WebResourceLoadDelegate::willSendRequest in the Bundle
+        https://bugs.webkit.org/show_bug.cgi?id=52897
+        <rdar://problem/8898294>
+
+        * WebCore.exp.in: Add export now needed by WebKit2
+
+2011-02-03  Victoria Kirst  <vrk@google.com>
+
+        Reviewed by James Robinson.
+
+        Replaces float literals with uniform values in shader code
+        so that buggy drivers unable to parse float values in different
+        locales will not produce a pink video.
+
+        [chromium] Fix pink video bug with gpu-acceleration enabled
+        https://bugs.webkit.org/show_bug.cgi?id=53568
+
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::SharedValues::SharedValues):
+        (WebCore::VideoLayerChromium::drawYUV):
+        * platform/graphics/chromium/VideoLayerChromium.h:
+        (WebCore::VideoLayerChromium::SharedValues::signAdjLocation):
+
+2011-02-03  James Kozianski  <koz@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add navigator.registerProtocolHandler behind a flag.
+        https://bugs.webkit.org/show_bug.cgi?id=52609
+
+        This method is described in the HTML5 specification here,
+        http://dev.w3.org/html5/spec/Overview.html#dom-navigator-registerprotocolhandler
+
+        This change is largely cribbed from B. Green's 29651 patches. It is
+        behind a flag so as not to break JS feature detection.
+
+        New layout test fast/dom/registerProtocolHandler.html.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::registerProtocolHandler):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::registerProtocolHandler):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * page/Navigator.cpp:
+        (WebCore::verifyCustomHandlerURL):
+        (WebCore::verifyProtocolHandlerScheme):
+        (WebCore::Navigator::registerProtocolHandler):
+        * page/Navigator.h:
+        * page/Navigator.idl:
+
+2011-02-03  Brian Ryner  <bryner@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Add a field to the ResourceResponse for tracking the socket address
+        of the host that the resource was fetched from.  Patch was originally
+        by Paul Marks.
+        https://bugs.webkit.org/show_bug.cgi?id=53699
+
+        * platform/network/chromium/ResourceResponse.cpp:
+        (WebCore::ResourceResponse::doPlatformCopyData):
+        (WebCore::ResourceResponse::doPlatformAdopt):
+        * platform/network/chromium/ResourceResponse.h:
+        (WebCore::ResourceResponse::socketAddress):
+        (WebCore::ResourceResponse::setSocketAddress):
+
+2011-02-03  Adam Langley  <agl@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Plumb mixed script URL to FrameLoaderClient
+        https://bugs.webkit.org/show_bug.cgi?id=52384
+
+        Regressions covered by http/tests/security/mixedContent/*
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::didRunInsecureContent):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkIfRunInsecureContent):
+        * loader/FrameLoaderClient.h:
+
+2011-02-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION: Artifacts on box-shadow corners in some cases
+        https://bugs.webkit.org/show_bug.cgi?id=53731
+
+        Fix overdrawing artifacts in ShadowBlur's tiling code path,
+        which show up in shadows using a color with alpha.
+        
+        Test: fast/box-shadow/shadow-tiling-artifact.html
+
+        * platform/graphics/ShadowBlur.cpp:
+        (WebCore::ShadowBlur::drawRectShadowWithTiling): Ensure
+        that the inner rect that gets filled does not overlap with any
+        of the eight tiled areas by having the corner and side dimensions
+        be the same for contiguous areas.
+
+2011-02-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        XSS Auditor is spinning inside decodeURLEscapeSequences() if there are
+        percent signs in large posted data
+        https://bugs.webkit.org/show_bug.cgi?id=53405
+
+        If the input string contains many non-% characters followed by a %
+        character that is not a valid URL escape sequence, then the old
+        algorithm would only advance the initial search by one character
+        (instead of jumping to just after the % character).  That would cause
+        the algorithm to take N^2 time (in the number of characters before the
+        first % character).  This patch just advances the search past the first
+        % character so we can start looking for next % character sooner.
+
+        * platform/KURL.cpp:
+        (WebCore::decodeURLEscapeSequences):
+
+2011-02-03  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: click on a breakpoint highlights wrong line in source frame.
+        https://bugs.webkit.org/show_bug.cgi?id=53692
+
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._setupBreakpointElement):
+
+2011-02-03  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [v8] Bail out if to string conversion returned empty handle
+        https://bugs.webkit.org/show_bug.cgi?id=53687
+
+        This a temporary measure: actually one probably should never get empty handle
+        if there was no exception.  The root cause is under investigation.
+        The bailout though allows Chromium not to crash---attempt to convert an empty
+        v8 hande into WebCore string crashes with invalid memory access.
+
+        See http://code.google.com/p/chromium/issues/detail?id=71544
+
+        There is no known reduction expressible as a layout test so far.  The crash found with automated testing tools.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8NonStringValueToWebCoreString): Bail out on empty handle
+        * bindings/v8/V8Binding.h:
+        (WebCore::V8ParameterBase::prepareBase): Ditto
+
+2011-02-03  Adam Barth  <abarth@webkit.org>
+
+        Attempt to fix Chromium build.
+
+        * html/parser/XSSFilter.cpp:
+
+2011-02-03  Dirk Pranke  <dpranke@chromium.org>
+
+        Unreviewed, rolling out r77562.
+        http://trac.webkit.org/changeset/77562
+        https://bugs.webkit.org/show_bug.cgi?id=53630
+
+        broke chromium mac build
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gyp/mac/check_objc_rename.sh: Removed.
+
+2011-02-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Daniel Bates.
+
+        XSS Auditor severely affects loading performance after submitting a large form
+        https://bugs.webkit.org/show_bug.cgi?id=49845
+
+        Switch over from the XSSAuditor to the XSSFilter, improving performance
+        on this example.
+
+        * html/parser/XSSFilter.cpp:
+        (WebCore::XSSFilter::filterToken):
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::isEnabled):
+
+2011-02-03  Dirk Pranke  <dpranke@chromium.org>
+
+        Unreviewed, rolling out r77567.
+        http://trac.webkit.org/changeset/77567
+        https://bugs.webkit.org/show_bug.cgi?id=53468
+
+        broke chromium linux svg, canvas tests, possibly win also?
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+
+2011-02-02  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Refactoring: <progress> should not use ShadowElement
+        https://bugs.webkit.org/show_bug.cgi?id=53583
+
+        - Introduced RenderIndicatorPart and RenderProgressBarValuePart
+          to be responsible for bar-part layout,
+          which adopted layout logic from ShadowBlockElement.
+        - ProgressBarValueElement is no longer a subclass of ShadowBlockElement.
+        - Remove dependency from RenderProgress to HTMLProgressElement and
+          ShadowBlockElement.
+        - The shadow tree is no longer removed on detach(). It becomes persistent.
+          This is now possible because the ShadowBlockElement dependency is gone.
+        - ::-webkit-appearance for -webkit-progress-bar-value is no longer referred.
+          That didn't make sense.
+
+        * html/HTMLProgressElement.cpp:
+        (WebCore::HTMLProgressElement::createShadowSubtreeIfNeeded):
+        * html/HTMLProgressElement.h:
+        * html/shadow/ProgressBarValueElement.h: Added.
+        (WebCore::ProgressBarValueElement::ProgressBarValueElement):
+        (WebCore::ProgressBarValueElement::shadowPseudoId):
+        (WebCore::ProgressBarValueElement::createRenderer):
+        (WebCore::ProgressBarValueElement::create):
+        * rendering/RenderIndicator.cpp:
+        (WebCore::RenderIndicatorPart::RenderIndicatorPart):
+        (WebCore::RenderIndicatorPart::~RenderIndicatorPart):
+        (WebCore::RenderIndicatorPart::layout):
+        (WebCore::RenderIndicatorPart::styleDidChange):
+        * rendering/RenderIndicator.h: Added RenderIndicatorPart class
+        (WebCore::RenderIndicatorPart::originalVisibility):
+        (WebCore::RenderIndicatorPart::requiresForcedStyleRecalcPropagation):
+        (WebCore::RenderIndicatorPart::canHaveChildren):
+        * rendering/RenderProgress.cpp:
+        (WebCore::RenderProgressBarValuePart::preferredFrameRect):
+        (WebCore::RenderProgressBarValuePart::shouldBeHidden):
+        (WebCore::RenderProgress::updateFromElement):
+        (WebCore::RenderProgress::layoutParts):
+        (WebCore::RenderProgress::shouldHaveParts):
+        * rendering/RenderProgress.h:
+        (WebCore::RenderProgressBarValuePart::RenderProgressBarValuePart):
+
+2011-02-03  Jia Pu  <jpu@apple.com>
+
+        Reversion should not be marked as misspelled.
+        https://bugs.webkit.org/show_bug.cgi?id=53255
+
+        This patch includes fix for reported bug, and also some housekeeping changes.
+
+        To implement desired behavior, we need:
+        1. Add a new marker type, SpellCheckingExemption, since now we distingusish between text
+           that shouldn't be spellchecked and text shouldn't be autocorrected.
+        2. Make sure that there is no pending correction panel when we enter markAllMisspellingsAndBadGrammarInRanges().
+           Otherwise the spell checking code in that function may interfere with autocorrection. This
+           is achieved by explicitly applying pending correction when user types space, line break or
+           paragraph break.
+
+        Housekeeping code changes include:
+        1. Change manual-tests that were broken by relocated WebCore directory.
+        2. Use TextIterator in various DocumentMarkerController functions instead of using
+           Node::traverseNextNode() directly.
+        3. Allow passing multiple marker types into DocumentMarkerController::removeMarkers() and
+           DocumentMarkerController::hasMarkers() to improve clarity and efficiency.
+        4. Fixes of minor bugs that were exposed previously.
+
+        * WebCore.exp.in: Change signature of DocumentMarkerController::removeMarkers().
+
+        * dom/DocumentMarker.h: Added new marker type SpellCheckingExemption.
+
+        * dom/DocumentMarkerController.cpp:
+        (WebCore::DocumentMarkerController::removeMarkers): Use TextIterator to scan the range to be
+           consistent with addMarker() function. Allow passing in multiple marker types in one call.
+           Added a boolean argument to specify the behavior when removing markers that partially
+           overlap the specified range.
+        (WebCore::DocumentMarkerController::removeMarkersFromMarkerMapVectorPair): Allow passing in
+           multiple marker types in one call.
+        (WebCore::DocumentMarkerController::hasMarkers): Use TextIterator to scan the range to be
+           consistent with addMarker() function. Allow passing in multiple marker types in one call.
+
+        * dom/DocumentMarkerController.h: Allow passing in multiple marker types to removeMarkers()
+           and hasMarkers(). Added a boolean argument to removeMarkers() to specify the behavior when
+           removing markers that partially overlap the specified range.
+
+        * editing/Editor.cpp:
+        (WebCore::markerTypesForAutocorrection): Add SpellCheckingExemption marker when apply correction.
+        (WebCore::markerTypesForReplacement): Ditto.
+        (WebCore::Editor::respondToChangedSelection): Reordered call to dismissCorrectionPanel() and
+           setSelection() to make sure there is no pending correction when entering
+           markAllMisspellingsAndBadGrammarInRanges().
+        (WebCore::Editor::appliedEditing): Only remove CorrectionIndicator markers when the command
+           is a top level command to improve efficiency.
+        (WebCore::Editor::insertTextWithoutSendingTextEvent): Added code to applying pending correction.
+        (WebCore::Editor::insertLineBreak): Ditto.
+        (WebCore::Editor::insertParagraphSeparator): Ditto.
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges): Don't mark mispelling if the
+           text carries SpellCheckingExemption marker.
+        (WebCore::Editor::correctionPanelTimerFired): Reset correction panel if the returned suggestion
+           from spellchecker is an empty string.
+        (WebCore::Editor::removeSpellAndCorrectionMarkersFromWordsToBeEdited):
+           Use new DocumentMarkerController::removeMarkers() to replace custom implemenation to improve
+           efficiency and readability.
+        (WebCore::Editor::applyCorrectionPanelInfo): Remove the code that set caret position after
+           applying correction, since it's unnecessary. Also, store pre-correction string together with
+           the marker for reversion panel to use.
+        (WebCore::Editor::applyAutocorrectionBeforeTypingIfAppropriate): Apply pending correction.
+        (WebCore::Editor::changeSelectionAfterCommand): Moved marker removal code to Editor::appliedEditing()
+           where we have access to EditCommand object.
+
+        * editing/Editor.h: Added new function applyAutocorrectionAfterTypingIfAppropriate().
+
+        * manual-tests/autocorrection/autocorrection-cancelled-by-ESC.html: Change manual-tests that
+           were broken by relocated WebCore directory.
+
+        * manual-tests/autocorrection/autocorrection-cancelled-by-typing-1.html: Ditto.
+
+        * manual-tests/autocorrection/autocorrection-contraction.html: Ditto.
+
+        * manual-tests/autocorrection/continue-typing-to-dismiss-reversion.html: Ditto.
+
+        * manual-tests/autocorrection/delete-to-dismiss-reversion.html: Ditto.
+
+        * manual-tests/autocorrection/delete-to-end-of-word-to-show-reversion.html: Ditto.
+
+        * manual-tests/autocorrection/dismiss-multiple-guesses.html: Ditto.
+
+        * manual-tests/autocorrection/move-to-end-of-word-to-show-reversion.html: Ditto.
+
+        * manual-tests/autocorrection/select-from-multiple-guesses.html: Ditto.
+
+        * manual-tests/autocorrection/spell-checking-after-reversion.html: Added.
+
+        * manual-tests/autocorrection/type-whitespace-to-dismiss-reversion.html: Change manual-tests that
+           were broken by relocated WebCore directory.
+
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintDocumentMarkers): Code clean-up to be more concise.
+
+2011-02-03  Abhishek Arya  <inferno@chromium.org>
+
+        Unreviewed, qt build fix.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeFloatingObject):
+
+2011-02-03  Brian Salomon  <bsalomon@google.com>
+
+        Reviewed by James Robinson.
+
+        Handle non-raster backed images in getUnmultipliedImageData()
+        https://bugs.webkit.org/show_bug.cgi?id=53468
+
+        No new tests. Existing canvas tests sufficient
+        LayoutTests/canvas/philip/...
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+
+2011-02-03  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Enforce more limits on root inline boxes height calculations.
+        https://bugs.webkit.org/show_bug.cgi?id=53729
+
+        Test: fast/overflow/overflow-height-float-not-removed-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeFloatingObject): prevent logicalBottom to
+        become negative when logicalTop is INT_MAX.
+        (WebCore::RenderBlock::markLinesDirtyInBlockRange): when logicalBottom
+        is INT_MAX, we should dirty everything. So, we bail out to make
+        afterLowest equal to the lastRootBox() or lowestDirstLine.
+
+2011-02-03  David Levin  <levin@chromium.org>
+
+        Reviewed by Adam Barth and Oliver Hunt.
+
+        Worker.importScript() should clean errors for cross origin imports.
+        https://bugs.webkit.org/show_bug.cgi?id=52871
+
+        Test: http/tests/workers/worker-importScriptsOnError.html
+
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate): Use sanitizeScriptError
+        to determine when to create a clean exception.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::evaluate): Ditto.
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::sanitizeScriptError): Figure out
+        if the error needs to be cleaned up.
+        (WebCore::ScriptExecutionContext::dispatchErrorEvent): Extracted
+        sanitizeScriptError for use by other places.
+        * dom/ScriptExecutionContext.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts): Use the reponse url when
+        telling the evaluate where the script came fro.
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::WorkerScriptLoader::responseURL): Expose the url that
+        the script was loaded from (which may be different from url() due
+        to redirects).
+        (WebCore::WorkerScriptLoader::didReceiveResponse): Capture the reponse url.
+        * workers/WorkerScriptLoader.h:
+
+2011-02-03  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium GYP build fix.
+
+        When various settings were moved to webcore_prerequisites in r66364,
+        things that should have been direct_dependent_settings were not marked
+        as such. GYP 'defines', for example, make no sense on a 'none'-type
+        target such as webcore_prerequisites. It appears that it was intended
+        for these settings to be pushed to direct dependents, which would make
+        direct_dependent_settings correct.
+
+        Losing the ChromiumWebCoreObjC defines on the Mac, for example, caused
+        http://crbug.com/71537, which at best causes Mac console log spew, and
+        at worst may result in Chromium's copy of WebCore using system
+        definitions of certain Objective-C classes at runtime, or vice-versa.
+
+        The build now includes a postbuild step to prevent
+        http://crbug.com/71537 from regressing again. The build will fail upon
+        regression.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53630
+
+        * WebCore.gyp/WebCore.gyp: Move things in webcore_prerequisites into
+          direct_dependent_settings as needed, add the check_objc_rename
+          postbuild step.
+        * WebCore.gyp/mac/check_objc_rename.sh: Added.
+
+2011-02-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Make XSSFilter go fast by adding a SuffixTree
+        https://bugs.webkit.org/show_bug.cgi?id=53665
+
+        The SuffixTree lets us quickly reject snippets if the POST data is
+        large (because we can avoid a linear scan over the POST data).
+
+        * html/parser/XSSFilter.cpp:
+        (WebCore::XSSFilter::init):
+        (WebCore::XSSFilter::isContainedInRequest):
+        * html/parser/XSSFilter.h:
+
+2011-02-03  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        REGRESSION (r77355): Page cache layout tests crash
+        https://bugs.webkit.org/show_bug.cgi?id=53648
+
+        Test: fast/events/pagehide-timeout.html
+        
+        Suspend active DOM objects after all pagehide event handlers have run,
+        otherwise it's possible for them to create more objects that weren't
+        getting suspended.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame):
+
+2011-02-03  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        SerializedScriptValue should not require v8 to create undefined and null values
+        https://bugs.webkit.org/show_bug.cgi?id=53730
+
+        Instead of creating a v8 type and passing that into the constructor, just use
+        the writer class directly. While I was at it, I cleaned up the code a bit too
+        by getting rid of the WireData/StringValue enum as I found that personally
+        confusing.
+
+        This is necessary because these methods are called by IndexedDB in the browser
+        process where v8 is not spun up.
+
+        No functionality changed and not possible to test.
+
+        * bindings/v8/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValue::createFromWire):
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::nullValue):
+        (WebCore::SerializedScriptValue::undefinedValue):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        * bindings/v8/SerializedScriptValue.h:
+
+2011-02-03  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for <rdar://problem/8944544> Ability to animate track
+        for WKPainter scrollers
+
+        Two new WebKitSystemInterface functions.
+        * WebCore.exp.in:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+        Use Scrollbar::convertFromContainingView() to return the right point.
+        * platform/mac/ScrollAnimatorMac.mm:
+        (-[ScrollbarPainterControllerDelegate scrollerImpPair:convertContentPoint:toScrollerImp:]):
+        
+        ScrollKnobAnimation is now ScrollbarPartAnimation. It can
+        now be used to animate the knob or the track.
+        (-[ScrollbarPartAnimation initWithScrollbarPainter:part:WebCore::scrollAnimator:WebCore::animateAlphaTo:duration:]):
+        (-[ScrollbarPartAnimation setCurrentProgress:]):
+        (-[ScrollbarPainterDelegate setUpAnimation:scrollerPainter:part:WebCore::animateAlphaTo:duration:]):
+        (-[ScrollbarPainterDelegate scrollerImp:animateKnobAlphaTo:duration:]):
+        (-[ScrollbarPainterDelegate scrollerImp:animateTrackAlphaTo:duration:]):
+
+        Scrollbars need invalodating after the overlay state changes. 
+        (-[ScrollbarPainterDelegate scrollerImp:overlayScrollerStateChangedTo:]):
+
+2011-02-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Scroll thumb jumps to top when resizing horizontally.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars): Add call to update
+        the scrollbar's offset in the case where we may have created
+        a new scrollbar but have not changed the current position.
+
+2011-02-03  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by Dirk Schulze.
+
+        startAnimations should use a local, RefCounted Vector.
+        https://bugs.webkit.org/show_bug.cgi?id=53458
+
+        Test: svg/custom/use-animation-in-fill.html
+
+        * svg/SVGDocumentExtensions.cpp:
+        (WebCore::SVGDocumentExtensions::startAnimations):
+
+2011-02-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Daniel Bates.
+
+        XSSFilter shouldn't bother to analyze pages without "injection"
+        characters in the request
+        https://bugs.webkit.org/show_bug.cgi?id=53664
+
+        If the request lacks these "injection" characters, then it's unlikely
+        that there's a reflective XSS attack happening.  This hueristic lets us
+        avoid analyzing the vast majority of responses for XSS.  Of course, the
+        hueristic isn't perfect.  Because of this huerstic, we miss out on
+        injections into unquoted attributes.  However, it's a trade-off that's
+        worked well in the XSSAuditor.
+
+        * html/parser/XSSFilter.cpp:
+        (WebCore::HTMLNames::isRequiredForInjection):
+        (WebCore::XSSFilter::XSSFilter):
+        (WebCore::XSSFilter::init):
+        (WebCore::XSSFilter::filterToken):
+        (WebCore::XSSFilter::isContainedInRequest):
+        * html/parser/XSSFilter.h:
+
+2011-02-03  Vangelis Kokkevis  <vangelis@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Fixing a compositor crash occurring on layers
+        without an associated RenderSurface.
+        https://bugs.webkit.org/show_bug.cgi?id=53679
+        Regression was introduced by in r77425 
+
+        Test: http://webkit.org/blog/386/3d-transforms/ doesn't crash
+        anymore.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawLayer):
+
+2011-02-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        <rdar://problem/8948788> Text emphasis marks have wrong orientation for vertical text
+        https://bugs.webkit.org/show_bug.cgi?id=53709
+
+        Covered by rendering of fast/text/emphasis-vertical.html
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::scaledFontData): Give the scaled font the same orientation this font
+        has.
+
+2011-02-02  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Moving cursor down in table cycles at the end of a row
+        https://bugs.webkit.org/show_bug.cgi?id=50012
+
+        Avoids a caret cycling issue with certain content (e.g. tables) found at the very
+        end of a document due to a bug in nextLeafWithSameEditability.
+
+        Test: editing/selection/move-by-line-cycles-in-table.html
+
+        * editing/visible_units.cpp:
+        (WebCore::nextLeafWithSameEditability): Properly avoid descending back into the
+        original leaf node.
+
+2011-02-03  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: remove dead code related to changes panel.
+        https://bugs.webkit.org/show_bug.cgi?id=53688
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ChangesView.js: Removed.
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        (#error-warning-count):
+        (#error-warning-count:hover):
+        (#error-count + #warning-count):
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+
+2011-02-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add notification of the end of a rubber band.
+        <rdar://problem/8940648>
+
+        * WebCore.exp.in:
+        Add additional exprots.
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::didCompleteRubberBandForMainFrame):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::didCompleteRubberBand):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::didCompleteRubberBand):
+        * platform/ScrollView.h:
+        Add hook.
+
+        * platform/ScrollableArea.h:
+        (WebCore::ScrollableArea::inLiveResize):
+        (WebCore::ScrollableArea::maximumScrollPosition):
+        (WebCore::ScrollableArea::visibleWidth):
+        (WebCore::ScrollableArea::overhangAmount):
+        (WebCore::ScrollableArea::didCompleteRubberBand):
+        Reorganize and de-virtualize live resize notifications.
+
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::snapRubberBandTimerFired):
+        Call the new hook when the rubberband ends.
+
+2011-02-02  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] complex joining characters positioned in wrong place
+        https://bugs.webkit.org/show_bug.cgi?id=53637
+
+        Provide the correct font metrics to Harfbuzz related to the font design space.
+        There are used in some fonts for GPOS positioning.
+
+        Test: platform/chromium-linux/fast/text/international/complex-joining-using-gpos.html
+
+        * platform/graphics/chromium/ComplexTextControllerLinux.cpp:
+        (WebCore::ComplexTextController::setupFontForScriptRun):
+        (WebCore::ComplexTextController::allocHarfbuzzFont):
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::emSizeInFontUnits):
+        (WebCore::FontPlatformData::operator=):
+        * platform/graphics/chromium/FontPlatformDataLinux.h:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2011-02-02  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        REGRESSION(r76147): Slider thumb position is not updated when value attribute is changed.
+        https://bugs.webkit.org/show_bug.cgi?id=53634
+
+        Test: fast/dom/HTMLInputElement/input-slider-update.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setValue): Added a call to InputType::valueChanged.
+        * html/InputType.cpp:
+        (WebCore::InputType::valueChanged): Added empty implementation.
+        * html/InputType.h: Added def.
+        * html/RangeInputType.cpp:
+        (WebCore::RangeInputType::valueChanged): Added implementation that dirties layout
+            bit on the thumb.
+        * html/RangeInputType.h: Added def.
+
+2011-02-02  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: do not share source frames between resources panel and scripts panel.
+        https://bugs.webkit.org/show_bug.cgi?id=53584
+
+        Currently, we show error messages only for resources. This change will allow showing error
+        messages in source frame even when resource is not available (eval scripts, inlined scripts).
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.addMessage):
+        (WebInspector.ConsoleView.prototype.clearMessages):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.recreateResourceView):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.FrameResourceTreeElement.prototype._setBubbleText):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._scriptSourceChanged):
+        (WebInspector.ScriptsPanel.prototype.addConsoleMessage):
+        (WebInspector.ScriptsPanel.prototype.clearConsoleMessages):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype._sourceFrameForScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._sourceFrameForResource):
+        (WebInspector.ScriptsPanel.prototype._sourceFrameForScript):
+
+2011-02-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix 32-bit builds.
+
+        * platform/graphics/ShadowBlur.cpp:
+        (WebCore::ShadowBlur::blurLayerImage):
+
+2011-02-03  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Add reporting of JS heap size limit to 'console.memory'.
+        https://bugs.webkit.org/show_bug.cgi?id=53592
+
+        In JSC there is no limit, thus 'undefined' value is returned.
+        For V8, the limit reported by the VM is returned.
+
+        * Android.jscbindings.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSMemoryInfoCustom.cpp: Added.
+        * bindings/js/ScriptGCEvent.cpp:
+        (WebCore::ScriptGCEvent::getHeapSize):
+        * bindings/js/ScriptGCEvent.h:
+        * bindings/v8/ScriptGCEvent.cpp:
+        (WebCore::ScriptGCEvent::getHeapSize):
+        * bindings/v8/ScriptGCEvent.h:
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::setHeapSizeStatistic):
+        * page/MemoryInfo.cpp:
+        (WebCore::MemoryInfo::MemoryInfo):
+        * page/MemoryInfo.h:
+        (WebCore::MemoryInfo::jsHeapSizeLimit):
+        * page/MemoryInfo.idl:
+
+2011-01-27  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] LayoutTests/media/audio-mpeg4-supported.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=53125
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache): Add audio/x-m4a mimetype in the cache.
+
+2011-02-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        ShadowBlur radius for CSS shadows is slightly too big
+        https://bugs.webkit.org/show_bug.cgi?id=53660
+        
+        If we follow SVG gaussian blur for CSS shadows, we can end up rendering
+        shadows that extend further than the CSS "blur radius", which results
+        in the shadows being truncated.
+        
+        Fix with a small fudge factor to reduce the kernel diameter slightly
+        for CSS shadows.
+        
+        Also more closely follow the algorithm described in the SVG spec
+        for computing the kernel size for different diameters, and clean up
+        some variable naming relating to the shadow bounds.
+
+        * platform/graphics/ShadowBlur.cpp:
+        (WebCore::ShadowBlur::blurLayerImage):
+        (WebCore::ShadowBlur::drawRectShadowWithTiling):
+
+2011-02-01  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: introduce new api for managing JavaScript breakpoints.
+        https://bugs.webkit.org/show_bug.cgi?id=53235
+
+        Single protocol breakpoint (e.g. set by url) is mapped on zero or more VM breakpoints (set by sourceID).
+        removeJavaScriptBreakpoint(breakpointId) removes breakpoint and all linked VM breakpoints.
+        Since UI uses VM breakpoint location rather then protocol breakpoint location, all resolved breakpoints locations are passed to frontend.
+
+        SourceFrame is now aware of whether breakpoint is resolved or not and may display it accordingly.
+        JavaScriptBreakpointsSidebarPane filters out breakpoints set on nonexistent scripts to avoid UI cluttering.
+
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::setBreakpoint):
+        (WebCore::ScriptDebugServer::removeBreakpoint):
+        * bindings/js/ScriptDebugServer.h:
+        * bindings/v8/DebuggerScript.js:
+        ():
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::setBreakpoint):
+        * bindings/v8/ScriptDebugServer.h:
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp: clear breakpoints from inspector state when new frontend is created
+        (WebCore::InspectorAgent::restoreInspectorStateFromCookie):
+        (WebCore::InspectorAgent::populateScriptObjects):
+        (WebCore::InspectorAgent::restoreDebugger):
+        (WebCore::InspectorAgent::showAndEnableDebugger):
+        (WebCore::InspectorAgent::enableDebugger):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorDebuggerAgent.cpp: manage relations between protocol breakpoints and VM breakpoints
+        (WebCore::InspectorDebuggerAgent::InspectorDebuggerAgent):
+        (WebCore::InspectorDebuggerAgent::inspectedURLChanged):
+        (WebCore::InspectorDebuggerAgent::setJavaScriptBreakpoint):
+        (WebCore::InspectorDebuggerAgent::setJavaScriptBreakpointBySourceId):
+        (WebCore::InspectorDebuggerAgent::removeJavaScriptBreakpoint):
+        (WebCore::InspectorDebuggerAgent::continueToLocation):
+        (WebCore::InspectorDebuggerAgent::resolveBreakpoint):
+        (WebCore::InspectorDebuggerAgent::getScriptSource):
+        (WebCore::InspectorDebuggerAgent::didParseSource):
+        (WebCore::InspectorDebuggerAgent::didPause):
+        * inspector/InspectorDebuggerAgent.h:
+        (WebCore::InspectorDebuggerAgent::Script::Script):
+        * inspector/InspectorValues.cpp:
+        (WebCore::InspectorValue::asNumber):
+        (WebCore::InspectorBasicValue::asNumber):
+        (WebCore::InspectorObject::remove):
+        * inspector/InspectorValues.h:
+        (WebCore::InspectorObject::getNumber):
+        (WebCore::InspectorObject::find):
+        * inspector/ScriptBreakpoint.h:
+        (WebCore::ScriptBreakpoint::ScriptBreakpoint):
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint):
+        (WebInspector.Breakpoint.prototype.addLocation):
+        * inspector/front-end/BreakpointManager.js: remove all stuff related to JavaScript breakpoints from here
+        (WebInspector.BreakpointManager):
+        (WebInspector.BreakpointManager.prototype._projectChanged):
+        (WebInspector.BreakpointManager.prototype._saveBreakpoints):
+        (WebInspector.BreakpointManager.prototype._validateBreakpoints):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.JavaScriptBreakpointsSidebarPane): filter breakpoints set on nonexistent scripts to avoid ui cluttering
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel): pull all JavaScript from localStorage and push them to fronted when debugger is enabled, save resolved breakpoints data
+        * inspector/front-end/Script.js:
+        (WebInspector.Script.prototype.sourceLine):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._toggleDebugging):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+        * inspector/front-end/SourceFrame.js: handle resolved and unresolved breakpoints differently
+        * inspector/front-end/inspector.js:
+
+2011-02-03  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        small text which is scaled to be large renders pixelated
+        https://bugs.webkit.org/show_bug.cgi?id=12448
+
+        SVG <text> with font-size smaller or equal to 1 does not paint correctly
+        https://bugs.webkit.org/show_bug.cgi?id=14242
+
+        misplaced text in SVG
+        https://bugs.webkit.org/show_bug.cgi?id=17053
+
+        Don't render very small (but zoomed) text inside SVG
+        https://bugs.webkit.org/show_bug.cgi?id=19393
+
+        Tiny fonts scaled up end up too large in Safari
+        https://bugs.webkit.org/show_bug.cgi?id=20192
+
+        Stretched SVG Text has awful glyph spacing 
+        https://bugs.webkit.org/show_bug.cgi?id=21774
+
+        REGRESSION (r72141?): svg/batik/text/smallFonts.svg failing on Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=49846
+
+        [Gtk] Text height in zoomed SVG is 1px too high
+        https://bugs.webkit.org/show_bug.cgi?id=50313
+
+        SVG text smaller than 0.5px not displayed properly
+        https://bugs.webkit.org/show_bug.cgi?id=50528
+
+        When rendering text, we're selecting a font with a size, as specified in the markup.
+        This can lead to problems, if the context, where the text is rendered upon, is scaled. If a parent
+        element of the <text> defines a transform=".." or the outermost <svg> containing a viewBox the
+        problem becomes apparent.
+
+        Consider following two snippets, which should render exactly the same:
+        <svg viewBox="0 0 100 100"><text x="25" y="50" font-size="25">test</text></svg>
+        <svg viewBox="0 0 1 1"><text x="0.25" y="0.5" font-size="0.25">test</text></svg>
+
+        When selecting a font size below 0.5, FontCacheMac would request a font with size 0,
+        which AppKit turns into 12. This lead to huge text rendering, instead of small text on Mac.
+        Other platforms have different problems (Qt simply scales the font, leading to pixelation etc.)
+
+        To fix this in a cross-platform fashion, we now always compute the final font size on screen,
+        remove any scaling from the context, draw the text using the scaled font size, then reapply
+        the context scale. This makes the example snippets above render exactly the same and fixes
+        numerous of bugs, present since years. As we're now heavily using floating-point font sizes
+        internally, depending on the scale of the document, it's very important to use the new
+        floating-point text metrics information (floatAscent/floatDescent/floatHeight) everywhere in SVG.
+
+        Fixes existing tests: css3/zoom-coords.xhtml (cross-platform inconsistencies should be gone, mac now reports floatHeight values for SVG text height)
+                              svg/hixie/text/003.html (no more pixelation)
+                              svg/batik/text/smallFonts.svg (small fonts aren't rendered huge anymore on mac)
+                              svg/hixie/viewbox/preserveAspectRatio/001.xml (bug 21774, no more awful spacing)
+                              svg/zoom/page/zoom-zoom-coords.xhtml (cross-platform inconsistencies should be gone, inspired by bug 50313)
+
+        Tests: svg/text/font-size-below-point-five-2.svg (reduction from bug 50528)
+               svg/text/font-size-below-point-five.svg (reduction from bug 50528)
+               svg/text/scaled-font.svg (reduction from bug 12448)
+               svg/text/small-fonts-2.svg (reduction from bug 14242)
+               svg/text/small-fonts-3.svg (reduction from bug 17053)
+               svg/text/small-fonts-in-html5.html (reduction from bug 19393)
+               svg/text/small-fonts.svg (reduction from bug 20192))
+
+        * rendering/svg/RenderSVGInlineText.cpp: Cache 'float scalingFactor' & 'Font scaledFont', whenever the on-screen representation changes.
+        * rendering/svg/RenderSVGInlineText.h:
+        * rendering/svg/RenderSVGText.cpp: Update scalingFactor/scaledFont, if necessary.
+        * rendering/svg/SVGInlineTextBox.cpp: Switch to new font rendering strategy. Always use scaledFont, and remove any context scale before drawing.
+        * rendering/svg/SVGInlineTextBox.h:
+        * rendering/svg/SVGTextLayoutEngineBaseline.cpp: Use floating-point metrics everywhere.
+        * rendering/svg/SVGTextMetrics.cpp: Ditto.
+        * rendering/svg/SVGTextMetrics.h: Ditto.
+        * rendering/svg/SVGTextQuery.cpp: Ditto.
+        * svg/SVGFont.cpp: Adjust stroke thickness, when drawing SVGFonts into a normalized context (no more scale).
+        * svg/SVGTextContentElement.cpp: Make <text> elements always dependant on window size changes in combination with viewBox set.
+        * svg/SVGTextPositioningElement.cpp: Remove now unnecessary code to determine wheter relative lengths are used as text attributes.
+        * svg/SVGTextPositioningElement.h: 
+
+2011-02-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: resources panel doesn't show frames after reload.
+        https://bugs.webkit.org/show_bug.cgi?id=53430
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.show):
+        (WebInspector.ResourcesPanel.prototype.loadEventFired):
+        (WebInspector.ResourcesPanel.prototype._initDefaultSelection):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype.clear):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loadEventFired):
+
+2011-02-01  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Remove the *2 suffix from the CSS style-related protocol methods
+        https://bugs.webkit.org/show_bug.cgi?id=53492
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getStylesForNode):
+        (WebCore::InspectorCSSAgent::getInlineStyleForNode):
+        (WebCore::InspectorCSSAgent::getComputedStyleForNode):
+        (WebCore::InspectorCSSAgent::getAllStyles):
+        (WebCore::InspectorCSSAgent::getStyleSheet):
+        (WebCore::InspectorCSSAgent::getStyleSheetText):
+        (WebCore::InspectorCSSAgent::setStyleSheetText):
+        (WebCore::InspectorCSSAgent::setPropertyText):
+        (WebCore::InspectorCSSAgent::toggleProperty):
+        (WebCore::InspectorCSSAgent::setRuleSelector):
+        (WebCore::InspectorCSSAgent::addRule):
+        * inspector/InspectorCSSAgent.h:
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype.getStylesAsync):
+        (WebInspector.CSSStyleModel.prototype.getComputedStyleAsync):
+        (WebInspector.CSSStyleModel.prototype.getInlineStyleAsync):
+        (WebInspector.CSSStyleModel.prototype.setRuleSelector):
+        (WebInspector.CSSStyleModel.prototype.addRule):
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged):
+        (WebInspector.CSSStyleModel.prototype._onRevert):
+        (WebInspector.CSSStyleDeclaration.prototype.insertPropertyAt):
+        (WebInspector.CSSProperty.prototype.setText):
+        (WebInspector.CSSProperty.prototype.setDisabled):
+        (WebInspector.CSSStyleSheet.createForId):
+        (WebInspector.CSSStyleSheet.prototype.setText):
+
+2011-02-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Daniel Bates.
+
+        Teach XSSFilter about data URLs
+        https://bugs.webkit.org/show_bug.cgi?id=53662
+
+        The XSS filter doesn't really make sense for data URLs because
+        everything in a "response" from a data URL was part of the request.
+
+        Test: http/tests/security/xssAuditor/data-urls-work.html
+
+        * html/parser/XSSFilter.cpp:
+        (WebCore::XSSFilter::init):
+        (WebCore::XSSFilter::filterToken):
+
+2011-02-02  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        window.find() can fail when switching case sensitivity
+        https://bugs.webkit.org/show_bug.cgi?id=53654
+
+        Reset the pattern to a safe one when done, to avoid usearch_reset()
+        indirectly touching the old, stale text pointer.
+
+        Test: fast/text/find-window.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::SearchBuffer::~SearchBuffer): leave a safe pattern buffer when done.
+
+2011-02-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Daniel Bates.
+
+        Teach XSSFilter that <param> elements can contain URLs
+        https://bugs.webkit.org/show_bug.cgi?id=53652
+
+        When loading plugins for the <object> tag, we're "smart" enough to
+        reach into the <param> elements and pull out the URL in some cases.
+        This patch teaches the XSSFilter how to block injections into those
+        sorts of param elements.
+
+        Fixes:
+            http/tests/security/xssAuditor/object-*
+
+        * html/HTMLParamElement.cpp:
+        (WebCore::HTMLParamElement::isURLParameter):
+        (WebCore::HTMLParamElement::isURLAttribute):
+        (WebCore::HTMLParamElement::addSubresourceAttributeURLs):
+        * html/HTMLParamElement.h:
+            - Add a helper function so that HTMLParamElement can share the
+              ground truth for these names with the XSSFilter.
+        * html/parser/XSSFilter.cpp:
+        (WebCore::XSSFilter::filterTokenInitial):
+        (WebCore::XSSFilter::filterParamToken):
+        * html/parser/XSSFilter.h:
+
+2011-02-02  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by David Levin.
+
+        GCC compiler on ARM issues bogus warnings and fails to compile.
+        https://bugs.webkit.org/show_bug.cgi?id=53620
+
+        Despite warnings explicitly being disallowed (-Wno-uninitialized),
+        gcc (Ubuntu 4.4.3-4ubuntu5) 4.4.3 throws up the warnings like:
+
+        "error: 'colorTransparent.unstatic.4909' may be used uninitialized in this function"
+
+        The fix is to add an extra condition, which somehow pacifies the compiler.
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::createColor): Added workaround conditions.
+
+2011-02-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Daniel Bates.
+
+        Teach XSSFilter about X-XSS-Protection
+        https://bugs.webkit.org/show_bug.cgi?id=53640
+
+        This patch causes us to pass:
+            http/tests/security/xssAuditor/full-block-*
+            http/tests/security/xssAuditor/no-protection-script-tag.html
+
+        * html/parser/XSSFilter.cpp:
+        (WebCore::XSSFilter::XSSFilter):
+        (WebCore::XSSFilter::init):
+        (WebCore::XSSFilter::filterToken):
+        * html/parser/XSSFilter.h:
+
+2011-02-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Daniel Bates.
+
+        When XSSFilter blocks JavaScript URLs, use a safe JavaScript URL
+        instead of the empty string
+        https://bugs.webkit.org/show_bug.cgi?id=53643
+
+        In a URL context, the empty string completes to the URL of the current
+        page, which causes these tests to go into an infinite loop.  Instead,
+        we should use a "safe" JavaScript URL that does nothing.
+
+        Fixes:
+            http/tests/security/xssAuditor/javascript-link*
+
+        * html/parser/XSSFilter.cpp:
+        (WebCore::XSSFilter::eraseDangerousAttributesIfInjected):
+
+2011-02-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/8380506> REGRESSION (r61921): RTL text in <b> tag doesn't display in WebKit under certain conditions
+        https://bugs.webkit.org/show_bug.cgi?id=44942
+
+        Test: fast/text/bidi-embedding-pop-and-push-same-2.html
+
+        * platform/text/BidiResolver.h:
+        (WebCore::::commitExplicitEmbedding): Changed to return a boolean indicating whether there was
+        a change to embedding levels.
+        (WebCore::::createBidiRunsForLine): If embedding levels did not change as a result of committing
+        the explicit embedding sequence, then runs were not added, and we should continue normally.
+
+2011-02-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix miscalculation of the overhang area used for painting. We were
+        not correctly accounting for scrollbars resulting in an non-negative
+        overhang even when we weren't over the edge.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::calculateOverhangAreasForPainting):
+
+2011-02-02  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        IDBTransaction and IDBRequest can be deleted while ScriptExecutionContext is iterating....which is bad
+        https://bugs.webkit.org/show_bug.cgi?id=52722
+
+        The solution is to change ScriptExecutionContext's destructor to iterate over
+        the list in a way that handles the mutations. This new method is destructive,
+        but that's OK since the object is going away. I've also added a several asserts.
+
+        There should be no behavior change.
+
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::ScriptExecutionContext):
+        (WebCore::ScriptExecutionContext::~ScriptExecutionContext):
+        (WebCore::ScriptExecutionContext::canSuspendActiveDOMObjects):
+        (WebCore::ScriptExecutionContext::suspendActiveDOMObjects):
+        (WebCore::ScriptExecutionContext::resumeActiveDOMObjects):
+        (WebCore::ScriptExecutionContext::stopActiveDOMObjects):
+        (WebCore::ScriptExecutionContext::createdActiveDOMObject):
+        (WebCore::ScriptExecutionContext::destroyedActiveDOMObject):
+        * dom/ScriptExecutionContext.h:
+        * storage/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::contextDestroyed):
+        * storage/IDBTransaction.h:
+
+2011-02-02  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * WebCore.exp.in: Remove some bogus symbols from the .exp.in file.
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::unregisterScrollbar): Look the object
+        up in the HashMap rather than relying on a local variable that doesn't
+        exist.
+
+2011-02-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Daniel Bates.
+
+        Teach XSSFilter about JavaScript URLs
+        https://bugs.webkit.org/show_bug.cgi?id=53635
+
+        This patch teaches the XSSFilter to check for JavaScript URLs in
+        attribute values.  If this approach has too many false positives, we
+        can restrict which attribute names we examine.
+
+        Fixes these tests:
+            http/tests/security/xssAuditor/anchor-url-dom-write-location-javascript-URL.html
+            http/tests/security/xssAuditor/dom-write-location-javascript-URL.html
+            http/tests/security/xssAuditor/iframe-javascript-url*
+
+        * html/parser/XSSFilter.cpp:
+        (WebCore::HTMLNames::containsJavaScriptURL):
+        (WebCore::XSSFilter::filterTokenInitial):
+        (WebCore::XSSFilter::eraseDangerousAttributesIfInjected):
+        * html/parser/XSSFilter.h:
+
+2011-02-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig, even though this is just a...
+
+        ...build fix.
+
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::~ScrollAnimatorMac):
+
+2011-02-02  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <rdar://problem/8952012> Crash on launch inside scrollbar code.
+
+        We need to ensure that we remove ourselves as the delegates of objects when we're going
+        away as failing to do this can lead to crashes if the lifetime of the other objects
+        is longer than ours.
+
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::~ScrollAnimatorMac):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::unregisterScrollbar):
+
+2011-02-02  Beth Dakin  <bdakin@apple.com>
+
+        Build fix.
+
+        * WebCore.exp.in:
+
+2011-02-02  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r77397.
+
+        * page/wince/FrameWinCE.cpp:
+        (WebCore::computePageRectsForFrame):
+
+2011-02-02  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r77398.
+
+        * platform/graphics/wince/PlatformPathWinCE.cpp:
+        (WebCore::containsPoint):
+        (WebCore::inflateRectToContainPoint):
+        (WebCore::PlatformPath::addRect):
+        * platform/graphics/wince/SharedBitmap.cpp:
+        (WebCore::SharedBitmap::drawPattern):
+        * rendering/RenderThemeWinCE.cpp:
+        (WebCore::RenderThemeWinCE::paintMenuListButton):
+        (WebCore::RenderThemeWinCE::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeWinCE::paintSliderTrack):
+        (WebCore::RenderThemeWinCE::paintMediaMuteButton):
+        (WebCore::RenderThemeWinCE::paintMediaPlayButton):
+        (WebCore::RenderThemeWinCE::paintMediaSeekBackButton):
+        (WebCore::RenderThemeWinCE::paintMediaSeekForwardButton):
+
+2011-02-02  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [V8] Accessing DataView with index of -1 returns 0, doesn't throw
+        https://bugs.webkit.org/show_bug.cgi?id=53559
+
+        Added test cases to cover this in fast/canvas/webgl/data-view-test.html.
+
+        * html/canvas/DataView.h:
+        (WebCore::DataView::beyondRange):
+
+2011-02-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Add ChromeClient function to paint custom overhang areas.
+        https://bugs.webkit.org/show_bug.cgi?id=53639
+
+        * page/Chrome.cpp:
+        (WebCore::ChromeClient::paintCustomOverhangArea):
+        * page/ChromeClient.h:
+        Add ChromeClient function.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintOverhangAreas):
+        * page/FrameView.h:
+        Call out the the ChromeClient, call ScrollView base implementation
+        if the ChromeClient returns false.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::paintOverhangAreas):
+        * platform/ScrollView.h:
+        Add dirty rect for use when painting overhang areas.
+
+2011-02-02  Peter Kasting  <pkasting@google.com>
+
+        Not reviewed, build fix.
+
+        Fix compile after r77427.
+        https://bugs.webkit.org/show_bug.cgi?id=53455
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::internalHandleCurrentImage):
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageFrame::operator=):
+        * platform/image-decoders/bmp/BMPImageReader.cpp:
+        (WebCore::BMPImageReader::decodeBMP):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::rowAvailable):
+        * platform/image-decoders/webp/WEBPImageDecoder.cpp:
+        (WebCore::WEBPImageDecoder::decode):
+
+2011-02-02  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Levin.
+
+        Clean up ImageDecoder's comments (remove/trim/clarify).
+        https://bugs.webkit.org/show_bug.cgi?id=53455
+
+        This also renames or eliminates a couple of functions for clarity, and
+        switches a couple erroneous strncmp() calls to memcmp().
+
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::create):
+        (WebCore::ImageFrame::clearPixelData):
+        (WebCore::ImageFrame::zeroFillPixelData):
+        (WebCore::ImageFrame::setSize):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageFrame::originalFrameRect):
+        (WebCore::ImageFrame::setOriginalFrameRect):
+        (WebCore::ImageDecoder::ImageDecoder):
+        (WebCore::ImageDecoder::~ImageDecoder):
+        (WebCore::ImageDecoder::isSizeAvailable):
+        (WebCore::ImageDecoder::size):
+        (WebCore::ImageDecoder::setIgnoreGammaAndColorProfile):
+        (WebCore::ImageDecoder::clearFrameBufferCache):
+        (WebCore::ImageDecoder::isOverSize):
+        * platform/image-decoders/bmp/BMPImageReader.cpp:
+        (WebCore::BMPImageReader::processNonRLEData):
+        * platform/image-decoders/cg/ImageDecoderCG.cpp:
+        (WebCore::ImageFrame::setSize):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::clearFrameBufferCache):
+        (WebCore::GIFImageDecoder::frameComplete):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        * platform/image-decoders/qt/ImageFrameQt.cpp:
+        (WebCore::ImageFrame::operator=):
+        (WebCore::ImageFrame::clearPixelData):
+        (WebCore::ImageFrame::zeroFillPixelData):
+        (WebCore::ImageFrame::setSize):
+        * platform/image-decoders/skia/ImageDecoderSkia.cpp:
+        (WebCore::ImageFrame::operator=):
+        (WebCore::ImageFrame::clearPixelData):
+        (WebCore::ImageFrame::zeroFillPixelData):
+        (WebCore::ImageFrame::setSize):
+        * platform/image-decoders/webp/WEBPImageDecoder.h:
+
+2011-02-02  Vangelis Kokkevis  <vangelis@chromium.org>
+
+        [chromium] Adding support for reflections to the accelerated
+        compositing path.
+        https://bugs.webkit.org/show_bug.cgi?id=53179
+
+        All layout tests in compositing/reflections generate correct
+        results with the exception of:
+        1. nested-reflection-anchor-point.html : There appears to be
+           some issue with the layer transform math that I haven't been
+           able to track down yet.
+        2. reflection-opacity.html : The current implementation applies
+           opacity before doing the reflection which makes this test
+           produce incorrect results.  This will affect reflected layers
+           with opacity that overlap their original layer.  FIXME comment
+           added in the code.
+
+        Tests: Covered by existing layout tests in compositing/reflections.
+               Please see above for exceptions.
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setReplicatedByLayer):
+        (WebCore::GraphicsLayerChromium::updateAnchorPoint):
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::setReplicaLayer):
+        (WebCore::LayerChromium::replicaLayer):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::updateLayersRecursive):
+        (WebCore::LayerRendererChromium::drawLayer):
+        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
+        (WebCore::RenderSurfaceChromium::drawableContentRect):
+        (WebCore::RenderSurfaceChromium::drawSurface):
+        (WebCore::RenderSurfaceChromium::draw):
+        * platform/graphics/chromium/RenderSurfaceChromium.h:
+        (WebCore::RenderSurfaceChromium::drawTransform):
+
+2011-02-02  Xiyuan Xia  <xiyuan@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [Chromium] Select popup with padding has white strip on right
+        https://bugs.webkit.org/show_bug.cgi?id=53602
+
+        No new tests as this change restores old behavior.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::layout):
+
+2011-02-02  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix for <rdar://problem/8950343> CrashTracer: [USER]
+        1 crash in WebProcess at com.apple.WebCore: 
+        WebCore::ScrollbarThemeMac::unregisterScrollbar + 22
+
+        It is possible for a Scrollbar's ScrollableArea to be null,
+        so we must null check.
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::registerScrollbar):
+        (WebCore::ScrollbarThemeMac::unregisterScrollbar):
+
+2011-02-02  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        bufferData and bufferSubData should generate INVALID_VALUE with negative input
+        https://bugs.webkit.org/show_bug.cgi?id=53626
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::bufferData):
+        (WebCore::WebGLRenderingContext::bufferSubData):
+
+2011-02-02  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Darin Adler and Steve Falkenburg.
+
+        Add DerivedSources.make to some Visual Studio projects
+        https://bugs.webkit.org/show_bug.cgi?id=53607
+
+        * WebCore.vcproj/WebCoreGenerated.vcproj: Add DerivedSources.make.
+
+2011-02-02  Cris Neckar  <cdn@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Refcount domwindows when dispatching device orientation events.
+        https://bugs.webkit.org/show_bug.cgi?id=53623
+
+        Test: fast/events/device-orientation-crash.html
+
+        * dom/DeviceMotionController.cpp:
+        (WebCore::DeviceMotionController::timerFired):
+        (WebCore::DeviceMotionController::didChangeDeviceMotion):
+        * dom/DeviceMotionController.h:
+        * dom/DeviceOrientationController.cpp:
+        (WebCore::DeviceOrientationController::timerFired):
+        (WebCore::DeviceOrientationController::didChangeDeviceOrientation):
+        * dom/DeviceOrientationController.h:
+
+2011-02-02  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        A deleted object should never been bound again
+        https://bugs.webkit.org/show_bug.cgi?id=53604
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::checkObjectToBeBound): Helper function to bind* and useProgram.
+        (WebCore::WebGLRenderingContext::bindBuffer): Use checkObjectToBeBound.
+        (WebCore::WebGLRenderingContext::bindFramebuffer): Ditto.
+        (WebCore::WebGLRenderingContext::bindRenderbuffer): Ditto.
+        (WebCore::WebGLRenderingContext::bindTexture): Ditto, also check the target matching.
+        (WebCore::WebGLRenderingContext::deleteObject): Helper funtion to delete*.
+        (WebCore::WebGLRenderingContext::deleteBuffer): Use deleteObject.
+        (WebCore::WebGLRenderingContext::deleteFramebuffer): Ditto.
+        (WebCore::WebGLRenderingContext::deleteProgram): Ditto.
+        (WebCore::WebGLRenderingContext::deleteRenderbuffer): Ditto.
+        (WebCore::WebGLRenderingContext::deleteShader): Ditto.
+        (WebCore::WebGLRenderingContext::deleteTexture): Ditto.
+        (WebCore::WebGLRenderingContext::useProgram): Use checkObjectToBeBound.
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLTexture.h:
+        (WebCore::WebGLTexture::getTarget): Accessor to cached target.
+
+2011-02-02  Alejandro G. Castro  <alex@igalia.com>
+
+        Unreviewed Efl buildfix after r77399.
+
+        * CMakeListsEfl.txt:
+
+2011-02-02  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by James Robinson.
+
+        Rename Typed Array subset to subarray
+        https://bugs.webkit.org/show_bug.cgi?id=53618
+
+        * html/canvas/Float32Array.cpp:
+        (WebCore::Float32Array::subarray):
+        * html/canvas/Float32Array.h:
+        * html/canvas/Float32Array.idl:
+        * html/canvas/Int16Array.cpp:
+        (WebCore::Int16Array::subarray):
+        * html/canvas/Int16Array.h:
+        * html/canvas/Int16Array.idl:
+        * html/canvas/Int32Array.cpp:
+        (WebCore::Int32Array::subarray):
+        * html/canvas/Int32Array.h:
+        * html/canvas/Int32Array.idl:
+        * html/canvas/Int8Array.cpp:
+        (WebCore::Int8Array::subarray):
+        * html/canvas/Int8Array.h:
+        * html/canvas/Int8Array.idl:
+        * html/canvas/TypedArrayBase.h:
+        (WebCore::TypedArrayBase::subarrayImpl):
+        * html/canvas/Uint16Array.cpp:
+        (WebCore::Uint16Array::subarray):
+        * html/canvas/Uint16Array.h:
+        * html/canvas/Uint16Array.idl:
+        * html/canvas/Uint32Array.cpp:
+        (WebCore::Uint32Array::subarray):
+        * html/canvas/Uint32Array.h:
+        * html/canvas/Uint32Array.idl:
+        * html/canvas/Uint8Array.cpp:
+        (WebCore::Uint8Array::subarray):
+        * html/canvas/Uint8Array.h:
+        * html/canvas/Uint8Array.idl:
+
+2011-02-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add an empty file for Content Security Policy
+        https://bugs.webkit.org/show_bug.cgi?id=53573
+
+        Posting this as a separate patch because editing the build files is so
+        painful.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2011-02-02  Dan Winship  <danw@gnome.org>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] remove old data: URI handler, fix the SoupRequest-based one
+        to pass tests
+        https://bugs.webkit.org/show_bug.cgi?id=50885
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::sendRequestCallback): Do content-type sniffing here for
+        non-HTTP requests.
+        (WebCore::startHTTPRequest): Rename to match WebKit style.
+        (WebCore::ResourceHandle::start): Pass everything except HTTP to
+        startNonHTTPRequest, letting the SoupRequester decide whether it's
+        supported or not.
+        (WebCore::startNonHTTPRequest): Remove some old pre-SoupRequester
+        code that was a no-op for file: URIs, but would break some data:
+        URIs.
+
+2011-02-02  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Update even more references to right() and bottom() in Chromium. Sheesh.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::getFramebufferPixels): Replaced bottom/right with maxY/maxX.
+
+2011-02-02  Alejandro G. Castro  <alex@igalia.com>
+
+        Unreviewed Gtk3 buildfix after r77286.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53520
+        Remove the physical terminology from IntRect and FloatRect.
+
+        * platform/gtk/RenderThemeGtk3.cpp:
+        (WebCore::RenderThemeGtk::paintMenuList):
+
+2011-02-02  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::pinnedInDirection):
+
+2011-02-02  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53619
+
+        Floats should not use physical terminology for their rects. Replace left/top with x/y and right/bottom
+        with maxX/maxY.  This matches IntRect.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addOverflowFromFloats):
+        (WebCore::RenderBlock::flipFloatForWritingMode):
+        (WebCore::RenderBlock::paintFloats):
+        (WebCore::RenderBlock::selectionGaps):
+        (WebCore::RenderBlock::addOverhangingFloats):
+        (WebCore::RenderBlock::addIntrudingFloats):
+        (WebCore::RenderBlock::hitTestFloats):
+        (WebCore::RenderBlock::adjustForBorderFit):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::FloatingObject::x):
+        (WebCore::RenderBlock::FloatingObject::maxX):
+        (WebCore::RenderBlock::FloatingObject::y):
+        (WebCore::RenderBlock::FloatingObject::maxY):
+        (WebCore::RenderBlock::FloatingObject::setX):
+        (WebCore::RenderBlock::FloatingObject::setY):
+        (WebCore::RenderBlock::logicalTopForFloat):
+        (WebCore::RenderBlock::logicalBottomForFloat):
+        (WebCore::RenderBlock::logicalLeftForFloat):
+        (WebCore::RenderBlock::logicalRightForFloat):
+        (WebCore::RenderBlock::setLogicalTopForFloat):
+        (WebCore::RenderBlock::setLogicalLeftForFloat):
+        (WebCore::RenderBlock::xPositionForFloatIncludingMargin):
+        (WebCore::RenderBlock::yPositionForFloatIncludingMargin):
+
+2011-02-02  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Update more references to right() and bottom() in Chromium Win.
+
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::compositeOpaqueComposite): Replaced bottom/right with maxY/maxX.
+        (WebCore::TransparencyWin::compositeTextComposite): Ditto.
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::paintMenuList): Ditto.
+
+2011-02-02  Adam Roben  <aroben@apple.com>
+
+        Encode/decode FormData and FormDataElement objects consistently
+
+        Fixes <http://webkit.org/b/53615> <rdar://problem/8943346> WebKit2: Restoring session state
+        that contains form data fails (asserts in Debug build)
+
+        To prevent this from interfering with WebKit2 testing, it's useful to get this into a build
+        now, even though we don't have an automated test for it yet. Writing a test is covered by
+        <http://webkit.org/b/53616>.
+
+        Reviewed by Darin Adler.
+
+        * history/HistoryItem.cpp: Bump the encoding version, since this patch changes how we encode
+        FormData objects.
+
+        * platform/network/FormData.cpp:
+        (WebCore::decode): Decode the type from the Decoder, rather than getting it from the
+        default-constructed FormDataElement. Failing to do this meant that all future uses of the
+        Decoder would be reading from an unexpected part of the buffer (i.e., the next decode would
+        start by reading the uint32_t that we forgot to decode here, and so on). We already had code
+        to correctly set the FormDataElement's type based on this decoded type later in the
+        function.
+        (WebCore::FormData::encodeForBackForward): Encode m_identifier as an int64_t, since that
+        matches its type and how we decode it.
+
+2011-02-02  Dan Winship  <danw@gnome.org>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] drop soup cache stuff, which has been moved to libsoup
+        https://bugs.webkit.org/show_bug.cgi?id=50747
+
+        Use libsoup-based cache/requester API and remove the WebCore version
+        of this functionality. This has been pushed upstream fully.
+
+        No new tests because this should not change functionality.
+
+        * GNUmakefile.am: Update for removed files.
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal): Update
+        type names, drop m_requester.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ensureSessionIsInitialized): Add a SoupRequester to the
+        session.
+        (WebCore::parseDataUrl):
+        (WebCore::startHttp): Get the requester from the session rather
+        than using m_requester.
+        (WebCore::sendRequestCallback):
+        (WebCore::ResourceHandle::platformSetDefersLoading):
+        (WebCore::readCallback):
+        (WebCore::startGio): Update type names.
+        * platform/network/soup/cache/soup-directory-input-stream.c: Removed.
+        * platform/network/soup/cache/soup-directory-input-stream.h: Removed.
+        * platform/network/soup/cache/soup-http-input-stream.c: Removed.
+        * platform/network/soup/cache/soup-http-input-stream.h: Removed.
+        * platform/network/soup/cache/soup-request-data.c: Removed.
+        * platform/network/soup/cache/soup-request-data.h: Removed.
+        * platform/network/soup/cache/soup-request-file.c: Removed.
+        * platform/network/soup/cache/soup-request-file.h: Removed.
+        * platform/network/soup/cache/soup-request-http.c: Removed.
+        * platform/network/soup/cache/soup-request-http.h: Removed.
+        * platform/network/soup/cache/soup-request.c: Removed.
+        * platform/network/soup/cache/soup-request.h: Removed.
+        * platform/network/soup/cache/soup-requester.c: Removed.
+        * platform/network/soup/cache/soup-requester.h: Removed.
+        * platform/network/soup/cache/webkit/soup-cache-private.h: Removed.
+        * platform/network/soup/cache/webkit/soup-cache.c: Removed.
+        * platform/network/soup/cache/webkit/soup-cache.h: Removed.
+
+2011-02-02  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53520
+
+        Remove physical accessors from IntRect and FloatRect.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::adjustPageHeightDeprecated):
+        * platform/graphics/FloatRect.h:
+        * platform/graphics/IntRect.h:
+
+2011-02-02  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53614
+
+        Remove physical terminology from overflow.  Replace with minX/maxX/minY/maxY.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::addBoxShadowVisualOverflow):
+        (WebCore::InlineFlowBox::addTextBoxVisualOverflow):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::minYLayoutOverflow):
+        (WebCore::InlineFlowBox::maxYLayoutOverflow):
+        (WebCore::InlineFlowBox::minXLayoutOverflow):
+        (WebCore::InlineFlowBox::maxXLayoutOverflow):
+        (WebCore::InlineFlowBox::logicalLeftLayoutOverflow):
+        (WebCore::InlineFlowBox::logicalRightLayoutOverflow):
+        (WebCore::InlineFlowBox::logicalTopLayoutOverflow):
+        (WebCore::InlineFlowBox::logicalBottomLayoutOverflow):
+        (WebCore::InlineFlowBox::minYVisualOverflow):
+        (WebCore::InlineFlowBox::maxYVisualOverflow):
+        (WebCore::InlineFlowBox::minXVisualOverflow):
+        (WebCore::InlineFlowBox::maxXVisualOverflow):
+        (WebCore::InlineFlowBox::logicalLeftVisualOverflow):
+        (WebCore::InlineFlowBox::logicalRightVisualOverflow):
+        (WebCore::InlineFlowBox::logicalminYVisualOverflow):
+        (WebCore::InlineFlowBox::logicalmaxYVisualOverflow):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustLinePositionForPagination):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::beforeSideVisualOverflowForLine):
+        (WebCore::RenderBlock::afterSideVisualOverflowForLine):
+        (WebCore::RenderBlock::beforeSideLayoutOverflowForLine):
+        (WebCore::RenderBlock::afterSideLayoutOverflowForLine):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::minYLayoutOverflow):
+        (WebCore::RenderBox::maxYLayoutOverflow):
+        (WebCore::RenderBox::minXLayoutOverflow):
+        (WebCore::RenderBox::maxXLayoutOverflow):
+        (WebCore::RenderBox::logicalLeftLayoutOverflow):
+        (WebCore::RenderBox::logicalRightLayoutOverflow):
+        (WebCore::RenderBox::minYVisualOverflow):
+        (WebCore::RenderBox::maxYVisualOverflow):
+        (WebCore::RenderBox::minXVisualOverflow):
+        (WebCore::RenderBox::maxXVisualOverflow):
+        (WebCore::RenderBox::logicalLeftVisualOverflow):
+        (WebCore::RenderBox::logicalRightVisualOverflow):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::linesVisualOverflowBoundingBox):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::anyLineIntersectsRect):
+        (WebCore::RenderLineBoxList::lineIntersectsDirtyRect):
+        (WebCore::RenderLineBoxList::paint):
+        (WebCore::RenderLineBoxList::hitTest):
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::computePosition):
+        * rendering/RenderOverflow.h:
+        (WebCore::RenderOverflow::RenderOverflow):
+        (WebCore::RenderOverflow::minYLayoutOverflow):
+        (WebCore::RenderOverflow::maxYLayoutOverflow):
+        (WebCore::RenderOverflow::minXLayoutOverflow):
+        (WebCore::RenderOverflow::maxXLayoutOverflow):
+        (WebCore::RenderOverflow::minYVisualOverflow):
+        (WebCore::RenderOverflow::maxYVisualOverflow):
+        (WebCore::RenderOverflow::minXVisualOverflow):
+        (WebCore::RenderOverflow::maxXVisualOverflow):
+        (WebCore::RenderOverflow::setminYVisualOverflow):
+        (WebCore::RenderOverflow::visualOverflowRect):
+        (WebCore::RenderOverflow::move):
+        (WebCore::RenderOverflow::addVisualOverflow):
+        (WebCore::RenderOverflow::setVisualOverflow):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::shouldPaint):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        (WebCore::RenderTable::paint):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeLayers):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::docTop):
+
+2011-02-02  Steve Lacey  <sjl@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Implement basic media statistics on media elements.
+        https://bugs.webkit.org/show_bug.cgi?id=53322
+
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * features.pri:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::webkitAudioBytesDecoded):
+        (WebCore::HTMLMediaElement::webkitVideoBytesDecoded):
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::webkitDecodedFrames):
+        (WebCore::HTMLVideoElement::webkitDroppedFrames):
+        * html/HTMLVideoElement.h:
+        * html/HTMLVideoElement.idl:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::decodedFrames):
+        (WebCore::MediaPlayer::droppedFrames):
+        (WebCore::MediaPlayer::audioBytesDecoded):
+        (WebCore::MediaPlayer::videoBytesDecoded):
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::decodedFrames):
+        (WebCore::MediaPlayerPrivateInterface::droppedFrames):
+        (WebCore::MediaPlayerPrivateInterface::audioBytesDecoded):
+        (WebCore::MediaPlayerPrivateInterface::videoBytesDecoded):
+
+2011-02-02  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by David Hyatt.
+
+        More conversion from right()/bottom() to maxX()/maxY().
+
+        * page/qt/FrameQt.cpp:
+        (WebCore::Frame::dragImageForSelection):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::roundToDevicePixels):
+
+2011-02-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fixes for wxWebKit.
+
+        * bindings/cpp/WebDOMHTMLDocumentCustom.cpp:
+        (documentWrite):
+        * bindings/scripts/CodeGeneratorCPP.pm:
+        * page/wx/DragControllerWx.cpp:
+        (WebCore::DragController::dragOperation):
+        * platform/graphics/wx/FontCustomPlatformData.h:
+        * platform/graphics/wx/FontPlatformData.h:
+        (WebCore::FontPlatformData::widthVariant):
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::computeHash):
+        * platform/graphics/wx/FontWx.cpp:
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        * platform/wx/RenderThemeWx.cpp:
+
+2011-02-02  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        More right()/bottom() to maxX()/maxY() conversion.
+
+        * page/chromium/FrameChromium.cpp:
+        (WebCore::Frame::nodeImage):
+        (WebCore::Frame::dragImageForSelection):
+
+2011-02-02  Sam Weinig  <sam@webkit.org>
+
+        Fix windows clean build.
+
+        * DerivedSources.make:
+
+2011-02-02  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Chromium] Landing detailed heap snapshots, part 2.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53606
+
+        Display progress while taking a snapshot, and hints while loading
+        and parsing. This is needed because taking detailed heap snapshots
+        takes time.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.DetailedHeapshotProfileType.prototype.buttonClicked):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._reset):
+        (WebInspector.ProfilesPanel.prototype._addProfileHeader):
+        (WebInspector.ProfilesPanel.prototype.getProfiles):
+        (WebInspector.ProfilesPanel.prototype.loadHeapSnapshot):
+        (WebInspector.ProfilesPanel.prototype._finishHeapSnapshot.doParse):
+        (WebInspector.ProfilesPanel.prototype._finishHeapSnapshot):
+        (WebInspector.ProfilesPanel.prototype.takeHeapSnapshot):
+        (WebInspector.ProfilesPanel.prototype._reportHeapSnapshotProgress):
+        * inspector/front-end/SidebarTreeElement.js:
+        (WebInspector.SidebarTreeElement.prototype.refreshTitles):
+
+2011-02-02  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        More conversion from right()/bottom() to maxX()/maxY().
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenuWin::calculatePositionAndSize):
+        (WebCore::PopupMenuWin::paint):
+
+2011-02-02  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Removal of right()/bottom().  Replace with maxX() and maxY().  Still converting.  Haven't removed yet.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::layoutAndCalculateWidgetRect):
+        (WebCore::PopupListBox::scrollToRevealRow):
+        (WebCore::PopupListBox::layout):
+        * platform/graphics/FloatRect.h:
+        * platform/graphics/IntRect.h:
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::getImageData):
+        (WebCore::putImageData):
+        * platform/graphics/chromium/GLES2Canvas.cpp:
+        (WebCore::GLES2Canvas::drawTexturedRect):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::verticalScrollbarRect):
+        (WebCore::LayerRendererChromium::horizontalScrollbarRect):
+        (WebCore::LayerRendererChromium::setScissorToRect):
+        (WebCore::LayerRendererChromium::setDrawViewportRect):
+        * platform/graphics/chromium/LayerTilerChromium.cpp:
+        (WebCore::LayerTilerChromium::contentRectToTileIndices):
+        (WebCore::LayerTilerChromium::growLayerToContain):
+        * platform/graphics/gpu/TilingData.cpp:
+        (WebCore::TilingData::tileBoundsWithBorder):
+        (WebCore::TilingData::overlappedTileIndices):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::getImageData):
+        (WebCore::putImageData):
+        * platform/graphics/skia/FloatRectSkia.cpp:
+        (WebCore::FloatRect::operator SkRect):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::putImageData):
+        * platform/graphics/skia/IntRectSkia.cpp:
+        (WebCore::IntRect::operator SkIRect):
+        (WebCore::IntRect::operator SkRect):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::beginLayerClippedToImage):
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::clip):
+        * platform/graphics/win/IntRectWin.cpp:
+        (WebCore::IntRect::operator RECT):
+        * platform/graphics/win/UniscribeController.cpp:
+        (WebCore::UniscribeController::shapeAndPlaceItem):
+        * platform/graphics/wince/GraphicsContextWinCE.cpp:
+        (WebCore::roundRect):
+        (WebCore::mapRect):
+        (WebCore::TransparentLayerDC::TransparentLayerDC):
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::strokeRect):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenuWin::calculatePositionAndSize):
+        (WebCore::PopupMenuWin::paint):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::invalidateRect):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::paintMenuListButtonGradients):
+        (WebCore::RenderThemeSafari::paintMenuListButton):
+        (WebCore::RenderThemeSafari::paintSliderTrack):
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::paintInnerSpinButton):
+        (WebCore::RenderThemeWin::paintMenuListButton):
+
+2011-02-02  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Use Vector instead of a linked list for rules in CSSStyleSelector
+        https://bugs.webkit.org/show_bug.cgi?id=53581
+        
+        - eliminate CSSRuleDataList, replace with Vector<RuleData>
+        - rename CSSRuleData -> RuleData and CSSRuleSet -> RuleSet 
+          (these are selector internal classes, CSS prefix is better reserved for public ones).
+        - constify a bit
+        - shrink the vectors to fit after collecting the rules
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::RuleData::RuleData):
+        (WebCore::RuleData::position):
+        (WebCore::RuleData::rule):
+        (WebCore::RuleData::selector):
+        (WebCore::RuleSet::disableAutoShrinkToFit):
+        (WebCore::RuleSet::getIDRules):
+        (WebCore::RuleSet::getClassRules):
+        (WebCore::RuleSet::getTagRules):
+        (WebCore::RuleSet::getPseudoRules):
+        (WebCore::RuleSet::getUniversalRules):
+        (WebCore::RuleSet::getPageRules):
+        (WebCore::collectSiblingRulesInDefaultStyle):
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        (WebCore::loadFullDefaultStyle):
+        (WebCore::loadSimpleDefaultStyle):
+        (WebCore::loadViewSourceStyle):
+        (WebCore::CSSStyleSelector::matchRules):
+        (WebCore::CSSStyleSelector::matchRulesForList):
+        (WebCore::operator >):
+        (WebCore::operator <=):
+        (WebCore::CSSStyleSelector::sortMatchedRules):
+        (WebCore::CSSStyleSelector::matchUARules):
+        (WebCore::RuleSet::RuleSet):
+        (WebCore::RuleSet::~RuleSet):
+        (WebCore::RuleSet::addToRuleSet):
+        (WebCore::RuleSet::addRule):
+        (WebCore::RuleSet::addPageRule):
+        (WebCore::RuleSet::addRulesFromSheet):
+        (WebCore::RuleSet::addStyleRule):
+        (WebCore::collectIdsAndSiblingRulesFromList):
+        (WebCore::RuleSet::collectIdsAndSiblingRules):
+        (WebCore::shrinkMapVectorsToFit):
+        (WebCore::RuleSet::shrinkToFit):
+        (WebCore::CSSStyleSelector::matchPageRules):
+        (WebCore::CSSStyleSelector::matchPageRulesForList):
+        * css/CSSStyleSelector.h:
+        (WebCore::CSSStyleSelector::addMatchedRule):
+
+2011-02-02  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Use DIVs instead of TABLE in TextViewer
+        https://bugs.webkit.org/show_bug.cgi?id=53299
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._createTextViewer):
+        (WebInspector.SourceFrame.prototype._mouseDown):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer):
+        (WebInspector.TextViewer.prototype.set mimeType):
+        (WebInspector.TextViewer.prototype.revealLine):
+        (WebInspector.TextViewer.prototype.addDecoration):
+        (WebInspector.TextViewer.prototype.removeDecoration):
+        (WebInspector.TextViewer.prototype.markAndRevealRange):
+        (WebInspector.TextViewer.prototype.highlightLine):
+        (WebInspector.TextViewer.prototype.clearLineHighlight):
+        (WebInspector.TextViewer.prototype.freeCachedElements):
+        (WebInspector.TextViewer.prototype._handleKeyDown):
+        (WebInspector.TextViewer.prototype.editLine.finishEditing):
+        (WebInspector.TextViewer.prototype.editLine):
+        (WebInspector.TextViewer.prototype.beginUpdates):
+        (WebInspector.TextViewer.prototype.endUpdates):
+        (WebInspector.TextViewer.prototype.resize):
+        (WebInspector.TextViewer.prototype._textChanged):
+        (WebInspector.TextViewer.prototype._updatePanelOffsets):
+        (WebInspector.TextViewer.prototype._syncScroll):
+        (WebInspector.TextViewer.prototype._syncDecorationsForLine):
+        (WebInspector.TextEditorChunkedPanel):
+        (WebInspector.TextEditorChunkedPanel.prototype.set syncScrollListener):
+        (WebInspector.TextEditorChunkedPanel.prototype.get textModel):
+        (WebInspector.TextEditorChunkedPanel.prototype.addDecoration):
+        (WebInspector.TextEditorChunkedPanel.prototype.removeDecoration):
+        (WebInspector.TextEditorChunkedPanel.prototype.revealLine):
+        (WebInspector.TextEditorChunkedPanel.prototype.makeLineAChunk):
+        (WebInspector.TextEditorChunkedPanel.prototype.textChanged):
+        (WebInspector.TextEditorChunkedPanel.prototype.beginUpdates):
+        (WebInspector.TextEditorChunkedPanel.prototype.endUpdates):
+        (WebInspector.TextEditorChunkedPanel.prototype.resize):
+        (WebInspector.TextEditorChunkedPanel.prototype._scroll):
+        (WebInspector.TextEditorChunkedPanel.prototype._scheduleRepaintAll):
+        (WebInspector.TextEditorChunkedPanel.prototype._buildChunks):
+        (WebInspector.TextEditorChunkedPanel.prototype._repaintAll):
+        (WebInspector.TextEditorChunkedPanel.prototype._chunkNumberForLine):
+        (WebInspector.TextEditorChunkedPanel.prototype._chunkForLine):
+        (WebInspector.TextEditorGutterPanel):
+        (WebInspector.TextEditorGutterPanel.prototype.freeCachedElements):
+        (WebInspector.TextEditorGutterPanel.prototype._createNewChunk):
+        (WebInspector.TextEditorGutterPanel.prototype._expandChunks):
+        (WebInspector.TextEditorGutterChunk):
+        (WebInspector.TextEditorGutterChunk.prototype.get expanded):
+        (WebInspector.TextEditorGutterChunk.prototype.set expanded):
+        (WebInspector.TextEditorGutterChunk.prototype.get height):
+        (WebInspector.TextEditorGutterChunk.prototype._createRow):
+        (WebInspector.TextEditorMainPanel):
+        (WebInspector.TextEditorMainPanel.prototype.set syncDecorationsForLine):
+        (WebInspector.TextEditorMainPanel.prototype.set mimeType):
+        (WebInspector.TextEditorMainPanel.prototype.markAndRevealRange):
+        (WebInspector.TextEditorMainPanel.prototype.highlightLine):
+        (WebInspector.TextEditorMainPanel.prototype.clearLineHighlight):
+        (WebInspector.TextEditorMainPanel.prototype.freeCachedElements):
+        (WebInspector.TextEditorMainPanel.prototype._buildChunks):
+        (WebInspector.TextEditorMainPanel.prototype._createNewChunk):
+        (WebInspector.TextEditorMainPanel.prototype._expandChunks):
+        (WebInspector.TextEditorMainPanel.prototype._highlightDataReady):
+        (WebInspector.TextEditorMainPanel.prototype._paintLines):
+        (WebInspector.TextEditorMainPanel.prototype._paintLine):
+        (WebInspector.TextEditorMainPanel.prototype._releaseLinesHighlight):
+        (WebInspector.TextEditorMainPanel.prototype._getSelection):
+        (WebInspector.TextEditorMainPanel.prototype._restoreSelection):
+        (WebInspector.TextEditorMainPanel.prototype._selectionToPosition):
+        (WebInspector.TextEditorMainPanel.prototype._positionToSelection):
+        (WebInspector.TextEditorMainPanel.prototype._appendTextNode):
+        (WebInspector.TextEditorMainPanel.prototype._handleDomUpdates):
+        (WebInspector.TextEditorMainChunk):
+        (WebInspector.TextEditorMainChunk.prototype.addDecoration):
+        (WebInspector.TextEditorMainChunk.prototype.set expanded):
+        (WebInspector.TextEditorMainChunk.prototype.get height):
+        (WebInspector.TextEditorMainChunk.prototype.getExpandedLineRow):
+        (WebInspector.TextEditorMainChunk.prototype._createRow):
+        (WebInspector):
+        * inspector/front-end/textViewer.css:
+        (.text-editor-lines):
+        (.text-editor-contents):
+        (.text-editor-editable):
+        (.webkit-line-decorations):
+        (.webkit-line-number):
+        (.webkit-execution-line.webkit-line-content):
+        (.diff-container .webkit-added-line.webkit-line-content):
+        (.diff-container .webkit-removed-line.webkit-line-content):
+        (.diff-container .webkit-changed-line.webkit-line-content):
+        (.webkit-highlighted-line.webkit-line-content):
+
+2011-02-02  Hans Wennborg  <hans@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        IndexedDB: Implement support for cursor updates
+        https://bugs.webkit.org/show_bug.cgi?id=53421
+
+        Implement support for cursor updates using the same pattern as cursor
+        deletes: forward the calls to the IDBObjectStoreBackend::put().
+        The put() function's signature needs to be changed to allow for a
+        "cursor update mode". This makes the signature more clear anyway,
+        since it replaces the boolean parameter.
+
+        Test: storage/indexeddb/cursor-update.html
+
+        * storage/IDBCursor.idl:
+        * storage/IDBCursorBackendImpl.cpp:
+        (WebCore::IDBCursorBackendImpl::key):
+        (WebCore::IDBCursorBackendImpl::update):
+        * storage/IDBCursorBackendImpl.h:
+        * storage/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::add):
+        (WebCore::IDBObjectStore::put):
+        * storage/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::put):
+        (WebCore::IDBObjectStoreBackendImpl::putInternal):
+        * storage/IDBObjectStoreBackendImpl.h:
+        * storage/IDBObjectStoreBackendInterface.h:
+
+2011-02-02  Naoki Takano  <takano.naoki@gmail.com>
+
+        Reviewed by Kent Tamura.
+
+        Fix popup menu RTL bug introduced by Changeset 75982.
+        https://bugs.webkit.org/show_bug.cgi?id=53567
+
+        PopupMenuChromium::layout() calculates X position according to RTL or not. So Change the X position calculation in layoutAndCalculateWidgetRect().
+
+        No new tests. However we can check manually with select_dropdown_box_alignment.html, autofill_alignment.html, select_alignment.html, select_dropdown_box_alignment.html, autofill-popup-width-and-item-direction.html
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::layoutAndCalculateWidgetRect): Fix calculation of x position, because layout() considers RTL. And change the parameter from both X and Y positions to only Y position.
+        (WebCore::PopupContainer::showPopup): Change the passing parameter.
+        (WebCore::PopupContainer::refresh): Change the passing parameter.
+        * platform/chromium/PopupMenuChromium.h: Change the parameter declaration.
+
+2011-02-02  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Fix dist compilation
+        https://bugs.webkit.org/show_bug.cgi?id=53579
+
+        * GNUmakefile.am: Added FontWidthVariant.h to the sources, it was
+        added in r77153.
+
+2011-02-02  Dai Mikurube  <dmikurube@google.com>
+
+        Reviewed by David Levin.
+
+        Make mime type lookup in File::create(path) thread-safe
+        https://bugs.webkit.org/show_bug.cgi?id=47700
+
+        This patch introduces a new function MIMETypeRegistry::getMIMETypeForExtensionThreadSafe().
+        The function is to be called as a thread-safe version of getMIMETypeForExtension() when
+        both FILE_SYSTEM and WORKERS are enabled.
+
+        No tests for this patch. This patch itself doesn't change the behaviors.
+        For Chromium, it runs in the same way with getMIMETypeForExtensionThreadSafe().
+        For the other platforms, it causes compilation error in case of enabled FILE_SYSTEM and WORKERS.
+        The compilation error would be a signal to implement getMIMETypeForExtensionThreadSafe() in these
+        platforms. Currently it doesn't happen since FILE_SYSTEM is not available in the other platforms.
+
+        * platform/MIMETypeRegistry.cpp: Defined generic getMIMETypeForExtension() calling getMIMETypeForExtensionThreadSafe() for enabled FILE_SYSTEM and WORKERS.
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        * platform/MIMETypeRegistry.h: Declared getMIMETypeForExtensionThreadSafe() which should be implemented for each platform.
+        * platform/android/TemporaryLinkStubs.cpp:
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        * platform/brew/MIMETypeRegistryBrew.cpp:
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        * platform/chromium/MIMETypeRegistryChromium.cpp: Defined getMIMETypeForExtensionThreadSafe() for the case when FILE_SYSTEM and WORKERS are enabled.
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtensionThreadSafe):
+        * platform/efl/MIMETypeRegistryEfl.cpp:
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        * platform/gtk/MIMETypeRegistryGtk.cpp:
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        * platform/haiku/MIMETypeRegistryHaiku.cpp:
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        * platform/mac/MIMETypeRegistryMac.mm:
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        * platform/qt/MIMETypeRegistryQt.cpp:
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        * platform/win/MIMETypeRegistryWin.cpp:
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        * platform/wince/MIMETypeRegistryWinCE.cpp:
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        * platform/wx/MimeTypeRegistryWx.cpp:
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+
+2011-02-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Improve readability of updateWidget by converting bool parameter to an enum
+        https://bugs.webkit.org/show_bug.cgi?id=53576
+
+        As requested on webkit-dev.
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::updateWidget):
+        * html/HTMLEmbedElement.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::updateWidget):
+        * html/HTMLMediaElement.h:
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::updateWidget):
+        * html/HTMLObjectElement.h:
+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::HTMLPlugInImageElement::updateWidgetIfNecessary):
+        * html/HTMLPlugInImageElement.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateWidget):
+
+2011-02-01  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [v8] Increase V8 native->js recursion limit to match document.write() recursion limit
+        https://bugs.webkit.org/show_bug.cgi?id=53566
+
+        A recursion limit of 22 is necessary to pass fast/dom/Document/document-write-recursion.html.
+        Other than being large enough for this one test case, this limit is arbitrary.
+
+        * bindings/v8/V8Proxy.h:
+
+2011-02-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Remove useless comment
+        https://bugs.webkit.org/show_bug.cgi?id=53549
+
+        The reason for this parameter is captured in
+        plugins/netscape-plugin-setwindow-size.html, which is a better place to
+        capture it than in this comment (which otherwise just re-iterates the
+        name of the parameter).
+
+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::HTMLPlugInImageElement::updateWidgetIfNecessary):
+
+2011-02-01  James Simonsen  <simonjam@chromium.org>
+
+        Reviewed by Tony Gentilcore.
+
+        [WebTiming] Remove asserts that verify timestamp order
+        https://bugs.webkit.org/show_bug.cgi?id=53548
+
+        Covered by existing tests.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): Remove assert.
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchTimedEvent): Ditto.
+
+2011-02-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Add the 'default_targets' enclosure to the flags.
+
+        * WebCore.gyp/WebCore.gyp: Did it.
+
+2011-02-01  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Async event handlers should not fire within a modal dialog
+        https://bugs.webkit.org/show_bug.cgi?id=53202
+
+        Asychronous events that use EventQueue would currently fire while a
+        modal dialog (e.g. window.alert()) was up. Change EventQueue to use a
+        SuspendableTimer (which automatically gets suspended while dialogs are
+        up and in other cases where JS execution is not allowed).
+        
+        Test: fast/events/scroll-event-during-modal-dialog.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/EventQueue.cpp:
+        (WebCore::EventQueueTimer::EventQueueTimer):
+        (WebCore::EventQueueTimer::fired):
+        (WebCore::EventQueue::EventQueue):
+        (WebCore::EventQueue::enqueueEvent):
+        (WebCore::EventQueue::pendingEventTimerFired):
+        * dom/EventQueue.h:
+        (WebCore::EventQueue::create):
+        * page/SuspendableTimer.cpp:
+        (WebCore::SuspendableTimer::SuspendableTimer):
+        (WebCore::SuspendableTimer::suspend):
+        (WebCore::SuspendableTimer::resume):
+        * page/SuspendableTimer.h:
+
+2011-02-01  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Change wrong PLATFORM(WIN) to USE(WININET)
+        https://bugs.webkit.org/show_bug.cgi?id=53547
+
+        * platform/network/ResourceHandle.h:
+
+2011-02-01  Beth Dakin  <bdakin@apple.com>
+
+        32-bit build fix.
+
+        * platform/mac/ScrollAnimatorMac.mm:
+        (-[ScrollbarPainterControllerDelegate contentAreaRectForScrollerImpPair:]):
+
+2011-01-25  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] Two tests crash after r76555
+        https://bugs.webkit.org/show_bug.cgi?id=53057
+
+        Instead of creating synchronous ResourceHandles manually, use the ::create factory.
+        This ensures that ::start() is not called when there is a scheduled failure and also
+        reduces code duplication.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::loadResourceSynchronously): Use the ::create factory method.
+
+2011-02-01  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        [GTK] GObject DOM bindings do no support the CallWith attribute
+        https://bugs.webkit.org/show_bug.cgi?id=53331
+
+        Disable building GObject DOM bindings for IndexedDB because we do not support
+        the CallWith attribute at this time.
+
+        * bindings/gobject/GNUmakefile.am: Disable building bindings for the IndexedDB API.
+
+2011-02-01  Darin Adler  <darin@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Fix a couple loose ends from the back/forward tree encode/decode work
+        https://bugs.webkit.org/show_bug.cgi?id=53537
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::encodeBackForwardTreeNode): Remove extra copy of
+        original URL string; no need to encode it twice.
+        (WebCore::HistoryItem::decodeBackForwardTree): Ditto.
+        * history/HistoryItem.h: Removed declaration for function that is no
+        longer defined nor used.
+
+2011-02-01  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        [chromium] disable arm uninitialized variable warnings
+        https://bugs.webkit.org/show_bug.cgi?id=53553
+
+        We just got another error:
+        third_party/WebKit/Source/WebCore/css/CSSPrimitiveValue.cpp:123:error:
+        'colorTransparent.unstatic.4879' may be used uninitialized in this
+        function
+
+        * WebCore.gyp/WebCore.gyp:
+
+2011-02-01  chris reiss  <christopher.reiss@nokia.com>
+
+        Reviewed by Adam Barth.
+
+        Self-replicating code makes Safari hang and eventually crash
+        https://bugs.webkit.org/show_bug.cgi?id=15123
+
+       
+        Here we are replicating the Firefox safeguard against
+        recursive document.write( ) 's.
+
+        See  https://bug197052.bugzilla.mozilla.org/attachment.cgi?id=293907 in bug 
+        https://bugzilla.mozilla.org/show_bug.cgi?id=197052 .   Firefox does two things - 
+            a) imposes a recursion limit of 20 on document.write( ) and
+            b) once that limit is passed, panics all the way the call stack (rather than just returning one level.)
+        To see why this is necessary, consider the script : 
+
+        <script>
+           var t = document.body.innerHTML;
+           document.write(t);
+        </script> 
+
+        This will create a tree both broad and deep as the script keeps appending itself to the text.   If
+        we just return one level after the recursion limit is reached, we still allow millions of copies to 
+        duplicate (and execute).   
+
+        The recursion is fortunately depth-first, so as soon as we cross this limit, we panic up the callstack
+        to prevent this situation.    (IE apparently does the same thing, with a lower recursion limit.) 
+
+        Test: fast/dom/Document/document-write-recursion.html        
+        Test: fast/dom/Document/document-close-iframe-load.html
+        Test: fast/dom/Document/document-close-nested-iframe-load.html
+
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::write):
+        * dom/Document.h:
+
+2011-02-01  Johnny Ding  <jnd@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Don't set user gesture in HTMLAnchorElement's click handler because the click handler can be triggered by untrusted event.
+        https://bugs.webkit.org/show_bug.cgi?id=53424
+
+        Test: fast/events/popup-blocked-from-untrusted-click-event-on-anchor.html
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::handleLinkClick):
+
+2011-02-01  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed Qt buildfix after r77286.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53520 
+        Remove the physical terminology from IntRect and FloatRect.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::createTiles):
+
+2011-02-01  Sam Weinig  <sam@webkit.org>
+
+        Fix Mac production builds.
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/mac/ScrollAnimatorMac.h:
+        * platform/mac/ScrollbarThemeMac.h:
+
+2011-02-01  Darin Adler  <darin@apple.com>
+
+        Reviewed by Chris Fleizach.
+
+        REGRESSION: Removing focus from area element causes unwanted scrolling
+        https://bugs.webkit.org/show_bug.cgi?id=50169
+
+        Test: fast/images/imagemap-scroll.html
+
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::setFocus): Added override. Calls the new
+        RenderImage::areaElementFocusChanged function.
+        (WebCore::HTMLAreaElement::updateFocusAppearance): Removed the code
+        here that calls setNeedsLayout on the image's renderer. This was an
+        attempt to cause repaint of the renderer, but this function does not
+        need to do that. Also changed this to use the imageElement function
+        to avoid repeating code.
+
+        * html/HTMLAreaElement.h: Updated for above changes.
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paint): Updated for name change.
+        (WebCore::RenderImage::paintAreaElementFocusRing): Renamed this from
+        paintFocusRing, because it only paints area focus rings, and should
+        not be confused with paintFocusRing functions in other classes. Also
+        removed the unused style argument. Removed the code that used an
+        HTMLCollection to see if the focused area element is for this image
+        and instead just call imageElement on the area element.
+        (WebCore::RenderImage::areaElementFocusChanged): Added. Calls repaint.
+
+        * rendering/RenderImage.h: Added a public areaElementFocusChanged
+        function for HTMLAreaElement to call. Made the paintFocusRing function
+        private, renamed it to paintAreaElementFocusRing, and removed its
+        unused style argument.
+
+2011-02-01  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r77286.
+
+        * platform/graphics/wince/GraphicsContextWinCE.cpp:
+        (WebCore::TransparentLayerDC::TransparentLayerDC):
+
+2011-02-01  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        AX: AXPosition of AXScrollArea is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=53511
+
+        AccessibilityScrollView needed to return a valid documentFrameView() object.
+        At the same time, the code from document() should be consolidated in 
+        AccessibilityObject, so all objects can use it.
+
+        Test: platform/mac/accessibility/webkit-scrollarea-position.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::document):
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityScrollView.cpp:
+        (WebCore::AccessibilityScrollView::accessibilityHitTest):
+        (WebCore::AccessibilityScrollView::documentFrameView):
+        * accessibility/AccessibilityScrollView.h:
+
+2011-02-01  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        getUniform should support SAMPLER_2D or SAMPLER_CUBE
+        https://bugs.webkit.org/show_bug.cgi?id=52190
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::getUniform):
+
+2011-02-01  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fix the incorrect usage of RetainPtr cases in GraphicsContext3DCG.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=53531
+
+        With this fix, running WebGL conformance tests should no longer crash randomly.
+
+        * platform/graphics/cg/GraphicsContext3DCG.cpp:
+        (WebCore::GraphicsContext3D::getImageData):
+
+2011-02-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        One more Chromium build fix after r77286.
+
+        * platform/chromium/ScrollbarThemeChromiumMac.mm:
+        (WebCore::ScrollbarThemeChromiumMac::paint): Changed to not use topLeft().
+
+2011-02-01  Sam Weinig  <sam@webkit.org>
+
+        Fix the build for Beth.
+
+        * platform/mac/ScrollAnimatorMac.mm:
+        (-[ScrollbarPainterControllerDelegate inLiveResizeForScrollerImpPair:]):
+
+2011-02-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Part 2 for <rdar://problem/8492788>
+        Adopt WKScrollbarPainterController
+
+        Use header detection to define scrollbar painting controller #define.
+
+        * WebCore.exp.in:
+        * platform/mac/ScrollAnimatorMac.h:
+        * platform/mac/ScrollbarThemeMac.h:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2011-02-01  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53520
+        
+        Remove the physical terminology from IntRect and FloatRect.
+        
+        Now that we have flipped RenderBlocks for vertical-rl and horizontal-bt writing modes,
+        we need to update our terminology to be more accurate.
+
+        I'm borrowing a page from AppKit here (which also supports flipped NSViews) and
+        renaming right() and bottom() to maxX() and maxY().  These terms remain accurate
+        even for flipped rectangles.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::boundsForVisiblePositionRange):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper position]):
+        * dom/ClientRect.h:
+        (WebCore::ClientRect::right):
+        (WebCore::ClientRect::bottom):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::convertLogicalToDevice):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::normalizeRect):
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::drawElementTitle):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::adjustWindowRect):
+        * page/DragController.cpp:
+        (WebCore::dragLocForSelectionDrag):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::sendContextMenuEventForKey):
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::computePageRectsWithPageSizeInternal):
+        (WebCore::PrintContext::pageNumberForElement):
+        * page/SpatialNavigation.cpp:
+        (WebCore::end):
+        (WebCore::areRectsFullyAligned):
+        (WebCore::areRectsMoreThanFullScreenApart):
+        (WebCore::below):
+        (WebCore::rightOf):
+        (WebCore::isRectInDirection):
+        (WebCore::entryAndExitPointsForDirection):
+        (WebCore::virtualRectForDirection):
+        * page/WindowFeatures.cpp:
+        (WebCore::WindowFeatures::WindowFeatures):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::setFrameRect):
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::splitTrack):
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        (WebCore::ScrollbarThemeChromium::paintTickmarks):
+        * platform/graphics/FloatQuad.h:
+        (WebCore::FloatQuad::FloatQuad):
+        * platform/graphics/FloatRect.cpp:
+        (WebCore::FloatRect::intersects):
+        (WebCore::FloatRect::contains):
+        (WebCore::FloatRect::intersect):
+        (WebCore::FloatRect::unite):
+        (WebCore::enclosingIntRect):
+        * platform/graphics/FloatRect.h:
+        (WebCore::FloatRect::maxX):
+        (WebCore::FloatRect::maxY):
+        (WebCore::FloatRect::contains):
+        * platform/graphics/IntRect.cpp:
+        (WebCore::IntRect::intersects):
+        (WebCore::IntRect::contains):
+        (WebCore::IntRect::intersect):
+        (WebCore::IntRect::unite):
+        * platform/graphics/IntRect.h:
+        (WebCore::IntRect::maxX):
+        (WebCore::IntRect::maxY):
+        (WebCore::IntRect::shiftXEdgeTo):
+        (WebCore::IntRect::shiftMaxXEdgeTo):
+        (WebCore::IntRect::shiftYEdgeTo):
+        (WebCore::IntRect::shiftMaxYEdgeTo):
+        (WebCore::IntRect::contains):
+        * platform/graphics/WidthIterator.cpp:
+        (WebCore::WidthIterator::advance):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::getImageData):
+        (WebCore::putImageData):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw):
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::copyImageBytes):
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::adjustGlyphsAndAdvances):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformBoundsForGlyph):
+        * platform/graphics/transforms/AffineTransform.cpp:
+        (WebCore::AffineTransform::mapRect):
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::drawGDIGlyphs):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::centerRectVerticallyInParentInputElement):
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::paint):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::addBoxShadowVisualOverflow):
+        (WebCore::InlineFlowBox::addTextBoxVisualOverflow):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::selectionRect):
+        (WebCore::InlineTextBox::paint):
+        (WebCore::InlineTextBox::positionForOffset):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addOverflowFromChildren):
+        (WebCore::RenderBlock::paintChildren):
+        (WebCore::RenderBlock::paintEllipsisBoxes):
+        (WebCore::RenderBlock::inlineSelectionGaps):
+        (WebCore::RenderBlock::adjustPointToColumnContents):
+        (WebCore::RenderBlock::flipForWritingModeIncludingColumns):
+        (WebCore::RenderBlock::adjustForColumns):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::FloatingObject::right):
+        (WebCore::RenderBlock::FloatingObject::bottom):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::reflectedRect):
+        (WebCore::RenderBox::localCaretRect):
+        (WebCore::RenderBox::addShadowOverflow):
+        (WebCore::RenderBox::addLayoutOverflow):
+        (WebCore::RenderBox::visualOverflowRectForPropagation):
+        (WebCore::RenderBox::layoutOverflowRectForPropagation):
+        (WebCore::RenderBox::flipForWritingMode):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::paintColumnBorder):
+        (WebCore::RenderFrameSet::paintRowBorder):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::paintOutlineForLine):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::getRectToExpose):
+        (WebCore::cornerRect):
+        (WebCore::RenderLayer::positionOverflowControls):
+        (WebCore::RenderLayer::overflowBottom):
+        (WebCore::RenderLayer::overflowRight):
+        (WebCore::RenderLayer::paintResizer):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::rangeIntersectsRect):
+        (WebCore::RenderLineBoxList::paint):
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::positionListMarker):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
+        * rendering/RenderOverflow.h:
+        (WebCore::RenderOverflow::RenderOverflow):
+        (WebCore::RenderOverflow::addLayoutOverflow):
+        (WebCore::RenderOverflow::addVisualOverflow):
+        (WebCore::RenderOverflow::setLayoutOverflow):
+        (WebCore::RenderOverflow::setVisualOverflow):
+        (WebCore::RenderOverflow::resetLayoutOverflow):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::shouldPaint):
+        * rendering/RenderScrollbarTheme.cpp:
+        (WebCore::RenderScrollbarTheme::constrainTrackRectToTrackPieces):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paint):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paint):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::paintObject):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::absoluteQuads):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::forwardEvent):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMenuListButtonGradients):
+        (WebCore::RenderThemeMac::paintMenuListButton):
+        (WebCore::RenderThemeMac::paintSliderTrack):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::computeRectForRepaint):
+        (WebCore::RenderView::docBottom):
+        (WebCore::RenderView::docRight):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::paddedLayoutOverflowRect):
+        * rendering/svg/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::localCaretRect):
+
+2011-02-01  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for <rdar://problem/8492788> Adopt WKScrollbarPainterController
+
+        Lots of new WebCoreSystemInterface functions to export.
+        * WebCore.exp.in:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+        Let the scrollAnimator know when the mouse has
+        moved anywhere inside the page, and when the mouse 
+        has moved in or out of the window. 
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::mouseMoved):
+        (WebCore::EventHandler::updateMouseEventTargetNode):
+
+        Let the scrollAnimator know when the window has become
+        active or inactive.
+        * page/FocusController.cpp:
+        (WebCore::FocusController::setActive):
+        
+        Let the scrollAnimator know when all of these things
+        are happening.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setContentsSize):
+        (WebCore::FrameView::didMoveOnscreen):
+        (WebCore::FrameView::willMoveOffscreen):
+        (WebCore::FrameView::currentMousePosition):
+        (WebCore::FrameView::contentsResized):
+        
+        New functions called through WebKit2 that allow the
+        scrollAnimator to know when a live resize starts and ends.
+        (WebCore::FrameView::willStartLiveResize):
+        (WebCore::FrameView::willEndLiveResize):
+        * page/FrameView.h:
+        
+        New functions on ScrollAnimator that pass information
+        to the WKPainterController when we're using one.
+        * platform/ScrollAnimator.h:
+        (WebCore::ScrollAnimator::scrollableArea):
+        (WebCore::ScrollAnimator::contentAreaWillPaint):
+        (WebCore::ScrollAnimator::mouseEnteredContentArea):
+        (WebCore::ScrollAnimator::mouseExitedContentArea):
+        (WebCore::ScrollAnimator::mouseMovedInContentArea):
+        (WebCore::ScrollAnimator::willStartLiveResize):
+        (WebCore::ScrollAnimator::contentsResized):
+        (WebCore::ScrollAnimator::willEndLiveResize):
+        (WebCore::ScrollAnimator::contentAreaDidShow):
+        (WebCore::ScrollAnimator::contentAreaDidHide):
+        (WebCore::ScrollAnimatorMac::ScrollAnimatorMac):
+        (WebCore::ScrollAnimatorMac::scrollbarPainterDelegate):
+        (WebCore::ScrollAnimatorMac::setPainterForPainterController):
+        (WebCore::ScrollAnimatorMac::removePainterFromPainterController):
+        (WebCore::ScrollAnimatorMac::notityPositionChanged):
+        (WebCore::ScrollAnimatorMac::contentAreaWillPaint):
+        (WebCore::ScrollAnimatorMac::mouseEnteredContentArea):
+        (WebCore::ScrollAnimatorMac::mouseExitedContentArea):
+        (WebCore::ScrollAnimatorMac::mouseMovedInContentArea):
+        (WebCore::ScrollAnimatorMac::willStartLiveResize):
+        (WebCore::ScrollAnimatorMac::contentsResized):
+        (WebCore::ScrollAnimatorMac::willEndLiveResize):
+        (WebCore::ScrollAnimatorMac::contentAreaDidShow):
+        (WebCore::ScrollAnimatorMac::contentAreaDidHide):
+        
+        Let the scrollAnimator know when this is happening.
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::paint):
+        
+        New function lets the scrollAnimator get the current 
+        mouse position.
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::currentMousePosition):
+        
+        New function that returns the scrollAnimator when needed.
+        * platform/ScrollableArea.h:
+        (WebCore::ScrollableArea::scrollAnimator):
+        
+        Keep track of if we're in a live resize using a new memeber
+        variable.
+        * platform/mac/ScrollAnimatorMac.h:
+        (WebCore::ScrollAnimatorMac::inLiveResize):
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::view):
+        
+        New delegates for the WKPainter and WKPainterController
+        (-[ScrollbarPainterControllerDelegate initWithScrollAnimator:WebCore::]):
+        (-[ScrollbarPainterControllerDelegate contentAreaRectForScrollerImpPair:]):
+        (-[ScrollbarPainterControllerDelegate inLiveResizeForScrollerImpPair:]):
+        (-[ScrollbarPainterControllerDelegate mouseLocationInContentAreaForScrollerImpPair:]):
+        (-[ScrollbarPainterControllerDelegate scrollerImpPair:convertContentPoint:toScrollerImp:]):
+        (-[ScrollbarPainterControllerDelegate scrollerImpPair:setContentAreaNeedsDisplayInRect:]):
+        (-[ScrollbarPainterControllerDelegate scrollerImpPair:updateScrollerStyleForNewRecommendedScrollerStyle:]):
+        (-[ScrollKnobAnimation initWithScrollbarPainter:forScrollAnimator:WebCore::animateKnobAlphaTo:duration:]):
+        (-[ScrollKnobAnimation setCurrentProgress:]):
+        (-[ScrollbarPainterDelegate initWithScrollAnimator:WebCore::]):
+        (-[ScrollbarPainterDelegate convertRectToBacking:]):
+        (-[ScrollbarPainterDelegate convertRectFromBacking:]):
+        (-[ScrollbarPainterDelegate layer]):
+        (-[ScrollbarPainterDelegate setUpAnimation:scrollerPainter:animateKnobAlphaTo:duration:]):
+        (-[ScrollbarPainterDelegate scrollerImp:animateKnobAlphaTo:duration:]):
+        (-[ScrollbarPainterDelegate scrollerImp:animateTrackAlphaTo:duration:]):
+        (-[ScrollbarPainterDelegate scrollerImp:overlayScrollerStateChangedTo:]):
+
+        Get the WKScrollbarPainterRefs to synch up with the 
+        WKScrollbarPainterControllerRefs when appropriate
+        * platform/mac/ScrollbarThemeMac.h:
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::registerScrollbar):
+        (WebCore::ScrollbarThemeMac::unregisterScrollbar):
+        (WebCore::ScrollbarThemeMac::setNewPainterForScrollbar):
+        (WebCore::ScrollbarThemeMac::usesOverlayScrollbars):
+
+        Implement ScrollableArea's virtual function contentsSize() for access
+        through the scrollAnimator.
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::contentsSize):
+
+2011-02-01  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by David Hyatt.
+
+        layoutTestController.counterValueForElementById does not return the correct value
+        https://bugs.webkit.org/show_bug.cgi?id=53037
+
+        Test: fast/css/counters/deep-before.html
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::counterValueForElement):
+        Modified to use the newly available RenderObject::beforePseudoElement()
+        and RenderObject::afterPseudoElement() instead of the old imperfect
+        algorithm to find the before and after pseudo elements.
+
+2011-02-01  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Allow access for security origin same as this.
+        https://bugs.webkit.org/show_bug.cgi?id=53440
+
+        Hard to test as newly added path currently is never hit.
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::canAccess): allow access if this == other
+
+2011-01-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Update JSObject storage for new marking API
+        https://bugs.webkit.org/show_bug.cgi?id=53467
+
+        Update WebCore to handle new anonymous slot behaviour.
+
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::setWindow):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::initScript):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2011-02-01  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Fix a text rendering problem when enclosing block is RTL and text runs
+        are in different directionality.
+        https://bugs.webkit.org/show_bug.cgi?id=34176
+
+        The problem happens in the following example scenario (ABC represents 
+        Hebrew characters):
+        <div dir=rtl>this is a <span><span>test <span>ABC</span></span></span></div>
+
+        The line consists of 3 text runs -- TextRun1 TextRun2 TextRun3. In which
+        TextRun1 and TextRun2's bidi level are 2, and TextRun3's bidi level is 1.
+        TextRun2 and TextRun3's least common ancestor is not a sibling of TextRun1.
+
+        The visual bidi run order of the text runs is TextRun3 TextRun1 TextRun2.
+
+        Inside RenderBlock::constructLine(), when RenderBlock::createLineBoxes()
+        creates InlineFlowBox for TextRun2, it should check an InlineFlowBox for
+        the run's render object's ancestor (not only its parent) has already 
+        been constructed or has something following it on the line, in which 
+        case, create a new box for TextRun2 instead of sharing the same box with
+        TextRun3.
+
+        In other words, the following 2 div should render the same results
+        (ABC represents Hebrew characters).
+        <div dir=rtl>this is a <span><span>test <span>ABC</span></span></span></div>
+        <div dir=rtl>this is a <span>Test <span>ABC</span></span></div>
+
+        Test: fast/dom/34176.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::parentIsConstructedOrHaveNext):
+        (WebCore::RenderBlock::createLineBoxes):
+
+2011-02-01  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Do not add a node in the document's stylesheet candidate node list if the
+        node is already removed from document.
+        https://bugs.webkit.org/show_bug.cgi?id=53441
+
+        Test: fast/css/stylesheet-candidate-nodes-crash.xhtml
+
+        * dom/Document.cpp:
+        (WebCore::Document::addStyleSheetCandidateNode):
+
+2011-02-01  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46422, make printing and pagination work
+        with vertical text.
+
+        Change printing functions to check writing-mode and properly swap width and height
+        as needed.
+        
+        Fix the setScrollOrigin function so that the origin doesn't cause
+        scroll spasming during printing (this is only partially successful, but it's better
+        than it was).
+
+        Rewrite computePageRects to handle both RTL documents properly as well as vertical
+        text documents properly.
+
+        * WebCore.exp.in:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::adjustViewSize):
+        (WebCore::FrameView::forceLayoutForPagination):
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::computePageRects):
+        (WebCore::PrintContext::computePageRectsWithPageSizeInternal):
+        (WebCore::PrintContext::computeAutomaticScaleFactor):
+        (WebCore::PrintContext::spoolPage):
+        (WebCore::PrintContext::spoolRect):
+        * page/PrintContext.h:
+        * page/mac/WebCoreFrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::platformSetScrollOrigin):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::layout):
+
+2011-02-01  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Fix profiles reset to avoid clearing heap profiles in Chromium.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53500
+
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::resetFrontendProfiles):
+
+2011-02-01  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Chromium] Landing detailed heap snapshots, part 1.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53173
+
+        Adding code for accessing heap snapshot data and
+        performing graph calculations.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/HeapSnapshot.js:
+        (WebInspector.HeapSnapshotArraySlice): Helper class to avoid array contents copying.
+        (WebInspector.HeapSnapshotEdge): Wrapper for accessing graph edge properties.
+        (WebInspector.HeapSnapshotEdgeIterator):
+        (WebInspector.HeapSnapshotNode): Wrapper for accessing graph node properties.
+        (WebInspector.HeapSnapshotNodeIterator):
+        (WebInspector.HeapSnapshot): Wrapper for the heap snapshot.
+        (WebInspector.HeapSnapshotFilteredOrderedIterator):
+        (WebInspector.HeapSnapshotEdgesProvider):
+        (WebInspector.HeapSnapshotNodesProvider):
+        (WebInspector.HeapSnapshotPathFinder):
+        * inspector/front-end/HeapSnapshotView.js:
+        (WebInspector.HeapSnapshotView.prototype._convertSnapshot):
+
+2011-02-01  Adam Roben  <aroben@apple.com>
+
+        Fix linker warnings in Release_LTCG builds
+
+        * WebCore.vcproj/WebCore.vcproj: Exclude EventNames.cpp and EventTarget.cpp from all
+        configurations, since they get pulled in via DOMAllInOne.cpp.
+
+2011-02-01  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: [Chromium] Wrongly labelled context-menu item for links in Web Inspector's side-pane
+        https://bugs.webkit.org/show_bug.cgi?id=53482
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.populateHrefContextMenu):
+        * inspector/front-end/inspector.js:
+        (WebInspector.resourceForURL):
+        (WebInspector.openLinkExternallyLabel):
+
+2011-02-01  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Propagate parent document security origin to newly create Document XML response
+        https://bugs.webkit.org/show_bug.cgi?id=53444
+
+        Covered by the existing tests.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::responseXML):
+
+2011-02-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Rollout r77230 which caused many layout tests
+        crashes on Chromium Debug bots.
+
+        Async event handlers should not fire within a modal dialog
+        https://bugs.webkit.org/show_bug.cgi?id=53202
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/EventQueue.cpp:
+        (WebCore::EventQueue::EventQueue):
+        (WebCore::EventQueue::enqueueEvent):
+        (WebCore::EventQueue::pendingEventTimerFired):
+        * dom/EventQueue.h:
+
+2011-02-01  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Dirk Schulze.
+
+        LightElement changes does not require relayout.
+        https://bugs.webkit.org/show_bug.cgi?id=53232
+
+        When an attribute of a LightElement changes, it
+        send an update message to the lighting filters
+        to update its corresponding LightSource objects,
+        and repaint the filters.
+
+        Duplicated 'id' attributes removed from svg-filter-animation.svg.
+
+        Existing dynamic-update tests covers this feature.
+
+        5x speedup on manual-tests/svg-filter-animation.svg
+
+        * manual-tests/svg-filter-animation.svg:
+        * platform/graphics/filters/DistantLightSource.h:
+        * platform/graphics/filters/FEDiffuseLighting.cpp:
+        (WebCore::FEDiffuseLighting::setLightingColor):
+        (WebCore::FEDiffuseLighting::setSurfaceScale):
+        (WebCore::FEDiffuseLighting::setDiffuseConstant):
+        (WebCore::FEDiffuseLighting::setKernelUnitLengthX):
+        (WebCore::FEDiffuseLighting::setKernelUnitLengthY):
+        * platform/graphics/filters/FEDiffuseLighting.h:
+        * platform/graphics/filters/LightSource.cpp:
+        (WebCore::PointLightSource::setX):
+        (WebCore::PointLightSource::setY):
+        (WebCore::PointLightSource::setZ):
+        (WebCore::SpotLightSource::setX):
+        (WebCore::SpotLightSource::setY):
+        (WebCore::SpotLightSource::setZ):
+        (WebCore::SpotLightSource::setPointsAtX):
+        (WebCore::SpotLightSource::setPointsAtY):
+        (WebCore::SpotLightSource::setPointsAtZ):
+        (WebCore::SpotLightSource::setSpecularExponent):
+        (WebCore::SpotLightSource::setLimitingConeAngle):
+        (WebCore::DistantLightSource::setAzimuth):
+        (WebCore::DistantLightSource::setElevation):
+        (WebCore::LightSource::setAzimuth):
+        (WebCore::LightSource::setElevation):
+        (WebCore::LightSource::setX):
+        (WebCore::LightSource::setY):
+        (WebCore::LightSource::setZ):
+        (WebCore::LightSource::setPointsAtX):
+        (WebCore::LightSource::setPointsAtY):
+        (WebCore::LightSource::setPointsAtZ):
+        (WebCore::LightSource::setSpecularExponent):
+        (WebCore::LightSource::setLimitingConeAngle):
+        * platform/graphics/filters/LightSource.h:
+        * platform/graphics/filters/PointLightSource.h:
+        * platform/graphics/filters/SpotLightSource.h:
+        * rendering/svg/RenderSVGResourceFilter.cpp:
+        (WebCore::RenderSVGResourceFilter::primitiveAttributeChanged):
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::setFilterEffectAttribute):
+        (WebCore::SVGFEDiffuseLightingElement::lightElementAttributeChanged):
+        (WebCore::SVGFEDiffuseLightingElement::build):
+        (WebCore::SVGFEDiffuseLightingElement::findLightElement):
+        (WebCore::SVGFEDiffuseLightingElement::findLight):
+        * svg/SVGFEDiffuseLightingElement.h:
+        * svg/SVGFELightElement.cpp:
+        (WebCore::SVGFELightElement::svgAttributeChanged):
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::setFilterEffectAttribute):
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+
+2011-02-01  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 53289 - DOM: Move DocumentOrderedMap from Document into separate files
+        https://bugs.webkit.org/show_bug.cgi?id=53289
+
+        Moving the nested class DocumentOrderedMap from Document into separate files,
+        updating code where necessary.
+
+        No new tests. (refactoring)
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUMakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::getElementById):
+        (WebCore::Document::getImageMap):
+        * dom/Document.h:
+        * dom/DocumentOrderedMap.cpp: Added.
+        (WebCore::keyMatchesId):
+        (WebCore::keyMatchesMapName):
+        (WebCore::keyMatchesLowercasedMapName):
+        (WebCore::DocumentOrderedMap::clear):
+        (WebCore::DocumentOrderedMap::add):
+        (WebCore::DocumentOrderedMap::remove):
+        (WebCore::DocumentOrderedMap::get):
+        (WebCore::DocumentOrderedMap::getElementById):
+        (WebCore::DocumentOrderedMap::getElementByMapName):
+        (WebCore::DocumentOrderedMap::getElementByLowercasedMapName):
+        * dom/DocumentOrderedMap.h: Added.
+        (WebCore::DocumentOrderedMap::contains):
+        (WebCore::DocumentOrderedMap::containsMultiple):
+        * dom/DOMAllInOne.cpp:
+
+2011-02-01  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [Gtk] atk_text_set_caret_offset fails for list items
+        https://bugs.webkit.org/show_bug.cgi?id=53388
+
+        Allow using text ranges across list items.
+
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (WebCore::AccessibilityObject::allowsTextRanges): Add list items
+        to the list of accessibility objects supporting text ranges.
+
+2011-02-01  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] character range extents is off when the end of a wrapped line is included
+        https://bugs.webkit.org/show_bug.cgi?id=53323
+
+        Fixed wrong calculation getting the range extents.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_text_get_range_extents): Removed '+1' since the
+        requested interval shouldn't include the last character.
+
+2011-02-01  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Caret Offset is one off at the end of wrapped lines
+        https://bugs.webkit.org/show_bug.cgi?id=53300
+
+        Consider linebreaks as special cases.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (objectAndOffsetUnignored): In order to avoid getting wrong values
+        when around linebreaks, we need to workaround this by explicitly
+        avoiding those '\n' text nodes from affecting the result of
+        calling to TextIterator:rangeLength().
+
+2011-02-01  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Unreviewed, rolling out r77229.
+        http://trac.webkit.org/changeset/77229
+        https://bugs.webkit.org/show_bug.cgi?id=53289
+
+        revert mysterious build breakage
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/DOMAllInOne.cpp:
+        * dom/Document.cpp:
+        (WebCore::Document::DocumentOrderedMap::clear):
+        (WebCore::Document::DocumentOrderedMap::add):
+        (WebCore::Document::DocumentOrderedMap::remove):
+        (WebCore::Document::DocumentOrderedMap::get):
+        (WebCore::keyMatchesId):
+        (WebCore::Document::getElementById):
+        (WebCore::keyMatchesMapName):
+        (WebCore::keyMatchesLowercasedMapName):
+        (WebCore::Document::getImageMap):
+        * dom/Document.h:
+        (WebCore::Document::DocumentOrderedMap::contains):
+        (WebCore::Document::DocumentOrderedMap::containsMultiple):
+        * dom/DocumentOrderedMap.cpp: Removed.
+        * dom/DocumentOrderedMap.h: Removed.
+
+2011-02-01  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Async event handlers should not fire within a modal dialog
+        https://bugs.webkit.org/show_bug.cgi?id=53202
+
+        Asychronous events that use EventQueue would currently fire while a
+        modal dialog (e.g. window.alert()) was up. Change EventQueue to use a
+        SuspendableTimer (which automatically gets suspended while dialogs are
+        up and in other cases where JS execution is not allowed).
+        
+        Test: fast/events/scroll-event-during-modal-dialog.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/EventQueue.cpp:
+        (WebCore::EventQueueTimer::EventQueueTimer):
+        (WebCore::EventQueueTimer::fired):
+        (WebCore::EventQueue::EventQueue):
+        (WebCore::EventQueue::enqueueEvent):
+        (WebCore::EventQueue::pendingEventTimerFired):
+        * dom/EventQueue.h:
+        (WebCore::EventQueue::create):
+
+2011-02-01  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 53289 - DOM: Move DocumentOrderedMap from Document into separate files
+        https://bugs.webkit.org/show_bug.cgi?id=53289
+
+        Moving the nested class DocumentOrderedMap from Document into separate files,
+        updating code where necessary.
+
+        No new tests. (refactoring)
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUMakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::getElementById):
+        (WebCore::Document::getImageMap):
+        * dom/Document.h:
+        * dom/DocumentOrderedMap.cpp: Added.
+        (WebCore::keyMatchesId):
+        (WebCore::keyMatchesMapName):
+        (WebCore::keyMatchesLowercasedMapName):
+        (WebCore::DocumentOrderedMap::clear):
+        (WebCore::DocumentOrderedMap::add):
+        (WebCore::DocumentOrderedMap::remove):
+        (WebCore::DocumentOrderedMap::get):
+        (WebCore::DocumentOrderedMap::getElementById):
+        (WebCore::DocumentOrderedMap::getElementByMapName):
+        (WebCore::DocumentOrderedMap::getElementByLowercasedMapName):
+        * dom/DocumentOrderedMap.h: Added.
+        (WebCore::DocumentOrderedMap::contains):
+        (WebCore::DocumentOrderedMap::containsMultiple):
+        * dom/DOMAllInOne.cpp:
+
+2011-02-01  Naoki Takano  <takano.naoki@gmail.com>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Autofill should work with HTML5 form elements
+        https://bugs.webkit.org/show_bug.cgi?id=51809
+        http://crbug.com/65654
+
+        No new tests, because this fix is for Chromium project and hard to test only in WebKit project.
+
+        * html/InputType.h: Insert comment for canSetSuggestedValue().
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::canSetSuggestedValue): Implemented to return always true for that all text filed inputs can be completed.
+        * html/TextFieldInputType.h: Declare canSetSuggestedValue().
+        * html/TextInputType.cpp: Delete canSetSuggestedValue() not to return true anymore.
+        * html/TextInputType.h: Delete canSetSuggestedValue() not to return true anymore.
+
+2011-02-01  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r65062): Safari loops forever under WebCore::plainTextToMallocAllocatedBuffer()
+        https://bugs.webkit.org/show_bug.cgi?id=53272
+
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::handleTextBox): Pass the appropriate renderer to emitText().
+
+2011-01-31  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53466
+        Move WebKit2 to printing via API methods
+
+        * WebCore.exp.in: Export IntRect::scale().
+
+2011-01-31  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Remove obsolete comment after r41871
+        https://bugs.webkit.org/show_bug.cgi?id=53406
+
+        * dom/Document.h:
+
+2011-01-31  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix according to reviewer comments: can just use Color::black now.
+
+        * platform/graphics/ShadowBlur.cpp:
+        (WebCore::ShadowBlur::drawInsetShadow):
+        (WebCore::ShadowBlur::drawRectShadowWithoutTiling):
+
+2011-01-31  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Clean up ShadowBlur
+        https://bugs.webkit.org/show_bug.cgi?id=53472
+
+        Some minor ShadowBlur cleanup.
+
+        * platform/graphics/ShadowBlur.h:
+        * platform/graphics/ShadowBlur.cpp:
+        (WebCore::ShadowBlur::ShadowBlur): Use m_blurRadius rather than the radius
+        paramter.
+        (WebCore::ShadowBlur::adjustBlurRadius): Renamed from adjustBlurDistance.
+        (WebCore::ShadowBlur::calculateLayerBoundingRect): Rename layerFloatRect to
+        layerRect. Make frameSize a float.
+        (WebCore::ShadowBlur::beginShadowLayer): This now takes a precomputed
+        layerRect rather than calling calculateLayerBoundingRect() to compute
+        it itself, since we were calling calculateLayerBoundingRect() twice.
+        (WebCore::ShadowBlur::drawRectShadow): Optimize to call calculateLayerBoundingRect()
+        only once. The shadowRect variable was unused, so two return paths could be
+        collapsed into one.
+        (WebCore::ShadowBlur::drawInsetShadow): Call calculateLayerBoundingRect() before
+        beginShadowLayer() now.
+        (WebCore::ShadowBlur::drawRectShadowWithoutTiling): The layerRect gets passed in.
+        We always used alpha=1, so no need to pass that in.
+        (WebCore::ShadowBlur::drawRectShadowWithTiling): We always used alpha=1, so no need to
+        pass that in. Move shadowRect down to first use.
+        ShadowBlur::clipBounds() was unused.
+
+2011-01-31  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QWebElements example from QtWebKit Bridge documentation does not work at all
+        https://bugs.webkit.org/show_bug.cgi?id=46748
+
+        This problem disappears when we register QWebElement using qRegisterMetaType, which we now do in QtInstance.
+        Added a regression test to tst_QWebFrame.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::QtInstance):
+
+2011-01-27  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Dimitri Glazkov.
+        
+        Convert <progress> shadow DOM to a DOM-based shadow.
+        https://bugs.webkit.org/show_bug.cgi?id=50660
+
+        * Removed RenderProgress::m_valuePart, moved the shadow node
+          to the shadow root of HTMLProgressElement.
+        * Removed hard-coded pseudo ID for -webkit-progress-bar-value.
+          ProgressBarValueElement is defined only for overriding
+          shadowPseudoId().
+        
+        No new tests. No behavioral change.
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::pseudoId):
+        (WebCore::nameToPseudoTypeMap):
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        * html/HTMLProgressElement.cpp:
+        (WebCore::ProgressBarValueElement::ProgressBarValueElement):
+        (WebCore::ProgressBarValueElement::shadowPseudoId):
+        (WebCore::ProgressBarValueElement::create):
+        (WebCore::ProgressBarValueElement::detach):
+        (WebCore::HTMLProgressElement::parseMappedAttribute):
+        (WebCore::HTMLProgressElement::attach):
+        (WebCore::HTMLProgressElement::valuePart):
+        (WebCore::HTMLProgressElement::didElementStateChange):
+        (WebCore::HTMLProgressElement::createShadowSubtreeIfNeeded):
+        * html/HTMLProgressElement.h:
+        * rendering/RenderProgress.cpp:
+        (WebCore::RenderProgress::~RenderProgress):
+        (WebCore::RenderProgress::updateFromElement):
+        (WebCore::RenderProgress::layoutParts):
+        (WebCore::RenderProgress::shouldHaveParts):
+        (WebCore::RenderProgress::valuePart):
+        * rendering/RenderProgress.h:
+        * rendering/style/RenderStyleConstants.h:
+
+2011-01-31  Charlie Reis  <creis@chromium.org>
+
+        Reviewed by Mihai Parparita.
+
+        Add sanity check to help diagnose bug 52819
+        https://bugs.webkit.org/show_bug.cgi?id=53402
+
+        Crash early if the children of fromItem look invalid.
+
+        * loader/HistoryController.cpp:
+
+2011-01-31  Kalle Vahlman  <kalle.vahlman@movial.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] canvas.drawImage(HTMLVideoElement) doesn't work with Qt Multimedia backend
+        https://bugs.webkit.org/show_bug.cgi?id=53325
+
+        Reimplement paintCurrentFrameInContext() rather than delegate the
+        rendering to paint() to make sure we really do get the video frame
+        content into the GraphicsContext, regardless of accelerated
+        compositing and the video scene state.
+
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivateQt::paintCurrentFrameInContext):
+        * platform/graphics/qt/MediaPlayerPrivateQt.h:
+
+2011-01-31  Emil A Eklund  <eae@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Setting "selected" attribute to false should have no effect in single line <select>
+        https://bugs.webkit.org/show_bug.cgi?id=52436
+
+        Change SelectElement::setSelectedIndex to select the first selectable
+        option when the select state of all options is set to false as required
+        by the HTML5 specification.
+
+        Test: fast/dom/HTMLSelectElement/selected-false.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::setSelectedIndex):
+
+2011-01-31  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Console source references need a left-margin
+        https://bugs.webkit.org/show_bug.cgi?id=53308
+
+        * inspector/front-end/inspector.css:
+        (.console-message-url): Added a 4px margin on the left.
+
+2011-01-31  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by David Hyatt.
+
+        Code Changes only.
+
+        It is needlessly expensive to find the generating node from an anonymous renderer of a pseudoelement.
+        https://bugs.webkit.org/show_bug.cgi?id=53024
+
+        No new tests. No change in functionality
+
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::before):
+        (WebCore::RenderObject::after):
+        (WebCore::RenderObject::generatingNode):
+        Added new accessors for the use of the CSS 2.1 counters code
+        (mainlyly)
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::beforeAfterContainer):
+        (WebCore::RenderObjectChildList::invalidateCounters):
+        (WebCore::RenderObjectChildList::before):
+        (WebCore::RenderObjectChildList::after):
+        Refactored the code to take advantage of the new accessors.
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+        Changed to store the generating node in the :before and :after
+        renderers.
+        * rendering/RenderObjectChildList.h:
+
+2011-01-31  Krithigassree Sambamurthy  <krithigassree.sambamurthy@nokia.com>
+
+        Reviewed by David Hyatt.
+
+        Add background-clip to background shorthand
+        https://bugs.webkit.org/show_bug.cgi?id=52080
+
+        Added background-clip to background-shorthand. Also made changes to
+        include webkitMaskClip to the mask shorthand to keep both in sync.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseFillShorthand):
+
+2011-01-31  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        WKView should support scrollPageDown:, scrollPageUp:, scrollToBeg and other similar selectors
+        https://bugs.webkit.org/show_bug.cgi?id=53460
+
+        * editing/EditorCommand.cpp:
+        (WebCore::executeScrollPageBackward): Added.
+        (WebCore::executeScrollPageForward): Added.
+        (WebCore::executeScrollToBeginningOfDocument): Added.
+        (WebCore::executeScrollToEndOfDocument): Added.
+        (WebCore::createCommandMap): Added the four commands above to the map.
+
+2011-01-31  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Inter-ideograph justification should apply to hiragana and katakana as well
+        https://bugs.webkit.org/show_bug.cgi?id=53464
+
+        Changed the test for expansion opportunities from isCJKIdeograph() to isCJKIdeographOrSymbol().
+
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::expansionOpportunityCount):
+        * platform/graphics/WidthIterator.cpp:
+        (WebCore::WidthIterator::advance):
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::adjustGlyphsAndAdvances):
+
+2011-01-31  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by James Robinson.
+
+        REGRESSION(r76951): Appearance of media controls changed slightly on Qt/Chromium ports
+        https://bugs.webkit.org/show_bug.cgi?id=53314
+
+        Fixes media/controls-strict.html on Chromium.
+
+        * css/mediaControlsChromium.css:
+        (audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline):
+            Added proper box-sizing to avoid differences between strict/quirks mode.
+
+2011-01-31  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Validation message bubble shouldn't inherit text-security style
+        https://bugs.webkit.org/show_bug.cgi?id=53457
+
+        No new tests because the validation message feature depends on timers
+        and is enabled only in Chromium port.
+
+        * css/html.css:
+        (::-webkit-validation-bubble): Reset -webkit-text-security.
+
+2011-01-31  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Potentially Unsafe HashSet of RuntimeObject* in RootObject definition
+        https://bugs.webkit.org/show_bug.cgi?id=53271
+
+        Reapplying this patch again. 
+        The removal of this patch in <http://trac.webkit.org/changeset/77125>
+        as part of https://bugs.webkit.org/show_bug.cgi?id=53418,
+        removed the both the first (failing) patch (r76893) and this fixed 
+        patch (r76969).  This patch includes slight changes necessitated by
+        r77151.
+
+        Reapplying this patch with the change that the second ASSERT in 
+        RootObject::removeRuntimeObject was changed to use
+        .uncheckedGet() instead of the failing .get().  The object in question
+        could be in the process of being GC'ed.  The get() call will not return
+        such an object while the uncheckedGet() call will return the (unsafe) 
+        object.  This is the behavior we want.
+
+        Precautionary change.
+        Changed RootObject to use WeakGCMap instead of HashSet.
+        Found will looking for another issue, but can't produce a test case
+        that is problematic.  THerefore there aren't any new tests.
+
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::invalidate):
+        (JSC::Bindings::RootObject::addRuntimeObject):
+        (JSC::Bindings::RootObject::removeRuntimeObject):
+        * bridge/runtime_root.h:
+
+2011-01-31  Andreas Kling  <kling@webkit.org>
+
+        Unbreak Qt build after r77151.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::removeCachedMethod):
+        (JSC::Bindings::QtInstance::markAggregate):
+
+2011-01-31  takano takumi  <takano@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Implement text-combine rendering code
+        https://bugs.webkit.org/show_bug.cgi?id=50621
+
+        Test: fast/text/international/text-combine-image-test.html
+
+        * Android.mk: Added RenderCombineText.cpp/h
+        * CMakeLists.txt: Added RenderCombineText.cpp/h
+        * GNUmakefile.am: Added RenderCombineText.cpp/h
+        * WebCore.exp.in:
+        * WebCore.gypi: Added RenderCombineText.cpp/h
+        * WebCore.pro: Added RenderCombineText.cpp/h
+        * WebCore.vcproj/WebCore.vcproj: Added RenderCombineText.cpp/h
+        * WebCore.xcodeproj/project.pbxproj: Added RenderCombineText.cpp/h
+        * css/CSSFontFaceSource.cpp:
+        (WebCore::CSSFontFaceSource::getFontData):
+        - Added fontDescription.widthVariant to SimpleFontData creation.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        - Changed to set "Unique" flag to RenderStyle in case of TextCombine.
+        * dom/Text.cpp:
+        (WebCore::Text::createRenderer):
+        - Changed to create RenderCombineText in case of TextCombine.
+        * loader/cache/CachedFont.cpp:
+        (WebCore::CachedFont::platformDataFromCustomData):
+        - Added FontWidthVariant as an argument for FontPlatformData creation.
+        * loader/cache/CachedFont.h:
+        - Ditto.
+        * platform/graphics/Font.h:
+        (WebCore::Font::widthVariant):
+        - The accessor to FontWidthVariant member variable.
+        * platform/graphics/FontCache.cpp:
+        - Made cache to incorporate FontWidthVariant value.
+        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
+        (WebCore::FontPlatformDataCacheKey::operator==):
+        (WebCore::computeHash):
+        (WebCore::FontCache::getCachedFontPlatformData):
+        * platform/graphics/FontDescription.h:
+        - Add a member variable that holds a width variant - none, half-width, third-width, and quarter-width.
+        (WebCore::FontDescription::FontDescription):
+        (WebCore::FontDescription::widthVariant):
+        (WebCore::FontDescription::setWidthVariant):
+        (WebCore::FontDescription::operator==):
+        * platform/graphics/FontWidthVariant.h: Added.
+        * platform/graphics/cairo/FontCustomPlatformData.h:
+        - Changed to carry FontWidthVariant value.
+        * platform/graphics/cocoa/FontPlatformData.h:
+        - Changed to carry FontWidthVariant value.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::widthVariant):
+        (WebCore::FontPlatformData::hash):
+        (WebCore::FontPlatformData::operator==):
+        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
+        (WebCore::FontPlatformData::FontPlatformData):
+        - Changed to carry FontWidthVariant value.
+        (WebCore::FontPlatformData::operator=):
+        - Ditto.
+        (WebCore::mapFontWidthVariantToCTFeatureSelector):
+        - A function to map a FontWidthVariant value to a CoreText's text spacing feature selector.
+        (WebCore::FontPlatformData::ctFont):
+        - Changed to create CTFont with text spacing variant based on FontWidthVariant.
+        * platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        - Changed to carry FontWidthVariant value.
+        * platform/graphics/haiku/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        - Changed to carry FontWidthVariant value.
+        * platform/graphics/haiku/FontCustomPlatformData.h:
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore::FontCache::createFontPlatformData):
+        - Changed to carry FontWidthVariant value.
+        * platform/graphics/mac/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        - Changed to carry FontWidthVariant value.
+        * platform/graphics/mac/FontCustomPlatformData.h:
+        - Ditto.
+        * platform/graphics/mac/GlyphPageTreeNodeMac.cpp:
+        (WebCore::shouldUseCoreText):
+        - Changed to skip CT path when width variant is specified.
+        * platform/graphics/pango/FontCustomPlatformDataPango.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        - Ditto.
+        * platform/graphics/qt/FontCustomPlatformData.h:
+        - Ditto.
+        * platform/graphics/qt/FontCustomPlatformDataQt.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        - Ditto.
+        * platform/graphics/skia/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        - Ditto.
+        * platform/graphics/skia/FontCustomPlatformData.h:
+        - Ditto.
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        - Ditto.
+        * platform/graphics/win/FontCustomPlatformData.h:
+        - Ditto.
+        * platform/graphics/win/FontCustomPlatformDataCairo.cpp:
+        - Ditto.
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        - Ditto.
+        * platform/graphics/win/FontCustomPlatformDataCairo.h:
+        - Ditto.
+        * platform/graphics/wince/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        - Ditto.
+        * platform/graphics/wince/FontCustomPlatformData.h:
+        - Ditto.
+        * platform/graphics/wx/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        - Ditto.
+        * platform/graphics/wx/FontCustomPlatformData.h:
+        - Ditto.
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+        - In case of RenderCombineText, we don't rotate text even in vertical writing. Also, we render original text
+        instead of text returned from text().
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computeInlinePreferredLogicalWidths):
+        - Made to call RenderCombinedText's prepareTextCombine() here.
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::textWidth):
+        - Made to always use the render object's width() in case of TextCombine.
+        (WebCore::RenderBlock::findNextLineBreak):
+        - Made to call RenderCombinedText's prepareTextCombine() here.
+        * rendering/RenderCombineText.cpp: Added. A subclass of RenderText.
+        (WebCore::RenderCombineText::RenderCombineText):
+        (WebCore::RenderCombineText::styleDidChange):
+        - Clear the flag that indicated the font has been prepared for combining. The font will be reinitialized in
+        the next call of RenderBlock::findNextLineBreak().
+        (WebCore::RenderCombineText::setTextInternal):
+        - Ditto.
+        (WebCore::RenderCombineText::width):
+        - Returns 1-em width in case of font combine.
+        (WebCore::RenderCombineText::adjustTextOrigin):
+        - Adjust drawing origin point in case of font combine.
+        (WebCore::RenderCombineText::charactersToRender):
+        - Return original text instead of current text in case of font combine.
+        (WebCore::RenderCombineText::combineText):
+        - This function tries to pack passed text with; 1) the current font as is, 2) the font created
+        from the descriptor with half-width variant specified, 3) the font with third-width variant, 4) the font
+        with quarter-width variant.
+        - If a suitable font successfully found, replace the current font with the new font. If no appropriate font found,
+        we give up text-combine as the CSS spec describes.
+        - If a new font found, we replace the text with 0xFFFC. This is needed for a combined text block to be able to
+        behave like a single character against text decorations.
+        * rendering/RenderCombineText.h: Added.
+        (WebCore::RenderCombineText::isCombined):
+        (WebCore::RenderCombineText::combinedTextWidth):
+        - Returns 1-em width in case of font combine.
+        (WebCore::RenderCombineText::renderName):
+        (WebCore::toRenderCombineText):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::widthFromCache):
+        - Made to call RenderCombineText's combinedTextWidth when the text is combined.
+        * rendering/RenderingAllInOne.cpp: Added RenderCombineText.cpp
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::hasTextCombine):
+        - Added for a quick test of TextCombine.
+
+2011-01-31  Oliver Hunt  <oliver@apple.com>
+
+        Convert markstack to a slot visitor API
+        https://bugs.webkit.org/show_bug.cgi?id=53219
+
+        rolling r77098, r77099, r77100, r77109, and
+        r77111 back in, along with a few more Qt fix attempts.
+
+        * ForwardingHeaders/runtime/WriteBarrier.h: Added.
+        * WebCore.exp.in:
+        * bindings/js/DOMWrapperWorld.h:
+        (WebCore::DOMWrapperWorld::globalData):
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markDOMNodesForDocument):
+        (WebCore::markDOMObjectWrapper):
+        (WebCore::markDOMNodeWrapper):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::markChildren):
+        (WebCore::JSDOMGlobalObject::setInjectedScript):
+        (WebCore::JSDOMGlobalObject::injectedScript):
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
+        (WebCore::getDOMConstructor):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::DialogHandler::dialogCreated):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::JSDOMWindowShell):
+        (WebCore::JSDOMWindowShell::setWindow):
+        (WebCore::JSDOMWindowShell::markChildren):
+        (WebCore::JSDOMWindowShell::unwrappedObject):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::window):
+        (WebCore::JSDOMWindowShell::setWindow):
+        * bindings/js/JSDeviceMotionEventCustom.cpp:
+        (WebCore::createAccelerationObject):
+        (WebCore::createRotationRateObject):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::markJSFunction):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::jsFunction):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::setAll):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::scopeChain):
+        (WebCore::JSJavaScriptCallFrame::scopeType):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::markAggregate):
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSNodeFilterCondition.h:
+        * bindings/js/JSNodeFilterCustom.cpp:
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        (WebCore::JSSQLResultSetRowList::item):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::restore):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneDeserializer::putProperty):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/qt/qt_class.cpp:
+        (JSC::Bindings::QtClass::fallbackObject):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::QtInstance):
+        (JSC::Bindings::QtInstance::removeCachedMethod):
+        (JSC::Bindings::QtInstance::markAggregate):
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::QtRuntimeMetaMethod):
+        (JSC::Bindings::QtRuntimeMetaMethod::markChildren):
+        (JSC::Bindings::QtRuntimeMetaMethod::connectGetter):
+        (JSC::Bindings::QtRuntimeMetaMethod::disconnectGetter):
+        * bridge/qt/qt_runtime.h:
+        * dom/Document.h:
+
+2011-01-31  Dan Winship  <danw@gnome.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        wss (websockets ssl) support for gtk via new gio TLS support
+        https://bugs.webkit.org/show_bug.cgi?id=50344
+
+        Update to use GPollableOutputStream and GTlsConnection to
+        implement wss URLs
+
+        * platform/network/soup/SocketStreamHandle.h:
+        * platform/network/soup/SocketStreamHandleSoup.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+        (WebCore::SocketStreamHandle::connected):
+        (WebCore::SocketStreamHandle::platformSend):
+        (WebCore::SocketStreamHandle::beginWaitingForSocketWritability):
+        (WebCore::writeReadyCallback):
+
+2011-01-31  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Check the textarea node still exists in document before casting
+        it to HTMLTextAreaElement.
+        https://bugs.webkit.org/show_bug.cgi?id=53429
+
+        Test: fast/forms/textarea-node-removed-from-document-crash.html
+
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::~RenderTextControlMultiLine):
+
+2011-01-27  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        If beforeChild is wrapped in an anonymous table section, we need to
+        go the parent to find it and use it before adding childs to table.
+        https://bugs.webkit.org/show_bug.cgi?id=53276
+
+        We need to make sure that beforeChild's parent is "this" before calling
+        RenderBox::addChild. The previous condition in while is too restrictive
+        and fails to calculate the right beforeChild value when its display
+        style is table caption.
+        Test: fast/table/before-child-non-table-section-add-table-crash.html
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::addChild):
+
+2011-01-31  Shane Stephens  <shanestephens@google.com>
+
+        Reviewed by Simon Fraser.
+
+        AffineTransform::translateRight incorrectly computes a translateLeft.
+        https://bugs.webkit.org/show_bug.cgi?id=52551
+
+        Removed translateRight and converted all uses to perform standard
+        matrix multiplication.
+
+        No new tests because patch doesn't modify functionality.
+
+        * platform/graphics/transforms/AffineTransform.cpp:
+        * platform/graphics/transforms/AffineTransform.h:
+        (WebCore::AffineTransform::translation):
+        * rendering/svg/RenderSVGResourceMarker.cpp:
+        (WebCore::RenderSVGResourceMarker::localToParentTransform):
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::localToRepaintContainerTransform):
+        (WebCore::RenderSVGRoot::localToParentTransform):
+        * rendering/svg/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::localToParentTransform):
+        * rendering/svg/SVGTextLayoutEngine.cpp:
+        (WebCore::SVGTextLayoutEngine::finalizeTransformMatrices):
+
+2011-01-31  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [Gtk] atk_text_set_caret_offset returns True even when it is unsuccessful
+        https://bugs.webkit.org/show_bug.cgi?id=53389
+
+        Return FALSE when not able to set the caret at the specified offset.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_text_set_caret_offset): Return FALSE when the
+        range created is NULL and adjust offset to account for list markers.
+
+2011-01-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: copy HAR to clipboard instead of saving blob on export.
+        https://bugs.webkit.org/show_bug.cgi?id=53328
+
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkPanel.prototype._exportAll):
+        (WebInspector.NetworkPanel.prototype._exportResource):
+
+2011-01-30  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: speed up network panel rendering.
+        https://bugs.webkit.org/show_bug.cgi?id=53397
+
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype.get scrollContainer):
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkPanel.prototype.elementsToRestoreScrollPositionsFor):
+        (WebInspector.NetworkPanel.prototype._positionSummaryBar):
+        (WebInspector.NetworkPanel.prototype._createTable):
+        (WebInspector.NetworkPanel.prototype._exportResource):
+        (WebInspector.NetworkPanel.prototype._onScroll):
+        * inspector/front-end/networkPanel.css:
+        (.network-sidebar .data-grid.small tr.offscreen):
+        (.network-sidebar .data-grid tr.offscreen):
+        (.network-sidebar .data-grid tr.offscreen td):
+
+2011-01-31  Peter Varga  <pvarga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Remove wrec from WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=53298
+
+        No new tests needed.
+
+        * Android.jscbindings.mk:
+        * ForwardingHeaders/wrec/WREC.h: Removed.
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/copyForwardingHeaders.cmd:
+
+2011-01-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r76969.
+        http://trac.webkit.org/changeset/76969
+        https://bugs.webkit.org/show_bug.cgi?id=53418
+
+        "It is causing crashes in GTK+ and Leopard bots" (Requested by
+        alexg__ on #webkit).
+
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::invalidate):
+        (JSC::Bindings::RootObject::addRuntimeObject):
+        (JSC::Bindings::RootObject::removeRuntimeObject):
+        * bridge/runtime_root.h:
+
+2011-01-31  Antti Koivisto  <antti@apple.com>
+
+        Not reviewed.
+
+        Spelling.
+
+        * css/CSSSelectorList.h:
+        (WebCore::CSSSelectorList::next):
+
+2011-01-31  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Fix Chromium compilation on Linux.
+
+        * platform/graphics/ShadowBlur.cpp: added PLATFORM(CHROMIUM) guard
+        * platform/graphics/ShadowBlur.h: added missing ColorSpace.h header include
+
+2011-01-31  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Fix Chromium compilation on Mac broken by r77101.
+
+        * WebCore.gypi: add ShadowBlur.{h,cpp} to the gypi file.
+
+2011-01-31  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        WebInspector: Change button title from "Clear CPU profiles" to "Clear all profiles".
+
+        https://bugs.webkit.org/show_bug.cgi?id=53309
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+
+2011-01-31  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed, fix the build with current GTK+ 3.x.
+
+        * plugins/gtk/gtk2xtbin.c:
+        * plugins/gtk/gtk2xtbin.h:
+
+2011-01-30  Kenichi Ishibashi  <bashi@google.com>
+
+        Reviewed by Kent Tamura.
+
+        Dangling form associated elements should not be registered on the document
+        https://bugs.webkit.org/show_bug.cgi?id=53223
+
+        Adds insertedIntoDocument() and remvoedFromDocument() to
+        FormAssociatedElement class to register the element on the document
+        if and only if it actually inserted into (removed from) the document.
+
+        Test: fast/forms/dangling-form-element-crash.html
+
+        * html/FormAssociatedElement.cpp:
+        (WebCore::FormAssociatedElement::insertedIntoDocument): Added.
+        (WebCore::FormAssociatedElement::removedFromDocument): Ditto.
+        (WebCore::FormAssociatedElement::insertedIntoTree): Don't register
+        the element to a document.
+        (WebCore::FormAssociatedElement::removedFromTree): Don't unregister
+        the element from a document.
+        * html/FormAssociatedElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::insertedIntoDocument): Added.
+        (WebCore::HTMLFormControlElement::removedFromDocument): Ditto.
+        * html/HTMLFormControlElement.h:
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::insertedIntoDocument): Calls
+        FormAssociatedElement::insertedIntoDocument().
+        (WebCore::HTMLObjectElement::removedFromDocument): Calls
+        FormAssociatedElement::removedFromDocument().
+
+2011-01-30  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed, rolling out r77098, r77099, r77100, r77109, and
+        r77111.
+        http://trac.webkit.org/changeset/77098
+        http://trac.webkit.org/changeset/77099
+        http://trac.webkit.org/changeset/77100
+        http://trac.webkit.org/changeset/77109
+        http://trac.webkit.org/changeset/77111
+        https://bugs.webkit.org/show_bug.cgi?id=53219
+
+        Qt build is broken
+
+        * ForwardingHeaders/runtime/WriteBarrier.h: Removed.
+        * WebCore.exp.in:
+        * bindings/js/DOMWrapperWorld.h:
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markDOMNodesForDocument):
+        (WebCore::markDOMObjectWrapper):
+        (WebCore::markDOMNodeWrapper):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::markChildren):
+        (WebCore::JSDOMGlobalObject::setInjectedScript):
+        (WebCore::JSDOMGlobalObject::injectedScript):
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
+        (WebCore::getDOMConstructor):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::DialogHandler::dialogCreated):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::JSDOMWindowShell):
+        (WebCore::JSDOMWindowShell::setWindow):
+        (WebCore::JSDOMWindowShell::markChildren):
+        (WebCore::JSDOMWindowShell::unwrappedObject):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::window):
+        (WebCore::JSDOMWindowShell::setWindow):
+        * bindings/js/JSDeviceMotionEventCustom.cpp:
+        (WebCore::createAccelerationObject):
+        (WebCore::createRotationRateObject):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::markJSFunction):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::jsFunction):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::setAll):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::scopeChain):
+        (WebCore::JSJavaScriptCallFrame::scopeType):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::markAggregate):
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSNodeFilterCondition.h:
+        * bindings/js/JSNodeFilterCustom.cpp:
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        (WebCore::JSSQLResultSetRowList::item):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::restore):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneDeserializer::putProperty):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::QtInstance):
+        (JSC::Bindings::QtInstance::removeCachedMethod):
+        (JSC::Bindings::QtInstance::markAggregate):
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::QtRuntimeMetaMethod):
+        (JSC::Bindings::QtRuntimeMetaMethod::markChildren):
+        (JSC::Bindings::QtRuntimeMetaMethod::connectGetter):
+        (JSC::Bindings::QtRuntimeMetaMethod::disconnectGetter):
+        * bridge/qt/qt_runtime.h:
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::invalidate):
+        * bridge/runtime_root.h:
+        * dom/Document.h:
+
+2011-01-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r77107.
+        http://trac.webkit.org/changeset/77107
+        https://bugs.webkit.org/show_bug.cgi?id=53412
+
+        Caused 5 new form-related test crashes (Requested by smfr on
+        #webkit).
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::pseudoId):
+        (WebCore::nameToPseudoTypeMap):
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        * html/HTMLProgressElement.cpp:
+        (WebCore::HTMLProgressElement::parseMappedAttribute):
+        (WebCore::HTMLProgressElement::attach):
+        * html/HTMLProgressElement.h:
+        * rendering/RenderProgress.cpp:
+        (WebCore::RenderProgress::~RenderProgress):
+        (WebCore::RenderProgress::updateFromElement):
+        (WebCore::RenderProgress::layoutParts):
+        (WebCore::RenderProgress::shouldHaveParts):
+        * rendering/RenderProgress.h:
+        * rendering/style/RenderStyleConstants.h:
+
+2011-01-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Enhance ShadowBlur to render inset box shadows
+        https://bugs.webkit.org/show_bug.cgi?id=51567
+        
+        Use ShadowBlur for inset box-shadows with CG. It 
+        currently lacks a tiled version, but is still much
+        faster than CG shadows.
+
+        Test: fast/box-shadow/inset-box-shadow-radius.html
+
+        * platform/graphics/ShadowBlur.cpp:
+        * platform/graphics/ShadowBlur.h: New method for inset
+        shadows.
+        (WebCore::ShadowBlur::drawInsetShadow): 
+
+        * platform/graphics/GraphicsContext.cpp: #ifdef out
+        fillRectWithRoundedHole() for CG.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::fillRectWithRoundedHole): If there's
+        a shadow with a radius > 0, use ShadowBlur.
+
+2011-01-28  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Chris Marrin.
+
+        WebGL shows PNG Textures with indexed colors too dark
+        https://bugs.webkit.org/show_bug.cgi?id=47477
+
+        Properly handle indexed PNG images by re-rendering them as RGBA
+        images before upload. Verified with this layout test and the test
+        cases from bugs 47477 and 53269.
+
+        * platform/graphics/cg/GraphicsContext3DCG.cpp:
+        (WebCore::GraphicsContext3D::getImageData):
+
+2011-01-27  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Dimitri Glazkov.
+        
+        Convert <progress> shadow DOM to a DOM-based shadow.
+        https://bugs.webkit.org/show_bug.cgi?id=50660
+
+        * Removed RenderProgress::m_valuePart, moved the shadow node
+          to the shadow root of HTMLProgressElement.
+        * Removed hard-coded pseudo ID for -webkit-progress-bar-value.
+          ProgressBarValueElement is defined only for overriding
+          shadowPseudoId().
+        
+        No new tests. No behavioral change.
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::pseudoId):
+        (WebCore::nameToPseudoTypeMap):
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        * html/HTMLProgressElement.cpp:
+        (WebCore::ProgressBarValueElement::ProgressBarValueElement):
+        (WebCore::ProgressBarValueElement::shadowPseudoId):
+        (WebCore::ProgressBarValueElement::create):
+        (WebCore::HTMLProgressElement::parseMappedAttribute):
+        (WebCore::HTMLProgressElement::attach):
+        (WebCore::HTMLProgressElement::valuePart):
+        (WebCore::HTMLProgressElement::didElementStateChange):
+        (WebCore::HTMLProgressElement::createShadowSubtreeIfNeeded):
+        * html/HTMLProgressElement.h:
+        * rendering/RenderProgress.cpp:
+        (WebCore::RenderProgress::~RenderProgress):
+        (WebCore::RenderProgress::updateFromElement):
+        (WebCore::RenderProgress::layoutParts):
+        (WebCore::RenderProgress::shouldHaveParts):
+        (WebCore::RenderProgress::valuePart):
+        * rendering/RenderProgress.h:
+        * rendering/style/RenderStyleConstants.h:
+
+2011-01-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Enhance ShadowBlur to render inset box shadows; Part 1.
+        https://bugs.webkit.org/show_bug.cgi?id=51567
+        
+        Add a new method to GraphicsContext to render a rect with a rounded hole,
+        for use by inset box-shadow code. Knowledge that we're rendering a rounded
+        hole will enable ShadowBlur to be used here in future.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::fillRectWithRoundedHole):
+        * platform/graphics/GraphicsContext.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+
+2011-01-23  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION: Inset shadow with too large border radius misses rounded corner.
+        https://bugs.webkit.org/show_bug.cgi?id=52800
+
+        The refactoring on r76083 broke the invariant between border
+        IntRect and its radii because RoundedIntRect::setRect() is called
+        after getRoundedInnerBorderWithBorderWidths(), which enforces the
+        invariant. Th rounded-rect clipping code verifies the invariant,
+        and discard the invalid radii, that results broken paintings.
+        
+        This change moved setRect() before
+        getRoundedInnerBorderWithBorderWidths() not to modify the valid
+        RoundedIntRect value.
+        
+        Test: fast/box-shadow/inset-with-extraordinary-radii-and-border.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+
+2011-01-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Attempt to fix Windows build by adding ShadowBlur.cpp/h to the
+        vcproj.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2011-01-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        -webkit-box-shadow causes awful scroll/resize/redraw performance
+        https://bugs.webkit.org/show_bug.cgi?id=22102
+        
+        Use ShadowBlur for CG, whe rendering shadows on rects and
+        rounded rects outside of canvas.
+        
+        CG shadows with a radius of more than 8px do not render
+        correctly. We preserve this incorrect rendering by compensating
+        for it when rending -webkit-box-shadow. Calls that should use
+        this deprecated radius behavior now use setLegacyShadow().
+
+        Test: fast/box-shadow/box-shadow-transformed.html
+        
+        * html/canvas/CanvasRenderingContext2D.cpp: Use setLegacyShadow()
+        for canvas, to indicate that it should use the deprecated radius
+        behavior.
+        (WebCore::CanvasRenderingContext2D::setAllAttributesToDefault): Ditto.
+        (WebCore::CanvasRenderingContext2D::setShadow): Ditto.
+        (WebCore::CanvasRenderingContext2D::applyShadow): Ditto.
+        
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setLegacyShadow): Set the m_state.shadowsUseLegacyRadius bit.
+        
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::GraphicsContextState::GraphicsContextState): Add a 
+        shadowsUseLegacyRadius bit to the state.
+        
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::radiusToLegacyRadius): Map from the actual radius to one
+        that approximates CG behavior.
+        (WebCore::hasBlurredShadow): Helper that returns true if we have a shadow
+        with a non-zero blur radius.
+        (WebCore::GraphicsContext::fillRect): Use ShadowBlur if not canvas.
+        (WebCore::GraphicsContext::fillRoundedRect): Ditto.
+        (WebCore::GraphicsContext::setPlatformShadow): Comment.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBoxShadow): Call setLegacyShadow()
+        for -webkit-box-shadow.
+
+        * platform/graphics/ShadowBlur.cpp: 
+        (WebCore::ShadowBlur::calculateLayerBoundingRect): Fix some pixel crack issues
+        by rounding up the blur radius.
+        (WebCore::ShadowBlur::drawRectShadow): Ditto
+        (WebCore::ShadowBlur::drawRectShadowWithTiling): Ditto.
+
+2011-01-30  Oliver Hunt  <oliver@apple.com>
+
+        Try to fix Qt build (again).
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::connectGetter):
+        (JSC::Bindings::QtRuntimeMetaMethod::disconnectGetter):
+
+2011-01-30  Oliver Hunt  <oliver@apple.com>
+
+        Try to fix Qt build.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::QtInstance):
+        (JSC::Bindings::QtInstance::removeCachedMethod):
+        (JSC::Bindings::QtInstance::markAggregate):
+        * bridge/qt/qt_instance.h:
+
+2011-01-30  Oliver Hunt  <oliver@apple.com>
+
+        Convert markstack to a slot visitor API
+        https://bugs.webkit.org/show_bug.cgi?id=53219
+
+        rolling r77006 and r77020 back in.
+
+        * ForwardingHeaders/runtime/WriteBarrier.h: Added.
+        * WebCore.exp.in:
+        * bindings/js/DOMWrapperWorld.h:
+        (WebCore::DOMWrapperWorld::globalData):
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markDOMNodesForDocument):
+        (WebCore::markDOMObjectWrapper):
+        (WebCore::markDOMNodeWrapper):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::markChildren):
+        (WebCore::JSDOMGlobalObject::setInjectedScript):
+        (WebCore::JSDOMGlobalObject::injectedScript):
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
+        (WebCore::getDOMConstructor):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::DialogHandler::dialogCreated):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::JSDOMWindowShell):
+        (WebCore::JSDOMWindowShell::setWindow):
+        (WebCore::JSDOMWindowShell::markChildren):
+        (WebCore::JSDOMWindowShell::unwrappedObject):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::window):
+        (WebCore::JSDOMWindowShell::setWindow):
+        * bindings/js/JSDeviceMotionEventCustom.cpp:
+        (WebCore::createAccelerationObject):
+        (WebCore::createRotationRateObject):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::markJSFunction):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::jsFunction):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::setAll):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::scopeChain):
+        (WebCore::JSJavaScriptCallFrame::scopeType):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::markAggregate):
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSNodeFilterCondition.h:
+        * bindings/js/JSNodeFilterCustom.cpp:
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        (WebCore::JSSQLResultSetRowList::item):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::restore):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneDeserializer::putProperty):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::QtRuntimeMetaMethod):
+        (JSC::Bindings::QtRuntimeMetaMethod::markChildren):
+        (JSC::Bindings::QtRuntimeMetaMethod::connectGetter):
+        (JSC::Bindings::QtRuntimeMetaMethod::disconnectGetter):
+        * bridge/qt/qt_runtime.h:
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::invalidate):
+        * bridge/runtime_root.h:
+        * dom/Document.h:
+
+2011-01-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make ContextShadow code cross-platform
+        https://bugs.webkit.org/show_bug.cgi?id=51312
+
+        Add a new class, ShadowBlur, that contains most of the
+        code from ContextShadow, but is fully cross-platform.
+        It depends on one new method, GraphicsContext::clipBounds(),
+        which platforms will have to implement.
+        
+        Add ShadowBlur to the Mac Xcode project, but don't use it
+        anywhere yet.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::clipBounds):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/ShadowBlur.cpp: Added.
+        (WebCore::roundUpToMultipleOf32):
+        (WebCore::ScratchBuffer::ScratchBuffer):
+        (WebCore::ScratchBuffer::getScratchBuffer):
+        (WebCore::ScratchBuffer::scheduleScratchBufferPurge):
+        (WebCore::ScratchBuffer::timerFired):
+        (WebCore::ScratchBuffer::clearScratchBuffer):
+        (WebCore::ScratchBuffer::shared):
+        (WebCore::ShadowBlur::ShadowBlur):
+        (WebCore::ShadowBlur::blurLayerImage):
+        (WebCore::ShadowBlur::adjustBlurDistance):
+        (WebCore::ShadowBlur::calculateLayerBoundingRect):
+        (WebCore::ShadowBlur::beginShadowLayer):
+        (WebCore::ShadowBlur::endShadowLayer):
+        (WebCore::ShadowBlur::drawRectShadow):
+        (WebCore::ShadowBlur::drawRectShadowWithoutTiling):
+        (WebCore::ShadowBlur::drawRectShadowWithTiling):
+        (WebCore::ShadowBlur::clipBounds):
+        * platform/graphics/ShadowBlur.h: Added.
+        (WebCore::ShadowBlur::setShadowsIgnoreTransforms):
+        (WebCore::ShadowBlur::shadowsIgnoreTransforms):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::clipBounds):
+
+2011-01-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        CSS3 gradients with em-based stops fail to repaint when font size changes
+        https://bugs.webkit.org/show_bug.cgi?id=51845
+        
+        Mark as uncacheable gradidients whose color stops depend on font size,
+        and don't attempt to put these into CSSImageGeneratorValue's image cache.
+        This means we return a new gradient each time, which is fairly cheap, and
+        fixes repaint issues under changing font size.
+
+        Test: fast/repaint/gradients-em-stops-repaint.html
+
+        * css/CSSGradientValue.cpp:
+        (WebCore::CSSGradientValue::image):
+        (WebCore::CSSGradientValue::isCacheable):
+        * css/CSSGradientValue.h:
+
+2011-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Undo try to fix the Qt build.
+        
+        My guess didn't work.
+
+        * WebCore.pro:
+
+2011-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Qt build.
+
+        * WebCore.pro: Added platform/text/CharacterNames.h.
+
+2011-01-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Some more Heap cleanup.
+        https://bugs.webkit.org/show_bug.cgi?id=53357
+        
+        Updated for JavaScriptCore changes.
+
+        * bindings/js/ScriptGCEvent.cpp:
+        (WebCore::ScriptGCEvent::getHeapSize):
+
+2011-01-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Daniel Bates.
+
+        Fix XSSFilter crash when extracting the source for a token twice
+        https://bugs.webkit.org/show_bug.cgi?id=53368
+
+        Previously, it was unsafe to extract the source for the same token
+        twice because the HTMLSourceTracker would advance its internal
+        representation of the SegmentedString.  This patch introduces a cache
+        to make calling HTMLSourceTracker::sourceForToken multiple times safe.
+
+        * html/parser/HTMLSourceTracker.cpp:
+        (WebCore::HTMLSourceTracker::end):
+        (WebCore::HTMLSourceTracker::sourceForToken):
+        * html/parser/HTMLSourceTracker.h:
+
+2011-01-29  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix fat build for both 32-bit and 64-bit under llvm-gcc 4.2
+        https://bugs.webkit.org/show_bug.cgi?id=53386
+
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::elasticDeltaForReboundDelta):
+        (WebCore::scrollWheelMultiplier):
+        (WebCore::ScrollAnimatorMac::smoothScrollWithEvent):
+        (WebCore::ScrollAnimatorMac::beginScrollGesture):
+        (WebCore::roundTowardZero):
+        (WebCore::ScrollAnimatorMac::snapRubberBandTimerFired):
+
+2011-01-29  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove reference to ${CMAKE_SOURCE_DIR}/Source in CMake files
+        https://bugs.webkit.org/show_bug.cgi?id=53382
+
+        Our file system hierarchy ensures that CMAKE_SOURCE_DIR is defined to be /Source.
+        So, ${CMAKE_SOURCE_DIR}/Source evaluates to the non-existent directory /Source/Source.
+        Therefore, we should remove such references.
+
+        * CMakeLists.txt:
+
+2011-01-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix 32-bit build on the Mac.
+
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::roundTowardZero):
+        (WebCore::roundToDevicePixelTowardZero):
+        Use floats instead of doubles to avoid double-to-float conversion
+        issues.
+
+2011-01-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Use clampToInteger() functions in a few places
+        https://bugs.webkit.org/show_bug.cgi?id=53363
+        
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Use clampToInteger() for z-index.
+        (WebCore::CSSStyleSelector::createTransformOperations): Use clampToPositiveInteger().
+        * platform/graphics/transforms/PerspectiveTransformOperation.cpp: Ditto.
+        (WebCore::PerspectiveTransformOperation::blend): Ditto.
+
+2011-01-29  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Move CharacterNames.h into WTF directory
+        https://bugs.webkit.org/show_bug.cgi?id=49618
+
+        * ForwardingHeaders/wtf/unicode/CharacterNames.h: Added.
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * accessibility/AccessibilityObject.cpp:
+        * accessibility/AccessibilityRenderObject.cpp:
+        * bindings/cpp/WebDOMHTMLDocumentCustom.cpp:
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        * dom/Position.cpp:
+        * dom/SelectElement.cpp:
+        * editing/CompositeEditCommand.cpp:
+        * editing/Editor.cpp:
+        * editing/HTMLInterchange.cpp:
+        * editing/InsertTextCommand.cpp:
+        * editing/MarkupAccumulator.cpp:
+        * editing/TextIterator.cpp:
+        * editing/VisibleSelection.cpp:
+        * editing/htmlediting.cpp:
+        * editing/htmlediting.h:
+        * editing/markup.cpp:
+        * html/FTPDirectoryDocument.cpp:
+        * html/HTMLFormControlElement.cpp:
+        * html/parser/HTMLTreeBuilder.cpp:
+        * loader/appcache/ManifestParser.cpp:
+        * platform/chromium/PopupMenuChromium.cpp:
+        * platform/graphics/Font.h:
+        * platform/graphics/FontFastPath.cpp:
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        * platform/graphics/StringTruncator.cpp:
+        * platform/graphics/mac/ComplexTextController.cpp:
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        * platform/graphics/wince/GraphicsContextWinCE.cpp:
+        * platform/mac/PasteboardMac.mm:
+        * platform/text/TextCodecICU.cpp:
+        * platform/text/mac/TextCodecMac.cpp:
+        * platform/text/transcoder/FontTranscoder.cpp:
+        * rendering/RenderBlockLineLayout.cpp:
+        * rendering/RenderFlexibleBox.cpp:
+        * rendering/RenderListMarker.cpp:
+        * rendering/RenderText.cpp:
+        * rendering/RenderTextControl.cpp:
+        * rendering/RenderTreeAsText.cpp:
+        * rendering/break_lines.cpp:
+        * rendering/mathml/RenderMathMLOperator.h:
+        * websockets/WebSocketHandshake.cpp:
+        * wml/WMLTableElement.cpp:
+
+2011-01-29  Dan Winship  <danw@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Remove HAVE_LIBSOUP_2_29_90 conditionals; we depend on
+        libsoup 2.33.1 now.
+        https://bugs.webkit.org/show_bug.cgi?id=50675
+
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::defaultCookieJar):
+        (WebCore::setCookies):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::prepareForURL):
+        (WebCore::restartedCallback):
+        (WebCore::startHttp):
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::updateSoupMessage):
+        (WebCore::ResourceRequest::toSoupMessage):
+        (WebCore::ResourceRequest::updateFromSoupMessage):
+
+2011-01-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Daniel Bates.
+
+        XSSFilter should replace URLs with about:blank instead of the empty string
+        https://bugs.webkit.org/show_bug.cgi?id=53370
+
+        Using the empty string will make the URL complete to the current
+        document's URL, which isn't really what we want.  Instead, we want to
+        use about:blank, which is safe.
+
+        * html/parser/XSSFilter.cpp:
+        (WebCore::XSSFilter::filterObjectToken):
+        (WebCore::XSSFilter::filterEmbedToken):
+
+2011-01-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Daniel Bates.
+
+        XSSFilter should pass xssAuditor/script-tag-addslashes*
+        https://bugs.webkit.org/show_bug.cgi?id=53365
+
+        We need to canonicalize strings to avoid being tricked by addslashes.
+
+        * html/parser/XSSFilter.cpp:
+        (WebCore::HTMLNames::isNonCanonicalCharacter):
+            - This function is copied from the XSSAuditor (with some tweaks).
+              We'll eventually remove the XSSAuditor once we've got XSSFilter
+              working properly.
+        (WebCore::HTMLNames::canonicalize):
+        (WebCore::HTMLNames::decodeURL):
+        (WebCore::XSSFilter::isContainedInRequest):
+
+2011-01-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Daniel Bates.
+
+        XSSFilter should pass xssAuditor/script-tag-with-source-same-host.html
+        and xssAuditor/script-tag-post-*
+        https://bugs.webkit.org/show_bug.cgi?id=53364
+
+        We're supposed to allow loading same-origin resources even if they
+        appear as part of the request.
+
+        Also, we're supposed to look at the POST data too.  :)
+
+        * html/parser/XSSFilter.cpp:
+        (WebCore::XSSFilter::eraseAttributeIfInjected):
+        (WebCore::XSSFilter::isSameOriginResource):
+            - Copy/paste from XSSAuditor::isSameOriginResource.  We'll
+              eventually remove the XSSAuditor version when XSSFilter is done.
+        * html/parser/XSSFilter.h:
+
+2011-01-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Daniel Bates.
+
+        XSSFilter should pass 16 of the xssAuditor/script-tag* tests
+        https://bugs.webkit.org/show_bug.cgi?id=53362
+
+        Turns out we need to replace the src attribute of script tags with
+        about:blank to avoid loading the main document URL as a script.  Also,
+        move misplaced return statement that was triggering the console message
+        too often.
+
+        * html/parser/HTMLToken.h:
+        (WebCore::HTMLToken::appendToAttributeValue):
+        * html/parser/XSSFilter.cpp:
+        (WebCore::XSSFilter::filterScriptToken):
+        (WebCore::XSSFilter::eraseAttributeIfInjected):
+        * html/parser/XSSFilter.h:
+
+2011-01-28  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Downloads in WK2 on Windows should write resume data to bundle
+        https://bugs.webkit.org/show_bug.cgi?id=53282
+        <rdar://problem/8753077>
+
+        Reviewed by Alice Liu.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        Added new files to project.
+
+        * platform/network/cf/DownloadBundle.h: Added.
+        * platform/network/win/DownloadBundleWin.cpp: Added.
+        (WebCore::DownloadBundle::magicNumber):
+        Moved from WebKit's WebDownload so that WebKit and WebKit2 can share
+        it.
+        (WebCore::DownloadBundle::fileExtension):
+        Ditto.
+        (WebCore::DownloadBundle::appendResumeData):
+        Ditto - but modified to return bool rather than HRESULT and to clean up
+        whitespace.
+        (WebCore::DownloadBundle::extractResumeData):
+        Ditto - modified to clean up whitespace.
+
+2011-01-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r77050.
+        http://trac.webkit.org/changeset/77050
+        https://bugs.webkit.org/show_bug.cgi?id=53371
+
+        Caused a crash in Chromium's test_shell_tests (Requested by
+        rniwa on #webkit).
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::FragmentParsingContext::FragmentParsingContext):
+        (WebCore::HTMLTreeBuilder::FragmentParsingContext::document):
+        (WebCore::HTMLTreeBuilder::FragmentParsingContext::finished):
+        * html/parser/HTMLTreeBuilder.h:
+
+2011-01-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        HTML5 TreeBuilder regressed a Peacekeeper DOM test by 40%
+        https://bugs.webkit.org/show_bug.cgi?id=48719
+
+        It's unclear exactly what the Peacekeeper benchmark is testing,
+        because I haven't found a way to run it myself.
+
+        However, I constructed a benchmark which shows at least one possible slow point.
+        The HTML5 spec talks about creating a new document for every time we use
+        the fragment parsing algorithm.  Document() it turns out, it a huge bloated
+        mess, and the constructor and destructor do a huge amount of work.
+        To avoid constructing (or destructing) documents for each innerHTML call,
+        this patch adds a shared dummy document used by all innerHTML calls.
+
+        This patch brings us from 7x slower than Safari 5 on tiny-innerHTML
+        to only 1.5x slower than Safari 5.  I'm sure there is more work to do here.
+
+        Saving a shared Document like this is error prone.  Currently
+        DummyDocumentFactory::releaseDocument() calls removeAllChildren()
+        in an attempt to clear the Document's state. However it's possible
+        that that call is not sufficient and we'll have future bugs here.
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::DummyDocumentFactory::createDummyDocument):
+        (WebCore::DummyDocumentFactory::releaseDocument):
+        (WebCore::HTMLTreeBuilder::FragmentParsingContext::FragmentParsingContext):
+        (WebCore::HTMLTreeBuilder::FragmentParsingContext::document):
+        (WebCore::HTMLTreeBuilder::FragmentParsingContext::finished):
+        * html/parser/HTMLTreeBuilder.h:
+
+2011-01-28  Johnny Ding  <jnd@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Gesture API: Don't use current gesture status to set "forceUserGesture" parameter when calling ScriptController::executeScript.
+        The "forceUserGesture" parameter should be only set when you are definitely sure that the running script is from a hyper-link.
+        https://bugs.webkit.org/show_bug.cgi?id=53244
+
+        Test: fast/events/popup-blocked-from-iframe-src.html
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+
+2011-01-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add various clampToInt() methods to MathExtras.h
+        https://bugs.webkit.org/show_bug.cgi?id=52910
+
+        Use clampToInteger() from MathExtras.h
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseCounter):
+
+2011-01-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r77006 and r77020.
+        http://trac.webkit.org/changeset/77006
+        http://trac.webkit.org/changeset/77020
+        https://bugs.webkit.org/show_bug.cgi?id=53360
+
+        "Broke Windows tests" (Requested by rniwa on #webkit).
+
+        * ForwardingHeaders/runtime/WriteBarrier.h: Removed.
+        * WebCore.exp.in:
+        * bindings/js/DOMWrapperWorld.h:
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markDOMNodesForDocument):
+        (WebCore::markDOMObjectWrapper):
+        (WebCore::markDOMNodeWrapper):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::markChildren):
+        (WebCore::JSDOMGlobalObject::setInjectedScript):
+        (WebCore::JSDOMGlobalObject::injectedScript):
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
+        (WebCore::getDOMConstructor):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::DialogHandler::dialogCreated):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::JSDOMWindowShell):
+        (WebCore::JSDOMWindowShell::setWindow):
+        (WebCore::JSDOMWindowShell::markChildren):
+        (WebCore::JSDOMWindowShell::unwrappedObject):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::window):
+        (WebCore::JSDOMWindowShell::setWindow):
+        * bindings/js/JSDeviceMotionEventCustom.cpp:
+        (WebCore::createAccelerationObject):
+        (WebCore::createRotationRateObject):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::markJSFunction):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::jsFunction):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::setAll):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::scopeChain):
+        (WebCore::JSJavaScriptCallFrame::scopeType):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::markAggregate):
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSNodeFilterCondition.h:
+        * bindings/js/JSNodeFilterCustom.cpp:
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        (WebCore::JSSQLResultSetRowList::item):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::restore):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneDeserializer::putProperty):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::QtRuntimeMetaMethod):
+        (JSC::Bindings::QtRuntimeMetaMethod::markChildren):
+        (JSC::Bindings::QtRuntimeMetaMethod::connectGetter):
+        (JSC::Bindings::QtRuntimeMetaMethod::disconnectGetter):
+        * bridge/qt/qt_runtime.h:
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::invalidate):
+        * bridge/runtime_root.h:
+        * dom/Document.h:
+
+2011-01-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        XSSFilter should log to the console when it blocks something
+        https://bugs.webkit.org/show_bug.cgi?id=53354
+
+        This patch refactors a bunch of methods in XSSFilter to return a bool
+        indicating whether they blocked anything.  Using this bool, we decide
+        whether to log to the console.  We're using the same log message as the
+        XSSAuditor, but it seems likely we can improve this message in the
+        future (especially by piping in the correct line number, which is now
+        accessible via the parser).
+
+        * html/parser/XSSFilter.cpp:
+        (WebCore::HTMLNames::isNameOfInlineEventHandler):
+        (WebCore::XSSFilter::filterToken):
+        (WebCore::XSSFilter::filterTokenInitial):
+        (WebCore::XSSFilter::filterTokenAfterScriptStartTag):
+        (WebCore::XSSFilter::filterScriptToken):
+        (WebCore::XSSFilter::filterObjectToken):
+        (WebCore::XSSFilter::filterEmbedToken):
+        (WebCore::XSSFilter::filterAppletToken):
+        (WebCore::XSSFilter::filterMetaToken):
+        (WebCore::XSSFilter::filterBaseToken):
+        (WebCore::XSSFilter::eraseInlineEventHandlersIfInjected):
+        * html/parser/XSSFilter.h:
+
+2011-01-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Daniel Bates.
+
+        Wire up settings->xssAuditorEnabled to XSSFilter
+        https://bugs.webkit.org/show_bug.cgi?id=53345
+
+        * html/parser/XSSFilter.cpp:
+        (WebCore::XSSFilter::XSSFilter):
+        (WebCore::XSSFilter::filterToken):
+        * html/parser/XSSFilter.h:
+
+2011-01-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Daniel Bates.
+
+        Teach XSSFilter about <meta> and <base> tags
+        https://bugs.webkit.org/show_bug.cgi?id=53339
+
+        I'm not 100% sure we need to block <meta http-equiv>, but it seems
+        prudent given how powerful that attribute is.  We definitely need to
+        block injection of <base href> because that can redirect script tags
+        that use relative URLs.
+
+        * html/parser/XSSFilter.cpp:
+        (WebCore::XSSFilter::filterToken):
+        (WebCore::XSSFilter::filterMetaToken):
+        (WebCore::XSSFilter::filterBaseToken):
+        * html/parser/XSSFilter.h:
+
+2011-01-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Daniel Bates.
+
+        Teach XSSFilter about <applet>
+        https://bugs.webkit.org/show_bug.cgi?id=53338
+
+        HTML5 is pretty light on information about how the <applet> tag works.
+        According to this site:
+
+        http://download.oracle.com/javase/1.4.2/docs/guide/misc/applet.html
+
+        The "code" and "object" attributes are the essential attributes for
+        determining which piece of Java to run.  We might need to expand to the
+        codebase and archive attributes at some point, but hopefully code and
+        object will be sufficient.
+
+        * html/parser/XSSFilter.cpp:
+        (WebCore::XSSFilter::filterToken):
+        (WebCore::XSSFilter::filterAppletToken):
+        * html/parser/XSSFilter.h:
+
+2011-01-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Daniel Bates.
+
+        Teach the XSSFilter about object and embed tags
+        https://bugs.webkit.org/show_bug.cgi?id=53336
+
+        For <object> and <embed>, we filter out attribute values that either
+        indicate which piece of media to load or which plugin to load.  In a
+        perfect world, we'd only need to filter out the URLs of the media, but
+        some plug-ins (like Flash) have lots of fun places you can hide the
+        URL (e.g., the "movie" <param>).
+
+        * html/parser/XSSFilter.cpp:
+        (WebCore::XSSFilter::filterToken):
+        (WebCore::XSSFilter::filterScriptToken):
+        (WebCore::XSSFilter::filterObjectToken):
+        (WebCore::XSSFilter::filterEmbedToken):
+        (WebCore::XSSFilter::eraseAttributeIfInjected):
+        * html/parser/XSSFilter.h:
+
+2011-01-28  Oliver Hunt  <oliver@apple.com>
+
+        Fix Qt build.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::QtRuntimeMetaMethod):
+        (JSC::Bindings::QtRuntimeMetaMethod::markChildren):
+        (JSC::Bindings::QtRuntimeMetaMethod::connectGetter):
+        (JSC::Bindings::QtRuntimeMetaMethod::disconnectGetter):
+        * bridge/qt/qt_runtime.h:
+
+2011-01-28  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        CSS styles are shared based on uninitialized property values
+        https://bugs.webkit.org/show_bug.cgi?id=53285
+        
+        Null test.
+
+        * dom/NamedNodeMap.cpp:
+        (WebCore::NamedNodeMap::mappedMapsEquivalent):
+
+2011-01-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Convert markstack to a slot visitor API
+        https://bugs.webkit.org/show_bug.cgi?id=53219
+
+        Update WebCore to the new marking apis, correct bindings
+        codegen. 
+
+        * ForwardingHeaders/runtime/WriteBarrier.h: Added.
+        * WebCore.exp.in:
+        * bindings/js/DOMWrapperWorld.h:
+        (WebCore::DOMWrapperWorld::globalData):
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markDOMNodesForDocument):
+        (WebCore::markDOMObjectWrapper):
+        (WebCore::markDOMNodeWrapper):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::markChildren):
+        (WebCore::JSDOMGlobalObject::setInjectedScript):
+        (WebCore::JSDOMGlobalObject::injectedScript):
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
+        (WebCore::getDOMConstructor):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::DialogHandler::dialogCreated):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::JSDOMWindowShell):
+        (WebCore::JSDOMWindowShell::setWindow):
+        (WebCore::JSDOMWindowShell::markChildren):
+        (WebCore::JSDOMWindowShell::unwrappedObject):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::window):
+        (WebCore::JSDOMWindowShell::setWindow):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::markJSFunction):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::jsFunction):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::setAll):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::scopeChain):
+        (WebCore::JSJavaScriptCallFrame::scopeType):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::markAggregate):
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSNodeFilterCondition.h:
+        * bindings/js/JSNodeFilterCustom.cpp:
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        (WebCore::JSSQLResultSetRowList::item):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::restore):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneDeserializer::putProperty):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/Document.h:
+
+2011-01-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Keyboard scrolling doesn’t work in WebKit2
+        <rdar://problem/8909672>
+
+        * platform/mac/ScrollAnimatorMac.mm:
+        (-[ScrollAnimationHelperDelegate convertSizeToBacking:]):
+        (-[ScrollAnimationHelperDelegate convertSizeFromBacking:]):
+        Add additional necessary delegate methods.
+
+2011-01-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Re-land this patch with the missing null check that caused crashes in layout tests.
+
+        Changing cursor style has no effect until the mouse moves
+        https://bugs.webkit.org/show_bug.cgi?id=14344
+        rdar://problem/7563712
+
+        No tests added because we don't have infrastructure for testing actual cursor
+        changes (as opposed to cursor style computation) at this time. We might add it later.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dispatchFakeMouseMoveEventSoon): Added.
+        * page/EventHandler.h: Ditto.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::areNonIdenticalCursorListsEqual): Added.
+        (WebCore::areCursorsEqual): Added.
+        (WebCore::RenderObject::styleDidChange): Call dispatchFakeMouseMoveEventSoon if
+        cursor styles changed.
+
+2011-01-28  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        We should hold RefPtrs to SVG font faces
+        https://bugs.webkit.org/show_bug.cgi?id=53270
+
+        Test: svg/custom/use-multiple-on-nested-disallowed-font.html
+
+        * css/CSSFontFaceSource.cpp:
+        (WebCore::CSSFontFaceSource::getFontData):
+        * css/CSSFontFaceSource.h:
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::associatedFontElement):
+        * svg/SVGFontFaceElement.h:
+
+2011-01-28  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        uniformN*v should generate INVALID_VALUE of the array size is not a multiple of N
+        https://bugs.webkit.org/show_bug.cgi?id=53306
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::validateUniformMatrixParameters):
+
+2011-01-28  Tom Sepez  <tsepez@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        NULL pointer crash in TextIterator::handleTextBox()
+        https://bugs.webkit.org/show_bug.cgi?id=53267
+
+        Test: fast/css/rtl-nth-child-first-letter-crash.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::handleTextBox):
+
+2011-01-28  Adrienne Walker  <enne@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Remove a spurious diagnostic CRASH check.
+        https://bugs.webkit.org/show_bug.cgi?id=52379
+
+        * platform/graphics/chromium/LayerTilerChromium.cpp:
+        (WebCore::LayerTilerChromium::invalidateRect):
+
+2011-01-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/4761512> <select> can't display right-to-left (rtl) languages
+        https://bugs.webkit.org/show_bug.cgi?id=19785
+
+        Changed <select> pop-up menus on Mac OS X Snow Leopard and later to have their items aligned in the
+        direction corresponding to the writing direction of the <select> element, with the checkmarks
+        on the "start" side, and use the <option>'s writing direction rather than "natural". Made the
+        pop-up button match the menu by adding a Chrome boolean function, selectItemAlignmentFollowsMenuWritingDirection(),
+        which returns true for this pop-up behavior.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::selectItemAlignmentFollowsMenuWritingDirection): Added.
+        * manual-tests/pop-up-alignment-and-direction.html: Added.
+        * page/Chrome.cpp:
+        (WebCore::Chrome::selectItemAlignmentFollowsMenuWritingDirection): Added. Calls through to the
+        client.
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * platform/PopupMenuStyle.h:
+        (WebCore::PopupMenuStyle::PopupMenuStyle): Added hasTextDirectionOverride parameter and member
+        variable initialization.
+        (WebCore::PopupMenuStyle::hasTextDirectionOverride): Added this accessor.
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenuMac::populate): Set the pop-up's layout direction and items' text alignment
+        to match the menu's writing direction. Set items' writing direction and direction override
+        according to their styles.
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::RenderMenuList): Removed unncesaary initialization of a smart pointer.
+        (WebCore::RenderMenuList::adjustInnerStyle): If the alignment of items in the menu follows the
+        menu's writing direction, use that alignment for the button as well. Also in this mode, use the
+        item's writing direction and override setting.
+        (WebCore::RenderMenuList::setTextFromOption): Store the option element's style.
+        (WebCore::RenderMenuList::itemStyle): Pass the text direction override value.
+        (WebCore::RenderMenuList::menuStyle): Ditto. Also use the button's direction, not the inner text's.
+        * rendering/RenderMenuList.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::menuStyle): Pass the text direction override value.
+
+2011-01-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Daniel Bates.
+
+        Teach XSSFilter how to filter <script> elements
+        https://bugs.webkit.org/show_bug.cgi?id=53279
+
+        This patch adds the ability for the XSSFilter to block injected
+        <script> elements.  Handling script elements is slightly subtle because
+        these elements act very differently depending on whether they have a
+        src attribute.
+        
+        In the "src case", which check whether the src attribute was present in
+        the request.  In the "non-src case", we check whether the start tag and
+        the body of the script element was included in the request.  Checking
+        for the whole start tag means we miss out on some attribute splitting
+        attacks inside of script tags, but that doesn't seem like that big a
+        deal.
+
+        This patch also introduces some amount of state into the XSSFilter
+        because inline script elements span multiple tokens.  There's a lot of
+        tuning and optimization left in these cases, some of which I've noted
+        with FIXMEs.
+
+        To test this patch, I played around with some of the existing
+        XSSAuditor tests.  Hopefully I'll be able to run the test suite more
+        systematically in the future.
+
+        * html/parser/HTMLToken.h:
+        (WebCore::HTMLToken::eraseCharacters):
+        (WebCore::HTMLToken::eraseValueOfAttribute):
+        * html/parser/XSSFilter.cpp:
+        (WebCore::HTMLNames::hasName):
+        (WebCore::HTMLNames::findAttributeWithName):
+        (WebCore::HTMLNames::isNameOfScriptCarryingAttribute):
+        (WebCore::XSSFilter::XSSFilter):
+        (WebCore::XSSFilter::filterToken):
+        (WebCore::XSSFilter::filterTokenAfterScriptStartTag):
+        (WebCore::XSSFilter::filterScriptToken):
+        (WebCore::XSSFilter::snippetForRange):
+        (WebCore::XSSFilter::snippetForAttribute):
+        * html/parser/XSSFilter.h:
+
+2011-01-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Daniel Bates.
+
+        Sketch out new XSS filter design (disabled by default)
+        https://bugs.webkit.org/show_bug.cgi?id=53205
+
+        This patch adds a basic sketch of the new XSS filter design.  Rather
+        than watching scripts as they execute, in this design, we watch tokens
+        emitted by the tokenizer.  We then map the tokens directly back into
+        input characters, which lets us skip all the complicated logic related
+        to HTML entities and double-decoding of JavaScript URLs.
+
+        This patch contains only the bare essentially machinery.  I'll add more
+        in future patches and eventually remove the previous code once this
+        code is up and running correctly.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::HTMLDocumentParser):
+        (WebCore::HTMLDocumentParser::pumpTokenizer):
+        (WebCore::HTMLDocumentParser::sourceForToken):
+        * html/parser/HTMLDocumentParser.h:
+        * html/parser/XSSFilter.cpp: Added.
+        * html/parser/XSSFilter.h: Added.
+
+2011-01-28  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Potentially Unsafe HashSet of RuntimeObject* in RootObject definition
+        https://bugs.webkit.org/show_bug.cgi?id=53271
+
+        Reapplying this patch with the change that the second ASSERT in 
+        RootObject::removeRuntimeObject was changed to use
+        .uncheckedGet() instead of the failing .get().  The object in question
+        could be in the process of being GC'ed.  The get() call will not return
+        such an object while the uncheckedGet() call will return the (unsafe) 
+        object.  This is the behavior we want.
+
+        Precautionary change.
+        Changed RootObject to use WeakGCMap instead of HashSet.
+        Found will looking for another issue, but can't produce a test case
+        that is problematic.  THerefore there aren't any new tests.
+
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::invalidate):
+        (JSC::Bindings::RootObject::addRuntimeObject):
+        (JSC::Bindings::RootObject::removeRuntimeObject):
+        * bridge/runtime_root.h:
+
+2011-01-28  Adam Roben  <aroben@apple.com>
+
+        Notify CACFLayerTreeHost when the context is flushed
+
+        LegacyCACFLayerTreeHost was keeping this a secret, which meant that WebCore's animation
+        timers were never starting.
+
+        Fixes <http://webkit.org/b/53302> [Windows 7 Release Tests] changesets 76853, 76856, and
+        76858 broke ~36 animations, compositing, and transitions tests
+
+        Reviewed by Sam Weinig.
+
+        * platform/graphics/ca/win/LegacyCACFLayerTreeHost.cpp:
+        (WebCore::LegacyCACFLayerTreeHost::contextDidChange): Call up to the base class after we
+        start our render timer.
+
+2011-01-28  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Remove dead code that tried to map from CSS values to parser values
+        https://bugs.webkit.org/show_bug.cgi?id=53318
+
+        * css/CSSFunctionValue.cpp:
+        * css/CSSFunctionValue.h:
+        * css/CSSPrimitiveValue.cpp:
+        * css/CSSPrimitiveValue.h:
+        * css/CSSValue.h:
+        * css/CSSValueList.cpp:
+        * css/CSSValueList.h:
+
+2011-01-28  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Some drag and drop tests fail since r76824
+        https://bugs.webkit.org/show_bug.cgi?id=53304
+
+        There were '||' instead of '&&' in the checks for valid
+        clipboard content.
+        
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::getData):
+        (WebCore::ClipboardWin::types):
+        (WebCore::ClipboardWin::files):
+
+2011-01-28  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] AudioProcessingEvent.h and JSJavaScriptAudioNode.h: No such file or directory
+        https://bugs.webkit.org/show_bug.cgi?id=52889
+
+        Build fix for WebAudio. Include WebAudio source files on the source
+        list when WebAudio is enabled.
+
+        * GNUmakefile.am: Include missing source files.
+
+2011-01-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add basic rubber banding support
+        <rdar://problem/8219429>
+        https://bugs.webkit.org/show_bug.cgi?id=53277
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleGestureEvent):
+        Pass gesture events to the FrameView.
+
+        * platform/ScrollAnimator.cpp:
+        (WebCore::ScrollAnimator::handleGestureEvent):
+        * platform/ScrollAnimator.h:
+        Add stubbed out implementation.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::overhangAmount):
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::ScrollableArea):
+        (WebCore::ScrollableArea::handleGestureEvent):
+        * platform/ScrollableArea.h:
+        (WebCore::ScrollableArea::constrainsScrollingToContentEdge):
+        (WebCore::ScrollableArea::setConstrainsScrollingToContentEdge):
+        Move constrains scrolling bit to ScrollableArea from ScrollView.
+
+        (WebCore::ScrollableArea::contentsSize):
+        (WebCore::ScrollableArea::overhangAmount):
+        Add additional virtual functions for information needed by the animator.
+
+        * platform/mac/ScrollAnimatorMac.h:
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::ScrollAnimatorMac):
+        (WebCore::ScrollAnimatorMac::immediateScrollByDeltaX):
+        (WebCore::ScrollAnimatorMac::immediateScrollByDeltaY):
+        (WebCore::elasticDeltaForTimeDelta):
+        (WebCore::elasticDeltaForReboundDelta):
+        (WebCore::reboundDeltaForElasticDelta):
+        (WebCore::scrollWheelMultiplier):
+        (WebCore::ScrollAnimatorMac::handleWheelEvent):
+        (WebCore::ScrollAnimatorMac::handleGestureEvent):
+        (WebCore::ScrollAnimatorMac::pinnedInDirection):
+        (WebCore::ScrollAnimatorMac::allowsVerticalStretching):
+        (WebCore::ScrollAnimatorMac::allowsHorizontalStretching):
+        (WebCore::ScrollAnimatorMac::smoothScrollWithEvent):
+        (WebCore::ScrollAnimatorMac::beginScrollGesture):
+        (WebCore::ScrollAnimatorMac::endScrollGesture):
+        (WebCore::ScrollAnimatorMac::snapRubberBand):
+        (WebCore::roundTowardZero):
+        (WebCore::roundToDevicePixelTowardZero):
+        (WebCore::ScrollAnimatorMac::snapRubberBandTimerFired):
+        Implement basic rubber banding.
+
+2011-01-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Changing unicode-bidi doesn’t force layout
+        https://bugs.webkit.org/show_bug.cgi?id=53311
+
+        Test: fast/dynamic/unicode-bidi.html
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff): Return a layout difference if unicode-bidi values differ.
+
+2011-01-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        Change HTMLInputElement-derived parts of media element shadow DOM to use shadowPseudoId.
+        https://bugs.webkit.org/show_bug.cgi?id=53122
+
+        This is the first step in converting HTMLMediaElement to the new shadow DOM.
+
+        Should not regress any existing tests. No observable change in behavior.
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::pseudoId): Removed now-unnecessary hard-coded pseudo-element selectors.
+        (WebCore::nameToPseudoTypeMap): Ditto.
+        (WebCore::CSSSelector::extractPseudoType): Ditto.
+        * css/CSSSelector.h: Ditto.
+        * css/mediaControls.css: Added proper initial values, now that elements use the proper selector pipeline.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlInputElement::MediaControlInputElement): Removed the switch statement,
+            which is now replaced with virtual shadowPseudoId on each corresponding class.
+        (WebCore::MediaControlInputElement::styleForElement): Changed to use element pipeline.
+        (WebCore::MediaControlMuteButtonElement::MediaControlMuteButtonElement): Changed to set
+            display type in constructor.
+        (WebCore::MediaControlMuteButtonElement::create): Changed to not take PseudoId as
+            constructor argument.
+        (WebCore::MediaControlMuteButtonElement::shadowPseudoId): Added.
+        (WebCore::MediaControlVolumeSliderMuteButtonElement::MediaControlVolumeSliderMuteButtonElement): Added
+            to disambiguate from the MediaControlMuteButtonElement.
+        (WebCore::MediaControlVolumeSliderMuteButtonElement::create): Added.
+        (WebCore::MediaControlVolumeSliderMuteButtonElement::shadowPseudoId): Added.
+        (WebCore::MediaControlPlayButtonElement::MediaControlPlayButtonElement): Changed to not take PseudoId as
+            constructor argument.
+        (WebCore::MediaControlPlayButtonElement::shadowPseudoId): Added.
+        (WebCore::MediaControlSeekButtonElement::MediaControlSeekButtonElement): Changed to not take PseudoId as
+            constructor argument.
+        (WebCore::MediaControlSeekForwardButtonElement::MediaControlSeekForwardButtonElement): Added.
+        (WebCore::MediaControlSeekForwardButtonElement::create): Added.
+        (WebCore::MediaControlSeekForwardButtonElement::shadowPseudoId): Added.
+        (WebCore::MediaControlSeekBackButtonElement::MediaControlSeekBackButtonElement): Added.
+        (WebCore::MediaControlSeekBackButtonElement::create): Added.
+        (WebCore::MediaControlSeekBackButtonElement::shadowPseudoId): Added.
+        (WebCore::MediaControlRewindButtonElement::MediaControlRewindButtonElement): Added.
+        (WebCore::MediaControlRewindButtonElement::shadowPseudoId): Added.
+        (WebCore::MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement): Changed to not take PseudoId as
+            constructor argument.
+        (WebCore::MediaControlReturnToRealtimeButtonElement::shadowPseudoId): Added.
+        (WebCore::MediaControlToggleClosedCaptionsButtonElement::MediaControlToggleClosedCaptionsButtonElement): Changed to not take PseudoId as
+            constructor argument.
+        (WebCore::MediaControlToggleClosedCaptionsButtonElement::shadowPseudoId): Added.
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement): Changed to not take PseudoId as
+            constructor argument.
+        (WebCore::MediaControlTimelineElement::shadowPseudoId): Added.
+        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement): Changed to not take PseudoId as
+            constructor argument.
+        (WebCore::MediaControlVolumeSliderElement::shadowPseudoId): Added.
+        (WebCore::MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement): Changed to not take PseudoId as
+            constructor argument.
+        (WebCore::MediaControlFullscreenButtonElement::shadowPseudoId): Added.
+        * rendering/MediaControlElements.h:
+        (WebCore::MediaControlSeekForwardButtonElement::isForwardButton): Added.
+        (WebCore::MediaControlSeekBackButtonElement::isForwardButton): Added.
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createMuteButton): Changed to use new constructor.
+        (WebCore::RenderMedia::createSeekBackButton): Ditto.
+        (WebCore::RenderMedia::createSeekForwardButton): Ditto.
+        (WebCore::RenderMedia::createVolumeSliderMuteButton): Ditto.
+        * rendering/style/RenderStyleConstants.h: Removed constants that are no longer used.
+
+2011-01-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Split MediaControls out of RenderMedia.
+        https://bugs.webkit.org/show_bug.cgi?id=53252
+
+        Near-mechanical moving of stuff, no change in behavior, thus no new tests.
+
+        * Android.mk: Added MediaControls to build system.
+        * CMakeLists.txt: Ditto.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::defaultEventHandler): Changed to forward events to MediaControls.
+        * html/shadow/MediaControls.cpp: Copied all controls-related methods from
+            Source/WebCore/rendering/RenderMedia.cpp, pulled them into their own class called MediaControls. 
+        * html/shadow/MediaControls.h: Ditto from Source/WebCore/rendering/RenderMedia.h.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::defaultEventHandler): Changed to use MediaControls.
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::RenderMedia): Moved relevant constructor initializers out to MediaControls.
+        (WebCore::RenderMedia::destroy): Changed to use MediaControls.
+        (WebCore::RenderMedia::styleDidChange): Ditto.
+        (WebCore::RenderMedia::layout): Ditto.
+        (WebCore::RenderMedia::updateFromElement): Ditto.
+        * rendering/RenderMedia.h: Updated defs accordingly and removed player() accessor, which
+            is only used by sub-class RenderVideo.
+        (WebCore::RenderMedia::controls): Added.
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::~RenderVideo): Changed to access MediaPlayer* directly from mediaElement().
+        (WebCore::RenderVideo::calculateIntrinsicSize): Ditto.
+        (WebCore::RenderVideo::paintReplaced): Ditto.
+        (WebCore::RenderVideo::updatePlayer): Ditto.
+        (WebCore::RenderVideo::supportsAcceleratedRendering): Ditto.
+        (WebCore::RenderVideo::acceleratedRenderingStateChanged): Ditto.
+
+2011-01-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: allow remote debugging with front-end
+        served from the cloud.
+        https://bugs.webkit.org/show_bug.cgi?id=53303
+
+        * inspector/front-end/inspector.js:
+
+2011-01-28  Aparna Nandyal  <aparna.nand@wipro.com>
+
+        Reviewed by Andreas Kling.
+
+        Setting value of m_PressedPos to make scrolling smooth
+
+        Page scroll popup menu "Scroll here" option not working when cliking above scroll slider/handler.
+        https://bugs.webkit.org/show_bug.cgi?id=51349
+
+        The value of m_PressedPos was getting set before moveThumb() call
+        in all other scenarios except when "Scroll Here" option is used.
+        Hence scrolling with this option was not as expected even in cases
+        where scrolling was happening. The thumb would move in unexpected
+        direction. m_PressedPos is now set to pressed position so delta is
+        calculated.
+        Unable to write a test case as the test needs to click on "Scroll
+        Here" option of context sensitive menu and QTest is unable to do it.
+        Besides no new functionality introduced.
+
+        * platform/qt/ScrollbarQt.cpp:
+        (WebCore::Scrollbar::contextMenu):
+
+2011-01-28  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Extensions API] add JSON schema for extensions API
+        https://bugs.webkit.org/show_bug.cgi?id=53236
+
+        * inspector/front-end/ExtensionAPISchema.json: Added.
+
+2011-01-27  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Remove _LENGTH enumerants
+        https://bugs.webkit.org/show_bug.cgi?id=53259
+
+        * html/canvas/WebGLRenderingContext.cpp: Remove queries for *LENGTH.
+        (WebCore::WebGLRenderingContext::getProgramParameter):
+        (WebCore::WebGLRenderingContext::getShaderParameter):
+        * html/canvas/WebGLRenderingContext.idl: Remove *LENGTH.
+
+2011-01-28  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: syntax highlight inline JS and CSS in HTML resources
+        https://bugs.webkit.org/show_bug.cgi?id=30831
+
+        * inspector/front-end/SourceHTMLTokenizer.js:
+        (WebInspector.SourceHTMLTokenizer):
+        (WebInspector.SourceHTMLTokenizer.prototype.set line):
+        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceHTMLTokenizer.re2js:
+
+2011-01-28  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: [STYLES] Up/Down-suggestion breaks an existing keyword
+        https://bugs.webkit.org/show_bug.cgi?id=53295
+
+        Select the current word suffix before switching to the next suggestion.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        ():
+
+2011-01-28  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Fix dist compilation for the release
+        https://bugs.webkit.org/show_bug.cgi?id=53290
+
+        * GNUmakefile.am: Added inspector files to the extra dist.
+
+2011-01-28  Ilya Sherman  <isherman@chromium.org>
+
+        Reviewed by Andreas Kling.
+
+        Const-correct HTMLSelectElement and WebSelectElement
+        https://bugs.webkit.org/show_bug.cgi?id=53293
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::value): const.
+        * html/HTMLSelectElement.h:
+
+2011-01-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r76893.
+        http://trac.webkit.org/changeset/76893
+        https://bugs.webkit.org/show_bug.cgi?id=53287
+
+        It made some tests crash on GTK and Qt debug bots (Requested
+        by Ossy on #webkit).
+
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::invalidate):
+        (JSC::Bindings::RootObject::addRuntimeObject):
+        (JSC::Bindings::RootObject::removeRuntimeObject):
+        * bridge/runtime_root.h:
+
+2011-01-27  Greg Coletta  <greg.coletta@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        Get rid of prefix header dependency for WebKit2 build system
+        https://bugs.webkit.org/show_bug.cgi?id=50174
+
+        Guard EmptyProtocalDefinitions.h to make sure it's not included twice.
+
+        * platform/mac/EmptyProtocolDefinitions.h:
+
+2011-01-27  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Recalc table sections if needed before calculating the first line
+        box baseline.
+        https://bugs.webkit.org/show_bug.cgi?id=53265
+
+        When we try to calculate the baseline position of a table cell,
+        we recurse through all the child sibling boxes (when children are
+        non inline) and add their first linebox baseline values. If one of
+        the children is a table with pending section recalc, we will access
+        wrong table section values. We recalc table sections if it is needed.
+
+        Test: fast/table/recalc-section-first-body-crash-main.html
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::firstLineBoxBaseline):
+
+2011-01-27  Adrienne Walker  <enne@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Add CRASH calls to further debug tiled compositor memcpy crash.
+        https://bugs.webkit.org/show_bug.cgi?id=52379
+
+        Test: LayoutTests/compositing (to verify these weren't triggered)
+
+        * platform/graphics/chromium/LayerTilerChromium.cpp:
+        (WebCore::LayerTilerChromium::invalidateRect):
+        (WebCore::LayerTilerChromium::update):
+
+2011-01-27  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [STYLES] Cancelled suggestion of a property name results in a visual artifact
+        https://bugs.webkit.org/show_bug.cgi?id=53242
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2011-01-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r76891.
+        http://trac.webkit.org/changeset/76891
+        https://bugs.webkit.org/show_bug.cgi?id=53280
+
+        Makes every layout test crash (Requested by othermaciej on
+        #webkit).
+
+        * page/EventHandler.cpp:
+        * page/EventHandler.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleDidChange):
+
+2011-01-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Unreviewed, rolling out r76839.
+        http://trac.webkit.org/changeset/76839
+        https://bugs.webkit.org/show_bug.cgi?id=49744
+
+        broke pixel tests
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::localCaretRect):
+
+2011-01-27  Emil A Eklund  <eae@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        contentEditable formatBlock crashes on divs with contenteditable="false"
+        https://bugs.webkit.org/show_bug.cgi?id=53263
+
+        Check if editableRootForPosition returns null for position.
+
+        Test: editing/execCommand/format-block-contenteditable-false.html
+
+        * editing/FormatBlockCommand.cpp:
+        (WebCore::FormatBlockCommand::formatRange):
+
+2011-01-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Remove RenderMedia members that aren't used.
+        https://bugs.webkit.org/show_bug.cgi?id=53245
+
+        Refactoring, no change in behavior, so no new tests.
+
+        * rendering/RenderMedia.h: Removed unused member variables.
+
+2011-01-27  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Potentially Unsafe HashSet of RuntimeObject* in RootObject definition
+        https://bugs.webkit.org/show_bug.cgi?id=53271
+
+        Precautionary change.
+        Changed RootObject to use WeakGCMap instead of HashSet.
+        Found will looking for another issue, but can't produce a test case
+        that is problematic.  THerefore there aren't any new tests.
+
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::invalidate):
+        (JSC::Bindings::RootObject::addRuntimeObject):
+        (JSC::Bindings::RootObject::removeRuntimeObject):
+        * bridge/runtime_root.h:
+
+2011-01-27  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by James Robinson.
+
+        Rename Typed Array slice() to subset()
+        https://bugs.webkit.org/show_bug.cgi?id=53273
+
+        * bindings/js/JSArrayBufferViewHelper.h:
+        (WebCore::constructArrayBufferView):
+        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
+        (WebCore::constructWebGLArray):
+        * html/canvas/Float32Array.cpp:
+        (WebCore::Float32Array::subset):
+        * html/canvas/Float32Array.h:
+        * html/canvas/Float32Array.idl:
+        * html/canvas/Int16Array.cpp:
+        (WebCore::Int16Array::subset):
+        * html/canvas/Int16Array.h:
+        * html/canvas/Int16Array.idl:
+        * html/canvas/Int32Array.cpp:
+        (WebCore::Int32Array::subset):
+        * html/canvas/Int32Array.h:
+        * html/canvas/Int32Array.idl:
+        * html/canvas/Int8Array.cpp:
+        (WebCore::Int8Array::subset):
+        * html/canvas/Int8Array.h:
+        * html/canvas/Int8Array.idl:
+        * html/canvas/TypedArrayBase.h:
+        (WebCore::TypedArrayBase::subsetImpl):
+        * html/canvas/Uint16Array.cpp:
+        (WebCore::Uint16Array::subset):
+        * html/canvas/Uint16Array.h:
+        * html/canvas/Uint16Array.idl:
+        * html/canvas/Uint32Array.cpp:
+        (WebCore::Uint32Array::subset):
+        * html/canvas/Uint32Array.h:
+        * html/canvas/Uint32Array.idl:
+        * html/canvas/Uint8Array.cpp:
+        (WebCore::Uint8Array::subset):
+        * html/canvas/Uint8Array.h:
+        * html/canvas/Uint8Array.idl:
+
+2011-01-27  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Changing cursor style has no effect until the mouse moves
+        https://bugs.webkit.org/show_bug.cgi?id=14344
+        rdar://problem/7563712
+
+        No tests added because we don't have infrastructure for testing actual cursor
+        changes (as opposed to cursor style computation) at this time. We might add it later.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dispatchFakeMouseMoveEventSoon): Added.
+        * page/EventHandler.h: Ditto.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::areNonIdenticalCursorListsEqual): Added.
+        (WebCore::areCursorsEqual): Added.
+        (WebCore::RenderObject::styleDidChange): Call dispatchFakeMouseMoveEventSoon if
+        cursor styles changed.
+
+2011-01-27  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        Reviewed by Dirk Schulze.
+
+        SVG Use Cycle is not detected
+        https://bugs.webkit.org/show_bug.cgi?id=52544
+
+        We should check if SVGUseElement::buildInstanceTree finds problem
+        for every child node. If it finds problem for any children we must
+        return immediately because otherwise the foundProblem variable may
+        be rewritten to false.
+
+        Test: svg/custom/recursive-use2.svg
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::buildInstanceTree):
+
+2011-01-27  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        texSubImage2D's format/type needs to match the internalformat/type from the previous texImage2D call
+        https://bugs.webkit.org/show_bug.cgi?id=53054
+
+        Test: fast/canvas/webgl/tex-sub-image-2d-bad-args.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::texSubImage2DBase): Check format/type match.
+
+2011-01-27  Yi Shen  <yi.4.shen@nokia.com>, Tor Arne Vestbø <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Add fullscreen media control button for html video
+        https://bugs.webkit.org/show_bug.cgi?id=51543
+
+        Implement media control fullscreen button for QtWebKit html5 video.
+
+        * css/mediaControlsQt.css:
+        (video::-webkit-media-controls-fullscreen-button):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintMediaFullscreenButton):
+
+2011-01-27  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Remove FrameLoader::url() and update callers to use
+        Document::url().
+        https://bugs.webkit.org/show_bug.cgi?id=41165
+
+        Refactor, no new tests.
+
+        * WebCore.exp.in:
+        * dom/Document.cpp:
+        (WebCore::Document::processHttpEquiv):
+        (WebCore::Document::removePendingSheet):
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::CachedFrameBase):
+        * history/PageCache.cpp:
+        (WebCore::logCanCacheFrameDecision):
+        (WebCore::PageCache::canCachePageContainingThisFrame):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::isURLAllowed):
+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::HTMLPlugInImageElement::allowedToLoadFrameURL):
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::inspectedURL):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::buildObjectForFrame):
+        * loader/DocumentWriter.cpp:
+        (WebCore::DocumentWriter::replaceDocument):
+        (WebCore::DocumentWriter::deprecatedFrameEncoding):
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::updateForStandardLoad):
+        (WebCore::HistoryController::updateForRedirectWithLockedBackForwardList):
+        (WebCore::HistoryController::updateForSameDocumentNavigation):
+        * loader/NavigationScheduler.cpp:
+        (WebCore::ScheduledHistoryNavigation::fire):
+        (WebCore::NavigationScheduler::scheduleLocationChange):
+        (WebCore::NavigationScheduler::scheduleRefresh):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateControlTints):
+        * page/Location.cpp:
+        (WebCore::Location::url):
+        (WebCore::Location::setProtocol):
+        (WebCore::Location::setHost):
+        (WebCore::Location::setHostname):
+        (WebCore::Location::setPort):
+        (WebCore::Location::setPathname):
+        (WebCore::Location::setSearch):
+        (WebCore::Location::setHash):
+        (WebCore::Location::reload):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+
+2011-01-27  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix performance regression in ImageQualityController::objectDestroyed().
+        https://bugs.webkit.org/show_bug.cgi?id=52645
+
+        In r72282, I inadvertently introduced this regression by using a
+        linear search through the hash map on object destruction.  This was
+        because the hash key consisted of both object pointer and layer id,
+        but on object destruction we only know the object pointer, requiring
+        a search to find all the layers. 
+        By replacing the hash map with two nested hash maps, where the outer key
+        is the object and the inner key is the layer, we can find all the
+        relevant data for an object in one hash lookup.
+
+        * rendering/RenderBoxModelObject.cpp:
+        Replace the (object,layer)->size HashMap with object->layer and
+        layer->size HashMaps.
+        (WebCore::ImageQualityController::isEmpty):
+        Implement isEmpty() for the outer HashMap.
+        (WebCore::ImageQualityController::removeLayer):
+        When a layer is removed, remove it from the inner hash map.
+        (WebCore::ImageQualityController::set):
+        Implement set():  if the inner map exists, set the layer->size tuple
+        directly.  If not, create a new inner map, set the tuple, and insert
+        it in the outer map.
+        (WebCore::ImageQualityController::objectDestroyed):
+        Look up the object in the outer map only.
+        (WebCore::ImageQualityController::highQualityRepaintTimerFired):
+        Cosmetic changes for the renamed now-outer hash map.
+        (WebCore::ImageQualityController::shouldPaintAtLowQuality):
+        Do both outer and inner hash map lookups.  Call set() to add/update
+        entries to the hash maps.  keyDestroyed() is now removeLayer().
+        (WebCore::imageQualityController):
+        Make the ImageQualityController a file-static global, so it can be
+        created and destroyed on the fly.
+        (WebCore::RenderBoxModelObject::~RenderBoxModelObject):
+        If there is no ImageQualityController, don't call objectDestroyed().
+        If it's empty, delete it.
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintIntoRect):
+        Also pass the Image* as the (void*) layer, since 0 is not a valid
+        HashMap key.
+
+2011-01-27  Adrienne Walker  <enne@google.com>
+
+        Reviewed by James Robinson.
+
+        [chromium] Tiled compositor crashes if compositing turned off mid-paint
+        https://bugs.webkit.org/show_bug.cgi?id=53198
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawLayers):
+        * platform/graphics/chromium/LayerTilerChromium.cpp:
+        (WebCore::LayerTilerChromium::update):
+        (WebCore::LayerTilerChromium::draw):
+
+2011-01-27  Carol Szabo <carol.szabo@nokia.com>
+
+        Reviewed by David Hyatt.
+
+        A corrupted counter tree is created when renderers are added to the
+        tree bypassing RenderObject::addChild
+        https://bugs.webkit.org/show_bug.cgi?id=51270
+
+        No new tests. This patch reimplements the fix for bugs 43812 and
+        51637 and hence all tests are already there as part of the original
+        fixes for those bugs.
+
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+        Removed old workaround as this patch hopefully fixes the real
+        problem.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::addChild):
+        Removed call to counter updater as it was moved to a lower level.
+        (WebCore::RenderObject::destroy):
+        Moved attached counter nodes destruction to after the node is
+        removed from the tree.
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::removeChildNode):
+        (WebCore::RenderObjectChildList::appendChildNode):
+        (WebCore::RenderObjectChildList::insertChildNode):
+        Added notifications to the Counter system such that the
+        CounterForest reflects the changes to the RendererTree.
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy):
+        Applied the same changes as for RenderObject::destroy()
+        since RenderObject::destroy() is not called from here.
+
+2011-01-27  Adam Roben  <aroben@apple.com>
+
+        Add WKCACFViewLayerTreeHost
+
+        This is a class that derives from CACFLayerTreeHost and uses a WKCACFView to render.
+
+        Fixes <http://webkit.org/b/53251> <rdar://problem/8925496> CACFLayerTreeHost should use
+        WKCACFView for rendering
+
+        * WebCore.vcproj/WebCore.vcproj: Added WKCACFViewLayerTreeHost.{cpp,h}.
+
+        * platform/graphics/ca/win/CACFLayerTreeHost.cpp:
+        (WebCore::CACFLayerTreeHost::acceleratedCompositingAvailable): Make the test window have a
+        non-zero size. WKCACFView will always say it can't render if you pass it a 0-sized window,
+        so we need a non-empty window to perform a valid test.
+        (WebCore::CACFLayerTreeHost::create): First try to create a WKCACFViewLayerTreeHost, then
+        fall back to a LegacyCACFLayerTreeHost.
+        (WebCore::CACFLayerTreeHost::flushPendingLayerChangesNow): Moved code to react to the
+        context flush from here...
+        (WebCore::CACFLayerTreeHost::contextDidChange): ...to here. Derived classes are required to
+        call this function whenever changes are flushed to the context.
+
+        * platform/graphics/ca/win/CACFLayerTreeHost.h: Added contextDidChange.
+
+        * platform/graphics/ca/win/LegacyCACFLayerTreeHost.cpp:
+        (WebCore::LegacyCACFLayerTreeHost::createRenderer):
+        (WebCore::LegacyCACFLayerTreeHost::resize):
+        Changed to use flushContext instead of flushing the context manually so that we will always
+        notify the base class when the context gets flushed.
+
+        (WebCore::LegacyCACFLayerTreeHost::flushContext): Added a call to contextDidChange so the
+        base class will know what happened. Moved code to schedule a render from here...
+        (WebCore::LegacyCACFLayerTreeHost::contextDidChange): ...to here.
+
+        * platform/graphics/ca/win/LegacyCACFLayerTreeHost.h: Added contextDidChange.
+
+        * platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp: Added.
+        (WebCore::WKCACFViewLayerTreeHost::create): If WebKitQuartzCoreAdditions, which provides
+        WKCACFView, isn't present, bail. Otherwise allocate and return a new host.
+        (WebCore::WKCACFViewLayerTreeHost::WKCACFViewLayerTreeHost): Initialize members.
+        (WebCore::WKCACFViewLayerTreeHost::updateViewIfNeeded): Update the view if we previously
+        marked that we needed to do so, and flush the context if our layer's bounds have changed.
+        (WebCore::WKCACFViewLayerTreeHost::contextDidChangeCallback): Call through to
+        contextDidChange.
+        (WebCore::WKCACFViewLayerTreeHost::contextDidChange): Tell the WKCACFView to start rendering
+        (if we didn't already), then call up to the base class.
+        (WebCore::WKCACFViewLayerTreeHost::initializeContext): Set the context's user data, the
+        view's layer, and hook up our "context did change" callback.
+        (WebCore::WKCACFViewLayerTreeHost::resize): Mark that the view needs to be updated the next
+        time we paint.
+        (WebCore::WKCACFViewLayerTreeHost::createRenderer): Update our view and return whether it is
+        able to render or not.
+        (WebCore::WKCACFViewLayerTreeHost::destroyRenderer): Clear out all the info we passed down
+        to the view.
+        (WebCore::WKCACFViewLayerTreeHost::lastCommitTime): Call through to the view.
+        (WebCore::WKCACFViewLayerTreeHost::flushContext): Ditto.
+        (WebCore::WKCACFViewLayerTreeHost::paint): Update the view so it will draw at the right
+        size, then call up to the base class.
+        (WebCore::WKCACFViewLayerTreeHost::render): Invalidate the view using the passed-in dirty
+        rects, then ask it to draw.
+
+        * platform/graphics/ca/win/WKCACFViewLayerTreeHost.h: Copied from Source/WebCore/platform/graphics/ca/win/LegacyCACFLayerTreeHost.h.
+
+2011-01-27  Adam Roben  <aroben@apple.com>
+
+        Move LegacyCACFLayerTreeHost into its own files
+
+        More preparation for <http://webkit.org/b/53251> <rdar://problem/8925496> CACFLayerTreeHost
+        should use WKCACFView for rendering
+
+        Reviewed by Simon Fraser.
+
+        * WebCore.vcproj/WebCore.vcproj: Added LegacyCACFLayerTreeHost.{cpp,h}.
+
+        * platform/graphics/ca/win/CACFLayerTreeHost.cpp: Moved code from here to new files.
+
+        * platform/graphics/ca/win/LegacyCACFLayerTreeHost.cpp: Added.
+        * platform/graphics/ca/win/LegacyCACFLayerTreeHost.h: Added.
+
+2011-01-27  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r76824.
+
+        * platform/wince/DragDataWinCE.cpp:
+        (WebCore::DragData::dragDataMap):
+
+2011-01-27  Adam Roben  <aroben@apple.com>
+
+        Split CACFLayerTreeHost into base and derived classes
+
+        The derived class, LegacyCACFLayerTreeHost, contains all the D3D-related code. A later patch
+        will add a new derived class that replaces the D3D code with a different rendering API.
+
+        For now, LegacyCACFLayerTreeHost lives in CACFLayerTreeHost.cpp. This keeps the diff a
+        little smaller. A later patch will move it to its own source files.
+
+        Preparation for <http://webkit.org/b/53251> <rdar://problem/8925496> CACFLayerTreeHost
+        should use WKCACFView for rendering
+
+        Reviewed by Simon Fraser.
+
+        * platform/graphics/ca/win/CACFLayerTreeHost.cpp:
+        (WebCore::CACFLayerTreeHost::acceleratedCompositingAvailable): Clear the window before
+        destroying the host, as that is now the API contract that clients must fulfill.
+        (WebCore::LegacyCACFLayerTreeHost::create): Added. Simple creator.
+        (WebCore::CACFLayerTreeHost::create): Now instantiates a LegacyCACFLayerTreeHost. Calls the
+        new initialize function to perform initialization that has to happen after the vtable has
+        been set up.
+
+        (WebCore::LegacyCACFLayerTreeHost::LegacyCACFLayerTreeHost):
+        (WebCore::CACFLayerTreeHost::CACFLayerTreeHost):
+        (WebCore::LegacyCACFLayerTreeHost::initializeContext):
+        (WebCore::CACFLayerTreeHost::initialize):
+        Moved some initialization code from the CACFLayerTreeHost constructor into these new
+        functions.
+
+        (WebCore::LegacyCACFLayerTreeHost::~LegacyCACFLayerTreeHost): Added. Moved code here from
+        ~CACFLayerTreeHost.
+        (WebCore::CACFLayerTreeHost::~CACFLayerTreeHost): Rather than clearing the window at this
+        point (which would be too late, since we won't be able to call into the derived class's
+        virtual functions), just assert that it has already been cleared (or was never set in the
+        first place).
+        (WebCore::LegacyCACFLayerTreeHost::createRenderer): Renamed from
+        CACFLayerTreeHost::createRenderer, and changed to use getters instead of accessing
+        CACFLayerTreeHost's data members directly.
+
+        (WebCore::LegacyCACFLayerTreeHost::destroyRenderer):
+        (WebCore::CACFLayerTreeHost::destroyRenderer):
+        Moved some code to the new LegacyCACFLayerTreeHost function.
+
+        (WebCore::LegacyCACFLayerTreeHost::resize):
+        (WebCore::LegacyCACFLayerTreeHost::renderTimerFired):
+        Moved these functions to LegacyCACFLayerTreeHost.
+
+        (WebCore::LegacyCACFLayerTreeHost::paint):
+        (WebCore::CACFLayerTreeHost::paint):
+        Moved some code to the new LegacyCACFLayerTreeHost function.
+
+        (WebCore::LegacyCACFLayerTreeHost::render):
+        (WebCore::LegacyCACFLayerTreeHost::renderSoon):
+        Moved these functions to LegacyCACFLayerTreeHost.
+
+        (WebCore::CACFLayerTreeHost::flushPendingLayerChangesNow): Moved code to flush the context
+        from here...
+        (WebCore::LegacyCACFLayerTreeHost::flushContext): ...to this new function.
+
+        (WebCore::LegacyCACFLayerTreeHost::lastCommitTime): Moved code to get the last commit time
+        to this new function...
+        (WebCore::CACFLayerTreeHost::notifyAnimationsStarted): ...from here.
+
+        (WebCore::LegacyCACFLayerTreeHost::initD3DGeometry):
+        (WebCore::LegacyCACFLayerTreeHost::resetDevice):
+        Moved these functions to LegacyCACFLayerTreeHost.
+
+        * platform/graphics/ca/win/CACFLayerTreeHost.h: Made some functions virtual, removed some
+        members that have moved to LegacyCACFLayerTreeHost, grouped remaining members more
+        logically, and added some getters used by LegacyCACFLayerTreeHost.
+
+2011-01-27  Adam Roben  <aroben@apple.com>
+
+        Move CACFLayerTreeHostClient to its own header file
+
+        Rubber-stamped by Steve Falkenburg.
+
+        * WebCore.vcproj/WebCore.vcproj: Added CACFLayerTreeHostClient.h. Also let VS have its way
+        with the file.
+
+        * platform/graphics/ca/win/CACFLayerTreeHost.cpp: Added new #include.
+
+        * platform/graphics/ca/win/CACFLayerTreeHost.h: Removed CACFLayerTreeHostClient.
+
+        * platform/graphics/ca/win/CACFLayerTreeHostClient.h: Added.
+
+        * platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp: Moved some #includes here
+        from the header file.
+
+        * platform/graphics/win/MediaPlayerPrivateFullscreenWindow.h: Replaced broader #includes
+        with more specific ones, plus a forward-declaration.
+
+2011-01-27  James Simonsen  <simonjam@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [Chromium] Simplify small caps logic in complex text on linux
+        https://bugs.webkit.org/show_bug.cgi?id=53207
+
+        Test: fast/text/atsui-multiple-renderers.html
+              fast/text/atsui-small-caps-punctuation-size.html
+
+        * platform/graphics/chromium/ComplexTextControllerLinux.cpp:
+        (WebCore::ComplexTextController::nextScriptRun): Remove redundant logic. Case changes in a text run imply FontData changes.
+        (WebCore::ComplexTextController::setupFontForScriptRun): Update comment to reflect above.
+
+2011-01-27  Adam Barth  <abarth@webkit.org>
+
+        In which I attempt to fix the EFL build.
+
+        * CMakeLists.txt:
+
+2011-01-25  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Adding border and padding to the calculation of the local caret rect for RenderBoxes.
+        Corrected for mistake in r76625
+
+        Undo moves caret to invalid position
+        https://bugs.webkit.org/show_bug.cgi?id=49744
+
+        Tests: editing/selection/caret-painting-after-paste-undo-rtl.html
+               editing/selection/caret-painting-after-paste-undo.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::localCaretRect):
+
+2011-01-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r76825.
+        http://trac.webkit.org/changeset/76825
+        https://bugs.webkit.org/show_bug.cgi?id=53256
+
+        "caused crashes on GTK and chromium" (Requested by rniwa on
+        #webkit).
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::ImageQualityController::keyDestroyed):
+        (WebCore::ImageQualityController::objectDestroyed):
+        (WebCore::ImageQualityController::highQualityRepaintTimerFired):
+        (WebCore::ImageQualityController::shouldPaintAtLowQuality):
+        (WebCore::imageQualityController):
+        (WebCore::RenderBoxModelObject::~RenderBoxModelObject):
+
+2011-01-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Generalize the mechanism view-source uses to remember the source for an HTMLToken
+        https://bugs.webkit.org/show_bug.cgi?id=53200
+
+        Currently view-source tracks the source associated with each HTMLToken.
+        We want to re-use this mechanism for the new XSS auditor.  This patch
+        moves this code into its own class so it can be shared between the
+        view-source parser and the general HTML parser.  This patch also add
+        support for tracking the source of tokens that span document.write
+        boundaries.
+
+        No functional change.  This code change is somewhat tested by our
+        view-source layout tests.
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+            - Fun with updating build files.
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::pumpTokenizer):
+            - Teach HTMLDocumentParser to track the source for HTMLTokens.
+              Currently, this information isn't used, but it will be shortly.
+              I ran the HTML parser benchmark and this change didn't have a
+              measurable effect.
+        * html/parser/HTMLDocumentParser.h:
+            - Composite in the HTMLSourceTracker.
+        * html/parser/HTMLSourceTracker.cpp: Added.
+        (WebCore::HTMLSourceTracker::HTMLSourceTracker):
+        (WebCore::HTMLSourceTracker::start):
+        (WebCore::HTMLSourceTracker::end):
+            - This function should eventualy be folded into HTMLTokenizer.
+        (WebCore::HTMLSourceTracker::sourceForToken):
+        * html/parser/HTMLSourceTracker.h: Added.
+        * html/parser/HTMLToken.h:
+            - Now HTMLTokens always have a start index of zero.  To do the job
+              of the old start index, this patch introduces the notion of a
+              baseOffset.  Unlike the start index (which was used as the base
+              offset for all the other indicies), the baseOffset can change
+              over the lifetime of the token.  We need the flexibility to
+              change the offset for tokens that span document.write boundaries.
+              Values are now normalized to zero-offset when stored.
+        (WebCore::HTMLToken::clear):
+        (WebCore::HTMLToken::setBaseOffset):
+        (WebCore::HTMLToken::end):
+        (WebCore::HTMLToken::beginAttributeName):
+        (WebCore::HTMLToken::endAttributeName):
+        (WebCore::HTMLToken::beginAttributeValue):
+        (WebCore::HTMLToken::endAttributeValue):
+        * html/parser/HTMLViewSourceParser.cpp:
+            - Updates the HTMLViewSourceParser to use the new
+              HTMLSourceTracker.
+        (WebCore::HTMLViewSourceParser::pumpTokenizer):
+        (WebCore::HTMLViewSourceParser::append):
+        (WebCore::HTMLViewSourceParser::sourceForToken):
+            - This function now just calls through to HTMLSourceTracker.
+        * html/parser/HTMLViewSourceParser.h:
+        * platform/text/SegmentedString.cpp:
+        (WebCore::SegmentedString::currentColumn):
+        (WebCore::SegmentedString::setCurrentPosition):
+        * platform/text/SegmentedString.h:
+        (WebCore::SegmentedString::numberOfCharactersConsumed):
+            - We need to handle the general case now.  The "slow" version
+              doesn't turn out to be any slower in practice anyway.
+
+2011-01-27  Sam Weinig  <sam@webkit.org>
+
+        Fix all the builds.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::paintOverhangAreas): Add parameters.
+
+2011-01-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Add ability to do an unconstrained scroll on a ScrollView
+        https://bugs.webkit.org/show_bug.cgi?id=53249
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::ScrollView):
+        Initialize m_constrainsScrollingToContentEdge to true.
+
+        (WebCore::ScrollView::setScrollOffset):
+        Only constrain the offset if the m_constrainsScrollingToContentEdge is set.
+
+        (WebCore::ScrollView::updateScrollbars):
+        Simplify expression converting an IntSize to an IntPoint.
+        
+        (WebCore::ScrollView::paint):
+        Paint the overhang if there is any.
+        
+        (WebCore::ScrollView::calculateOverhangAreasForPainting):
+        Calculate the overhang in viewport coordinates for painting.
+
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::constrainsScrollingToContentEdge):
+        (WebCore::ScrollView::setConstrainsScrollingToContentEdge):
+        Add bit to control whether the scroll position should be constrained
+        to the content edge when set.
+
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::usedTotalSize):
+        (WebCore::ScrollbarThemeComposite::thumbPosition):
+        (WebCore::ScrollbarThemeComposite::thumbLength):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint):
+        Improve calculations of thumb size and position to take overhang into account.
+
+2011-01-27  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG animation of Paths with segments of different coordinate modes on begin and end
+        https://bugs.webkit.org/show_bug.cgi?id=52984
+
+        At the moment we just support SVG path animations, if the number of segments on the given start path
+        is the same as the number of segments on the given end path. But a segment on a given position must be identical
+        on both paths as well. Not only the segment type, also the coordinate mode of the segments must be identical.
+        If MoveToRel is on the second position on the start path a MoveToRel must be on the second position
+        of the end path too. According to the SVG spec, at least the coordinate mode can differ. Means, if we have MoveToRel
+        in the start path, we can use MoveToAbs on the same position in the end path.
+
+        This patch fixes the blending code to follow the spec here. It was necessary to track the current position of
+        both paths, transform coordinates to the same coordinate mode and transform the resulting animation coordinate back
+        to the coordinate mode of either the start or the end path. Which mode is taken depends on the progress of the
+        animation.
+
+        Tests: svg/animations/animate-path-animation-Cc-Ss.html
+               svg/animations/animate-path-animation-Ll-Vv-Hh.html
+               svg/animations/animate-path-animation-Qq-Tt.html
+               svg/animations/animate-path-animation-cC-sS-inverse.html
+               svg/animations/animate-path-animation-lL-vV-hH-inverse.html
+               svg/animations/animate-path-animation-qQ-tT-inverse.html
+
+        * svg/SVGPathBlender.cpp:
+        (WebCore::blendFloatPoint):
+        (WebCore::blendAnimatedFloat):
+        (WebCore::SVGPathBlender::blendAnimatedDimensionalFloat):
+        (WebCore::SVGPathBlender::blendAnimatedFloatPoint):
+        (WebCore::SVGPathBlender::blendMoveToSegment):
+        (WebCore::SVGPathBlender::blendLineToSegment):
+        (WebCore::SVGPathBlender::blendLineToHorizontalSegment):
+        (WebCore::SVGPathBlender::blendLineToVerticalSegment):
+        (WebCore::SVGPathBlender::blendCurveToCubicSegment):
+        (WebCore::SVGPathBlender::blendCurveToCubicSmoothSegment):
+        (WebCore::SVGPathBlender::blendCurveToQuadraticSegment):
+        (WebCore::SVGPathBlender::blendCurveToQuadraticSmoothSegment):
+        (WebCore::SVGPathBlender::blendArcToSegment):
+        (WebCore::coordinateModeOfCommand):
+        (WebCore::isSegmentEqual):
+        (WebCore::SVGPathBlender::blendAnimatedPath):
+        (WebCore::SVGPathBlender::cleanup):
+        * svg/SVGPathBlender.h:
+
+2011-01-27  Cris Neckar  <cdn@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Clear the parent on a css keyframe's m_style when removing it from the stylesheet.
+        https://bugs.webkit.org/show_bug.cgi?id=52320
+
+        Test: fast/css/css-keyframe-style-crash.html
+
+        * css/CSSRuleList.cpp:
+        (WebCore::CSSRuleList::deleteRule):
+        * css/WebKitCSSKeyframesRule.cpp:
+        (WebCore::WebKitCSSKeyframesRule::~WebKitCSSKeyframesRule):
+
+2011-01-27  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Kent Tamura.
+
+        Color changes to option elements in a select multiple aren't drawn immediately
+        https://bugs.webkit.org/show_bug.cgi?id=49790
+
+        Redirect style changes on <option> element to the owner <select> element.
+
+        Test: fast/repaint/select-option-background-color.html
+
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::setRenderStyle):
+
+2011-01-19  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix performance regression in ImageQualityController::objectDestroyed().
+        https://bugs.webkit.org/show_bug.cgi?id=52645
+
+        In r72282, I inadvertently introduced this regression by using a
+        linear search through the hash map on object destruction.  This was
+        because the hash key consisted of both object pointer and layer id,
+        but on object destruction we only know the object pointer, requiring
+        a search to find all the layers. 
+        By replacing the hash map with two nested hash maps, where the outer key
+        is the object and the inner key is the layer, we can find all the
+        relevant data for an object in one hash lookup.
+
+        * rendering/RenderBoxModelObject.cpp:
+        Replace the (object,layer)->size HashMap with object->layer and
+        layer->size HashMaps.
+        (WebCore::ImageQualityController::isEmpty):
+        Implement isEmpty() for the outer HashMap.
+        (WebCore::ImageQualityController::removeLayer):
+        When a layer is removed, remove it from the inner hash map.
+        (WebCore::ImageQualityController::set):
+        Implement set():  if the inner map exists, set the layer->size tuple
+        directly.  If not, create a new inner map, set the tuple, and insert
+        it in the outer map.
+        (WebCore::ImageQualityController::objectDestroyed):
+        Look up the object in the outer map only.
+        (WebCore::ImageQualityController::highQualityRepaintTimerFired):
+        Cosmetic changes for the renamed now-outer hash map.
+        (WebCore::ImageQualityController::shouldPaintAtLowQuality):
+        Do both outer and inner hash map lookups.  Call set() to add/update
+        entries to the hash maps.  keyDestroyed() is now removeLayer().
+        (WebCore::imageQualityController):
+        Make the ImageQualityController a file-static global, so it can be
+        created and destroyed on the fly.
+        (WebCore::RenderBoxModelObject::~RenderBoxModelObject):
+        If there is no ImageQualityController, don't call objectDestroyed().
+        If it's empty, delete it.
+
+
+2011-01-26  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler and Adam Roben.
+
+        WebKit2: add support for drag and drop on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=52775
+        <rdar://problem/8514409>
+        
+        On Windows the access to the content being dragged is
+        provided via the IDataObject interface that is made available
+        to the window that registers itself as drop target.
+        Since this interface cannot be accessed from the WebProcess,
+        in every call to one of the methods of the IDropTarget interface
+        we serialize the content of the drag clipboard and send it over to
+        the WebProcess.
+        The bulk of this patch consists in the refactoring needed in DragData
+        and ClipboardWin classes to extract the data from the serialized object.
+        
+        * platform/DragData.cpp:
+        * platform/DragData.h:
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::getWebLocData):
+        (WebCore::getURL):
+        (WebCore::getPlainText):
+        (WebCore::getTextHTML):
+        (WebCore::getCFHTML):
+        (WebCore::fragmentFromFilenames):
+        (WebCore::containsFilenames):
+        (WebCore::fragmentFromHTML):
+        (WebCore::containsHTML):
+        (WebCore::getClipboardData):
+        * platform/win/ClipboardUtilitiesWin.h:
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::Clipboard::create):
+        (WebCore::ClipboardWin::ClipboardWin):
+        (WebCore::ClipboardWin::getData):
+        (WebCore::ClipboardWin::types):
+        (WebCore::ClipboardWin::files):
+        (WebCore::ClipboardWin::hasData):
+        * platform/win/ClipboardWin.h:
+        (WebCore::ClipboardWin::create):
+        * platform/win/DragDataWin.cpp:
+        (WebCore::DragData::DragData):
+        (WebCore::DragData::containsURL):
+        (WebCore::DragData::dragDataMap):
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::containsFiles):
+        (WebCore::DragData::asFilenames):
+        (WebCore::DragData::containsPlainText):
+        (WebCore::DragData::asPlainText):
+        (WebCore::DragData::canSmartReplace):
+        (WebCore::DragData::containsCompatibleContent):
+        (WebCore::DragData::asFragment):
+
+2011-01-27  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Space characters in source document interfere with reported caret offset
+        https://bugs.webkit.org/show_bug.cgi?id=53033
+
+        Calculate caret offset from rendered text instead of from node contents.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (objectAndOffsetUnignored): Calculate the caret offset based only
+        on positions and ranges, instead of using the computed offset in
+        the container node.
+
+2011-01-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53197
+        <rdar://problem/8895682> Make WebKit2 printing asynchronous
+
+        * WebCore.exp.in: Export more PrintContext methods that we didn't use on Mac before.
+
+        * page/PrintContext.cpp: (WebCore::PrintContext::spoolRect): Changed to make the same
+        transformation as spoolPages does for consistency.
+
+2011-01-27  David Grogan  <dgrogan@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        initial support for close() in indexeddb backend
+        https://bugs.webkit.org/show_bug.cgi?id=53150
+
+        Test: storage/indexeddb/transaction-after-close.html
+
+        * storage/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::IDBDatabase):
+        (WebCore::IDBDatabase::transaction):
+        (WebCore::IDBDatabase::close):
+        * storage/IDBDatabase.h:
+        * storage/IDBDatabase.idl:
+        * storage/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::transaction):
+        (WebCore::IDBDatabaseBackendImpl::close):
+
+2011-01-27  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG animation doesn't support calcMode discrete for number and color values.
+        https://bugs.webkit.org/show_bug.cgi?id=53189
+
+        Add support for calcMode discrete on number and color animation.
+
+        Tests: svg/animations/animate-color-calcMode-discrete.html
+               svg/animations/animate-number-calcMode-discrete.html
+
+        * svg/SVGAnimateElement.cpp:
+        (WebCore::SVGAnimateElement::calculateAnimatedValue):
+
+2011-01-26  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        shaderSource needs to preserve original source
+        https://bugs.webkit.org/show_bug.cgi?id=52833
+
+        Test: fast/canvas/webgl/gl-getshadersource.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::getShaderParameter): Intercept SHADER_SOURCE_LENGTH.
+        (WebCore::WebGLRenderingContext::getShaderSource): Intercept the call.
+        (WebCore::WebGLRenderingContext::shaderSource): Cache the source.
+        * html/canvas/WebGLShader.cpp: Cache shader source.
+        (WebCore::WebGLShader::WebGLShader):
+        * html/canvas/WebGLShader.h: Ditto.
+        (WebCore::WebGLShader::getSource):
+        (WebCore::WebGLShader::setSource):
+
+2011-01-27  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r76743.
+
+        * platform/graphics/wince/FontWinCE.cpp:
+        (WebCore::TextRunComponent::TextRunComponent):
+
+2011-01-27  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Closure and Global variable details automatically collapsing on each step through JavaScript code.
+        https://bugs.webkit.org/show_bug.cgi?id=53234
+
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane):
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2011-01-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r76789.
+        http://trac.webkit.org/changeset/76789
+        https://bugs.webkit.org/show_bug.cgi?id=53238
+
+        Broke GTK layout tests (Requested by podivilov on #webkit).
+
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane):
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2011-01-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: store all settings related to the agents on the frontend side
+        https://bugs.webkit.org/show_bug.cgi?id=53174
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptDebugServer.cpp:
+        * bindings/js/ScriptDebugServer.h:
+        * bindings/js/ScriptProfiler.cpp:
+        * bindings/js/ScriptProfiler.h:
+        * bindings/v8/ScriptDebugServer.cpp:
+        * bindings/v8/ScriptDebugServer.h:
+        * bindings/v8/ScriptProfiler.cpp:
+        * bindings/v8/ScriptProfiler.h:
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp: profiler and debugger enablement state is now stored
+        on the front-end side and will be pushed to the backend when the frontend is loaded.
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::disconnectFrontend):
+        (WebCore::InspectorAgent::restoreDebugger):
+        (WebCore::InspectorAgent::restoreProfiler):
+        (WebCore::InspectorAgent::enableProfiler):
+        (WebCore::InspectorAgent::disableProfiler):
+        (WebCore::InspectorAgent::showAndEnableDebugger):
+        (WebCore::InspectorAgent::enableDebugger):
+        (WebCore::InspectorAgent::disableDebugger):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorConsoleAgent.cpp: XHR failures will be logged to the console only
+        if the front-end was opened during current browser session and XHR logging is turned on
+        there.
+        (WebCore::InspectorConsoleAgent::setMonitoringXHREnabled):
+        (WebCore::InspectorConsoleAgent::setConsoleMessagesEnabled):
+        * inspector/InspectorDebuggerAgent.cpp:
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::identifierForInitialRequestImpl):
+        (WebCore::InspectorInstrumentation::didLoadResourceFromMemoryCacheImpl):
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::InspectorProfilerAgent):
+        (WebCore::InspectorProfilerAgent::startUserInitiatedProfiling):
+        * inspector/InspectorSettings.cpp: Removed.
+        * inspector/InspectorSettings.h: Removed.
+        * inspector/InspectorState.cpp:
+        (WebCore::InspectorState::InspectorState):
+        * inspector/InspectorState.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher.dispatcher.consoleMessagesCleared):
+        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher):
+        (WebInspector.ConsoleView.prototype._handleContextMenuEvent.itemAction):
+        (WebInspector.ConsoleView.prototype._handleContextMenuEvent):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._toggleProfiling):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._toggleDebugging):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+        * inspector/front-end/inspector.js:
+
+2011-01-27  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Closure and Global variable details automatically collapsing on each step through JavaScript code.
+        https://bugs.webkit.org/show_bug.cgi?id=53234
+
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane):
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2011-01-27  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Elements panel] Tooltip for relative links incorrectly identifies current URL
+        https://bugs.webkit.org/show_bug.cgi?id=53171
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.completeURL): Taught to understand partial href's that start with "?" (contain GET parameters only)
+
+2011-01-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [V8] Crash in WebCore::addMessageToConsole
+        https://bugs.webkit.org/show_bug.cgi?id=53227
+
+        * bindings/v8/V8Proxy.cpp: check that the Frame where the error
+        occured still has a page before getting a console object from it.
+        (WebCore::V8Proxy::reportUnsafeAccessTo):
+
+2011-01-27  Hans Wennborg  <hans@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        IndexedDB: Remove IDBCallbacks::onSuccess() used for null values.
+        https://bugs.webkit.org/show_bug.cgi?id=53178
+
+        Remove the IDBCallbacks::onSuccess() function that was used for
+        null values, and replace such calls with calls to
+        IDBCallBacks::onSuccess(SerializedScriptValue::nullValue())
+        instead.
+
+        No new functionality, so no new tests.
+
+        * storage/IDBCallbacks.h:
+        * storage/IDBCursorBackendImpl.cpp:
+        (WebCore::IDBCursorBackendImpl::updateInternal):
+        (WebCore::IDBCursorBackendImpl::continueFunctionInternal):
+        * storage/IDBIndexBackendImpl.cpp:
+        (WebCore::IDBIndexBackendImpl::openCursorInternal):
+        * storage/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::deleteInternal):
+        (WebCore::IDBObjectStoreBackendImpl::openCursorInternal):
+        * storage/IDBRequest.cpp:
+        * storage/IDBRequest.h:
+
+2011-01-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r76773.
+        http://trac.webkit.org/changeset/76773
+        https://bugs.webkit.org/show_bug.cgi?id=53230
+
+        breaks multiple GTK media tests (Requested by philn-tp on
+        #webkit).
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2011-01-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r76770.
+        http://trac.webkit.org/changeset/76770
+        https://bugs.webkit.org/show_bug.cgi?id=53229
+
+        Some inspector tests fail (Requested by yurys on #webkit).
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::isDebuggerAlwaysEnabled):
+        * bindings/js/ScriptDebugServer.h:
+        * bindings/js/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::isProfilerAlwaysEnabled):
+        * bindings/js/ScriptProfiler.h:
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::isDebuggerAlwaysEnabled):
+        * bindings/v8/ScriptDebugServer.h:
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::isProfilerAlwaysEnabled):
+        * bindings/v8/ScriptProfiler.h:
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::disconnectFrontend):
+        (WebCore::InspectorAgent::restoreDebugger):
+        (WebCore::InspectorAgent::restoreProfiler):
+        (WebCore::InspectorAgent::ensureSettingsLoaded):
+        (WebCore::InspectorAgent::enableProfiler):
+        (WebCore::InspectorAgent::disableProfiler):
+        (WebCore::InspectorAgent::showAndEnableDebugger):
+        (WebCore::InspectorAgent::enableDebugger):
+        (WebCore::InspectorAgent::disableDebugger):
+        * inspector/InspectorAgent.h:
+        (WebCore::InspectorAgent::settings):
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::setMonitoringXHREnabled):
+        (WebCore::InspectorConsoleAgent::setConsoleMessagesEnabled):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::isDebuggerAlwaysEnabled):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::identifierForInitialRequestImpl):
+        (WebCore::InspectorInstrumentation::didLoadResourceFromMemoryCacheImpl):
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::InspectorProfilerAgent):
+        (WebCore::InspectorProfilerAgent::startUserInitiatedProfiling):
+        * inspector/InspectorSettings.cpp: Added.
+        (WebCore::InspectorSettings::InspectorSettings):
+        (WebCore::InspectorSettings::getBoolean):
+        (WebCore::InspectorSettings::setBoolean):
+        (WebCore::InspectorSettings::getLong):
+        (WebCore::InspectorSettings::setLong):
+        (WebCore::InspectorSettings::registerBoolean):
+        (WebCore::InspectorSettings::registerLong):
+        * inspector/InspectorSettings.h: Copied from Source/WebCore/bindings/v8/ScriptProfiler.h.
+        * inspector/InspectorState.cpp:
+        (WebCore::InspectorState::InspectorState):
+        * inspector/InspectorState.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher.dispatcher.monitoringXHRStateChanged):
+        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher):
+        (WebInspector.ConsoleView.prototype._handleContextMenuEvent):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._toggleProfiling):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._toggleDebugging):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+        * inspector/front-end/inspector.js:
+
+2011-01-26  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] LayoutTests/media/audio-mpeg4-supported.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=53125
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache): Add audio/x-m4a mimetype in the cache.
+
+2011-01-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: store all settings related to the agents on the frontend side
+        https://bugs.webkit.org/show_bug.cgi?id=53174
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp: profiler and debugger enablement state is now stored
+        on the front-end side and will be pushed to the backend when the frontend is loaded.
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::disconnectFrontend):
+        (WebCore::InspectorAgent::restoreDebugger):
+        (WebCore::InspectorAgent::restoreProfiler):
+        (WebCore::InspectorAgent::enableProfiler):
+        (WebCore::InspectorAgent::disableProfiler):
+        (WebCore::InspectorAgent::showAndEnableDebugger):
+        (WebCore::InspectorAgent::enableDebugger):
+        (WebCore::InspectorAgent::disableDebugger):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorConsoleAgent.cpp: XHR failures will be logged to the console only
+        if the front-end was opened during current browser session and XHR logging is turned on
+        there.
+        (WebCore::InspectorConsoleAgent::setMonitoringXHREnabled):
+        (WebCore::InspectorConsoleAgent::setConsoleMessagesEnabled):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::identifierForInitialRequestImpl):
+        (WebCore::InspectorInstrumentation::didLoadResourceFromMemoryCacheImpl):
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::enable):
+        (WebCore::InspectorProfilerAgent::startUserInitiatedProfiling):
+        * inspector/InspectorProfilerAgent.h:
+        * inspector/InspectorSettings.cpp: Removed.
+        * inspector/InspectorSettings.h: Removed.
+        * inspector/InspectorState.cpp:
+        (WebCore::InspectorState::InspectorState):
+        * inspector/InspectorState.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher.dispatcher.consoleMessagesCleared):
+        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher):
+        (WebInspector.ConsoleView.prototype._handleContextMenuEvent.itemAction):
+        (WebInspector.ConsoleView.prototype._handleContextMenuEvent):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._toggleProfiling):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._toggleDebugging):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+        * inspector/front-end/inspector.js:
+
+2011-01-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION (r76743): Uneven spacing in right-to-left justified text
+        https://bugs.webkit.org/show_bug.cgi?id=53225
+
+        Fixes failure in fast/text/atsui-spacing-features.html
+
+        There was an inconsistency between rendering code and font code in the interpretation of
+        'after expansion' and 'trailing expansion'. Changed all code to interpret these in terms of
+        visual order rather than logical.
+
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::expansionOpportunityCount): Added a text direction parameter and changed to
+        iterate in visual order accordingly.
+        * platform/graphics/Font.h:
+        * platform/graphics/WidthIterator.cpp:
+        (WebCore::WidthIterator::WidthIterator): Pass the run direction to expansionOpportunityCount().
+        (WebCore::WidthIterator::advance): For right-to-left runs, evaluate the trailing expansion
+        condition with respect to the first character, which is the trailing character in visual order.
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::ComplexTextController): Pass the run direction to
+        expansionOpportunityCount().
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine): Ditto.
+
+2011-01-26  Adam Roben  <aroben@apple.com>
+
+        Don't create the Direct3D device before it's first needed
+
+        We only need the device once we decide to render. There's no point in creating it before
+        then.
+
+        Reviewed by Sam Weinig.
+
+        * platform/graphics/ca/win/CACFLayerTreeHost.cpp:
+        (WebCore::CACFLayerTreeHost::setWindow): Removed the call to createRenderer() from here.
+        We already have code to create it when we first try to draw.
+        (WebCore::CACFLayerTreeHost::createRenderer): Flush the context after we set our layer's
+        bounds so that the bounds will take effect the next time we render (which could be just
+        after this function returns).
+
+2011-01-26  Adam Roben  <aroben@apple.com>
+
+        Add assertions that CACFLayerTreeHost gains and loses an HWND only once
+
+        CACFLayerTreeHost doesn't support any other use pattern.
+
+        Reviewed by Sam Weinig.
+
+        * platform/graphics/ca/win/CACFLayerTreeHost.cpp:
+        (WebCore::CACFLayerTreeHost::CACFLayerTreeHost): Initialize new member.
+        (WebCore::CACFLayerTreeHost::setWindow): Assert that we transition from not having a window,
+        to having a window, to not having a window just once over the lifetime of this object.
+
+        * platform/graphics/ca/win/CACFLayerTreeHost.h: Added m_state.
+
+2011-01-26  Adam Roben  <aroben@apple.com>
+
+        Notify layers that their animations have started when we flush the context, not when we
+        render
+
+        r76372 separated context flushing from rendering, but this bit of code got left behind.
+
+        Reviewed by Sam Weinig.
+
+        * platform/graphics/ca/win/CACFLayerTreeHost.cpp:
+        (WebCore::CACFLayerTreeHost::render): Moved code to notify the layers from here to
+        notifyAnimationsStarted.
+        (WebCore::CACFLayerTreeHost::flushPendingLayerChangesNow): Added a call to
+        notifyAnimationsStarted after we flush the context.
+        (WebCore::CACFLayerTreeHost::notifyAnimationsStarted): Added. Code came from render. Changed
+        to call PlatformCALayer::animationStarted rather than calling through to the client
+        directly.
+
+        * platform/graphics/ca/win/CACFLayerTreeHost.h: Added notifyAniamtionsStarted.
+
+2011-01-26  Adam Roben  <aroben@apple.com>
+
+        Small cleanup in MediaPlayerPrivateFullscreenWindow
+
+        Reviewed by Sam Weinig.
+
+        * platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp:
+        (WebCore::MediaPlayerPrivateFullscreenWindow::~MediaPlayerPrivateFullscreenWindow): Moved
+        code here from close(), since this was the only place that called it after the following
+        change to createWindow.
+        (WebCore::MediaPlayerPrivateFullscreenWindow::createWindow): Replaced code that handled the
+        case where we had already created the window with an assertion that we have not already done
+        so. Our single caller (FullscreenVideoController) did not require this behavior.
+
+        * platform/graphics/win/MediaPlayerPrivateFullscreenWindow.h: Removed layerView.
+
+2011-01-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Move ScrollView scroll wheel code to ScrollAnimator.
+
+        * platform/ScrollAnimator.cpp:
+        (WebCore::ScrollAnimator::handleWheelEvent):
+        * platform/ScrollAnimator.h:
+        Moved implementation of handleWheelEvent from ScrollView::wheelEvent.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        Call down to the ScrollableArea.
+
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::handleWheelEvent):
+        Call down to the ScrollAnimator.
+
+        * platform/ScrollableArea.h:
+        (WebCore::ScrollableArea::scrollPosition):
+        (WebCore::ScrollableArea::minimumScrollPosition):
+        (WebCore::ScrollableArea::maximumScrollPosition):
+        (WebCore::ScrollableArea::visibleContentRect):
+        (WebCore::ScrollableArea::visibleHeight):
+        (WebCore::ScrollableArea::visibleWidth):
+        Add functions needed to implement wheel event in the animator.
+
+2011-01-26  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/53192> Add experimental support for HTTP pipelining in CFNetwork
+        <rdar://problem/8821760>
+
+        Reviewed by Antti Koivisto.
+
+        This adds support for HTTP pipelining in CFNetwork, but does not
+        enable it.  To enable it post-SnowLeopard, use this command:
+
+            defaults write BUNDLE.ID WebKitEnableHTTPPipelining -bool YES
+
+        Once enabled, it is possible to force the same load priority
+        (high) to be sent to CFNetwork to allow WebCore to handle the
+        scheduling:
+
+            defaults write BUNDLE.ID WebKitForceHTTPPipeliningPriorityHigh -bool YES
+
+        * WebCore.exp.in: Export _wkGetHTTPPipeliningPriority and
+        _wkSetHTTPPipeliningPriority.
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
+        Copy the priority to preflightRequest.
+
+        * loader/ResourceLoadScheduler.cpp:
+        (WebCore::ResourceLoadScheduler::scheduleLoad): Refactored code
+        at the end of the method to use an early return.
+
+        * loader/cache/CachedResourceRequest.cpp:
+        (WebCore::CachedResourceRequest::load): Set the priority on the
+        ResourceRequest object based on the priority of the
+        CachedResourceRequest before calling
+        ResourceLoadScheduler::scheduleSubresourceLoad().
+
+        * loader/icon/IconLoader.cpp:
+        (WebCore::IconLoader::startLoading): Create a ResourceRequest
+        object and set its priority to ResourceLoadPriorityLow before
+        passing it to ResourceLoadScheduler::scheduleSubresourceLoad().
+
+        * platform/mac/WebCoreSystemInterface.h:
+        (wkGetHTTPPipeliningPriority): Added.
+        (wkSetHTTPPipeliningPriority): Added.
+        * platform/mac/WebCoreSystemInterface.mm:
+        (wkGetHTTPPipeliningPriority): Added.
+        (wkSetHTTPPipeliningPriority): Added.
+
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::adopt): Set m_priority when
+        adopting a CrossThreadResourceRequestData.
+        (WebCore::ResourceRequestBase::copyData): Set m_priority when
+        creating a CrossThreadResourceRequestData.
+        (WebCore::ResourceRequestBase::priority): Added.
+        (WebCore::ResourceRequestBase::setPriority): Added.
+        (WebCore::equalIgnoringHeaderFields): Priorities must match when
+        comparing two ResourceRequest objects.
+
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::ResourceRequestBase): Set default
+        priority of new objects to ResourceLoadPriorityLow.
+        (WebCore::ResourceRequestBase::priority): Added declaration.
+        (WebCore::ResourceRequestBase::setPriority): Added declaration.
+        (WebCore::isHTTPPipeliningEnabled): Added.
+        (WebCore::shouldUseHTTPPipeliningPriority): Added.
+
+        * platform/network/cf/ResourceRequestCFNet.cpp: Updated so that
+        Mac OS X and Windows share code.
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost): Always
+        set the HTTP connection count per host, but return an
+        'unlimited' value when using HTTP pipelining.  This method used
+        to be defined in ResourceRequestMac.mm for Mac OS X.
+        (WebCore::readBooleanPreference): Added.  Helper method for
+        reading boolean user defaults.
+        (WebCore::isHTTPPipeliningEnabled): Returns value of user
+        default key WebKitEnableHTTPPipelining, or false if not set.
+        (WebCore::shouldUseHTTPPipeliningPriority): Returns value of
+        user default key WebKitForceHTTPPipeliningPriorityHigh, or false
+        if not set.
+        * platform/network/cf/ResourceRequestCFNet.h: Updated so that
+        Mac OS X and Windows share code.  Fixed indentation.
+        (WebCore::mapHTTPPipeliningPriorityToResourceLoadPriority): Added.
+        (WebCore::mapResourceLoadPriorityToHTTPPipeliningPriority): Added.
+
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest): Update
+        HTTP pipelining priority on NSMutableFURLRequest object.
+        (WebCore::ResourceRequest::doUpdateResourceRequest): Update
+        m_priority from the NSURLRequest object.
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost): Removed.
+        Code is now shared with Windows in ResourceRequestCFNet.cpp.
+
+2011-01-26  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/8895140> Adopt WKScrollbar metrics 
+        when using WKScrollbars.
+
+        New WebKitSystemInterface Functionality.
+        * WebCore.exp.in:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+        Some of the terrible static arrays are now only needed in the 
+        old non-WK code, so they are if-def'd now.
+        * platform/mac/ScrollbarThemeMac.mm:
+        
+        Just patching this function in a better way than I did
+        before.
+        (WebCore::updateArrowPlacement):
+        
+        Call into WK for the right values.
+        (WebCore::ScrollbarThemeMac::scrollbarThickness):
+        (WebCore::ScrollbarThemeMac::hasThumb):
+        (WebCore::ScrollbarThemeMac::minimumThumbLength):
+        
+        Return false if there are no buttons.
+        (WebCore::ScrollbarThemeMac::hasButtons):
+
+        Return an empty IntRect if there are not buttons.
+        (WebCore::buttonRepaintRect):
+
+2011-01-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add events to represent the start/end of a gesture scroll
+        https://bugs.webkit.org/show_bug.cgi?id=53215
+
+        * WebCore.exp.in: 
+        Add new file.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Add new file.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleGestureEvent):
+        * page/EventHandler.h:
+        Add entry point for handling gesture events.
+
+        * platform/PlatformGestureEvent.h: Added.
+        (WebCore::PlatformGestureEvent::PlatformGestureEvent):
+        (WebCore::PlatformGestureEvent::type):
+        (WebCore::PlatformGestureEvent::position):
+        (WebCore::PlatformGestureEvent::globalPosition):
+        (WebCore::PlatformGestureEvent::timestamp):
+        Add platform agnostic representation of a gesture event.
+
+2011-01-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        <rdar://problem/8446709> Allow inter-ideograph justification for CJK
+        https://bugs.webkit.org/show_bug.cgi?id=53184
+
+        Tests: fast/text/justify-ideograph-complex.html
+               fast/text/justify-ideograph-simple.html
+               fast/text/justify-ideograph-vertical.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawTextInternal): Corrected the type of the third parameter
+        passed to the TextRun constructor and added the trailingExpansionBehavior parameter.
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::expansionOpportunityCount): Added. Returns the number of expansion opportunities
+        for text justification. On entry, isAfterExpansion says whether an expansion opportunity exists
+        before the first character. On return, isAfterExpansion says whether an expansion opportunity
+        exists after the last character.
+        * platform/graphics/Font.h: 
+        * platform/graphics/GlyphBuffer.h:
+        (WebCore::GlyphBuffer::expandLastAdvance): Added.
+        * platform/graphics/TextRun.h:
+        (WebCore::TextRun::TextRun): Added a TrailingExpansionBehavior parameter to the constructors.
+        Renamed padding to expansion.
+        (WebCore::TextRun::expansion): Renamed padding() to this.
+        (WebCore::TextRun::allowsTrailingExpansion): Added this accessor.
+        * platform/graphics/WidthIterator.cpp:
+        (WebCore::WidthIterator::WidthIterator): Initialize m_isAfterExpansion. Use Font::expansionOpportunityCount()
+        and adjust the count if it includes a trailing expansion opportunity but the run disallows trailing
+        expansion.
+        (WebCore::WidthIterator::advance): Apply expansion before and after CJK ideographs.
+        (WebCore::WidthIterator::advanceOneCharacter): Changed to not clear the GlyphBuffer so that advance()
+        can expand the last advance if it is followed by a CJK ideograph.
+        * platform/graphics/WidthIterator.h: Renamed m_padding to m_expansion and m_padPerSpace
+        to m_expansionPerOpportunity.
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::canExpandAroundIdeographsInComplexText): Added.
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::Font::canExpandAroundIdeographsInComplexText): Added.
+        * platform/graphics/efl/FontEfl.cpp:
+        (WebCore::Font::canExpandAroundIdeographsInComplexText): Added.
+        * platform/graphics/gtk/FontGtk.cpp:
+        (WebCore::Font::canExpandAroundIdeographsInComplexText): Added.
+        * platform/graphics/haiku/FontHaiku.cpp:
+        (WebCore::Font::canExpandAroundIdeographsInComplexText): Added.
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::ComplexTextController): Initialize m_isAfterExpansion. Use
+        Font::expansionOpportunityCount() and adjust the count if it includes a trailing expansion
+        opportunity but the run disallows trailing expansion.
+        (WebCore::ComplexTextController::adjustGlyphsAndAdvances): Moved the definition and initialization
+        of hasExtraSpacing outside the loop. Apply expansion before and after CJK ideographs.
+        * platform/graphics/mac/ComplexTextController.h: Renamed m_padding to m_expansion and m_padPerSpace
+        to m_expansionPerOpportunity.
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::canExpandAroundIdeographsInComplexText): Added.
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::canExpandAroundIdeographsInComplexText): Added.
+        * platform/graphics/win/FontWin.cpp:
+        (WebCore::Font::canExpandAroundIdeographsInComplexText): Added.
+        * platform/graphics/win/UniscribeController.cpp:
+        (WebCore::UniscribeController::UniscribeController): Updated for rename.
+        * platform/graphics/wince/FontWinCE.cpp:
+        (WebCore::Font::canExpandAroundIdeographsInComplexText): Added.
+        * platform/graphics/wx/FontWx.cpp:
+        (WebCore::Font::canExpandAroundIdeographsInComplexText): Added.
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paint): Pass a TrailingExpansionBehavior to the TextRun constructor.
+        (WebCore::EllipsisBox::selectionRect): Ditto.
+        (WebCore::EllipsisBox::paintSelection): Ditto.
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox): Renamed m_toAdd to m_expansion.
+        (WebCore::InlineBox::expansion): Renamed toAdd() to this.
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::selectionRect): Pass a TrailingExpansionBehavior to the TextRun constructor.
+        (WebCore::InlineTextBox::paint): Ditto.
+        (WebCore::InlineTextBox::paintSelection): Ditto.
+        (WebCore::InlineTextBox::paintCompositionBackground): Ditto.
+        (WebCore::InlineTextBox::paintSpellingOrGrammarMarker): Ditto.
+        (WebCore::InlineTextBox::paintTextMatchMarker): Ditto.
+        (WebCore::InlineTextBox::computeRectForReplacementMarker): Ditto.
+        (WebCore::InlineTextBox::offsetForPosition): Ditto.
+        (WebCore::InlineTextBox::positionForOffset): Ditto.
+        * rendering/InlineTextBox.h:
+        (WebCore::InlineTextBox::setExpansion): Renamed setSpaceAdd() to this.
+        (WebCore::InlineTextBox::trailingExpansionBehavior): Added. Trailing expansion is allowed if this
+        is not the last leaf box on the line.
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine): Keep expansion opportunity counts
+        in a vector instead of computing them twice. Discard the trailing expansion opportunity in the
+        last text box.
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::paintObject): Pass a TrailingExpansionBehavior to the TextRun constructor.
+        (WebCore::RenderFileUploadControl::computePreferredLogicalWidths): Ditto.
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::updateFromElement): Ditto.
+        (WebCore::RenderListBox::paintItemForeground): Ditto. Also corrected the type of the second parameter.
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::getAvgCharWidth): Ditto.
+        (WebCore::RenderTextControl::paintPlaceholder): Ditto.
+        * rendering/svg/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::constructTextRun): Ditto.
+
+2011-01-26  Andy Estes  <aestes@apple.com>
+
+        Rubber-stamped by Darin Adler.
+
+        Inline HTMLObjectElement::hasValidClassId().
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::hasValidClassId):
+
+2011-01-26  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] crash on getBoundingClientRect in complex text
+        https://bugs.webkit.org/show_bug.cgi?id=53199
+
+        Use the correct array bound; we want the number of characters processed by
+        the shaper, not the longest continuous script run length.
+
+        Test: platform/chromium-linux/fast/text/international/complex-text-rectangle.html
+
+        * platform/graphics/chromium/ComplexTextControllerLinux.cpp:
+        (WebCore::ComplexTextController::nextScriptRun):
+        * platform/graphics/chromium/ComplexTextControllerLinux.h:
+        (WebCore::ComplexTextController::numCodePoints):
+
+2011-01-26  Emil A Eklund  <eae@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove cached document reference from CSSStyleSheet and XSLStyleSheet.
+        https://bugs.webkit.org/show_bug.cgi?id=52084
+
+        Test: fast/dom/css-delete-doc.html
+
+        * css/CSSMediaRule.cpp:
+        (WebCore::CSSMediaRule::insertRule):
+        (WebCore::CSSMediaRule::deleteRule):
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::CSSStyleSheet):
+        (WebCore::CSSStyleSheet::document):
+        * css/CSSStyleSheet.h:
+        * xml/XSLStyleSheet.h:
+        (WebCore::XSLStyleSheet::parentStyleSheet):
+        * xml/XSLStyleSheetLibxslt.cpp:
+        (WebCore::XSLStyleSheet::XSLStyleSheet):
+        (WebCore::XSLStyleSheet::cachedResourceLoader):
+        (WebCore::XSLStyleSheet::setParentStyleSheet):
+        (WebCore::XSLStyleSheet::ownerDocument):
+        * xml/XSLStyleSheetQt.cpp:
+        (WebCore::XSLStyleSheet::XSLStyleSheet):
+        (WebCore::XSLStyleSheet::cachedResourceLoader):
+        (WebCore::XSLStyleSheet::ownerDocument):
+
+2011-01-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        Reduce ref-count churn in shadowPseudoId.
+        https://bugs.webkit.org/show_bug.cgi?id=53136
+
+        Refactoring, so no new tests.
+
+        * dom/Element.h:
+        (WebCore::Element::shadowPseudoId): Changed signature to use const AtomicString&
+        * html/ValidationMessage.cpp:
+        (WebCore::ElementWithPseudoId::shadowPseudoId): Ditto.
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::SliderThumbElement::shadowPseudoId): Ditto, plus moved from the header file.
+        * html/shadow/SliderThumbElement.h: Ditto.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlMuteButtonElement::shadowPseudoId): Ditto.
+        (WebCore::MediaControlVolumeSliderMuteButtonElement::shadowPseudoId): Ditto.
+        (WebCore::MediaControlPlayButtonElement::shadowPseudoId): Ditto.
+        (WebCore::MediaControlSeekForwardButtonElement::shadowPseudoId): Ditto.
+        (WebCore::MediaControlSeekBackButtonElement::shadowPseudoId): Ditto.
+        (WebCore::MediaControlRewindButtonElement::shadowPseudoId): Ditto.
+        (WebCore::MediaControlReturnToRealtimeButtonElement::shadowPseudoId): Ditto.
+        (WebCore::MediaControlToggleClosedCaptionsButtonElement::shadowPseudoId): Ditto.
+        (WebCore::MediaControlTimelineElement::shadowPseudoId): Ditto.
+        (WebCore::MediaControlVolumeSliderElement::shadowPseudoId): Ditto.
+        (WebCore::MediaControlFullscreenButtonElement::shadowPseudoId): Ditto.
+        * rendering/MediaControlElements.h: Ditto.
+
+2011-01-26  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46421, make multi-column layout work with vertical text.
+
+        Added new tests in fast/multicol/vertical-lr and fast/multicol/vertical-rl.
+
+        * css/html.css:
+        Update p, blockquote and h1-h6 to respect directionality so that column layout tests that use those
+        elements work properly.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesInBlockDirection):
+        Fix a flipping bug with the computation of lineTopIncludingMargins where it could be incorrectly shrunk
+        in some cases (causing lines to all stack on top of one another).
+
+        * rendering/InlineTextBox.h:
+        (WebCore::InlineTextBox::calculateBoundaries):
+        Fix calculateBoundaries to be physical rather than logical.
+
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::addForcedColumnBreak):
+        * rendering/LayoutState.h:
+        Rename childY to childLogicalOffset.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::addOverflowFromChildren):
+        (WebCore::RenderBlock::addOverflowFromFloats):
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::estimateLogicalTopPosition):
+        (WebCore::RenderBlock::layoutBlockChild):
+        (WebCore::RenderBlock::markForPaginationRelayoutIfNeeded):
+        (WebCore::RenderBlock::paintColumnRules):
+        (WebCore::RenderBlock::paintColumnContents):
+        (WebCore::RenderBlock::paintFloats):
+        (WebCore::RenderBlock::selectionGaps):
+        (WebCore::RenderBlock::removeFloatingObjectsBelow):
+        (WebCore::RenderBlock::addOverhangingFloats):
+        (WebCore::RenderBlock::hitTestFloats):
+        (WebCore::RenderBlock::hitTestColumns):
+        (WebCore::RenderBlock::calcColumnWidth):
+        (WebCore::RenderBlock::desiredColumnWidth):
+        (WebCore::RenderBlock::columnRectAt):
+        (WebCore::RenderBlock::layoutColumns):
+        (WebCore::RenderBlock::adjustPointToColumnContents):
+        (WebCore::RenderBlock::adjustRectForColumns):
+        (WebCore::RenderBlock::flipForWritingModeIncludingColumns):
+        (WebCore::RenderBlock::adjustForColumns):
+        (WebCore::RenderBlock::adjustForBorderFit):
+        (WebCore::RenderBlock::nextPageLogicalTop):
+        (WebCore::RenderBlock::applyBeforeBreak):
+        (WebCore::RenderBlock::applyAfterBreak):
+        (WebCore::RenderBlock::adjustForUnsplittableChild):
+        (WebCore::RenderBlock::adjustLinePositionForPagination):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::logicalRightOffsetForContent):
+        (WebCore::RenderBlock::logicalLeftOffsetForContent):
+        (WebCore::RenderBlock::leftForFloatIncludingMargin):
+        (WebCore::RenderBlock::topForFloatIncludingMargin):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::determineStartPosition):
+        Reworking of all the RenderBlock column functions to support flipping and vertical modes.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::offsetFromContainer):
+        (WebCore::RenderBox::flipForWritingModeIncludingColumns):
+        Patch offsetFromContainer to be aware of flipped block writing modes when dealing with column layouts.
+
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::clientLogicalBottom):
+        Fix a bug in clientLogicalBottom where it didn't add in the right border/padding.
+        
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        Better terminology for pagination.
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::offsetFromContainer):
+        (WebCore::RenderInline::mapLocalToContainer):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintChildLayerIntoColumns):
+        (WebCore::RenderLayer::hitTestChildLayerColumns):
+        (WebCore::RenderLayer::localBoundingBox):
+        (WebCore::RenderLayer::boundingBox):
+        Patch painting in RenderLayers to be vertical-text-aware.
+    
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::mapLocalToContainer):
+        Add code to be flipped block-aware with columns.
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::layout):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows):
+        Fix pagination to use better terminology.
+        
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::absoluteQuads):
+        (WebCore::RenderText::absoluteQuadsForRange):
+        Fix a bug where vertical text wasn't taken into account.
+
+2011-01-26  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, rolling out r76719.
+        http://trac.webkit.org/changeset/76719
+        https://bugs.webkit.org/show_bug.cgi?id=53122
+
+        Broke a bunch of media tests in Chromium/Qt/GTK.
+
+2011-01-26  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        [gtk] strip NUL characters when copying text/html on GTK+
+        https://bugs.webkit.org/show_bug.cgi?id=52508
+
+        Putting NUL characters in the text/html clipboard doesn't work in
+        WebKit GTK+ (the pasted value is truncated at the NUL).  Since we're
+        already stripping this character for plain text (for Windows), strip
+        it in text/html too.
+
+        * editing/MarkupAccumulator.h: mark function as virtual
+        * editing/markup.cpp:
+        (WebCore::StyledMarkupAccumulator::appendString):
+        (WebCore::StyledMarkupAccumulator::takeResults): strip nulls
+
+2011-01-26  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Reliable crash with getTextAtOffset()
+        https://bugs.webkit.org/show_bug.cgi?id=53131
+
+        Properly calculate length in bytes for a UTF8 substring.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (utf8Substr): Use character instead of bytes as units to
+        calculate the length in bytes for the UTF8 string.
+
+2011-01-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        Change HTMLInputElement-derived parts of media element shadow DOM to use shadowPseudoId.
+        https://bugs.webkit.org/show_bug.cgi?id=53122
+
+        This is the first step in converting HTMLMediaElement to the new shadow DOM.
+
+        Should not regress any existing tests. No observable change in behavior.
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::pseudoId): Removed now-unnecessary hard-coded pseudo-element selectors.
+        (WebCore::nameToPseudoTypeMap): Ditto.
+        (WebCore::CSSSelector::extractPseudoType): Ditto.
+        * css/CSSSelector.h: Ditto.
+        * css/mediaControls.css: Added proper initial values, now that elements use the proper selector pipeline.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlInputElement::MediaControlInputElement): Removed the switch statement,
+            which is now replaced with virtual shadowPseudoId on each corresponding class.
+        (WebCore::MediaControlInputElement::styleForElement): Changed to use element pipeline.
+        (WebCore::MediaControlMuteButtonElement::MediaControlMuteButtonElement): Changed to set
+            display type in constructor.
+        (WebCore::MediaControlMuteButtonElement::create): Changed to not take PseudoId as
+            constructor argument.
+        (WebCore::MediaControlMuteButtonElement::shadowPseudoId): Added.
+        (WebCore::MediaControlVolumeSliderMuteButtonElement::MediaControlVolumeSliderMuteButtonElement): Added
+            to disambiguate from the MediaControlMuteButtonElement.
+        (WebCore::MediaControlVolumeSliderMuteButtonElement::create): Added.
+        (WebCore::MediaControlVolumeSliderMuteButtonElement::shadowPseudoId): Added.
+        (WebCore::MediaControlPlayButtonElement::MediaControlPlayButtonElement): Changed to not take PseudoId as
+            constructor argument.
+        (WebCore::MediaControlPlayButtonElement::shadowPseudoId): Added.
+        (WebCore::MediaControlSeekButtonElement::MediaControlSeekButtonElement): Changed to not take PseudoId as
+            constructor argument.
+        (WebCore::MediaControlSeekForwardButtonElement::MediaControlSeekForwardButtonElement): Added.
+        (WebCore::MediaControlSeekForwardButtonElement::create): Added.
+        (WebCore::MediaControlSeekForwardButtonElement::shadowPseudoId): Added.
+        (WebCore::MediaControlSeekBackButtonElement::MediaControlSeekBackButtonElement): Added.
+        (WebCore::MediaControlSeekBackButtonElement::create): Added.
+        (WebCore::MediaControlSeekBackButtonElement::shadowPseudoId): Added.
+        (WebCore::MediaControlRewindButtonElement::MediaControlRewindButtonElement): Added.
+        (WebCore::MediaControlRewindButtonElement::shadowPseudoId): Added.
+        (WebCore::MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement): Changed to not take PseudoId as
+            constructor argument.
+        (WebCore::MediaControlReturnToRealtimeButtonElement::shadowPseudoId): Added.
+        (WebCore::MediaControlToggleClosedCaptionsButtonElement::MediaControlToggleClosedCaptionsButtonElement): Changed to not take PseudoId as
+            constructor argument.
+        (WebCore::MediaControlToggleClosedCaptionsButtonElement::shadowPseudoId): Added.
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement): Changed to not take PseudoId as
+            constructor argument.
+        (WebCore::MediaControlTimelineElement::shadowPseudoId): Added.
+        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement): Changed to not take PseudoId as
+            constructor argument.
+        (WebCore::MediaControlVolumeSliderElement::shadowPseudoId): Added.
+        (WebCore::MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement): Changed to not take PseudoId as
+            constructor argument.
+        (WebCore::MediaControlFullscreenButtonElement::shadowPseudoId): Added.
+        * rendering/MediaControlElements.h:
+        (WebCore::MediaControlSeekForwardButtonElement::isForwardButton): Added.
+        (WebCore::MediaControlSeekBackButtonElement::isForwardButton): Added.
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createMuteButton): Changed to use new constructor.
+        (WebCore::RenderMedia::createSeekBackButton): Ditto.
+        (WebCore::RenderMedia::createSeekForwardButton): Ditto.
+        (WebCore::RenderMedia::createVolumeSliderMuteButton): Ditto.
+        * rendering/style/RenderStyleConstants.h: Removed constants that are no longer used.
+
+2011-01-26  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by James Robinson.
+
+        Fix multisampling support in DrawingBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=53154
+
+        In DrawingBuffer's multisampling code path, fixed enum usage and a
+        bug where it would incorrectly redefine the depth and stencil
+        buffers. Hooked up multisampling code path in Chromium port.
+
+        Tested manually with some accelerated 2D canvas content.
+        Multisampling isn't being switched on for the accelerated 2D
+        canvas at the current time because it will increase fill rate
+        requirements and cause a large number of rebaselines.
+
+        * platform/graphics/Extensions3D.h:
+        * platform/graphics/chromium/DrawingBufferChromium.cpp:
+        (WebCore::DrawingBuffer::publishToPlatformLayer):
+        * platform/graphics/chromium/Extensions3DChromium.h:
+        * platform/graphics/gpu/DrawingBuffer.cpp:
+        (WebCore::DrawingBuffer::create):
+        (WebCore::DrawingBuffer::reset):
+        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
+        (WebCore::Extensions3DOpenGL::supports):
+
+2011-01-26  Tony Chang  <tony@chromium.org>
+
+        Unreviewed.
+
+        [chromium] revert r68310 because of race conditions detected by tsans
+        https://bugs.webkit.org/show_bug.cgi?id=53185
+
+        Causes stability problems for Chromium, http://crbug.com/70589
+
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+
+2011-01-26  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Make fireEventsAndUpdateStyle use stack local vectors. 
+        https://bugs.webkit.org/show_bug.cgi?id=46760
+
+        Test: animations/animation-add-events-in-handler.html
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::fireEventsAndUpdateStyle):
+
+2011-01-26  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Remove m_URL from FrameLoader and depend on Document::url()
+        instead. FrameLoader::url() will be removed in a followup patch.
+        https://bugs.webkit.org/show_bug.cgi?id=41165
+
+        Refactor only, no new tests.
+
+        * WebCore.exp.in:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::updateURLForPushOrReplaceState):
+        * loader/DocumentWriter.cpp:
+        (WebCore::DocumentWriter::begin):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::iconURL):
+        (WebCore::FrameLoader::didOpenURL):
+        (WebCore::FrameLoader::didExplicitOpen):
+        (WebCore::FrameLoader::receivedFirstData):
+        (WebCore::FrameLoader::url):
+        (WebCore::FrameLoader::setOutgoingReferrer):
+        (WebCore::FrameLoader::startIconLoader):
+        (WebCore::FrameLoader::commitIconURLToIconDatabase):
+        (WebCore::FrameLoader::finishedParsing):
+        (WebCore::FrameLoader::checkIfDisplayInsecureContent):
+        (WebCore::FrameLoader::checkIfRunInsecureContent):
+        (WebCore::FrameLoader::updateFirstPartyForCookies):
+        (WebCore::FrameLoader::loadInSameDocument):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::open):
+        (WebCore::FrameLoader::shouldScrollToAnchor):
+        * loader/FrameLoader.h: Rename setURL() to setOutgoingReferrer().
+
+2011-01-25  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Crashes loading pages when cancelling subresource loads through WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=53123
+        <rdar://problem/8914361>
+        
+        Fix a crash that happened when cancelling subresource loads through WebKit.
+        
+        When a load is cancelled synchronously (via the WebKit client), CachedResourceLoader::requestResource 
+        can be called recursively on the same function, either leading to infinite recursion, or deleting 
+        an object when it is not done being used.
+        
+        The fix for this was to call checkForPendingPreloads and servePendingRequests asynchronously when 
+        CachedResourceLoader::loadDone was called synchronously (due to the load being cancelled synchronously).
+
+        Test: fast/loader/willSendRequest-null-for-preload.html
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::setRequest): Only dispatch didReceiveServerRedirectForProvisionalLoadForFrame 
+            if our new URL is non-null.
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::CachedResourceLoader): Initialize our timer.
+        (WebCore::CachedResourceLoader::loadDone): If the CachedResource we were passed in was 0, that means this 
+            function was called synchronously
+            from CachedResourceRequest::load, and we don't want to call into checkForPendingPreloads synchronously, 
+            so put it on a 0-delay timer to make the calls to checkForPendingPreloads and servePendingRequests asynchronous.
+        (WebCore::CachedResourceLoader::loadDonePendingActionTimerFired): Call checkForPendingPreloads and servePendingRequests.
+        (WebCore::CachedResourceLoader::checkForPendingPreloads): m_pendingPreloads is now a Deque instead of a Vector, 
+            so use Deque methods.
+        * loader/cache/CachedResourceLoader.h: Add the timer, the timer callback function, and make m_pendingPreloads a Deque.
+
+2011-01-25  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: evaluate in console may not work when window.console is substituted or deleted.
+        https://bugs.webkit.org/show_bug.cgi?id=53072
+
+        Test: inspector/console-substituted.html
+
+        * inspector/InjectedScriptSource.js:
+        (.):
+
+2011-01-26  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [cairo] Use CAIRO_OPERATOR_DARKEN when available
+        https://bugs.webkit.org/show_bug.cgi?id=53084
+
+        Use CAIRO_OPERATOR_DARKEN for CompositePlusDarker instead of
+        CAIRO_OPERATOR_SATURATE when building with cairo version >= 1.10.
+
+        * platform/graphics/cairo/CairoUtilities.cpp:
+        (WebCore::toCairoOperator):
+
+2011-01-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: visualize \n in strings as unicode cr
+        symbol in stack variables sidebar.
+        https://bugs.webkit.org/show_bug.cgi?id=53162
+
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+
+2011-01-26  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: size is wrong for cached resources in Network panel
+        - Set the size for 304/not modified resources from cached resource.
+        - Add response headers size to resource transfer size.
+        https://bugs.webkit.org/show_bug.cgi?id=52886
+
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::didReceiveResponse):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource):
+        (WebInspector.Resource.prototype.get transferSize):
+        (WebInspector.Resource.prototype.set responseHeaders):
+        (WebInspector.Resource.prototype._headersSize):
+        (WebInspector.Resource.prototype._mimeTypeIsConsistentWithType):
+
+2011-01-26  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fixed TiledBacking store to take into account new dirty regions caused by
+        paint time layouts.
+
+        Flawed rendering design for QtWebKit resulting in artifacts being displayed
+        https://bugs.webkit.org/show_bug.cgi?id=49184
+
+        There are no new tests as this patch aims at fixing flicker that
+        happen randomly, mostly on slow hardware, thus are hard to reproduce
+        consistently in an automated test.
+
+        This patch does not fully address the said bug but it is a step in the
+        right direction. A full solution to the bug, as currently perceived,
+        requires either a Qt GUI API change, a performance hit for QtWebKit,
+        or a hack, until a full solution is provided this patch is progress.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::updateTileBuffers):
+        Changed to take into account newly dirtied areas created during
+        tile update initiated layouts during the same update.
+
+2011-01-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [SKIA] Remove "current path" of GraphicsContext
+        https://bugs.webkit.org/show_bug.cgi?id=53124
+
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::strokeBoundingRect):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        * platform/graphics/skia/PlatformContextSkia.h:
+
+2011-01-26  Zalan Bujtas <zbujtas@gmail.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Path::normalAngleAtLength() returns incorrect value on ACID3.
+
+        QPainterPath returns angle values with the origo being at the top left corner,
+        we need to account for this in normalAngleAtLength().
+        This Regressed with r66979.
+
+        No new tests as this is already covered by ACID3.
+
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::normalAngleAtLength):
+
+2011-01-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: live edit does not update source snippet.
+        https://bugs.webkit.org/show_bug.cgi?id=53097
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._scriptSourceChanged):
+
+2011-01-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Incorrect on-hover evaluation of a variable named 'profile'.
+        https://bugs.webkit.org/show_bug.cgi?id=53018
+
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::evaluate):
+        (WebCore::InjectedScript::evaluateOnCallFrame):
+        (WebCore::InjectedScript::getCompletions):
+        (WebCore::InjectedScript::getCompletionsOnCallFrame):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptSource.js:
+        (.):
+        * inspector/Inspector.idl:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::evaluateOnCallFrame):
+        (WebCore::InspectorDebuggerAgent::getCompletionsOnCallFrame):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::evaluate):
+        (WebCore::InspectorRuntimeAgent::getCompletions):
+        * inspector/InspectorRuntimeAgent.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
+        (WebInspector.ConsoleView.prototype._enterKeyPressed):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame.updatingCallbackWrapper):
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._showPopup):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+
+2011-01-26  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        A speculative fix for Bug 52422 - [chromium] More crash in
+        FontFallbackList::determinePitch(const Font* font)
+        https://bugs.webkit.org/show_bug.cgi?id=52422
+
+        My previous change may not work on non-US Windows whose system fonts
+        have localized aliases matching to the system locale because of a
+        font-name mismatch in createFontIndirectAndGetWinName(). This change
+        tries all the fonts installed in a PC and returns the first font that we
+        can create without errors.
+
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore::GetLastResortFallbackFontProcData::GetLastResortFallbackFontProcData):
+        Added a struct used for getLastResortFallbackFontProc().
+        (WebCore::getLastResortFallbackFontProc): Added a callback for EnumFontFamilies().
+        (WebCore::FontCache::getLastResortFallbackFont): Use EnumFontFamilies() to find a last-resort font.
+
+2011-01-26  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        Add a DOMTimeStamp parameter to the requestAnimationFrame callback
+        https://bugs.webkit.org/show_bug.cgi?id=53142
+
+        This adds a DOMTimeStamp parameter to the requestAnimationFrame callback to more
+        closely match mozilla's proposal.  This is useful if the page has multiple imperative animations
+        and wants to ensure that they all remain synchronized.  If each callback used Date.now() to
+        update its animation state, they would potentially be out of sync with each other.  If they use
+        the timestamp then all callbacks for the same "frame" will update to the same state.
+
+        Test: fast/animation/request-animation-frame-timestamps.html
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/test/V8/V8TestCallback.cpp:
+        (WebCore::V8TestCallback::callbackWithClass2Param):
+        * dom/Document.cpp:
+        (WebCore::Document::serviceScriptedAnimations):
+        * dom/Document.h:
+        * dom/RequestAnimationFrameCallback.h:
+        * dom/RequestAnimationFrameCallback.idl:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::serviceScriptedAnimations):
+        * page/FrameView.h:
+
+2011-01-25  Yuzo Fujishima  <yuzo@google.com>
+
+        Unreviewed attempt to fix compilation error for Chromium Clang.
+
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::advance):
+
+2011-01-25  Ned Holbrook  <nholbrook@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        ComplexTextController incorrectly conflates string length and range of indexes
+        https://bugs.webkit.org/show_bug.cgi?id=52760
+
+        Test: fast/text/offsetForPosition-complex-fallback.html
+
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::offsetForPosition):
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun):
+        (WebCore::ComplexTextController::ComplexTextRun::setIsNonMonotonic):
+        (WebCore::ComplexTextController::advance):
+        * platform/graphics/mac/ComplexTextController.h:
+        (WebCore::ComplexTextController::ComplexTextRun::create):
+        (WebCore::ComplexTextController::ComplexTextRun::indexEnd):
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun):
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun):
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersCoreText):
+
+2011-01-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Scrollbars don't work correctly for top-to-bottom text in an overflow: scroll area
+        https://bugs.webkit.org/show_bug.cgi?id=53048
+
+        Test: fast/overflow/overflow-rtl-vertical-origin.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollPosition):
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+        Take the scroll origin into account when calculating scrollbars in more places.
+
+2011-01-25  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows production build fix.
+        Use correct configuration-specific path in makefile.
+
+        * WebCore.vcproj/WebCore.make:
+
+2011-01-25  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Radio button group state is not restored correctly
+        https://bugs.webkit.org/show_bug.cgi?id=50442
+
+        Fixes a bug that radio button states are not restored correctly in
+        a case that non-first radio button in a group is checked.
+
+        If "checked" attribute is present, the radio button is checked and
+        other radio buttons in the group are unchecked. This behavior
+        disturbs form state restoring. This patch changes this behavior so
+        that the "checked" attribute handling is delayed after form state
+        restoring.
+
+        Test: fast/forms/state-restore-radio-group.html
+
+        * html/HTMLFormControlElement.h:
+         Make finishParsingChildren() protected so that HTMLInpuElement can call it.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::HTMLInputElement):
+         - Add createdByParser parameter.
+         - Initialize m_stateRestored and m_parsingInProgress.
+        (WebCore::HTMLInputElement::create): Sync with the constructor.
+        (WebCore::HTMLInputElement::restoreFormControlState):
+         Set m_stateRestored in order to refer it in finishParsingChildren().
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+         Don't call setChecked() during parsing. Move setNeedsValidityCheck()
+         to setChecked().
+        (WebCore::HTMLInputElement::finishParsingChildren):
+         Call setChecked() if form state is not restored.
+        (WebCore::HTMLInputElement::setChecked):
+         Move setNeedsValidityCheck() from parseMappedAttribute() because
+         finishParsingChildren() also needs to call setNeedsValidityCheck().
+        * html/HTMLInputElement.h:
+         - Remove the default value of HTMLFormElement* of the HTMLInputElement
+           constructor, and add createdByParser parameter.
+         - Introduce m_parsingInProgress and m_stateRestored.
+        * html/HTMLIsIndexElement.cpp:
+        (WebCore::HTMLIsIndexElement::HTMLIsIndexElement):
+         Sync with the HTMLInputElement constructor change.
+        * html/HTMLTagNames.in: Add constructorNeedsCreatedByParser flag.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+         Sync with the HTMLInputElement constructor change.
+        * rendering/ShadowElement.cpp:
+        (WebCore::ShadowInputElement::ShadowInputElement): ditto.
+        * rendering/ShadowElement.h:
+        (WebCore::ShadowElement::ShadowElement): ditto.
+
+2011-01-25  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        HTMLFormElement::checkValidity() returns incorrect result if 'invalid' events are canceled.
+        https://bugs.webkit.org/show_bug.cgi?id=52565
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::validateInteractively):
+          Check checkInvalidControlsAndCollectUnhandled() result instead of
+          checking emptiness of unhandled invalid controls list.
+        (WebCore::HTMLFormElement::checkValidity): ditto.
+        (WebCore::HTMLFormElement::checkInvalidControlsAndCollectUnhandled):
+          Renamed from collectUnhandledInvalidControls().
+          Returns true if there is any invalid control regardless of event canceling.
+        * html/HTMLFormElement.h: Rename collectUnhandledInvalidControls() to
+          checkInvalidControlsAndCollectUnhandled().
+
+2011-01-25  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Range and number inputs should reject increment and decrement by
+        keyboard or mouse wheel if they are disabled or read-only
+        https://bugs.webkit.org/show_bug.cgi?id=53151
+
+        * html/RangeInputType.cpp:
+        (WebCore::RangeInputType::handleKeydownEvent): Check disabled() and readOnly().
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::handleKeydownEventForSpinButton): ditto.
+        (WebCore::TextFieldInputType::handleWheelEventForSpinButton): ditto.
+
+2011-01-25  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        API to support localized numbers for <input type=number>
+        https://bugs.webkit.org/show_bug.cgi?id=45730
+
+        Introduce platform/text/LocalizedNumber.h, and
+        LocalizedNumberNone.cpp, which is an empty implementation of the
+        functions in LocalizedNumber.h.  We use LocalizedNumberNone.cpp in
+        all platforms for now.
+
+        A string in a type=number field is parsed as a localized number
+        first. If the parsing fails, it is parsed as the HTML5 number.
+
+        We introduce HTMLInputElement::visibleValue(). It represents a value
+        which should be drawn by a renderer. HTMLInputElement::value() always
+        returns a number formatted for HTML5, and visibleValue() may return a
+        localized number.
+
+        No new tests because this doesn't change any behavior.
+
+        * Android.mk: Add LocalizedNumber.h and/or LocalizedNumberNone.cpp.
+        * CMakeLists.txt: ditto.
+        * GNUmakefile.am: ditto.
+        * WebCore.gypi: ditto.
+        * WebCore.pro: ditto.
+        * WebCore.vcproj/WebCore.vcproj: ditto.
+        * WebCore.xcodeproj/project.pbxproj: ditto.
+        * dom/InputElement.h: Add visibleValue().
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::visibleValue): Added.  Just call InputType::visibleValue().
+        * html/HTMLInputElement.h: Declare visibleValue().
+        * html/InputType.cpp:
+        (WebCore::InputType::visibleValue): Add the default implementation of
+          visibleValue(), which returns HTMLInputElement::value().
+        * html/InputType.h: Add declarations.
+        * html/NumberInputType.cpp:
+        (WebCore::isHTMLNumberCharacter): Renamed from isNumberCharacter().
+        (WebCore::isNumberCharacter): Calls isLocalizedNumberCharacter() and isHTMLNumberCharacter().
+        (WebCore::NumberInputType::visibleValue):
+          Returns a localized number string produced by formatLocalizedNumber().
+        (WebCore::NumberInputType::isAcceptableValue): Calls parseLocalizedNumber().
+        (WebCore::NumberInputType::sanitizeValue): Calls parseLocalizedNumber().
+        * html/NumberInputType.h: Add declarations.
+        * platform/text/LocalizedNumber.h: Added.
+        * platform/text/LocalizedNumberNone.cpp: Added.
+        (WebCore::parseLocalizedNumber):
+        (WebCore::formatLocalizedNumber):
+        (WebCore::isLocalizedNumberCharacter):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+          Calls InputElement::visibleValue() instead of value().
+        * wml/WMLInputElement.h:
+        (WebCore::WMLInputElement::visibleValue): Added. It just calls value().
+
+2011-01-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53143
+        Add IntRectHash
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/IntRectHash.h: Added.
+
+        * platform/graphics/IntSizeHash.h: Don't do "using WebCore::IntSize"!
+
+2011-01-25  Ilya Sherman  <isherman@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Remove trailing whitespace in HTMLInputElement.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=53152
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::updateCheckedRadioButtons):
+        (WebCore::HTMLInputElement::applyStep):
+        (WebCore::HTMLInputElement::updateFocusAppearance):
+        (WebCore::HTMLInputElement::mapToEntry):
+        (WebCore::HTMLInputElement::setAutofilled):
+        (WebCore::HTMLInputElement::willMoveToNewOwnerDocument):
+        (WebCore::HTMLInputElement::didMoveToNewOwnerDocument):
+
+2011-01-25  Mike Reed  <reed@google.com>
+
+        Reviewed by James Robinson.
+
+        DrawingBufer::reset() today checks if the new size is the same as its
+        m_size, and if so, returns immediately. This does not match the
+        semantics of <canvas>, which wants to clear its contents anytime the
+        size is specified.
+        https://bugs.webkit.org/show_bug.cgi?id=53149
+
+        Test: Covered by existing <canvas> tests using gpu.
+
+        * platform/graphics/chromium/DrawingBufferChromium.cpp:
+        (WebCore::DrawingBuffer::DrawingBuffer):
+        * platform/graphics/gpu/DrawingBuffer.cpp:
+        (WebCore::DrawingBuffer::reset):
+
+2011-01-25  Cris Neckar  <cdn@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add a hashset of DOMURLs to ScriptExecutionContext to track back references.
+        https://bugs.webkit.org/show_bug.cgi?id=53038
+
+        Test: fast/dom/window-domurl-crash.html
+
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::~ScriptExecutionContext):
+        (WebCore::ScriptExecutionContext::createdDomUrl):
+        (WebCore::ScriptExecutionContext::destroyedDomUrl):
+        * dom/ScriptExecutionContext.h:
+        (WebCore::ScriptExecutionContext::domUrls):
+        * html/DOMURL.cpp:
+        (WebCore::DOMURL::DOMURL):
+        (WebCore::DOMURL::~DOMURL):
+        (WebCore::DOMURL::contextDestroyed):
+        * html/DOMURL.h:
+        (WebCore::DOMURL::scriptExecutionContext):
+
+2011-01-23  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=52983
+        Eliminate m_tagHistory pointer from CSSSelector
+
+        Keep the component selectors in the array in CSSSelectorList instead
+        of maintaining a linked list between them. This allows eliminating
+        m_tagHistory pointer, shrinking CSSSelector by 25% (selection performance
+        seems to improve some too due to better locality).
+
+        * WebCore.xcodeproj/project.pbxproj:
+        
+            Make CSSSelector.h a private header.
+        
+        * css/CSSGrammar.y:
+        
+            Use CSSParserSelector during parsing to keep the tag history in 
+            a linked list. This is flattened to an array after parsing.
+            Use accessors for setting selector values.
+            Use OwnPtr in selector vector.
+            
+        * css/CSSPageRule.cpp:
+        (WebCore::CSSPageRule::CSSPageRule):
+        * css/CSSPageRule.h:
+        (WebCore::CSSPageRule::create):
+        
+            Simplify.
+    
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::~CSSParser):
+        (WebCore::CSSParser::createFloatingSelector):
+        (WebCore::CSSParser::sinkFloatingSelector):
+        (WebCore::CSSParser::createStyleRule):
+        (WebCore::CSSParser::updateSpecifiersWithElementName):
+        (WebCore::CSSParser::createPageRule):
+        * css/CSSParser.h:
+        (WebCore::CSSParser::reusableSelectorVector):
+        
+            CSSSelector -> CSSParserSelector.
+            Use OwnPtr in selector vector.
+            
+        * css/CSSParserValues.cpp:
+        (WebCore::CSSParserSelector::CSSParserSelector):
+        (WebCore::CSSParserSelector::~CSSParserSelector):
+        * css/CSSParserValues.h:
+        (WebCore::CSSParserSelector::releaseSelector):
+        (WebCore::CSSParserSelector::setTag):
+        (WebCore::CSSParserSelector::setValue):
+        (WebCore::CSSParserSelector::setAttribute):
+        (WebCore::CSSParserSelector::setArgument):
+        (WebCore::CSSParserSelector::setSimpleSelector):
+        (WebCore::CSSParserSelector::setMatch):
+        (WebCore::CSSParserSelector::setRelation):
+        (WebCore::CSSParserSelector::setForPage):
+        (WebCore::CSSParserSelector::pseudoType):
+        (WebCore::CSSParserSelector::isUnknownPseudoElement):
+        (WebCore::CSSParserSelector::isSimple):
+        (WebCore::CSSParserSelector::tagHistory):
+        (WebCore::CSSParserSelector::setTagHistory):
+        
+            Linked list used during parsing.
+            Avoid recursive destruction.
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        (WebCore::CSSSelector::operator==):
+        (WebCore::CSSSelector::selectorText):
+        (WebCore::CSSSelector::setSimpleSelector):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::CSSSelector):
+        (WebCore::CSSSelector::~CSSSelector):
+        (WebCore::CSSSelector::tagHistory):
+        (WebCore::CSSSelector::tag):
+        (WebCore::CSSSelector::value):
+        (WebCore::CSSSelector::setTag):
+        (WebCore::CSSSelector::isLastInTagHistory):
+        (WebCore::CSSSelector::setNotLastInTagHistory):
+        (WebCore::CSSSelector::RareData::RareData):
+        (WebCore::CSSSelector::RareData::~RareData):
+        (WebCore::CSSSelector::createRareData):
+        (WebCore::CSSSelector::setValue):
+        
+            Remove m_tagHistory.
+            Keep m_value in the union with the rare data pointer instead.
+            Make m_value and m_tag private, implement accessors.
+            Add a new bit to indicate end of the tag history (multipart selector).
+            Eliminate complex destruction. Selectors are now deleted as an array or by a CSSParserSelector chain.
+            
+        * css/CSSSelectorList.cpp:
+        (WebCore::CSSSelectorList::adoptSelectorVector):
+        
+            Flatten everything to an array.
+        
+        (WebCore::SelectorNeedsNamespaceResolutionFunctor::operator()):
+        * css/CSSSelectorList.h:
+        (WebCore::CSSSelectorList::hasOneSelector):
+        (WebCore::CSSSelectorList::next):
+        
+            Skip over the subparts of multipart selectors to find the next selector.
+    
+        * css/CSSStyleRule.h:
+        (WebCore::CSSStyleRule::adoptSelectorVector):
+        
+            CSSSelector -> CSSParserSelector.
+            
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        (WebCore::CSSRuleSet::addRule):
+        (WebCore::collectIdsAndSiblingRulesFromList):
+        (WebCore::CSSStyleSelector::matchPageRulesForList):
+        * dom/Node.cpp:
+        (WebCore::Node::querySelector):
+        * dom/SelectorNodeList.cpp:
+        (WebCore::createSelectorNodeList):
+        
+            Use accessors.
+
+2011-01-25  James Simonsen  <simonjam@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [Chromium] Support small caps in complex text on linux
+        https://bugs.webkit.org/show_bug.cgi?id=53051
+
+        * platform/graphics/chromium/ComplexTextControllerLinux.cpp:
+        (WebCore::ComplexTextController::nextScriptRun): Break runs at small caps boundaries.
+        (WebCore::ComplexTextController::setupFontForScriptRun): Setup small caps font data if needed.
+        * platform/graphics/chromium/ComplexTextControllerLinux.h: Store small caps text in separate string.
+
+2011-01-25  Steve Falkenburg  <sfalken@apple.com>
+
+        Rubber-stamped by Adam Roben.
+
+        Windows production build fix.
+        Use correct environment variable escaping
+
+        * WebCore.vcproj/WebCore.make:
+
+2011-01-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Empty URLs are never display isolated
+        https://bugs.webkit.org/show_bug.cgi?id=53053
+
+        This check mirrors the check in the local case.  There isn't a good way
+        to test this with a LayoutTest, but it is tested in Chromium (where
+        this registry is used).
+
+        * platform/SchemeRegistry.cpp:
+        (WebCore::SchemeRegistry::shouldTreatURLSchemeAsDisplayIsolated):
+
+2011-01-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Pipe a timestamp down into the PlatformWheelEvent for the Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=53111
+
+        * platform/PlatformWheelEvent.h:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        (WebCore::PlatformWheelEvent::timestamp):
+        Add timestamp member.
+
+        * platform/mac/WheelEventMac.mm:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        Initialize the timestamp from the event.
+
+2011-01-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r76625.
+        http://trac.webkit.org/changeset/76625
+        https://bugs.webkit.org/show_bug.cgi?id=53119
+
+        "incorrect pixel test results" (Requested by rniwa on
+        #webkit).
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::localCaretRect):
+
+2011-01-25  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r76614.
+
+        * platform/FileSystem.h:
+
+2011-01-21  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Adding border and padding to the calculation of the local caret rect for RenderBoxes.
+
+        Undo moves caret to invalid position
+        https://bugs.webkit.org/show_bug.cgi?id=49744
+
+        Tests: editing/selection/caret-painting-after-paste-undo-rtl.html
+               editing/selection/caret-painting-after-paste-undo.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::localCaretRect):
+
+2011-01-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add hasPreciseScrollingDeltas bit to PlatformWheelEvent on the Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=53107
+
+        * platform/PlatformWheelEvent.h:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        (WebCore::PlatformWheelEvent::hasPreciseScrollingDeltas):
+        * platform/mac/WheelEventMac.mm:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2011-01-20  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        REGRESSION (r72119): Audio never plays on Star Wars intro animation
+        https://bugs.webkit.org/show_bug.cgi?id=52467
+        
+        QuickTime's eat/m4a movie importer compontent doesn't list audio/m4a as a mime
+        type which it supports, though it handles .m4a files just fine.  Change the way
+        we build the list of supported MIME Types through a new WebKitSystemInterface
+        function.
+        
+        Caused by r72119, which adds system-specific extension->MIME entries to the cache
+        before global entries, and the system-specific entries include QuickTime's registry 
+        entries which contain the audio/m4a MIME type, while its components do not.
+
+        Test: media/audio-mpeg4-supported.html
+
+        * WebCore.vcproj/QTMovieWinCommon.vsprops:
+        * platform/graphics/win/QTMovie.cpp:
+        (getMIMETypeCallBack):
+        (initializeSupportedTypes):
+        (QTMovie::countSupportedTypes): gSupportedTypes is now a CFArrayRef.
+        (QTMovie::getSupportedType): Ditto.
+
+2011-01-25  Hans Wennborg  <hans@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        IndexedDB: Remove PlatformBridge::idbShutdown()
+        https://bugs.webkit.org/show_bug.cgi?id=53077
+
+        Since Chromium r72157, this is not used anymore. The previous use was
+        to signal to the embedder that IndexedDB was shutting down, but we
+        agreed it is better if the embedder keeps track of that itself.
+
+        No new tests: this does not change any functionality.
+
+        * platform/chromium/PlatformBridge.h:
+        * storage/IDBFactoryBackendInterface.cpp:
+        * storage/IDBFactoryBackendInterface.h:
+        (WebCore::IDBFactoryBackendInterface::~IDBFactoryBackendInterface):
+        * storage/chromium/IDBFactoryBackendInterface.cpp:
+
+2011-01-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit is using CSBackupSetItemExcluded incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=53095
+        rdar://problem/8790540
+
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::performOpenInitialization): Added code to
+        exclude the database from backup one time, and record inside the
+        database that this has been done.
+        (WebCore::IconDatabase::wasExcludedFromBackup): Added.
+        (WebCore::IconDatabase::setWasExcludedFromBackup): Added.
+        * loader/icon/IconDatabase.h: Added new functions above.
+
+        * platform/FileSystem.cpp:
+        (WebCore::canExcludeFromBackup): Added.
+        (WebCore::excludeFromBackup): Added.
+
+        * platform/FileSystem.h: Added canExcludeFromBackup, excludeFromBackup,
+        and pathAsURL functions. Cleaned up ifdefs and comments a bit and sorted
+        things alphabetically, particularly platform-specific sections.
+
+        * platform/cf/FileSystemCF.cpp:
+        (WebCore::pathAsURL): Added.
+
+        * platform/mac/FileSystemMac.mm:
+        (WebCore::canExcludeFromBackup): Added.
+        (WebCore::excludeFromBackup): Added.
+
+        * platform/network/cf/FormDataStreamCFNet.cpp:
+        (WebCore::advanceCurrentStream): Changed to call pathAsURL.
+        * platform/network/mac/FormDataStreamMac.mm:
+        (WebCore::advanceCurrentStream): Ditto.
+
+2011-01-25  Helder Correia  <helder@sencha.com>
+
+        Reviewed by Dirk Schulze.
+
+        REGRESSION(75139): SVG gradients are not applied to texts
+        https://bugs.webkit.org/show_bug.cgi?id=52531
+
+        CGContextConcatCTM should use the CGLayer context, not the
+        GraphicsContext. Also, the CTM needs to be adjusted (translated).
+        This fixes SVG text gradient fill.
+
+        Test: svg/css/composite-shadow-text.svg
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::fillRect):
+
+2011-01-25  Benjamin Kalman  <kalman@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Cannot extend or modify forward by word over a non-contenteditable region
+        https://bugs.webkit.org/show_bug.cgi?id=53070
+
+        Test: editing/selection/extend-forward-by-word-over-non-editable.html
+
+        Change all instances of honorEditableBoundaryAtOrAfter to honorEditableBoundaryAtOrBefore and vice versa in the
+        functions which determine the end/start of words/lines/sentences in visible_units.cpp.
+
+        This fixes the bug where moving forwards by a word over a non-contenteditable region would place the cursor
+        inside that region, and then get moved back to the start of the word due to honorEditableBoundaryAtOrBefore.
+        The cursor is now moved to the end of the region (which is effectively a noop in this case).
+
+        * editing/visible_units.cpp: Change all instances of honorEditableBoundaryAtOrAfter to
+        honorEditableBoundaryAtOrBefore and vice versa.
+        (WebCore::previousWordPosition):
+        (WebCore::nextWordPosition):
+        (WebCore::startOfLine):
+        (WebCore::endOfLine):
+        (WebCore::previousSentencePosition):
+        (WebCore::nextSentencePosition):
+        (WebCore::logicalStartOfLine):
+        (WebCore::logicalEndOfLine):
+
+2011-01-25  Yael Aharon  <yael.aharon@nokia.com>
+
+        Unreviewed build fix.
+        After r76466, efsrv.lib is used unconditionally.
+        Don't guard it with ENABLE_NETSCAPE_PLUGIN_API.
+
+        * WebCore.pro:
+
+2011-01-24  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Style cleanup for WebGLRenderingContext
+        https://bugs.webkit.org/show_bug.cgi?id=52352
+
+        * html/canvas/WebGLBuffer.cpp:
+        * html/canvas/WebGLBuffer.h:
+        * html/canvas/WebGLObject.cpp:
+        * html/canvas/WebGLProgram.cpp:
+        * html/canvas/WebGLRenderbuffer.cpp:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::create):
+        (WebCore::WebGLRenderingContext::blendFunc):
+        (WebCore::WebGLRenderingContext::createShader):
+        (WebCore::WebGLRenderingContext::deleteBuffer):
+        (WebCore::WebGLRenderingContext::deleteShader):
+        (WebCore::WebGLRenderingContext::deleteTexture):
+        (WebCore::WebGLRenderingContext::disableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::validateIndexArrayPrecise):
+        (WebCore::WebGLRenderingContext::validateRenderingState):
+        (WebCore::WebGLRenderingContext::enableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::getUniform):
+        (WebCore::WebGLRenderingContext::detachAndRemoveAllObjects):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLShader.cpp:
+        * html/canvas/WebGLTexture.cpp:
+        * html/canvas/WebGLUniformLocation.cpp:
+        * html/canvas/WebGLUniformLocation.h:
+
+2011-01-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Change ENABLE_3D_CANVAS to ENABLE_WEBGL
+        https://bugs.webkit.org/show_bug.cgi?id=53041
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.cpp:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        * bindings/js/JSArrayBufferCustom.cpp:
+        * bindings/js/JSCanvasRenderingContextCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDataViewCustom.cpp:
+        * bindings/js/JSDocumentCustom.cpp:
+        * bindings/js/JSFloat32ArrayCustom.cpp:
+        * bindings/js/JSHTMLCanvasElementCustom.cpp:
+        (WebCore::JSHTMLCanvasElement::getContext):
+        * bindings/js/JSInt16ArrayCustom.cpp:
+        * bindings/js/JSInt32ArrayCustom.cpp:
+        * bindings/js/JSInt8ArrayCustom.cpp:
+        * bindings/js/JSUint16ArrayCustom.cpp:
+        * bindings/js/JSUint32ArrayCustom.cpp:
+        * bindings/js/JSUint8ArrayCustom.cpp:
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::markChildren):
+        (WebCore::JSXMLHttpRequest::send):
+        (WebCore::JSXMLHttpRequest::response):
+        * bindings/v8/custom/V8ArrayBufferCustom.cpp:
+        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
+        * bindings/v8/custom/V8DataViewCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::V8Document::getCSSCanvasContextCallback):
+        * bindings/v8/custom/V8Float32ArrayCustom.cpp:
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::V8HTMLCanvasElement::getContextCallback):
+        * bindings/v8/custom/V8Int16ArrayCustom.cpp:
+        * bindings/v8/custom/V8Int32ArrayCustom.cpp:
+        * bindings/v8/custom/V8Int8ArrayCustom.cpp:
+        * bindings/v8/custom/V8Uint16ArrayCustom.cpp:
+        * bindings/v8/custom/V8Uint32ArrayCustom.cpp:
+        * bindings/v8/custom/V8Uint8ArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::V8XMLHttpRequest::responseAccessorGetter):
+        (WebCore::V8XMLHttpRequest::sendCallback):
+        * features.pri:
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        (WebCore::HTMLCanvasElement::reset):
+        * html/HTMLCanvasElement.h:
+        * html/canvas/ArrayBuffer.cpp:
+        * html/canvas/ArrayBuffer.idl:
+        * html/canvas/ArrayBufferView.cpp:
+        * html/canvas/ArrayBufferView.idl:
+        * html/canvas/DataView.cpp:
+        * html/canvas/DataView.idl:
+        * html/canvas/Float32Array.cpp:
+        * html/canvas/Float32Array.idl:
+        * html/canvas/Int16Array.cpp:
+        * html/canvas/Int16Array.idl:
+        * html/canvas/Int32Array.cpp:
+        * html/canvas/Int32Array.idl:
+        * html/canvas/Int8Array.cpp:
+        * html/canvas/Int8Array.idl:
+        * html/canvas/OESStandardDerivatives.cpp:
+        * html/canvas/OESStandardDerivatives.idl:
+        * html/canvas/OESTextureFloat.cpp:
+        * html/canvas/OESTextureFloat.idl:
+        * html/canvas/Uint16Array.cpp:
+        * html/canvas/Uint16Array.idl:
+        * html/canvas/Uint32Array.cpp:
+        * html/canvas/Uint32Array.idl:
+        * html/canvas/Uint8Array.cpp:
+        * html/canvas/Uint8Array.idl:
+        * html/canvas/WebGLActiveInfo.idl:
+        * html/canvas/WebGLBuffer.cpp:
+        * html/canvas/WebGLBuffer.idl:
+        * html/canvas/WebGLContextAttributes.cpp:
+        * html/canvas/WebGLContextAttributes.idl:
+        * html/canvas/WebGLContextEvent.idl:
+        * html/canvas/WebGLExtension.cpp:
+        * html/canvas/WebGLFramebuffer.cpp:
+        * html/canvas/WebGLFramebuffer.idl:
+        * html/canvas/WebGLGetInfo.cpp:
+        * html/canvas/WebGLObject.cpp:
+        * html/canvas/WebGLProgram.cpp:
+        * html/canvas/WebGLProgram.idl:
+        * html/canvas/WebGLRenderbuffer.cpp:
+        * html/canvas/WebGLRenderbuffer.idl:
+        * html/canvas/WebGLRenderingContext.cpp:
+        * html/canvas/WebGLRenderingContext.idl:
+        * html/canvas/WebGLShader.cpp:
+        * html/canvas/WebGLShader.idl:
+        * html/canvas/WebGLTexture.cpp:
+        * html/canvas/WebGLTexture.idl:
+        * html/canvas/WebGLUniformLocation.cpp:
+        * html/canvas/WebGLUniformLocation.idl:
+        * html/canvas/WebKitLoseContext.cpp:
+        * html/canvas/WebKitLoseContext.idl:
+        * page/DOMWindow.idl:
+        * platform/graphics/ANGLEWebKitBridge.cpp:
+        * platform/graphics/GraphicsContext3D.cpp:
+        * platform/graphics/cg/GraphicsContext3DCG.cpp:
+        * platform/graphics/gpu/DrawingBuffer.cpp:
+        * platform/graphics/gpu/mac/DrawingBufferMac.mm:
+        * platform/graphics/mac/GraphicsContext3DMac.mm:
+        * platform/graphics/mac/WebGLLayer.mm:
+        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        * platform/graphics/qt/Extensions3DQt.cpp:
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::GraphicsLayerQtImpl):
+        (WebCore::GraphicsLayerQtImpl::paint):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
+        * platform/graphics/qt/GraphicsLayerQt.h:
+        * platform/graphics/skia/GraphicsContext3DSkia.cpp:
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::isAcceleratedCanvas):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
+        (WebCore::RenderLayerBacking::containsPaintedContent):
+        (WebCore::RenderLayerBacking::contentChanged):
+        * webaudio/AudioBuffer.cpp:
+        * webaudio/AudioBuffer.idl:
+        * webaudio/RealtimeAnalyser.cpp:
+        * webaudio/RealtimeAnalyser.h:
+        * webaudio/RealtimeAnalyserNode.h:
+        * webaudio/RealtimeAnalyserNode.idl:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::setResponseType):
+        (WebCore::XMLHttpRequest::clearResponse):
+        (WebCore::XMLHttpRequest::didReceiveData):
+        * xml/XMLHttpRequest.h:
+
+2011-01-25  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Chromium] Prepare for landing of detailed heap snapshots.
+
+        - Introduce Preferences.detailedHeapProfiles flag for controlling
+          querying of detailed heap snapshots.
+        - Add boilerplate code for the new view.
+        - Factor out common code.
+
+        https://bugs.webkit.org/show_bug.cgi?id=52624
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/ScriptProfiler.h:
+        (WebCore::ScriptProfiler::HeapSnapshotControl::~HeapSnapshotControl):
+        (WebCore::ScriptProfiler::takeHeapSnapshot):
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::takeHeapSnapshot):
+        * bindings/v8/ScriptProfiler.h:
+        (WebCore::ScriptProfiler::HeapSnapshotControl::~HeapSnapshotControl):
+        * inspector/Inspector.idl:
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::takeHeapSnapshot):
+        * inspector/InspectorProfilerAgent.h:
+        * inspector/front-end/DetailedHeapshotView.js: Added.
+        (WebInspector.DetailedHeapshotView):
+        (WebInspector.DetailedHeapshotView.prototype.get statusBarItems):
+        (WebInspector.DetailedHeapshotView.prototype.get profile):
+        (WebInspector.DetailedHeapshotView.prototype.set profile):
+        (WebInspector.DetailedHeapshotView.prototype.show):
+        (WebInspector.DetailedHeapshotView.prototype.hide):
+        (WebInspector.DetailedHeapshotProfileType):
+        (WebInspector.DetailedHeapshotProfileType.prototype.get buttonTooltip):
+        (WebInspector.DetailedHeapshotProfileType.prototype.get buttonStyle):
+        (WebInspector.DetailedHeapshotProfileType.prototype.buttonClicked):
+        (WebInspector.DetailedHeapshotProfileType.prototype.get welcomeMessage):
+        (WebInspector.DetailedHeapshotProfileType.prototype.createSidebarTreeElementForProfile):
+        (WebInspector.DetailedHeapshotProfileType.prototype.createView):
+        * inspector/front-end/HeapSnapshot.js: Added.
+        (WebInspector.HeapSnapshotEdgesIterator):
+        (WebInspector.HeapSnapshotEdgesIterator.prototype.get done):
+        (WebInspector.HeapSnapshotEdgesIterator.prototype.get isElement):
+        (WebInspector.HeapSnapshotEdgesIterator.prototype.get isHidden):
+        (WebInspector.HeapSnapshotEdgesIterator.prototype.get name):
+        (WebInspector.HeapSnapshotEdgesIterator.prototype.next):
+        (WebInspector.HeapSnapshotEdgesIterator.prototype.get node):
+        (WebInspector.HeapSnapshotEdgesIterator.prototype.get nodeIndex):
+        (WebInspector.HeapSnapshotEdgesIterator.prototype._getNameOrIndex):
+        (WebInspector.HeapSnapshotEdgesIterator.prototype._getType):
+        (WebInspector.HeapSnapshotNodeWrapper):
+        (WebInspector.HeapSnapshotNodeWrapper.prototype.get edges):
+        (WebInspector.HeapSnapshotNodeWrapper.prototype.get edgesCount):
+        (WebInspector.HeapSnapshotNodeWrapper.prototype.get instancesCount):
+        (WebInspector.HeapSnapshotNodeWrapper.prototype.get isHidden):
+        (WebInspector.HeapSnapshotNodeWrapper.prototype.get name):
+        (WebInspector.HeapSnapshotNodeWrapper.prototype.get selfSize):
+        (WebInspector.HeapSnapshotNodeWrapper.prototype._getName):
+        (WebInspector.HeapSnapshotNodeWrapper.prototype._getEdges):
+        (WebInspector.HeapSnapshotNodeWrapper.prototype._getType):
+        (WebInspector.HeapSnapshot):
+        (WebInspector.HeapSnapshot.prototype._init):
+        (WebInspector.HeapSnapshot.prototype.get rootEdges):
+        * inspector/front-end/HeapSnapshotView.js:
+        (WebInspector.HeapSnapshotProfileType.prototype.buttonClicked):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._setRecordingProfile):
+        (WebInspector.ProfilesPanel.prototype._reportHeapSnapshotProgress):
+        (WebInspector.ProfilerDispatcher.prototype.setRecordingProfile):
+        (WebInspector.ProfilerDispatcher.prototype.reportHeapSnapshotProgress):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2011-01-25  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: remove "attached" state related methods from InspectorAgent
+        https://bugs.webkit.org/show_bug.cgi?id=53086
+
+        * WebCore.exp.in:
+        * inspector/InspectorAgent.cpp:
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorFrontendClientLocal.cpp:
+        (WebCore::InspectorFrontendClientLocal::changeAttachedWindowHeight):
+        (WebCore::InspectorFrontendClientLocal::restoreAttachedWindowHeight):
+        * inspector/InspectorSettings.cpp:
+        (WebCore::InspectorSettings::InspectorSettings):
+        * inspector/InspectorSettings.h:
+
+2011-01-25  Qi Zhang  <qi.2.zhang@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Symbian] RVCT fails to compile [U|I]nt[8|16|32]Array.h
+        https://bugs.webkit.org/show_bug.cgi?id=51873
+        
+        Replace the using declaration, because it doesn't compile on RVCT, and WINSCW has the same issue.
+        No new functionality so no new tests.
+
+        * html/canvas/Int32Array.h:
+        (WebCore::Int32Array::set):
+        * html/canvas/Int8Array.h:
+        (WebCore::Int8Array::set):
+        * html/canvas/Uint16Array.h:
+        (WebCore::Uint16Array::set):
+        * html/canvas/Uint32Array.h:
+        (WebCore::Uint32Array::set):
+        * html/canvas/Uint8Array.h:
+        (WebCore::Uint8Array::set):
+
+2011-01-25  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Dirk Schulze.
+
+        Repaint SVG elements with filter instead of relayout where possible
+        https://bugs.webkit.org/show_bug.cgi?id=52200
+
+        This patch allows repainting of filters, when their
+        attribute changes does not require relayout.
+
+        Existing dynamic-update tests cover this feature.
+
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::clearResult): Clearing the currently stored image
+        before repainting.
+        * platform/graphics/filters/FilterEffect.h:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isSVGResourceFilter): Not only the filter primitives,
+        but filters should also be detected to allow safe testing and casting.
+        * rendering/svg/RenderSVGResourceFilter.cpp:
+        (WebCore::RenderSVGResourceFilter::buildPrimitives): Passing the renderer.
+        (WebCore::RenderSVGResourceFilter::applyResource):
+        determineFilterPrimitiveSubregion does not require the filter anymore.
+        (WebCore::RenderSVGResourceFilter::postApplyResource): Repaint
+        if lastEffect->hasResult() is false.
+        (WebCore::RenderSVGResourceFilter::primitiveAttributeChanged):
+        Searching for all FilterEffects, whose created by the current FilterElement,
+        and clearing all resulting images depending on those FilterEffects.
+        * rendering/svg/RenderSVGResourceFilter.h:
+        (WebCore::RenderSVGResourceFilter::isSVGResourceFilter):
+        * rendering/svg/RenderSVGResourceFilterPrimitive.cpp:
+        (WebCore::RenderSVGResourceFilterPrimitive::determineFilterPrimitiveSubregion):
+        The filter argument is unnecessary anymore. But is is still kept as a static
+        member, since the primitive renderer still does not know about the
+        FilterEffect objects.
+        * rendering/svg/RenderSVGResourceFilterPrimitive.h:
+        (WebCore::RenderSVGResourceFilterPrimitive::RenderSVGResourceFilterPrimitive):
+        (WebCore::RenderSVGResourceFilterPrimitive::primitiveAttributeChanged):
+        Calls RenderSVGResourceFilter::primitiveAttributeChanged.
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::setFilterEffectAttribute):
+        Setting the new attribute value for each FilterEffect.
+        (WebCore::SVGFEDiffuseLightingElement::svgAttributeChanged):
+        * svg/SVGFEDiffuseLightingElement.h:
+        Calling primitiveAttributeChanged.
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::setFilterEffectAttribute):
+        This function will be removed when all FilterElement implements
+        their setFilterEffectAttribute
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::primitiveAttributeChanged):
+        * svg/graphics/filters/SVGFilterBuilder.cpp:
+        (WebCore::SVGFilterBuilder::appendEffectToEffectReferences): The
+        renderers are assigned to the filter effects.
+        (WebCore::SVGFilterBuilder::clearEffects):
+        (WebCore::SVGFilterBuilder::clearResultsRecursive): Recursively
+        clearing the result images for those filters, whose depend on
+        the starting filter.
+        * svg/graphics/filters/SVGFilterBuilder.h:
+        (WebCore::SVGFilterBuilder::effectReferences): 'get' is unnecessary
+        (WebCore::SVGFilterBuilder::effectByRenderer): returns the
+        FilterEffect belongs to this RenderObject.
+
+2011-01-25  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG is missing to-animation support for Path
+        https://bugs.webkit.org/show_bug.cgi?id=52982
+
+        SVG was missing 'to' animation support for SVG paths. Even the fallback to discrete
+        animation did not work and an assert was thrown, because of the missing m_fromPath.
+        This also influences a test of the W3C test suite. Subtest 2 of animate-elem-83-t.svg passes now.
+
+        Test: svg/animations/animate-path-to-animation.html
+
+        * svg/SVGAnimateElement.cpp:
+        (WebCore::SVGAnimateElement::calculateAnimatedValue): Take the value of the last SVGAnimateElement for
+        m_fromPath, since 'to' animations are accumulative.
+        (WebCore::SVGAnimateElement::calculateFromAndToValues): Added support for 'to' animations.
+        (WebCore::SVGAnimateElement::resetToBaseValue): Set m_animatedPath on the first animation element to baseVal.
+        * svg/SVGPathByteStream.h:
+        (WebCore::SVGPathByteStream::copySVGPathByteStream): Return copy of current byte stream.
+
+2011-01-25  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: bind resources to URLs upon adding them into the tree.
+        https://bugs.webkit.org/show_bug.cgi?id=53013
+
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.evalCallback.selectorsCallback):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged.callback):
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged):
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype._parsedScriptSource):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkManager.prototype._processCachedResources):
+        (WebInspector.NetworkManager.prototype.inflightResourceForURL):
+        (WebInspector.NetworkDispatcher):
+        (WebInspector.NetworkDispatcher.prototype.willSendRequest):
+        (WebInspector.NetworkDispatcher.prototype.markResourceAsCached):
+        (WebInspector.NetworkDispatcher.prototype.didReceiveResponse):
+        (WebInspector.NetworkDispatcher.prototype.didReceiveContentLength):
+        (WebInspector.NetworkDispatcher.prototype.didFinishLoading):
+        (WebInspector.NetworkDispatcher.prototype.didFailLoading):
+        (WebInspector.NetworkDispatcher.prototype.willSendWebSocketHandshakeRequest):
+        (WebInspector.NetworkDispatcher.prototype.didReceiveWebSocketHandshakeResponse):
+        (WebInspector.NetworkDispatcher.prototype.didCloseWebSocket):
+        (WebInspector.NetworkDispatcher.prototype._appendRedirect):
+        (WebInspector.NetworkDispatcher.prototype._startResource):
+        (WebInspector.NetworkDispatcher.prototype._finishResource):
+        (WebInspector.NetworkDispatcher.prototype._createResource):
+        * inspector/front-end/ResourceTreeModel.js:
+        (WebInspector.ResourceTreeModel.prototype.addResourceToFrame):
+        (WebInspector.ResourceTreeModel.prototype._bindResourceURL):
+        (WebInspector.ResourceTreeModel.prototype._clearResources):
+        (WebInspector.ResourceTreeModel.prototype._unbindResourceURL):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.canShowSourceLine):
+        (WebInspector.ResourcesPanel.prototype.showSourceLine):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._parsedScriptSource):
+        (WebInspector.ScriptsPanel.prototype._addScript):
+
+2011-01-25  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Introduce FontMetrics abstraction
+        https://bugs.webkit.org/show_bug.cgi?id=51456
+
+        Use accurate floating-point metrics for SVG Font calculations instead of casting float -> integer.
+        This hopefully fixes differences between 32/64 bit bots.
+
+        Needs new layout test results for several platforms, which need to be taken from the bots landing afterwards.
+
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData):
+        (WebCore::SimpleFontData::initCharWidths):
+
+2011-01-24  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: debugger and browser debugger agents should manage sticky breakpoints independently.
+        https://bugs.webkit.org/show_bug.cgi?id=52999
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::didCommitLoad):
+        (WebCore::InspectorAgent::enableDebugger):
+        (WebCore::InspectorAgent::inspectedURLWithoutFragment):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        (WebCore::InspectorBrowserDebuggerAgent::setAllBrowserBreakpoints):
+        (WebCore::InspectorBrowserDebuggerAgent::inspectedURLChanged):
+        (WebCore::InspectorBrowserDebuggerAgent::restoreStickyBreakpoint):
+        * inspector/InspectorBrowserDebuggerAgent.h:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::InspectorDebuggerAgent):
+        (WebCore::InspectorDebuggerAgent::setAllJavaScriptBreakpoints):
+        (WebCore::InspectorDebuggerAgent::inspectedURLChanged):
+        (WebCore::InspectorDebuggerAgent::restoreBreakpoints):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorState.cpp:
+        (WebCore::InspectorState::InspectorState):
+        * inspector/InspectorState.h:
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager):
+        (WebInspector.BreakpointManager.prototype._projectChanged):
+        (WebInspector.BreakpointManager.prototype._saveBreakpoints):
+        (WebInspector.BreakpointManager.prototype._pushBreakpointsToBackend):
+
+2011-01-25  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Crash in some pages containing flash
+        https://bugs.webkit.org/show_bug.cgi?id=53016
+
+        Flash plugin can produce X errors that are handled by the GDK X
+        error handler, which exits the process. Since we don't want to
+        crash due to flash bugs, we install a custom error handler to show
+        a warning when a X error happens without aborting.
+
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::webkitgtkXError):
+        (WebCore::PluginPackage::load):
+
+2011-01-25  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Implement spin buttons in RenderThemeGtk
+        https://bugs.webkit.org/show_bug.cgi?id=51454
+
+        Paint inner up/down buttons for spin button elements when building
+        with GTK+ 3.x.
+
+        Test results will land with the GTK+ 2.x version of this patch.
+
+        * platform/gtk/RenderThemeGtk.h:
+        * platform/gtk/RenderThemeGtk2.cpp:
+        (WebCore::RenderThemeGtk::adjustInnerSpinButtonStyle):
+        (WebCore::RenderThemeGtk::paintInnerSpinButton):
+        * platform/gtk/RenderThemeGtk3.cpp:
+        (WebCore::spinButtonArrowSize):
+        (WebCore::RenderThemeGtk::adjustInnerSpinButtonStyle):
+        (WebCore::paintSpinArrowButton):
+        (WebCore::RenderThemeGtk::paintInnerSpinButton):
+
+2011-01-24  Mihai Parparita  <mihaip@chromium.org>
+
+        Unreviewed. Missed move of one m_deleted use to be outside NDEBUG block
+        in r76575.
+
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::~CachedResource):
+
+2011-01-24  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        Add runtime checks for invariants in memory cache
+        https://bugs.webkit.org/show_bug.cgi?id=53059
+        
+        To help track down bug 53045, add some CRASH calls in addition to
+        ASSERTs, so that we can track down failures in reliability bots.
+
+        Just some checks, no new tests necessary.
+        
+        * css/CSSImageValue.cpp:
+        (WebCore::CSSImageValue::cachedImage):
+        * loader/cache/CachedResource.h:
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::~CachedResource):
+
+2011-01-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Leaking CSSRuleDataList objects
+        https://bugs.webkit.org/show_bug.cgi?id=53062
+
+        Fix leaked CSSRuleDataLists added to the m_pseudoRules hash.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSRuleSet::~CSSRuleSet):
+
+2011-01-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Refcount Images used in rendering code
+        https://bugs.webkit.org/show_bug.cgi?id=52701
+
+        Change StyleImage::image(RenderObject*, const IntSize&) and
+        CSSImageGeneratorValue::image(RenderObject*, const IntSize&) to
+        return PassRefPtr<Image>, and adjust other code accordingly.
+        
+        This allows us to return one-time images, for example for CSS gradients
+        whose appearance may change depending on factors other than the renderer
+        and the destination size.
+
+        * css/CSSCanvasValue.cpp:
+        (WebCore::CSSCanvasValue::image):
+        * css/CSSCanvasValue.h:
+        * css/CSSGradientValue.cpp:
+        (WebCore::CSSGradientValue::image):
+        * css/CSSGradientValue.h:
+        * css/CSSImageGeneratorValue.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        (WebCore::RenderBoxModelObject::paintNinePieceImage):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        (WebCore::RenderImage::paintIntoRect):
+        * rendering/RenderImageResource.h:
+        (WebCore::RenderImageResource::image):
+        * rendering/RenderImageResourceStyleImage.h:
+        (WebCore::RenderImageResourceStyleImage::image):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        * rendering/style/StyleCachedImage.cpp:
+        (WebCore::StyleCachedImage::image):
+        * rendering/style/StyleCachedImage.h:
+        * rendering/style/StyleGeneratedImage.cpp:
+        (WebCore::StyleGeneratedImage::image):
+        * rendering/style/StyleGeneratedImage.h:
+        * rendering/style/StyleImage.h:
+        * rendering/style/StylePendingImage.h:
+        (WebCore::StylePendingImage::image):
+        * rendering/svg/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+
+2011-01-24  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, round ascent and descent to match old code.
+
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2011-01-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Chris Marrin.
+
+        perspective() transform function should take lengths
+        https://bugs.webkit.org/show_bug.cgi?id=52683
+        
+        The argument to the perspective() transform function should
+        be a Length, rather than a bare number. Bare numbers are still
+        accepted (and treated as px), but this behavior is deprecated.
+
+        Test: animations/3d/transform-perspective.html
+              transforms/3d/general/3dtransform-values.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseTransform): Check the units for the perspective()
+        function. Allow bare numbers for backwards compatibility.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::createTransformOperations): Convert
+        value to Length.
+        * platform/graphics/transforms/PerspectiveTransformOperation.cpp:
+        (WebCore::clampToPostiveInteger): Helper.
+        (WebCore::PerspectiveTransformOperation::blend): Blend via Lengths.
+        * platform/graphics/transforms/PerspectiveTransformOperation.h:
+        (WebCore::PerspectiveTransformOperation::create): double -> Length.
+        (WebCore::PerspectiveTransformOperation::perspective): Ditto.
+        (WebCore::PerspectiveTransformOperation::isIdentity): Ditto.
+        (WebCore::PerspectiveTransformOperation::apply): Ditto.
+        (WebCore::PerspectiveTransformOperation::PerspectiveTransformOperation): Assert
+        that the Length is a fixed type.
+
+2011-01-24  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Windows] Textfield <input>s have different widths.
+        https://bugs.webkit.org/show_bug.cgi?id=48405
+
+        - Apply the padding override for type=text to other textfield types too.
+        - Reset margin value of outer spin button, which is not used in Windows.
+        - Don't add inner spin button width to the preferred text field width.
+          Text fields should have the identical widths regardless of the
+          existence of spin buttons.
+
+        Test: fast/forms/input-widths.html
+
+        * css/themeWin.css:
+        (input[type="week"]):
+        (input[type="week"]:disabled):
+        (input[type="search"]::-webkit-search-cancel-button):
+        (input::-webkit-outer-spin-button):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::preferredContentWidth):
+        Don't add inner spin button width to the preferred width.
+
+2011-01-24  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Some bugs of search cancel button and spin button about state change in
+        an event handler.
+        https://bugs.webkit.org/show_bug.cgi?id=46950
+
+        Fix the following problems:
+         * Type=search field didn't release event capturing
+         * Assertion failure when an input field with spin buttons was changed
+           to another type on focus event.
+         * A input field with spin button didn't release event capturing when it
+           was changed to another type on focus event.
+
+        Tests: fast/forms/input-number-change-type-on-focus.html
+               fast/forms/search-hide-cancel-on-cancel.html
+
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::SearchFieldCancelButtonElement::defaultEventHandler):
+         - Make the variable 'input' RefPtr.  It makes the code simpler.
+         - Remove visibility check on mouseup event. We should release capturing
+           anyway because the cancel button may be invisible if JavaScript code
+           called by the focus event removes the input value.
+        (WebCore::SpinButtonElement::detach):
+         - Release capturing on detach because it is possible that a spin button
+           node is detached while it is capturing events.
+        (WebCore::SpinButtonElement::defaultEventHandler):
+          Take a reference to this and check renderer() after some functions which
+          may run JavaScript code.
+        (WebCore::InputFieldSpeechButtonElement::defaultEventHandler):
+          Make the variable 'input' RefPtr to align other functions in this file.
+        (WebCore::InputFieldSpeechButtonElement::setRecognitionResult): ditto.
+        * rendering/TextControlInnerElements.h: Declare SpinButtonElement::detach().
+
+2011-01-24  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Ojan Vafai.
+
+        Inserting multiple whitespace using text composition (IME) should insert interleaved nbsp and whitespace.
+        https://bugs.webkit.org/show_bug.cgi?id=52781
+
+        The bug was caused by stringWithRebalancedWhitespace's replacing the space at the beginning of a paragraph
+        and the end of a paragraph by a non-breaking space after it replaced two consecutive spaces by a space and
+        non-breaking space pattern, thereby replacing more spaces by non-breaking spaces than needed.
+
+        Rewrote the function using Vector<UChar> to fix the bug. New function no longer calls String::replace
+        multiple times but instead it traverses through the string and replaces a space that immediately follows
+        another space or appears at the beginning of a paragraph or at the end of a paragraph by a non-break space.
+
+        * editing/CompositeEditCommand.cpp:
+        * editing/htmlediting.cpp:
+        (WebCore::stringWithRebalancedWhitespace): Written.
+        * editing/htmlediting.h:
+        (WebCore::isWhitespace): Removed from CompositeEditCommand.cpp
+
+2011-01-24  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by James Robinson.
+
+        Web Audio API: port FFTFrame to FFTW
+        https://bugs.webkit.org/show_bug.cgi?id=52989
+
+        Ported FFTFrame class to the open-source FFTW library. Tested with
+        unit tests from Chris Rogers. Made preliminary changes to GYP
+        files for conditional compilation of these files; will need to be
+        adjusted once FFTW is integrated as third-party source.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * platform/audio/FFTFrame.h:
+        * platform/audio/fftw: Added.
+        * platform/audio/fftw/FFTFrameFFTW.cpp: Added.
+        (WebCore::FFTFrame::FFTFrame):
+        (WebCore::FFTFrame::~FFTFrame):
+        (WebCore::FFTFrame::multiply):
+        (WebCore::FFTFrame::doFFT):
+        (WebCore::FFTFrame::doInverseFFT):
+        (WebCore::FFTFrame::cleanup):
+        (WebCore::FFTFrame::realData):
+        (WebCore::FFTFrame::imagData):
+        (WebCore::FFTFrame::fftwPlanForSize):
+
+2011-01-24  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Reset the page scale factor on standard frame loads
+        https://bugs.webkit.org/show_bug.cgi?id=53058
+        <rdar://problem/8908844>
+
+        Add a symbol needed by WebKit2.
+
+        * WebCore.exp.in:
+
+2011-01-24  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Stop instantiating legacy editing positions in InsertTextCommand, MoveSelectionCommand,
+        ReplaceSelectionCommand, SelectionController, SpellChecker, TypingCommand, and markup.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=52676
+
+        Stop instantiating legacy editing positions in the following files.
+
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::prepareForTextInsertion):
+        (WebCore::InsertTextCommand::performTrivialReplace):
+        (WebCore::InsertTextCommand::input):
+        (WebCore::InsertTextCommand::insertTab):
+        * editing/MoveSelectionCommand.cpp:
+        (WebCore::MoveSelectionCommand::doApply):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds):
+        (WebCore::ReplaceSelectionCommand::mergeEndIfNeeded):
+        (WebCore::ReplaceSelectionCommand::doApply):
+        (WebCore::ReplaceSelectionCommand::shouldRemoveEndBR):
+        (WebCore::ReplaceSelectionCommand::performTrivialReplace):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setSelectionFromNone):
+        * editing/SpellChecker.cpp:
+        (WebCore::SpellChecker::didCheck):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::makeEditableRootEmpty):
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        * editing/markup.cpp:
+        (WebCore::StyledMarkupAccumulator::appendText):
+        (WebCore::StyledMarkupAccumulator::serializeNodes):
+        (WebCore::highestAncestorToWrapMarkup):
+        (WebCore::createMarkup):
+
+2011-01-24  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin Adler.
+
+        Roll back r67261 ("Don't fire onclick on middle clicks") due to
+        regressions.
+        https://bugs.webkit.org/show_bug.cgi?id=46733
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::isLinkClick):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::preDispatchEventHandler):
+        (WebCore::HTMLInputElement::postDispatchEventHandler):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseDoubleClickEvent):
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+
+2011-01-24  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        [GTK] Many DOM XHTML tests time out
+        https://bugs.webkit.org/show_bug.cgi?id=52553
+
+        Properly handle the situation where a synchronous load fails before the inner
+        event loop has started. In this case, we simply do not run the inner event loop,
+        or else it will block indefinitely (since no GIO or libsoup callbacks will fire).
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::loadResourceSynchronously): Bail out of a synchronous
+        load if it fails up front.
+
+2011-01-24  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Cleanup WebGLGetInfo and related get*Parameter helpers in WebGLRenderingContext
+        https://bugs.webkit.org/show_bug.cgi?id=52338
+
+        Removed the long/unsigned long types and corresponding get functions
+        and use int/unsigned int instead.
+
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::toJS):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::toV8Object):
+        * html/canvas/WebGLGetInfo.cpp:
+        (WebCore::WebGLGetInfo::WebGLGetInfo):
+        (WebCore::WebGLGetInfo::getInt):
+        (WebCore::WebGLGetInfo::getUnsignedInt):
+        * html/canvas/WebGLGetInfo.h:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::getBufferParameter):
+        (WebCore::WebGLRenderingContext::getFramebufferAttachmentParameter):
+        (WebCore::WebGLRenderingContext::getParameter):
+        (WebCore::WebGLRenderingContext::getProgramParameter):
+        (WebCore::WebGLRenderingContext::getRenderbufferParameter):
+        (WebCore::WebGLRenderingContext::getShaderParameter):
+        (WebCore::WebGLRenderingContext::getTexParameter):
+        (WebCore::WebGLRenderingContext::getUniform):
+        (WebCore::WebGLRenderingContext::getVertexAttrib):
+        (WebCore::WebGLRenderingContext::getIntParameter):
+        (WebCore::WebGLRenderingContext::getUnsignedIntParameter):
+        * html/canvas/WebGLRenderingContext.h:
+
+2011-01-24  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Darin Adler.
+
+        Remove sizeInBytes from GraphicsContext3D's various implementations
+        https://bugs.webkit.org/show_bug.cgi?id=52339
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::sizeInBytes):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+
+2011-01-24  Adam Roben  <aroben@apple.com>
+
+        Windows Production build fix
+
+        * WebCore.vcproj/WebCore.make: Update for move of WebCore into Source.
+
+2011-01-24  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        [v8] Refactoring: extract IntrusiveDOMWrapperMap into a seprate class and files.
+        https://bugs.webkit.org/show_bug.cgi?id=52911
+
+        Plain refactoring, covered by the existing tests.
+
+        * WebCore.gypi: IntrusiveDOMWrapperMap.h added.
+        * bindings/v8/DOMDataStore.cpp: IntrusiveDOMWrapperMap is moved out of DOMDataStore class.
+        * bindings/v8/DOMDataStore.h: IntrusiveDOMWrapperMap is moved out of DOMDataStore class.
+        * bindings/v8/IntrusiveDOMWrapperMap.h: Added.
+        (WebCore::ChunkedTable::ChunkedTable):
+        (WebCore::ChunkedTable::add):
+        (WebCore::ChunkedTable::remove):
+        (WebCore::ChunkedTable::clear):
+        (WebCore::ChunkedTable::visit):
+        (WebCore::ChunkedTable::Chunk::Chunk):
+        (WebCore::ChunkedTable::clearEntries):
+        (WebCore::ChunkedTable::visitEntries):
+        (WebCore::IntrusiveDOMWrapperMap::IntrusiveDOMWrapperMap):
+        (WebCore::IntrusiveDOMWrapperMap::get):
+        (WebCore::IntrusiveDOMWrapperMap::set):
+        (WebCore::IntrusiveDOMWrapperMap::contains):
+        (WebCore::IntrusiveDOMWrapperMap::visit):
+        (WebCore::IntrusiveDOMWrapperMap::removeIfPresent):
+        (WebCore::IntrusiveDOMWrapperMap::clear):
+        (WebCore::IntrusiveDOMWrapperMap::ChunkedTableTraits::move):
+        (WebCore::IntrusiveDOMWrapperMap::ChunkedTableTraits::clear):
+        (WebCore::IntrusiveDOMWrapperMap::ChunkedTableTraits::visit):
+        * bindings/v8/StaticDOMDataStore.h: include added.
+
+2011-01-24  Shane Stephens  <shanestephens@google.com>
+
+        Reviewed by Chris Marrin.
+
+        TransformationMatrix multiply operations apply operands in wrong order.
+        https://bugs.webkit.org/show_bug.cgi?id=52780
+
+        Rename TranformationMatrix::multLeft into multiply (the method does a multRight,
+        not a multLeft).
+
+        Remove TransformationMatrix::multiply, which was actually doing a multLeft.
+
+        Fix TransformationMatrix::operator* and operator*= such that the operand is
+        applied to the right-hand side of the matrix that the method is called on.
+        i.e., previously "a * b" used to compute "b * a", and "a *= b" used to store
+        "b * a" in "a".  This has now been fixed so "a * b" computes "a * b" and
+        "a *= b" stores "a * b" in "a".
+
+        Convert all call sites for these methods to provide operands in the correct order.
+
+        No new tests as patch adds no new functionality.
+
+        * css/WebKitCSSMatrix.cpp:
+        (WebCore::WebKitCSSMatrix::multiply):
+        * platform/graphics/transforms/Matrix3DTransformOperation.h:
+        (WebCore::Matrix3DTransformOperation::apply):
+        * platform/graphics/transforms/MatrixTransformOperation.h:
+        (WebCore::MatrixTransformOperation::apply):
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::scaleNonUniform):
+        (WebCore::TransformationMatrix::scale3d):
+        (WebCore::TransformationMatrix::rotate3d):
+        (WebCore::TransformationMatrix::skew):
+        (WebCore::TransformationMatrix::applyPerspective):
+        (WebCore::TransformationMatrix::multiply):
+        (WebCore::TransformationMatrix::recompose):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::operator*=):
+        (WebCore::TransformationMatrix::operator*):
+        * rendering/RenderLayer.cpp:
+        (WebCore::transparencyClipBox):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::getTransformFromContainer):
+        * rendering/TransformState.cpp:
+        (WebCore::TransformState::applyTransform):
+        (WebCore::HitTestingTransformState::applyTransform):
+
+2011-01-24  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Nate Chapin.
+
+        IndexedDatabase methods should not take arguments of type OptionsObject
+        https://bugs.webkit.org/show_bug.cgi?id=53012
+
+        This patch reverts all IDB methods, except IDBDatabase::createObjectStore and
+        IDBObjectStore::createIndex, to using a plain list of arguments instead of
+        grouping the various parameters inside a single OptionsObject argument.
+        This decision was made on public-webapps@w3.org mailing list.
+
+        We also add support (v8 only for now) for passing DOMStringList objects as arguments to native
+        methods. The code for obtaining a DOMStringList object from a JS array of strings existed already
+        in OptionsObject.cpp, I just copied it to V8Bindings.cpp and taught the v8 code generator how to
+        use it.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8ValueToWebCoreDOMStringList):
+        * bindings/v8/V8Binding.h:
+        * storage/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::transaction):
+        * storage/IDBDatabase.h:
+        (WebCore::IDBDatabase::transaction):
+        * storage/IDBDatabase.idl:
+        * storage/IDBIndex.cpp:
+        (WebCore::IDBIndex::openCursor):
+        (WebCore::IDBIndex::openKeyCursor):
+        * storage/IDBIndex.h:
+        (WebCore::IDBIndex::openCursor):
+        (WebCore::IDBIndex::openKeyCursor):
+        * storage/IDBIndex.idl:
+        * storage/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::openCursor):
+        * storage/IDBObjectStore.h:
+        (WebCore::IDBObjectStore::openCursor):
+        * storage/IDBObjectStore.idl:
+
+2011-01-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: extract dispatch API from network manager.
+        https://bugs.webkit.org/show_bug.cgi?id=53009
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkManager):
+        (WebInspector.NetworkManager.prototype.reset):
+        (WebInspector.NetworkManager.prototype.requestContent):
+        (WebInspector.NetworkManager.prototype._processCachedResources):
+        (WebInspector.NetworkDispatcher):
+        (WebInspector.NetworkDispatcher.prototype._updateResourceWithRequest):
+        (WebInspector.NetworkDispatcher.prototype._updateResourceWithResponse):
+        (WebInspector.NetworkDispatcher.prototype._updateResourceWithCachedResource):
+        (WebInspector.NetworkDispatcher.prototype.identifierForInitialRequest):
+        (WebInspector.NetworkDispatcher.prototype.willSendRequest):
+        (WebInspector.NetworkDispatcher.prototype.didReceiveResponse):
+        (WebInspector.NetworkDispatcher.prototype.didLoadResourceFromMemoryCache):
+        (WebInspector.NetworkDispatcher.prototype.didCommitLoadForFrame):
+        (WebInspector.NetworkDispatcher.prototype.didCreateWebSocket):
+        (WebInspector.NetworkDispatcher.prototype._appendRedirect):
+        (WebInspector.NetworkDispatcher.prototype._startResource):
+        (WebInspector.NetworkDispatcher.prototype._updateResource):
+        (WebInspector.NetworkDispatcher.prototype._finishResource):
+        (WebInspector.NetworkDispatcher.prototype._addFramesRecursively):
+        (WebInspector.NetworkDispatcher.prototype._dispatchEventToListeners):
+        (WebInspector.NetworkDispatcher.prototype._createResource):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype._innerRequestContent):
+        * inspector/front-end/ResourceTreeModel.js:
+        (WebInspector.ResourceTreeModel):
+        (WebInspector.ResourceTreeModel.prototype.reset):
+        (WebInspector.ResourceTreeModel.prototype.unbindResourceURL):
+
+2011-01-24  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [JSC] remove ScriptDebugServer::pageCreated
+        https://bugs.webkit.org/show_bug.cgi?id=53007
+
+        It's impossible to create "provisional" inspector for pages which are
+        not yet created so there is no need to listen for page creation in ScriptDebugServer.
+
+        * bindings/js/ScriptDebugServer.cpp:
+        * bindings/js/ScriptDebugServer.h:
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+
+2011-01-24  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [REGRESSION] AppCache view on resources panel is broken.
+        https://bugs.webkit.org/show_bug.cgi?id=53002
+
+
+        * inspector/front-end/ApplicationCacheItemsView.js:
+        (WebInspector.ApplicationCacheItemsView.prototype._update):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.ApplicationCacheDispatcher.getApplicationCachesAsync):
+
+2011-01-24  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix warnings about unregistering an invalid timer
+        https://bugs.webkit.org/show_bug.cgi?id=53006
+
+        The ShadowBuffer's purge timer ID was initialized with 0 which lead
+        to us calling QObject::killTimer(0), causing some qWarnings.
+
+        * platform/graphics/qt/ContextShadowQt.cpp:
+        (WebCore::ShadowBuffer::ShadowBuffer):
+        (WebCore::ShadowBuffer::schedulePurge):
+
+2011-01-21  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Chromium] Fix heap snapshot table sorting.
+
+        Fix table sorting to avoid qsort instability artefacts.
+
+        https://bugs.webkit.org/show_bug.cgi?id=52914
+
+        * inspector/front-end/HeapSnapshotView.js:
+        (WebInspector.HeapSnapshotView.prototype._sortData):
+        (WebInspector.HeapSnapshotDataGridList.propertyComparator.comparator):
+        (WebInspector.HeapSnapshotDataGridList.propertyComparator):
+
+2011-01-24  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Find duplicate strings in localizedStrings.js, update it.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53005
+
+        * English.lproj/localizedStrings.js:
+
+2011-01-24  Pavel Podivilov  <podivilov@chromium.org>
+
+        Unreviewed, build fix  for r76509.
+
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::setBreakpoint):
+
+2011-01-24  Pavel Podivilov  <podivilov@chromium.org>
+
+        Unreviewed, build fix  for r76509.
+
+        * bindings/js/ScriptDebugServer.h:
+
+2011-01-24  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: set breakpoints by line:column.
+        https://bugs.webkit.org/show_bug.cgi?id=52615
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::setBreakpoint):
+        (WebCore::ScriptDebugServer::removeBreakpoint):
+        (WebCore::ScriptDebugServer::hasBreakpoint):
+        (WebCore::ScriptDebugServer::clearBreakpoints):
+        * bindings/js/ScriptDebugServer.h:
+        * bindings/v8/DebuggerScript.js:
+        ():
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::setBreakpoint):
+        * bindings/v8/ScriptDebugServer.h:
+        * inspector/Inspector.idl:
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        (WebCore::InspectorBrowserDebuggerAgent::restoreStickyBreakpoint):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::setStickyBreakpoint):
+        (WebCore::InspectorDebuggerAgent::setBreakpoint):
+        (WebCore::InspectorDebuggerAgent::restoreBreakpoint):
+        (WebCore::InspectorDebuggerAgent::didParseSource):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/ScriptBreakpoint.cpp: Removed.
+        * inspector/ScriptBreakpoint.h:
+        (WebCore::ScriptBreakpoint::ScriptBreakpoint):
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint):
+        (WebInspector.Breakpoint.prototype.get url):
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.JavaScriptBreakpoint.prototype._serializeToJSON):
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.continueToLine):
+        (WebInspector.DebuggerModel.prototype.setBreakpoint):
+        (WebInspector.DebuggerModel.prototype._breakpointSetOnBackend):
+        (WebInspector.DebuggerDispatcher.prototype.breakpointResolved):
+
+2011-01-24  Peter Beverloo  <peter@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: recognize application/x-font-woff as a valid mime-type.
+        https://bugs.webkit.org/show_bug.cgi?id=52977
+
+        No new tests.
+
+        * inspector/front-end/inspector.js:
+
+2011-01-24  Pavel Podivilov  <podivilov@chromium.org>
+
+        Unreviewed, fix for r76497.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.show):
+
+2011-01-24  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Use rad2deg() from WTF instead of rolling our own.
+        https://bugs.webkit.org/show_bug.cgi?id=52993
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::rotate):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::addArc):
+
+2011-01-24  Sergio Villar Senin  <svillar@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [Gtk] ResourceHandleSoup: do not wait for streams to close to issue didFinishLoading
+        https://bugs.webkit.org/show_bug.cgi?id=52885
+
+        No new tests as it does not change functionality. We will not wait for
+        the the input stream to close to issue didFinishLoading to
+        WebCore. We expect a subtle performance improvement with this
+        patch when loading complex web pages, as we wouldn't have to wait
+        for the stream to close (which involves creating a thread among
+        other things).
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::closeCallback):
+        (WebCore::readCallback):
+
+2011-01-21  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: eliminate SourceView and ScriptView classes.
+        https://bugs.webkit.org/show_bug.cgi?id=52896
+
+        SourceView and ScriptView delegate everything to SourceFrame and should be eliminated.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/GoToLineDialog.js:
+        (WebInspector.GoToLineDialog.prototype._highlightSelectedLine):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.createResourceView):
+        (WebInspector.ResourceView.resourceViewTypeMatchesResource):
+        (WebInspector.SourceFrameContentProviderForResource):  Moved from SourceView.
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.show):
+        (WebInspector.ResourcesPanel.prototype._applyDiffMarkup):
+        (WebInspector.FrameResourceTreeElement.prototype._errorsWarningsUpdated):
+        * inspector/front-end/ScriptView.js: Removed.
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._scriptSourceChanged):
+        (WebInspector.ScriptsPanel.prototype._sourceFrameForScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._setPauseOnExceptions):
+        (WebInspector.ScriptsPanel.prototype._formatScript):
+        (WebInspector.SourceFrameContentProviderForScript): Moved from ScriptView.
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        (WebInspector.SourceFrame.prototype.show):
+        (WebInspector.SourceFrame.prototype.hide):
+        (WebInspector.SourceFrame.prototype.hasContent):
+        (WebInspector.SourceFrame.prototype._createTextViewer):
+        (WebInspector.SourceFrame.prototype.performSearch.doFindSearchMatches):
+        (WebInspector.SourceFrame.prototype.performSearch):
+        * inspector/front-end/SourceView.js: Removed.
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2011-01-24  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt] Move project files into Source
+        https://bugs.webkit.org/show_bug.cgi?id=52891
+
+        No new tests needed.
+
+        * WebCore.pri:
+        * WebCore.pro:
+
+2011-01-24  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewed, trivial fix.
+
+        Fix a Chromium-only assertion failure by r76491.
+        https://bugs.webkit.org/show_bug.cgi?id=38982
+
+        Separate icon loading from the FileChooser constructor in order to avoid
+        ref() before adoptRef().
+
+        * platform/FileChooser.cpp:
+        (WebCore::FileChooser::FileChooser):
+        (WebCore::FileChooser::initialize):
+        (WebCore::FileChooser::create):
+        * platform/FileChooser.h:
+
+2011-01-24  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Kent Tamura.
+
+        TextControlInnerElement::m_shadowParent should be removed.
+        https://bugs.webkit.org/show_bug.cgi?id=52998
+
+        No new tests. No behavioral change.
+
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::TextControlInnerElement::TextControlInnerElement):
+        * rendering/TextControlInnerElements.h:
+
+2011-01-24  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        REGRESSION (r72895): console.trace crashes
+        https://bugs.webkit.org/show_bug.cgi?id=52981
+
+        - Use local RefPtr variable for accessing PassRefPtr arguments to make sure the PassRefPtr has
+        non-null value.
+        - Use PassRefPtr for objects whos ownership is passed to the inspector.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/InspectorConsoleInstrumentation.h: Added. Extract inline methods called from the console into their
+        own header to reduce compilation time of other classes that depend on the inspector instrumentation.
+        (WebCore::InspectorInstrumentation::addMessageToConsole):
+        (WebCore::InspectorInstrumentation::consoleCount):
+        (WebCore::InspectorInstrumentation::startConsoleTiming):
+        (WebCore::InspectorInstrumentation::stopConsoleTiming):
+        (WebCore::InspectorInstrumentation::consoleMarkTimeline):
+        (WebCore::InspectorInstrumentation::addStartProfilingMessageToConsole):
+        (WebCore::InspectorInstrumentation::addProfile):
+        (WebCore::InspectorInstrumentation::profilerEnabled):
+        (WebCore::InspectorInstrumentation::getCurrentUserInitiatedProfileName):
+        * inspector/InspectorDatabaseInstrumentation.h: Added. Extract inline methods called from the datanase code into their
+        own header to reduce compilation time of other classes that depend on the inspector instrumentation.
+        (WebCore::InspectorInstrumentation::didOpenDatabase):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::addMessageToConsoleImpl):
+        (WebCore::InspectorInstrumentation::consoleCountImpl):
+        (WebCore::InspectorInstrumentation::stopConsoleTimingImpl):
+        (WebCore::InspectorInstrumentation::consoleMarkTimelineImpl):
+        (WebCore::InspectorInstrumentation::addProfileImpl):
+        (WebCore::InspectorInstrumentation::didOpenDatabaseImpl):
+        * inspector/InspectorInstrumentation.h:
+        * page/Console.cpp: use RefPtr local variable instead of accessing PassRefPtr argument directly.
+        (WebCore::Console::addMessage):
+        (WebCore::Console::trace):
+        (WebCore::Console::count):
+        (WebCore::Console::markTimeline):
+        (WebCore::Console::profileEnd):
+        (WebCore::Console::timeEnd):
+        (WebCore::Console::group):
+        (WebCore::Console::groupCollapsed):
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+
+2010-01-24  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Support icon loading for <input type=file>
+        https://bugs.webkit.org/show_bug.cgi?id=38982
+
+        An icon data in Chromium port is represented as WebCore::Image. We
+        don't need OS-specific code anymore.
+
+        * WebCore.gypi:
+        * platform/graphics/Icon.h:
+        (WebCore::Icon::create): Add Chromium-specific factory.
+        * platform/graphics/chromium/IconChromium.cpp: Added.
+        * platform/graphics/chromium/IconChromiumLinux.cpp: Removed.
+        * platform/graphics/chromium/IconChromiumMac.cpp: Removed.
+        * platform/graphics/chromium/IconChromiumWin.cpp: Removed.
+        * platform/graphics/chromium/PlatformIcon.h:
+
+2011-01-21  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: move search functions from SourceView to SourceFrame.
+        https://bugs.webkit.org/show_bug.cgi?id=52895
+
+        This is the last step before eliminating SourceView and ScriptView since
+        this classes just delegate everything to SourceFrame.
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.set visible):
+        (WebInspector.SourceFrame.prototype._clearLineHighlight):
+        (WebInspector.SourceFrame.prototype._createTextViewer):
+        (WebInspector.SourceFrame.prototype.performSearch.doFindSearchMatches):
+        (WebInspector.SourceFrame.prototype.performSearch):
+        (WebInspector.SourceFrame.prototype.searchCanceled):
+        (WebInspector.SourceFrame.prototype.jumpToFirstSearchResult):
+        (WebInspector.SourceFrame.prototype.jumpToLastSearchResult):
+        (WebInspector.SourceFrame.prototype.jumpToNextSearchResult):
+        (WebInspector.SourceFrame.prototype.jumpToPreviousSearchResult):
+        (WebInspector.SourceFrame.prototype.showingFirstSearchResult):
+        (WebInspector.SourceFrame.prototype.showingLastSearchResult):
+        (WebInspector.SourceFrame.prototype._jumpToSearchResult):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype.hide):
+        (WebInspector.SourceView.prototype.searchCanceled):
+        (WebInspector.SourceView.prototype.performSearch):
+        (WebInspector.SourceView.prototype.jumpToFirstSearchResult):
+        (WebInspector.SourceView.prototype.jumpToLastSearchResult):
+        (WebInspector.SourceView.prototype.jumpToNextSearchResult):
+        (WebInspector.SourceView.prototype.jumpToPreviousSearchResult):
+        (WebInspector.SourceView.prototype.showingFirstSearchResult):
+        (WebInspector.SourceView.prototype.showingLastSearchResult):
+        (WebInspector.SourceView.prototype.clearMessages):
+
+2011-01-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r76463.
+        http://trac.webkit.org/changeset/76463
+        https://bugs.webkit.org/show_bug.cgi?id=52993
+
+        It broke canvas/philip/tests/2d.path.stroke.skew.html
+        (Requested by Ossy on #webkit).
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::rotate):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::addArc):
+
+2011-01-23  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: summary bar is not resized properly with the rest of network panel
+        https://bugs.webkit.org/show_bug.cgi?id=52881
+
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkPanel.prototype.updateSidebarWidth):
+        (WebInspector.NetworkPanel.prototype._positionSummaryBar):
+        (WebInspector.NetworkPanel.prototype._toggleGridMode):
+
+2011-01-19  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Ryosuke Niwa.
+
+        Space and tab characters "sent" by an input method give totally different results than typing them directly
+        https://bugs.webkit.org/show_bug.cgi?id=5241
+        
+        * Introduced TextEvent::InputTypeComposition and TypingCommand::TextCompositionType to 
+          distinguish text input which is originated by composition.
+        * Generalized rebalanceWhitespaceAt() to rebalanceWhitespaceOnTextSubstring() to rebalancing 
+          range of string on text node, instead of surrounding part of that.
+
+        Test: editing/inserting/insert-composition-whitespace.html
+
+        * dom/TextEvent.h:
+        (WebCore::TextEvent::isComposition):
+        * dom/TextEventInputType.h: Added TextEventInputComposition as a member of TextEvent::InputType
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::containsOnlyWhitespace):
+        (WebCore::CompositeEditCommand::shouldRebalanceLeadingWhitespaceFor):
+        (WebCore::CompositeEditCommand::canRebalance):
+        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt):
+        (WebCore::CompositeEditCommand::rebalanceWhitespaceOnTextSubstring): Added: A generalized version of rebalanceWhitespaceAt(), which takes a range inside Text string.
+        * editing/CompositeEditCommand.h:
+        * editing/Editor.cpp:
+        (WebCore::Editor::insertTextForConfirmedComposition): Added.
+        (WebCore::Editor::insertTextWithoutSendingTextEvent):
+        (WebCore::Editor::confirmComposition): Now uses insertTextForConfirmedComposition().
+        (WebCore::Editor::setComposition):
+        * editing/Editor.h:
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::input):
+        * editing/InsertTextCommand.h:
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::TypingCommand):
+        (WebCore::TypingCommand::insertText):
+        (WebCore::TypingCommand::insertTextRunWithoutNewlines):
+        * editing/TypingCommand.h: Added TypingCommand::m_compositionType and TypingCommand::TextCompositionType
+        (WebCore::TypingCommand::setCompositionType): Added.
+        (WebCore::TypingCommand::create):
+
+2011-01-23  Mark Rowe  <mrowe@apple.com>
+
+        Follow-up to r76477.
+
+        Fix the scripts that detect problematic code such as static initializers
+        and destructors, weak vtables, inappropriate files in the framework wrappers,
+        and public headers including private headers. These had all been broken
+        since the projects were moved in to the Source directory as the paths to the
+        scripts were not updated at that time.
+
+        Stop copying an IDL file in to the framework wrapper. Doing that doesn't even make sense.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2011-01-23  Mark Rowe  <mrowe@apple.com>
+
+        Build fix after r76459.
+
+        Static member variables or globals of types that have constructors or destructors are bad as
+        they generate static initializers and destructors. This is code that is run either at link time
+        when the library is loaded in to memory or at application termination time. Both of these are
+        terrible for performance and are thus outlawed in WebKit code.
+
+        The typical solution is to replace the static member or global with a function that allocates
+        the necessary variable on the heap. The variable is leaked to prevent it from being destroyed
+        at application termination time. The DEFINE_STATIC_LOCAL macro wraps this in to a concise little
+        package, but sadly fails to work in this case due to the type containing multiple template
+        parameters.
+        
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::inspectorAgents):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::bindInspectorAgent):
+        (WebCore::InspectorInstrumentation::unbindInspectorAgent):
+        (WebCore::InspectorInstrumentation::inspectorAgentForPage):
+
+2011-01-21  Vangelis Kokkevis  <vangelis@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Add support for -webkit-mask properties to the
+        accelerated compositing path.
+        https://bugs.webkit.org/show_bug.cgi?id=49780
+         
+        Tests: Existing tests in LayoutTests/compositing/masks
+
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::draw):
+        (WebCore::ContentLayerChromium::unreserveContentsTexture):
+        (WebCore::ContentLayerChromium::bindContentsTexture):
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setMaskLayer):
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::setMaskLayer):
+        (WebCore::LayerChromium::maskLayer):
+        (WebCore::LayerChromium::unreserveContentsTexture):
+        (WebCore::LayerChromium::bindContentsTexture):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::updateLayersRecursive):
+        * platform/graphics/chromium/LayerTexture.cpp:
+        (WebCore::LayerTexture::bindTexture):
+        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
+        (WebCore::RenderSurfaceChromium::SharedValues::SharedValues):
+        (WebCore::RenderSurfaceChromium::SharedValues::~SharedValues):
+        (WebCore::RenderSurfaceChromium::RenderSurfaceChromium):
+        (WebCore::RenderSurfaceChromium::draw):
+        * platform/graphics/chromium/RenderSurfaceChromium.h:
+        (WebCore::RenderSurfaceChromium::SharedValues::maskShaderProgram):
+        (WebCore::RenderSurfaceChromium::SharedValues::maskShaderSamplerLocation):
+        (WebCore::RenderSurfaceChromium::SharedValues::maskShaderMaskSamplerLocation):
+        (WebCore::RenderSurfaceChromium::SharedValues::maskShaderMatrixLocation):
+        (WebCore::RenderSurfaceChromium::SharedValues::maskShaderAlphaLocation):
+
+2011-01-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Use WTF::StringHasher in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=52934
+
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::urlHostHash):
+        * platform/LinkHash.cpp:
+        (WebCore::visitedLinkHashInline):
+        * platform/cf/BinaryPropertyList.cpp:
+        (WebCore::IntegerArrayHash::hash):
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::computeHash):
+        * platform/network/ProtectionSpaceHash.h:
+        (WebCore::ProtectionSpaceHash::hash):
+
+2011-01-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Add an overload to base64Encode with String output
+        https://bugs.webkit.org/show_bug.cgi?id=50122
+
+        This change removes duplicated code.
+
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::resourceContentBase64):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::btoa):
+        * platform/graphics/skia/FontCustomPlatformData.cpp:
+        (WebCore::createUniqueFontName):
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore::createUniqueFontName):
+        * platform/graphics/wince/FontCustomPlatformData.cpp:
+        (WebCore::createUniqueFontName):
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::encodeBasicAuthorization):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::encodeBasicAuthorization):
+        * platform/text/Base64.cpp:
+        (WebCore::base64Encode):
+        * platform/text/Base64.h:
+        (WebCore::base64Encode):
+        * platform/wince/KeygenWinCE.cpp:
+        (WebCore::WebCore::signedPublicKeyAndChallengeString):
+
+2011-01-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Add String::containsOnlyLatin1()
+        https://bugs.webkit.org/show_bug.cgi?id=52979
+
+        Use String::containsOnlyLatin1() instead of isSafeToConvertCharList().
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::btoa):
+        (WebCore::DOMWindow::atob):
+
+2011-01-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [CMake] Add missing CodeGenerator dependencies
+        https://bugs.webkit.org/show_bug.cgi?id=52976
+
+        * CMakeLists.txt:
+
+2011-01-23  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt][Symbian] Fix --minimal build
+        https://bugs.webkit.org/show_bug.cgi?id=52839
+
+        Some of the plugins' functionality is reimplemented in
+        Symbian specific files.
+        Some of this functionality should be compiled in even if 
+        the guard NETSCAPE_PLUGIN_API is turned off.
+        This patch moves that functionality out of the
+        NETSCAPE_PLUGIN_API guard.
+
+        Build fix so no new tests.
+
+        * WebCore.pro:
+        * plugins/symbian/PluginPackageSymbian.cpp:
+
+2011-01-23  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Use rad2deg() from WTF instead of rolling our own.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::rotate):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::addArc):
+
+2011-01-23  Kenneth Rohde Christiansen <kenneth@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Viewport meta: Always adjust device dimensions to the device pixel ratio.
+
+        * dom/ViewportArguments.cpp:
+        (WebCore::computeViewportAttributes):
+
+2011-01-23  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Don't scale absolute geometry specified by viewport meta tag.
+
+        * dom/ViewportArguments.cpp:
+        (WebCore::computeViewportAttributes):
+
+2011-01-23  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed build fix.
+
+        Web Inspector: looks like efl doesn't regenerate InspectorBackendDispatcher.
+
+        Touch Inspector.idl.
+
+        * inspector/Inspector.idl:
+
+2011-01-22  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: next step in splitting InspectorController.
+
+        Splitting InspectorController is a bit tricky process.
+
+        As a first step I'll do the next things:
+        1) rename existing InspectorController to InspectorAgent;
+        2) s/nspectorController/nspectorAgent/g everywhere in WebCore/inspector but InspectorInstrumentation;
+        3) create a fake InspectorController derived from the InspectorAgent for the rest of WebCore and WebKit;
+
+        The second step is a migration of a small set of functions described in bug 52510 from InspectorAgent to InspectorController.
+
+        As far as the second step will have significant changes in the functions' implementation I'll do it as a separate patch.
+
+        https://bugs.webkit.org/show_bug.cgi?id=52955
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::nodeForId):
+        (WebCore::JSInjectedScriptHost::selectDOMStorage):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::nodeForIdCallback):
+        * inspector/CodeGeneratorInspector.pm:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::clearConsoleMessages):
+        (WebCore::InjectedScriptHost::databaseForId):
+        (WebCore::InjectedScriptHost::selectDatabase):
+        (WebCore::InjectedScriptHost::selectDOMStorage):
+        (WebCore::InjectedScriptHost::injectedScriptForMainFrame):
+        (WebCore::InjectedScriptHost::inspectorDOMAgent):
+        (WebCore::InjectedScriptHost::frontend):
+        (WebCore::InjectedScriptHost::didCreateWorker):
+        (WebCore::InjectedScriptHost::didDestroyWorker):
+        * inspector/InjectedScriptHost.h:
+        (WebCore::InjectedScriptHost::create):
+        (WebCore::InjectedScriptHost::inspectorAgent):
+        (WebCore::InjectedScriptHost::disconnectController):
+        * inspector/InspectorAgent.cpp: Copied from Source/WebCore/inspector/InspectorController.cpp.
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::~InspectorAgent):
+        (WebCore::InspectorAgent::inspectedPageDestroyed):
+        (WebCore::InspectorAgent::enabled):
+        (WebCore::InspectorAgent::inspectorStartsAttached):
+        (WebCore::InspectorAgent::setInspectorStartsAttached):
+        (WebCore::InspectorAgent::setInspectorAttachedHeight):
+        (WebCore::InspectorAgent::inspectorAttachedHeight):
+        (WebCore::InspectorAgent::searchingForNodeInPage):
+        (WebCore::InspectorAgent::restoreInspectorStateFromCookie):
+        (WebCore::InspectorAgent::inspect):
+        (WebCore::InspectorAgent::focusNode):
+        (WebCore::InspectorAgent::highlight):
+        (WebCore::InspectorAgent::highlightDOMNode):
+        (WebCore::InspectorAgent::highlightFrame):
+        (WebCore::InspectorAgent::hideHighlight):
+        (WebCore::InspectorAgent::mouseDidMoveOverElement):
+        (WebCore::InspectorAgent::handleMousePress):
+        (WebCore::InspectorAgent::setInspectorFrontendClient):
+        (WebCore::InspectorAgent::didClearWindowObjectInWorld):
+        (WebCore::InspectorAgent::setSearchingForNode):
+        (WebCore::InspectorAgent::connectFrontend):
+        (WebCore::InspectorAgent::show):
+        (WebCore::InspectorAgent::showPanel):
+        (WebCore::InspectorAgent::close):
+        (WebCore::InspectorAgent::disconnectFrontend):
+        (WebCore::InspectorAgent::resourceAgent):
+        (WebCore::InspectorAgent::releaseFrontendLifetimeAgents):
+        (WebCore::InspectorAgent::populateScriptObjects):
+        (WebCore::InspectorAgent::pushDataCollectedOffline):
+        (WebCore::InspectorAgent::restoreDebugger):
+        (WebCore::InspectorAgent::restoreProfiler):
+        (WebCore::InspectorAgent::unbindAllResources):
+        (WebCore::InspectorAgent::didCommitLoad):
+        (WebCore::InspectorAgent::mainResourceFiredDOMContentEvent):
+        (WebCore::InspectorAgent::mainResourceFiredLoadEvent):
+        (WebCore::InspectorAgent::isMainResourceLoader):
+        (WebCore::InspectorAgent::willSendRequest):
+        (WebCore::InspectorAgent::ensureSettingsLoaded):
+        (WebCore::InspectorAgent::startTimelineProfiler):
+        (WebCore::InspectorAgent::stopTimelineProfiler):
+        (WebCore::PostWorkerNotificationToFrontendTask::create):
+        (WebCore::PostWorkerNotificationToFrontendTask::PostWorkerNotificationToFrontendTask):
+        (WebCore::PostWorkerNotificationToFrontendTask::performTask):
+        (WebCore::InspectorAgent::postWorkerNotificationToFrontend):
+        (WebCore::InspectorAgent::didCreateWorker):
+        (WebCore::InspectorAgent::didDestroyWorker):
+        (WebCore::InspectorAgent::didOpenDatabase):
+        (WebCore::InspectorAgent::getCookies):
+        (WebCore::InspectorAgent::buildArrayForCookies):
+        (WebCore::InspectorAgent::buildObjectForCookie):
+        (WebCore::InspectorAgent::deleteCookie):
+        (WebCore::InspectorAgent::didUseDOMStorage):
+        (WebCore::InspectorAgent::didCreateWebSocket):
+        (WebCore::InspectorAgent::willSendWebSocketHandshakeRequest):
+        (WebCore::InspectorAgent::didReceiveWebSocketHandshakeResponse):
+        (WebCore::InspectorAgent::didCloseWebSocket):
+        (WebCore::InspectorAgent::isRecordingUserInitiatedProfile):
+        (WebCore::InspectorAgent::startUserInitiatedProfiling):
+        (WebCore::InspectorAgent::stopUserInitiatedProfiling):
+        (WebCore::InspectorAgent::profilerEnabled):
+        (WebCore::InspectorAgent::enableProfiler):
+        (WebCore::InspectorAgent::disableProfiler):
+        (WebCore::InspectorAgent::showAndEnableDebugger):
+        (WebCore::InspectorAgent::enableDebugger):
+        (WebCore::InspectorAgent::disableDebugger):
+        (WebCore::InspectorAgent::resume):
+        (WebCore::InspectorAgent::setAllBrowserBreakpoints):
+        (WebCore::InspectorAgent::evaluateForTestInFrontend):
+        (WebCore::InspectorAgent::didEvaluateForTestInFrontend):
+        (WebCore::quadToPath):
+        (WebCore::drawOutlinedQuad):
+        (WebCore::drawOutlinedQuadWithClip):
+        (WebCore::drawHighlightForBox):
+        (WebCore::drawHighlightForLineBoxesOrSVGRenderer):
+        (WebCore::convertFromFrameToMainFrame):
+        (WebCore::frameToMainFrameOffset):
+        (WebCore::InspectorAgent::drawNodeHighlight):
+        (WebCore::InspectorAgent::drawElementTitle):
+        (WebCore::InspectorAgent::openInInspectedWindow):
+        (WebCore::InspectorAgent::addScriptToEvaluateOnLoad):
+        (WebCore::InspectorAgent::removeAllScriptsToEvaluateOnLoad):
+        (WebCore::InspectorAgent::setInspectorExtensionAPI):
+        (WebCore::InspectorAgent::inspectedURL):
+        (WebCore::InspectorAgent::reloadPage):
+        (WebCore::InspectorAgent::setExtraHeaders):
+        * inspector/InspectorAgent.h: Copied from Source/WebCore/inspector/InspectorController.h.
+        (WebCore::InspectorAgent::inspectorBackendDispatcher):
+        (WebCore::InspectorAgent::inspectorClient):
+        (WebCore::InspectorAgent::injectedScriptHost):
+        (WebCore::InspectorAgent::inspectedPage):
+        (WebCore::InspectorAgent::hideDOMNodeHighlight):
+        (WebCore::InspectorAgent::hideFrameHighlight):
+        (WebCore::InspectorAgent::frontend):
+        (WebCore::InspectorAgent::inspectorController):
+        (WebCore::InspectorAgent::inspectorAgent):
+        (WebCore::InspectorAgent::consoleAgent):
+        (WebCore::InspectorAgent::cssAgent):
+        (WebCore::InspectorAgent::domAgent):
+        (WebCore::InspectorAgent::injectedScriptAgent):
+        (WebCore::InspectorAgent::runtimeAgent):
+        (WebCore::InspectorAgent::timelineAgent):
+        (WebCore::InspectorAgent::databaseAgent):
+        (WebCore::InspectorAgent::domStorageAgent):
+        (WebCore::InspectorAgent::fileSystemAgent):
+        (WebCore::InspectorAgent::browserDebuggerAgent):
+        (WebCore::InspectorAgent::debuggerAgent):
+        (WebCore::InspectorAgent::profilerAgent):
+        (WebCore::InspectorAgent::applicationCacheAgent):
+        (WebCore::InspectorAgent::hasInspectorFrontendClient):
+        (WebCore::InspectorAgent::hasFrontend):
+        (WebCore::InspectorAgent::startProfiling):
+        (WebCore::InspectorAgent::stopProfiling):
+        (WebCore::InspectorAgent::debuggerEnabled):
+        (WebCore::InspectorAgent::state):
+        (WebCore::InspectorAgent::settings):
+        * inspector/InspectorApplicationCacheAgent.cpp:
+        (WebCore::InspectorApplicationCacheAgent::InspectorApplicationCacheAgent):
+        (WebCore::InspectorApplicationCacheAgent::getApplicationCaches):
+        * inspector/InspectorApplicationCacheAgent.h:
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        (WebCore::InspectorBrowserDebuggerAgent::InspectorBrowserDebuggerAgent):
+        (WebCore::InspectorBrowserDebuggerAgent::inspectedURLChanged):
+        (WebCore::InspectorBrowserDebuggerAgent::restoreStickyBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::setDOMBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::removeDOMBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::willInsertDOMNode):
+        (WebCore::InspectorBrowserDebuggerAgent::willRemoveDOMNode):
+        (WebCore::InspectorBrowserDebuggerAgent::willModifyDOMAttr):
+        (WebCore::InspectorBrowserDebuggerAgent::descriptionForDOMEvent):
+        (WebCore::InspectorBrowserDebuggerAgent::pauseOnNativeEventIfNeeded):
+        (WebCore::InspectorBrowserDebuggerAgent::willSendXMLHttpRequest):
+        * inspector/InspectorBrowserDebuggerAgent.h:
+        (WebCore::InspectorBrowserDebuggerAgent::create):
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::InspectorConsoleAgent):
+        (WebCore::InspectorConsoleAgent::~InspectorConsoleAgent):
+        (WebCore::InspectorConsoleAgent::clearConsoleMessages):
+        (WebCore::InspectorConsoleAgent::addMessageToConsole):
+        (WebCore::InspectorConsoleAgent::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorConsoleAgent::didReceiveResponse):
+        (WebCore::InspectorConsoleAgent::didFailLoading):
+        (WebCore::InspectorConsoleAgent::setMonitoringXHREnabled):
+        (WebCore::InspectorConsoleAgent::setConsoleMessagesEnabled):
+        (WebCore::InspectorConsoleAgent::addConsoleMessage):
+        * inspector/InspectorConsoleAgent.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDatabaseAgent.cpp:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::create):
+        (WebCore::InspectorDebuggerAgent::InspectorDebuggerAgent):
+        (WebCore::InspectorDebuggerAgent::~InspectorDebuggerAgent):
+        (WebCore::InspectorDebuggerAgent::evaluateOnCallFrame):
+        (WebCore::InspectorDebuggerAgent::getCompletionsOnCallFrame):
+        (WebCore::InspectorDebuggerAgent::currentCallFrames):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorFileSystemAgent.cpp:
+        (WebCore::InspectorFileSystemAgentCallbacks::didOpenFileSystem):
+        (WebCore::InspectorFileSystemAgent::InspectorFileSystemAgent):
+        (WebCore::InspectorFileSystemAgent::stop):
+        (WebCore::InspectorFileSystemAgent::getFileSystemPathAsync):
+        (WebCore::InspectorFileSystemAgent::didGetFileSystemPath):
+        (WebCore::InspectorFileSystemAgent::didGetFileSystemError):
+        * inspector/InspectorFileSystemAgent.h:
+        (WebCore::InspectorFileSystemAgent::create):
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::setExtensionAPI):
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::create):
+        (WebCore::InspectorProfilerAgent::InspectorProfilerAgent):
+        (WebCore::InspectorProfilerAgent::addProfileFinishedMessageToConsole):
+        (WebCore::InspectorProfilerAgent::addStartProfilingMessageToConsole):
+        (WebCore::InspectorProfilerAgent::startUserInitiatedProfiling):
+        (WebCore::InspectorProfilerAgent::stopUserInitiatedProfiling):
+        * inspector/InspectorProfilerAgent.h:
+
+2011-01-22  Chris Rogers  <crogers@google.com>
+
+        Rubber-stamped by Anders Carlsson.
+
+        Fix FFTFrameStub to compile properly
+        https://bugs.webkit.org/show_bug.cgi?id=52969
+
+        No new tests since this is a build fix.
+
+        * platform/audio/FFTFrameStub.cpp:
+        (WebCore::FFTFrame::FFTFrame):
+
+2011-01-22  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        IndexedDB corrupts data on disk
+        https://bugs.webkit.org/show_bug.cgi?id=52890
+
+        We need to store the SerializedScriptValues on disk in a BLOB column rather than TEXT.
+        Test: storage/indexeddb/data-corruption.html
+
+        * platform/sql/SQLiteStatement.cpp:
+        (WebCore::SQLiteStatement::bindBlob):
+        (WebCore::SQLiteStatement::getColumnBlobAsString):
+        (WebCore::SQLiteStatement::getColumnBlobAsVector):
+        * platform/sql/SQLiteStatement.h:
+        * storage/IDBCursorBackendImpl.cpp:
+        (WebCore::IDBCursorBackendImpl::loadCurrentRow):
+        * storage/IDBFactoryBackendImpl.cpp:
+        (WebCore::runCommands):
+        (WebCore::createTables):
+        (WebCore::createMetaDataTable):
+        (WebCore::migrateDatabase):
+        * storage/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::getInternal):
+        (WebCore::putObjectStoreData):
+
+2011-01-22  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Fix WinCE build.
+
+        * platform/graphics/wince/GraphicsContextWinCE.cpp:
+        (WebCore::GraphicsContext::drawText):
+        * rendering/RenderThemeWinCE.cpp:
+        (WebCore::RenderThemeWinCE::adjustMenuListButtonStyle):
+
+2011-01-22  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        REGRESSION: Vertical line metrics incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=52960
+
+        SimpleFontDataMac.mm contains a hack to modifiy lineGap/descent for the 'Hiragino' font.
+        That didn't influence the lineSpacing so far, but does now, causing regressions.
+
+        Restore old line spacing behaviour to fix the regression.
+        Covered by existing fast/blockflow, fast/repaint and fast/text/international test cases.
+
+        * platform/graphics/FontMetrics.h:
+        (WebCore::FontMetrics::FontMetrics):
+        (WebCore::FontMetrics::floatLineSpacing):
+        (WebCore::FontMetrics::setLineSpacing):
+        (WebCore::FontMetrics::lineSpacing):
+        (WebCore::FontMetrics::reset):
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData):
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/freetype/SimpleFontDataFreeType.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/haiku/SimpleFontDataHaiku.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/pango/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/win/SimpleFontDataCGWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        (WebCore::SimpleFontData::initGDIFont):
+        * platform/graphics/wince/SimpleFontDataWinCE.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2011-01-22  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] fast/backgrounds/svg-as-mask.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=52906
+
+        Transparency layers should start out with in SourceOver mode with
+        alpha 1.0 (modeled after CGContextBeginTransparencyLayer.)
+
+        * platform/graphics/qt/TransparencyLayer.h:
+        (WebCore::TransparencyLayer::TransparencyLayer):
+
+2011-01-22  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed.
+
+        Introduce FontMetrics abstraction
+        https://bugs.webkit.org/show_bug.cgi?id=51456
+
+        Fix Chromium/Win build.
+
+        * platform/graphics/chromium/UniscribeHelperTextRun.cpp: s/->/./
+        (WebCore::UniscribeHelperTextRun::UniscribeHelperTextRun):
+
+2011-01-21  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Introduce FontMetrics abstraction
+        https://bugs.webkit.org/show_bug.cgi?id=51456
+
+        Encapsulate ascent/descent/lineHeight/lineGap methods in a single FontMetrics class, instead of
+        having to define them in both Font & SimpleFontData. Changed to store floating point values
+        as default, in order to get accurate information for small sized fonts. All these methods
+        now have floating-point and integer versions. Whenever an integer variant of these functions
+        is called, lroundf() is used to round the value.
+
+        This makes it possible to support small font-sizes for SVG in a follow-up patch, as well
+        as fixing rounding issues when using SVG Fonts.
+        
+        Shouldn't affect existing tests.
+
+        * GNUmakefile.am: Add FontMetrics.h to build. 
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp: Use style->fontMetrics() instead of style->font() to access the metrics.
+        (baselinePositionForAccessibilityRenderObject):
+        * css/CSSPrimitiveValue.cpp:         
+        (WebCore::CSSPrimitiveValue::computeLengthDouble):
+        * html/canvas/CanvasRenderingContext2D.cpp: Ditto.
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * inspector/InspectorController.cpp: Ditto.
+        (WebCore::InspectorController::drawElementTitle):
+        * platform/chromium/PopupMenuChromium.cpp: Ditto.
+        (WebCore::PopupListBox::paintRow):
+        (WebCore::PopupListBox::getRowHeight):
+        * platform/graphics/Font.h: Remove ascent/descent/height/lineGap/lineSpacing/xHeight/unitsPerEm accessor...
+        (WebCore::Font::fontMetrics): ... and only expose a single FontMetrics object here.
+        * platform/graphics/FontFastPath.cpp: Use fontMetrics() to query metrics information.
+        (WebCore::Font::emphasisMarkAscent):
+        (WebCore::Font::emphasisMarkDescent):
+        (WebCore::Font::emphasisMarkHeight):
+        (WebCore::Font::floatWidthForSimpleText):
+        * platform/graphics/FontMetrics.h: Added.
+        (WebCore::FontMetrics::FontMetrics): Creates a FontMetrics object, stored in SimpleFontData.
+        (WebCore::FontMetrics::unitsPerEm): Returns an unsigned describing the unitsPerEm.
+        (WebCore::FontMetrics::setUnitsPerEm): Sets the unitsPerEm value.
+        (WebCore::FontMetrics::floatAscent): Returns the stored m_ascent float.
+        (WebCore::FontMetrics::setAscent): Sets the stored m_ascent float.
+        (WebCore::FontMetrics::floatDescent): Returns the stored m_descent float.
+        (WebCore::FontMetrics::setDescent): Sets the stored m_descent float.
+        (WebCore::FontMetrics::floatHeight): Returns floatAscent() + floatDescent().
+        (WebCore::FontMetrics::floatLineGap): Returns the stored m_lineGap float.
+        (WebCore::FontMetrics::setLineGap): Sets the stored m_lineGap float.
+        (WebCore::FontMetrics::floatLineSpacing): Returns the stored m_lineSpacing float.
+        (WebCore::FontMetrics::setLineSpacing): Sets the stored m_lineSpacing float.
+        (WebCore::FontMetrics::xHeight): Returns the stored m_xHeight float (no integer version available, hence no 'float' prefix).
+        (WebCore::FontMetrics::setXHeight): Sets the stored m_xHeight float.
+        (WebCore::FontMetrics::ascent): Returns a rounded version of ascent().
+        (WebCore::FontMetrics::descent): Ditto (for descent).
+        (WebCore::FontMetrics::height): Returns ascent() + descent().
+        (WebCore::FontMetrics::lineGap): Returns a rounded version of lineGap().
+        (WebCore::FontMetrics::lineSpacing): Ditto (for lineSpacing).
+        (WebCore::FontMetrics::reset): Nulls all members, used only by the platform variants of SimpleFontData.
+        * platform/graphics/SimpleFontData.cpp: Adapt SVG Fonts code, to initialize the FontMetrics object, as the m_ascent/etc.. members are gone.
+        (WebCore::SimpleFontData::SimpleFontData):
+        (WebCore::SimpleFontData::initCharWidths):
+        * platform/graphics/SimpleFontData.h: Remove ascent/descent/height/lineSpacing/lineGap/xHeight/unitsPerEm accessors, and members, just store a FontMetrics object and expose it.
+        (WebCore::SimpleFontData::fontMetrics):
+        (WebCore::SimpleFontData::avgCharWidth):
+        * platform/graphics/chromium/FontChromiumWin.cpp: Use fontMetrics() to query font metrics.
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::estimateTextBounds):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::drawGlyphs):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareUniscribePainter::estimateTextBounds):
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp: Adapt platform code, to initialize the FontMetrics object.
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp: Ditto.
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/chromium/UniscribeHelperTextRun.cpp: Use fontMetrics() to query font metrics.
+        (WebCore::UniscribeHelperTextRun::UniscribeHelperTextRun):
+        (WebCore::UniscribeHelperTextRun::nextWinFontData):
+        * platform/graphics/freetype/SimpleFontDataFreeType.cpp: Adapt platform code, to initialize the FontMetrics object.
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/haiku/SimpleFontDataHaiku.cpp: Ditto.
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/mac/FontComplexTextMac.cpp: Use fontMetrics() to query font metrics.
+        (WebCore::Font::floatWidthForComplexText):
+        * platform/graphics/mac/FontMac.mm: Ditto.
+        (WebCore::showGlyphsWithAdvances):
+        * platform/graphics/mac/SimpleFontDataMac.mm: Adapt platform code, to initialize the FontMetrics object.
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/pango/SimpleFontDataPango.cpp: Ditto.
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/qt/SimpleFontDataQt.cpp: Ditto. (+ Switch to QFontMetricsF to get floating-point accurancy.)
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/win/FontCGWin.cpp: Use fontMetrics() to query font metrics.
+        (WebCore::drawGDIGlyphs):
+        * platform/graphics/win/FontWin.cpp: Ditto.
+        (WebCore::Font::floatWidthForComplexText):
+        * platform/graphics/win/SimpleFontDataCGWin.cpp: Adapt platform code, to initialize the FontMetrics object.
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformBoundsForGlyph):
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp: Ditto.
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/win/SimpleFontDataWin.cpp: Ditto.
+        (WebCore::SimpleFontData::initGDIFont):
+        * platform/graphics/wince/GraphicsContextWinCE.cpp: Use fontMetrics() to query font metrics.
+        (WebCore::GraphicsContext::drawText):
+        * platform/graphics/wince/SimpleFontDataWinCE.cpp: Adapt platform code, to initialize the FontMetrics object.
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/wx/SimpleFontDataWx.cpp: Ditto.
+        (WebCore::SimpleFontData::platformInit):
+        * platform/win/PopupMenuWin.cpp: Use style->fontMetrics() instead of style->font() to access the metrics.
+        (WebCore::PopupMenuWin::calculatePositionAndSize): 
+        (WebCore::PopupMenuWin::paint):
+        * rendering/EllipsisBox.cpp: Ditto.
+        (WebCore::EllipsisBox::paint):
+        (WebCore::EllipsisBox::nodeAtPoint):
+        * rendering/InlineBox.cpp: Ditto.
+        (WebCore::InlineBox::logicalHeight):
+        * rendering/InlineFlowBox.cpp: Ditto.
+        (WebCore::verticalPositionForBox):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesInBlockDirection):
+        * rendering/InlineTextBox.cpp: Ditto.
+        (WebCore::InlineTextBox::paint):
+        (WebCore::InlineTextBox::paintDecoration):
+        (WebCore::InlineTextBox::paintSpellingOrGrammarMarker):
+        (WebCore::InlineTextBox::paintCompositionUnderline):
+        * rendering/RenderBlock.cpp: Ditto.
+        (WebCore::RenderBlock::baselinePosition):
+        (WebCore::RenderBlock::firstLineBoxBaseline):
+        (WebCore::RenderBlock::lastLineBoxBaseline):
+        * rendering/RenderBox.cpp: Ditto.
+        (WebCore::RenderBox::localCaretRect):
+        * rendering/RenderEmbeddedObject.cpp: Ditto.
+        (WebCore::RenderEmbeddedObject::paintReplaced):
+        * rendering/RenderImage.cpp: Ditto.
+        (WebCore::RenderImage::setImageSizeForAltText):
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderInline.cpp: Ditto.
+        (WebCore::RenderInline::baselinePosition):
+        * rendering/RenderListBox.cpp: Ditto.
+        (WebCore::RenderListBox::paintItemForeground):
+        (WebCore::RenderListBox::itemHeight):
+        * rendering/RenderListMarker.cpp: Ditto.
+        (WebCore::RenderListMarker::paint):
+        (WebCore::RenderListMarker::layout):
+        (WebCore::RenderListMarker::computePreferredLogicalWidths):
+        (WebCore::RenderListMarker::updateMargins):
+        (WebCore::RenderListMarker::getRelativeMarkerRect):
+        * rendering/RenderTextControl.cpp: Ditto.
+        (WebCore::RenderTextControl::paintPlaceholder):
+        * rendering/RenderTextControlSingleLine.cpp: Ditto.
+        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):
+        * rendering/RenderThemeWin.cpp: Ditto.
+        (WebCore::RenderThemeWin::adjustMenuListButtonStyle):
+        * rendering/mathml/RenderMathMLFraction.cpp: Ditto.
+        (WebCore::RenderMathMLFraction::baselinePosition):
+        * rendering/style/RenderStyle.h: Add "const FontMetrics& fontMetrics() const" accessor.
+        (WebCore::InheritedFlags::fontMetrics):
+        (WebCore::InheritedFlags::computedLineHeight):
+        * rendering/svg/RenderSVGInlineText.cpp: Use style->fontMetrics() instead of style->font() to access the metrics.
+        (WebCore::RenderSVGInlineText::positionForPoint):
+        * rendering/svg/SVGInlineTextBox.cpp: Ditto.
+        (WebCore::SVGInlineTextBox::selectionRectForTextFragment):
+        (WebCore::positionOffsetForDecoration):
+        (WebCore::SVGInlineTextBox::paintDecorationWithStyle):
+        (WebCore::SVGInlineTextBox::paintTextWithShadows):
+        (WebCore::SVGInlineTextBox::calculateBoundaries):
+        * rendering/svg/SVGTextLayoutEngineBaseline.cpp: Ditto.
+        (WebCore::SVGTextLayoutEngineBaseline::calculateBaselineShift):
+        (WebCore::SVGTextLayoutEngineBaseline::calculateAlignmentBaselineShift):
+        (WebCore::SVGTextLayoutEngineBaseline::calculateGlyphAdvanceAndOrientation):
+        * rendering/svg/SVGTextLayoutEngineSpacing.cpp: Ditto.
+        (WebCore::SVGTextLayoutEngineSpacing::calculateSVGKerning):
+        * rendering/svg/SVGTextMetrics.cpp: Ditto.
+        (WebCore::SVGTextMetrics::SVGTextMetrics):
+        * rendering/svg/SVGTextQuery.cpp: Ditto.
+        (WebCore::calculateGlyphBoundaries):
+        * svg/SVGFontFaceElement.cpp: 
+        (WebCore::SVGFontFaceElement::unitsPerEm): Rename defaultUnitsPerEm global to gDefaultUnitsPerEm.
+        * svg/SVGLength.cpp: Use style->fontMetrics() instead of style->font() to access the metrics.
+        (WebCore::SVGLength::convertValueFromUserUnitsToEXS):
+        (WebCore::SVGLength::convertValueFromEXSToUserUnits):
+
+2011-01-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Stop instantiating legacy editing positions in VisibleSelection, visible_units.cpp, Frame, and RenderBlock
+        https://bugs.webkit.org/show_bug.cgi?id=52759
+
+        Stopped instantiating legacy editing positions in the following files.
+
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries):
+        * editing/visible_units.cpp:
+        (WebCore::previousBoundary):
+        (WebCore::previousLinePosition):
+        (WebCore::nextLinePosition):
+        (WebCore::startOfBlock):
+        * page/Frame.cpp:
+        (WebCore::Frame::visiblePositionForPoint):
+        * rendering/RenderBlock.cpp: Removed RenderBlock::positionForRenderer because it was not called anywhere.
+        * rendering/RenderBlock.h: Ditto.
+
+2011-01-22  Adrienne Walker  <enne@google.com>
+
+        Reviewed by James Robinson.
+
+        [chromium] Fix compositor repaints for offscreen fixed elements
+        https://bugs.webkit.org/show_bug.cgi?id=52681
+
+        The fast path scrolling was clipping offscreen invalidations.
+        Additionally, the compositor was ignoring all invalidations that were
+        entirely out of the content rect.
+
+        Test: compositing/ to verify this caused no regressions.
+        Tested fix manually in browser as I could not generate a LayoutTest that reproduced the bug in run-webkit-tests.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollContentsFastPath):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::invalidateRootLayerRect):
+
+2011-01-22  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=52951
+        WebKit2 generates a bad PDF for cross process messaging
+
+        * page/PrintContext.cpp: (WebCore::PrintContext::spoolRect): Use a correct offset to actually
+        draw inside the requested rectangle.
+
+2011-01-21  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Regression: new window.onerror() implementation leaks cross-origin Javascript errors
+        https://bugs.webkit.org/show_bug.cgi?id=52903
+
+        In case of an exception in a script from different domain only generic message
+        will be passed to window.onerror hander.
+
+        Tests: http/tests/security/cross-origin-script-window-onerror-redirected.html
+               http/tests/security/cross-origin-script-window-onerror.html
+
+        * bindings/js/CachedScriptSourceProvider.h: use URL from the resource response to make sure we do all
+        cross origin checks agains real script URL, not the original URL which may have resulted in a sequence
+        of redirects to different domains.
+        (WebCore::CachedScriptSourceProvider::CachedScriptSourceProvider):
+        * bindings/v8/ScriptSourceCode.h: same for v8.
+        (WebCore::ScriptSourceCode::url):
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::dispatchErrorEvent): in case the error occurred in a script we cannot
+        access provide concise "Script error." message without any information about the error source. This is
+        what Firefox does in this case.
+
+2011-01-21  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Always set composition mode through GraphicsContext
+        https://bugs.webkit.org/show_bug.cgi?id=52940
+
+        GraphicsContext tracks the current composition mode so we should
+        never call through to the QPainter directly.
+
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::toQtCompositionMode): Changed this method to a static inline
+        since it's only used by GraphicsContextQt.cpp now.
+
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::draw):
+
+2011-01-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Inconsistent handling of no-break space in justification logic
+        https://bugs.webkit.org/show_bug.cgi?id=52938
+
+        Test: fast/text/justify-nbsp.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine): Count no-break space as a
+        space when computing the distribution of space between text boxes on the line.
+
 2011-01-21  Charlie Reis  <creis@chromium.org>
 
         Reviewed by Darin Fisher.
diff --git a/Source/WebCore/Configurations/FeatureDefines.xcconfig b/Source/WebCore/Configurations/FeatureDefines.xcconfig
index 46d5de4..3971037 100644
--- a/Source/WebCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebCore/Configurations/FeatureDefines.xcconfig
@@ -38,10 +38,10 @@ ENABLE_ACCELERATED_2D_CANVAS_macosx = $(ENABLE_ACCELERATED_2D_CANVAS_macosx_$(TA
 ENABLE_ACCELERATED_2D_CANVAS_macosx_1060 = ;
 ENABLE_ACCELERATED_2D_CANVAS_macosx_1070 = ;
 
-ENABLE_3D_CANVAS = $(ENABLE_3D_CANVAS_$(REAL_PLATFORM_NAME));
-ENABLE_3D_CANVAS_macosx = $(ENABLE_3D_CANVAS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-ENABLE_3D_CANVAS_macosx_1060 = ENABLE_3D_CANVAS;
-ENABLE_3D_CANVAS_macosx_1070 = ENABLE_3D_CANVAS;
+ENABLE_WEBGL = $(ENABLE_WEBGL_$(REAL_PLATFORM_NAME));
+ENABLE_WEBGL_macosx = $(ENABLE_WEBGL_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+ENABLE_WEBGL_macosx_1060 = ENABLE_WEBGL;
+ENABLE_WEBGL_macosx_1070 = ENABLE_WEBGL;
 
 ENABLE_3D_RENDERING = $(ENABLE_3D_RENDERING_$(REAL_PLATFORM_NAME));
 ENABLE_3D_RENDERING_iphoneos = ENABLE_3D_RENDERING;
@@ -91,6 +91,8 @@ ENABLE_NOTIFICATIONS = ;
 ENABLE_OFFLINE_WEB_APPLICATIONS = ENABLE_OFFLINE_WEB_APPLICATIONS;
 ENABLE_PROGRESS_TAG = ENABLE_PROGRESS_TAG;
 
+ENABLE_REGISTER_PROTOCOL_HANDLER = ;
+
 ENABLE_SHARED_WORKERS = $(ENABLE_SHARED_WORKERS_$(REAL_PLATFORM_NAME));
 ENABLE_SHARED_WORKERS_macosx = ENABLE_SHARED_WORKERS;
 
@@ -106,6 +108,8 @@ ENABLE_SVG_FOREIGN_OBJECT = ENABLE_SVG_FOREIGN_OBJECT;
 ENABLE_SVG_USE = ENABLE_SVG_USE;
 ENABLE_VIDEO = ENABLE_VIDEO;
 
+ENABLE_MEDIA_STATISTICS = ;
+
 ENABLE_WEB_AUDIO = ;
 
 ENABLE_WEB_SOCKETS = $(ENABLE_WEB_SOCKETS_$(REAL_PLATFORM_NAME));
@@ -121,4 +125,4 @@ ENABLE_XHTMLMP = ;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_FULLSCREEN_API) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_WEBGL) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_FULLSCREEN_API) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/Source/WebCore/Configurations/Version.xcconfig b/Source/WebCore/Configurations/Version.xcconfig
index 740d199..2901c21 100644
--- a/Source/WebCore/Configurations/Version.xcconfig
+++ b/Source/WebCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 534;
-MINOR_VERSION = 16;
+MINOR_VERSION = 20;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebCore/Configurations/WebCore.xcconfig b/Source/WebCore/Configurations/WebCore.xcconfig
index ac21049..f164902 100644
--- a/Source/WebCore/Configurations/WebCore.xcconfig
+++ b/Source/WebCore/Configurations/WebCore.xcconfig
@@ -63,7 +63,7 @@ PRODUCTION_FRAMEWORKS_DIR_iphonesimulator = $(PRODUCTION_FRAMEWORKS_DIR_iphoneos
 PRODUCTION_FRAMEWORKS_DIR_macosx = $(NEXT_ROOT)$(SYSTEM_LIBRARY_DIR)/Frameworks;
 
 WEBKIT2_LDFLAGS = $(WEBKIT2_LDFLAGS_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-WEBKIT2_LDFLAGS_1060 = -allowable_client WebKit2;
+WEBKIT2_LDFLAGS_1060 = -allowable_client WebKit2 -allowable_client WebKitTestRunner -allowable_client WebKitTestRunnerInjectedBundle;
 WEBKIT2_LDFLAGS_1070 = $(WEBKIT2_LDFLAGS_1060);
 
 JAVASCRIPTCORE_PRIVATE_HEADERS_DIR = $(JAVASCRIPTCORE_PRIVATE_HEADERS_DIR_$(CONFIGURATION));
diff --git a/Source/WebCore/DerivedSources.cpp b/Source/WebCore/DerivedSources.cpp
index 21271ea..b7bcb66 100644
--- a/Source/WebCore/DerivedSources.cpp
+++ b/Source/WebCore/DerivedSources.cpp
@@ -28,6 +28,8 @@
 #include "HTMLElementFactory.cpp"
 #include "HTMLEntityTable.cpp"
 #include "JSAbstractWorker.cpp"
+#include "JSArrayBuffer.cpp"
+#include "JSArrayBufferView.cpp"
 #include "JSAttr.cpp"
 #include "JSBarInfo.cpp"
 #include "JSBeforeLoadEvent.cpp"
@@ -37,7 +39,7 @@
 #include "JSCanvasPattern.cpp"
 #include "JSCanvasRenderingContext.cpp"
 #include "JSCanvasRenderingContext2D.cpp"
-#if ENABLE(3D_CANVAS)    
+#if ENABLE(WEBGL)    
 #include "JSWebGLRenderingContext.cpp"
 #endif
 #include "JSCDATASection.cpp"
@@ -50,6 +52,7 @@
 #include "JSConsole.cpp"
 #include "JSCoordinates.cpp"
 #include "JSCounter.cpp"
+#include "JSCrypto.cpp"
 #include "JSCSSCharsetRule.cpp"
 #include "JSCSSFontFaceRule.cpp"
 #include "JSCSSImportRule.cpp"
@@ -69,6 +72,7 @@
 #include "JSDatabaseSync.cpp"
 #include "JSDataGridColumn.cpp"
 #include "JSDataGridColumnList.cpp"
+#include "JSDataView.cpp"
 #include "JSDedicatedWorkerContext.cpp"
 #include "JSDeviceOrientationEvent.cpp"
 #include "JSDirectoryEntry.cpp"
@@ -124,6 +128,7 @@
 #include "JSFileWriterCallback.cpp"
 #include "JSFileWriterSync.cpp"
 #include "JSFlags.cpp"
+#include "JSFloat32Array.cpp"
 #include "JSGeolocation.cpp"
 #include "JSGeoposition.cpp"
 #include "JSHashChangeEvent.cpp"
@@ -222,6 +227,9 @@
 #include "JSImageData.cpp"
 #include "JSInjectedScriptHost.cpp"
 #include "JSInspectorFrontendHost.cpp"
+#include "JSInt16Array.cpp"
+#include "JSInt32Array.cpp"
+#include "JSInt8Array.cpp"
 #include "JSJavaScriptCallFrame.cpp"
 #include "JSKeyboardEvent.cpp"
 #include "JSLocation.cpp"
@@ -422,6 +430,9 @@
 #include "JSTouchEvent.cpp"
 #include "JSTouchList.cpp"
 #include "JSTreeWalker.cpp"
+#include "JSUint16Array.cpp"
+#include "JSUint32Array.cpp"
+#include "JSUint8Array.cpp"
 #include "JSUIEvent.cpp"
 #include "JSValidityState.cpp"
 #include "JSWebKitAnimationEvent.cpp"
diff --git a/Source/WebCore/DerivedSources.make b/Source/WebCore/DerivedSources.make
index ef2dc2f..3ead1c7 100644
--- a/Source/WebCore/DerivedSources.make
+++ b/Source/WebCore/DerivedSources.make
@@ -127,6 +127,7 @@ DOM_CLASSES = \
     Console \
     Coordinates \
     Counter \
+    Crypto \
     CustomEvent \
     DataGridColumn \
     DataGridColumnList \
@@ -569,6 +570,7 @@ all : \
     MathMLNames.cpp \
     XPathGrammar.cpp \
     tokenizer.cpp \
+    HeaderDetection.h \
 #
 
 # --------
@@ -932,3 +934,19 @@ DOM%.h : %.idl $(DOM_BINDINGS_SCRIPTS) bindings/objc/PublicDOMInterfaces.h
 endif # MACOS
 
 # ------------------------
+
+# header detection
+
+ifeq ($(OS),MACOS)
+
+HeaderDetection.h : DerivedSources.make /System/Library/CoreServices/SystemVersion.plist
+	rm -f $@
+	echo "/* This is a generated file. Do not edit. */" > $@
+	if [ -f $(SDKROOT)/System/Library/Frameworks/AppKit.framework/PrivateHeaders/NSScrollerImpPair_Private.h ]; then echo "#define USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER 1" >> $@; else echo >> $@; fi
+
+else
+
+HeaderDetection.h :
+	echo > $@
+
+endif
diff --git a/Source/WebCore/English.lproj/localizedStrings.js b/Source/WebCore/English.lproj/localizedStrings.js
index 7bd3da8..6f759a2 100644
--- a/Source/WebCore/English.lproj/localizedStrings.js
+++ b/Source/WebCore/English.lproj/localizedStrings.js
diff --git a/Source/WebCore/ForwardingHeaders/pcre/pcre.h b/Source/WebCore/ForwardingHeaders/pcre/pcre.h
deleted file mode 100644
index 198acc9..0000000
--- a/Source/WebCore/ForwardingHeaders/pcre/pcre.h
+++ /dev/null
@@ -1,5 +0,0 @@
-#ifndef WebCore_FWD_pcre_h
-#define WebCore_FWD_pcre_h
-#include <JavaScriptCore/pcre.h>
-#endif
-
diff --git a/Source/WebCore/ForwardingHeaders/runtime/WriteBarrier.h b/Source/WebCore/ForwardingHeaders/runtime/WriteBarrier.h
new file mode 100644
index 0000000..0857d2f
--- /dev/null
+++ b/Source/WebCore/ForwardingHeaders/runtime/WriteBarrier.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_WriteBarrier_h
+#define WebCore_FWD_WriteBarrier_h
+#include <JavaScriptCore/WriteBarrier.h>
+#endif
diff --git a/Source/WebCore/ForwardingHeaders/wrec/WREC.h b/Source/WebCore/ForwardingHeaders/wrec/WREC.h
deleted file mode 100644
index 5749ed9..0000000
--- a/Source/WebCore/ForwardingHeaders/wrec/WREC.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_WREC_h
-#define WebCore_FWD_WREC_h
-#include <JavaScriptCore/WREC.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/BloomFilter.h b/Source/WebCore/ForwardingHeaders/wtf/BloomFilter.h
new file mode 100644
index 0000000..98a67b9
--- /dev/null
+++ b/Source/WebCore/ForwardingHeaders/wtf/BloomFilter.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_BloomFilter_h
+#define WebCore_FWD_BloomFilter_h
+#include <JavaScriptCore/BloomFilter.h>
+#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/CryptographicallyRandomNumber.h b/Source/WebCore/ForwardingHeaders/wtf/CryptographicallyRandomNumber.h
new file mode 100644
index 0000000..6c36f9b
--- /dev/null
+++ b/Source/WebCore/ForwardingHeaders/wtf/CryptographicallyRandomNumber.h
@@ -0,0 +1,5 @@
+#ifndef WebCore_FWD_CryptographicallyRandomNumber_h
+#define WebCore_FWD_CryptographicallyRandomNumber_h
+#include <JavaScriptCore/CryptographicallyRandomNumber.h>
+#endif
+
diff --git a/Source/WebCore/ForwardingHeaders/wtf/OwnArrayPtrCommon.h b/Source/WebCore/ForwardingHeaders/wtf/OwnArrayPtrCommon.h
deleted file mode 100644
index e886c8a..0000000
--- a/Source/WebCore/ForwardingHeaders/wtf/OwnArrayPtrCommon.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_OwnArrayPtrCommon_h
-#define WebCore_FWD_OwnArrayPtrCommon_h
-#include <JavaScriptCore/OwnArrayPtrCommon.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/unicode/CharacterNames.h b/Source/WebCore/ForwardingHeaders/wtf/unicode/CharacterNames.h
new file mode 100644
index 0000000..5518642
--- /dev/null
+++ b/Source/WebCore/ForwardingHeaders/wtf/unicode/CharacterNames.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_CharacterNames_h
+#define WebCore_FWD_CharacterNames_h
+#include <JavaScriptCore/CharacterNames.h>
+#endif
diff --git a/Source/WebCore/ForwardingHeaders/yarr/Yarr.h b/Source/WebCore/ForwardingHeaders/yarr/Yarr.h
new file mode 100644
index 0000000..9d38201
--- /dev/null
+++ b/Source/WebCore/ForwardingHeaders/yarr/Yarr.h
@@ -0,0 +1,5 @@
+#ifndef WebCore_FWD_Yarr_h
+#define WebCore_FWD_Yarr_h
+#include <JavaScriptCore/Yarr.h>
+#endif
+
diff --git a/Source/WebCore/ForwardingHeaders/yarr/YarrInterpreter.h b/Source/WebCore/ForwardingHeaders/yarr/YarrInterpreter.h
new file mode 100644
index 0000000..00b10a8
--- /dev/null
+++ b/Source/WebCore/ForwardingHeaders/yarr/YarrInterpreter.h
@@ -0,0 +1,5 @@
+#ifndef WebCore_FWD_YarrInterpreter_h
+#define WebCore_FWD_YarrInterpreter_h
+#include <JavaScriptCore/YarrInterpreter.h>
+#endif
+
diff --git a/Source/WebCore/ForwardingHeaders/yarr/YarrPattern.h b/Source/WebCore/ForwardingHeaders/yarr/YarrPattern.h
new file mode 100644
index 0000000..c2cf0b6
--- /dev/null
+++ b/Source/WebCore/ForwardingHeaders/yarr/YarrPattern.h
@@ -0,0 +1,5 @@
+#ifndef WebCore_FWD_YarrPattern_h
+#define WebCore_FWD_YarrPattern_h
+#include <JavaScriptCore/YarrPattern.h>
+#endif
+
diff --git a/Source/WebCore/GNUmakefile.am b/Source/WebCore/GNUmakefile.am
index 0975094..4c3788b 100644
--- a/Source/WebCore/GNUmakefile.am
+++ b/Source/WebCore/GNUmakefile.am
@@ -87,9 +87,7 @@ webcoregtk_cppflags += \
 	-I$(srcdir)/Source/WebCore/platform/graphics/gstreamer \
 	-I$(srcdir)/Source/WebCore/platform/graphics/gtk \
 	-I$(srcdir)/Source/WebCore/platform/gtk \
-	-I$(srcdir)/Source/WebCore/platform/network/soup \
-	-I$(srcdir)/Source/WebCore/platform/network/soup/cache \
-	-I$(srcdir)/Source/WebCore/platform/network/soup/cache/webkit
+	-I$(srcdir)/Source/WebCore/platform/network/soup
 
 webcore_built_nosources += \
 	DerivedSources/WebCore/tokenizer.cpp
@@ -164,6 +162,8 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSCoordinates.h \
 	DerivedSources/WebCore/JSCounter.cpp \
 	DerivedSources/WebCore/JSCounter.h \
+	DerivedSources/WebCore/JSCrypto.cpp \
+	DerivedSources/WebCore/JSCrypto.h \
 	DerivedSources/WebCore/JSCSSCharsetRule.cpp \
 	DerivedSources/WebCore/JSCSSCharsetRule.h \
 	DerivedSources/WebCore/JSCSSFontFaceRule.cpp \
@@ -826,6 +826,7 @@ webcore_sources += \
 	Source/WebCore/bindings/js/JSLocationCustom.h \
 	Source/WebCore/bindings/js/JSMainThreadExecState.cpp \
 	Source/WebCore/bindings/js/JSMainThreadExecState.h \
+	Source/WebCore/bindings/js/JSMemoryInfoCustom.cpp \
 	Source/WebCore/bindings/js/JSMessageChannelCustom.cpp \
 	Source/WebCore/bindings/js/JSMessageEventCustom.cpp \
 	Source/WebCore/bindings/js/JSMessagePortCustom.cpp \
@@ -1167,6 +1168,8 @@ webcore_sources += \
 	Source/WebCore/dom/DocumentMarkerController.cpp \
 	Source/WebCore/dom/DocumentMarkerController.h \
 	Source/WebCore/dom/DocumentMarker.h \
+	Source/WebCore/dom/DocumentOrderedMap.cpp \
+	Source/WebCore/dom/DocumentOrderedMap.h \
 	Source/WebCore/dom/DocumentParser.cpp \
 	Source/WebCore/dom/DocumentParser.h \
 	Source/WebCore/dom/DocumentTiming.h \
@@ -1866,6 +1869,8 @@ webcore_sources += \
 	Source/WebCore/html/parser/HTMLScriptRunner.cpp \
 	Source/WebCore/html/parser/HTMLScriptRunner.h \
 	Source/WebCore/html/parser/HTMLScriptRunnerHost.h \
+	Source/WebCore/html/parser/HTMLSourceTracker.cpp \
+	Source/WebCore/html/parser/HTMLSourceTracker.h \
 	Source/WebCore/html/parser/HTMLToken.h \
 	Source/WebCore/html/parser/HTMLTokenizer.cpp \
 	Source/WebCore/html/parser/HTMLTokenizer.h \
@@ -1878,8 +1883,13 @@ webcore_sources += \
 	Source/WebCore/html/parser/TextDocumentParser.h \
 	Source/WebCore/html/parser/TextViewSourceParser.cpp \
 	Source/WebCore/html/parser/TextViewSourceParser.h \
+	Source/WebCore/html/parser/XSSFilter.cpp \
+	Source/WebCore/html/parser/XSSFilter.h \
+	Source/WebCore/html/shadow/MediaControls.cpp \
+	Source/WebCore/html/shadow/MediaControls.h \
 	Source/WebCore/html/shadow/SliderThumbElement.cpp \
 	Source/WebCore/html/shadow/SliderThumbElement.h \
+	Source/WebCore/html/shadow/ProgressBarValueElement.h \
 	Source/WebCore/html/PasswordInputType.cpp \
 	Source/WebCore/html/PasswordInputType.h \
 	Source/WebCore/html/PluginDocument.cpp \
@@ -1951,6 +1961,8 @@ webcore_sources += \
 	Source/WebCore/inspector/InjectedScript.h \
 	Source/WebCore/inspector/InjectedScriptHost.cpp \
 	Source/WebCore/inspector/InjectedScriptHost.h \
+	Source/WebCore/inspector/InspectorAgent.cpp \
+	Source/WebCore/inspector/InspectorAgent.h \
 	Source/WebCore/inspector/InspectorApplicationCacheAgent.cpp \
 	Source/WebCore/inspector/InspectorApplicationCacheAgent.h \
 	Source/WebCore/inspector/InspectorBrowserDebuggerAgent.cpp \
@@ -1961,10 +1973,12 @@ webcore_sources += \
 	Source/WebCore/inspector/InspectorController.h \
 	Source/WebCore/inspector/InspectorConsoleAgent.cpp \
 	Source/WebCore/inspector/InspectorConsoleAgent.h \
+	Source/WebCore/inspector/InspectorConsoleInstrumentation.h \
 	Source/WebCore/inspector/InspectorCSSAgent.cpp \
 	Source/WebCore/inspector/InspectorCSSAgent.h \
 	Source/WebCore/inspector/InspectorDatabaseAgent.cpp \
 	Source/WebCore/inspector/InspectorDatabaseAgent.h \
+	Source/WebCore/inspector/InspectorDatabaseInstrumentation.h \
 	Source/WebCore/inspector/InspectorDatabaseResource.cpp \
 	Source/WebCore/inspector/InspectorDatabaseResource.h \
 	Source/WebCore/inspector/InspectorDebuggerAgent.cpp \
@@ -1975,8 +1989,6 @@ webcore_sources += \
 	Source/WebCore/inspector/InspectorDOMStorageAgent.h \
 	Source/WebCore/inspector/InspectorDOMStorageResource.cpp \
 	Source/WebCore/inspector/InspectorDOMStorageResource.h \
-	Source/WebCore/inspector/InspectorFileSystemAgent.cpp \
-	Source/WebCore/inspector/InspectorFileSystemAgent.h \
 	Source/WebCore/inspector/InspectorFrontendClient.h \
 	Source/WebCore/inspector/InspectorFrontendClientLocal.cpp \
 	Source/WebCore/inspector/InspectorFrontendClientLocal.h \
@@ -1990,8 +2002,6 @@ webcore_sources += \
 	Source/WebCore/inspector/InspectorResourceAgent.h \
 	Source/WebCore/inspector/InspectorRuntimeAgent.cpp \
 	Source/WebCore/inspector/InspectorRuntimeAgent.h \
-	Source/WebCore/inspector/InspectorSettings.cpp \
-	Source/WebCore/inspector/InspectorSettings.h \
 	Source/WebCore/inspector/InspectorState.cpp \
 	Source/WebCore/inspector/InspectorState.h \
 	Source/WebCore/inspector/InspectorStyleSheet.cpp \
@@ -2003,7 +2013,6 @@ webcore_sources += \
 	Source/WebCore/inspector/InspectorWorkerResource.h \
 	Source/WebCore/inspector/ScriptArguments.cpp \
 	Source/WebCore/inspector/ScriptArguments.h \
-	Source/WebCore/inspector/ScriptBreakpoint.cpp \
 	Source/WebCore/inspector/ScriptBreakpoint.h \
 	Source/WebCore/inspector/ScriptCallFrame.cpp \
 	Source/WebCore/inspector/ScriptCallFrame.h \
@@ -2166,16 +2175,20 @@ webcore_sources += \
 	Source/WebCore/page/animation/KeyframeAnimation.h \
 	Source/WebCore/page/BarInfo.cpp \
 	Source/WebCore/page/BarInfo.h \
-	Source/WebCore/page/ChromeClient.h \
 	Source/WebCore/page/Chrome.cpp \
 	Source/WebCore/page/Chrome.h \
+	Source/WebCore/page/ChromeClient.h \
 	Source/WebCore/page/Console.cpp \
 	Source/WebCore/page/Console.h \
+	Source/WebCore/page/ContentSecurityPolicy.cpp \
+	Source/WebCore/page/ContentSecurityPolicy.h \
 	Source/WebCore/page/ContextMenuClient.h \
 	Source/WebCore/page/ContextMenuController.cpp \
 	Source/WebCore/page/ContextMenuController.h \
 	Source/WebCore/page/ContextMenuProvider.h \
 	Source/WebCore/page/Coordinates.h \
+	Source/WebCore/page/Crypto.cpp \
+	Source/WebCore/page/Crypto.h \
 	Source/WebCore/page/DOMSelection.cpp \
 	Source/WebCore/page/DOMSelection.h \
 	Source/WebCore/page/DOMTimer.cpp \
@@ -2204,9 +2217,9 @@ webcore_sources += \
 	Source/WebCore/page/Geolocation.cpp \
 	Source/WebCore/page/Geolocation.h \
 	Source/WebCore/page/GeolocationClient.h \
-	Source/WebCore/page/GeolocationError.h \
 	Source/WebCore/page/GeolocationController.cpp \
 	Source/WebCore/page/GeolocationController.h \
+	Source/WebCore/page/GeolocationError.h \
 	Source/WebCore/page/GeolocationPosition.h \
 	Source/WebCore/page/GeolocationPositionCache.cpp \
 	Source/WebCore/page/GeolocationPositionCache.h \
@@ -2223,30 +2236,30 @@ webcore_sources += \
 	Source/WebCore/page/MemoryInfo.h \
 	Source/WebCore/page/MouseEventWithHitTestResults.cpp \
 	Source/WebCore/page/MouseEventWithHitTestResults.h \
-	Source/WebCore/page/NavigatorBase.cpp \
-	Source/WebCore/page/NavigatorBase.h \
 	Source/WebCore/page/Navigator.cpp \
 	Source/WebCore/page/Navigator.h \
+	Source/WebCore/page/NavigatorBase.cpp \
+	Source/WebCore/page/NavigatorBase.h \
 	Source/WebCore/page/OriginAccessEntry.cpp \
 	Source/WebCore/page/OriginAccessEntry.h \
 	Source/WebCore/page/Page.cpp \
+	Source/WebCore/page/Page.h \
 	Source/WebCore/page/PageGroup.cpp \
 	Source/WebCore/page/PageGroup.h \
 	Source/WebCore/page/PageGroupLoadDeferrer.cpp \
 	Source/WebCore/page/PageGroupLoadDeferrer.h \
-	Source/WebCore/page/Page.h \
 	Source/WebCore/page/Performance.cpp \
 	Source/WebCore/page/Performance.h \
 	Source/WebCore/page/PerformanceNavigation.cpp \
 	Source/WebCore/page/PerformanceNavigation.h \
 	Source/WebCore/page/PerformanceTiming.cpp \
 	Source/WebCore/page/PerformanceTiming.h \
-	Source/WebCore/page/PluginHalterClient.h \
 	Source/WebCore/page/PluginHalter.cpp \
 	Source/WebCore/page/PluginHalter.h \
+	Source/WebCore/page/PluginHalterClient.h \
 	Source/WebCore/page/PositionCallback.h \
-	Source/WebCore/page/PositionErrorCallback.h \
 	Source/WebCore/page/PositionError.h \
+	Source/WebCore/page/PositionErrorCallback.h \
 	Source/WebCore/page/PositionOptions.h \
 	Source/WebCore/page/PrintContext.cpp \
 	Source/WebCore/page/PrintContext.h \
@@ -2283,8 +2296,6 @@ webcore_sources += \
 	Source/WebCore/page/WindowFeatures.h \
 	Source/WebCore/page/WorkerNavigator.cpp \
 	Source/WebCore/page/WorkerNavigator.h \
-	Source/WebCore/page/XSSAuditor.cpp \
-	Source/WebCore/page/XSSAuditor.h \
 	Source/WebCore/platform/animation/Animation.cpp \
 	Source/WebCore/platform/animation/Animation.h \
 	Source/WebCore/platform/animation/AnimationList.cpp \
@@ -2334,6 +2345,7 @@ webcore_sources += \
 	Source/WebCore/platform/graphics/ContextShadow.cpp \
 	Source/WebCore/platform/graphics/ContextShadow.h \
 	Source/WebCore/platform/graphics/DashArray.h \
+	Source/WebCore/platform/graphics/filters/DistantLightSource.cpp \
 	Source/WebCore/platform/graphics/filters/DistantLightSource.h \
 	Source/WebCore/platform/graphics/filters/FEBlend.cpp \
 	Source/WebCore/platform/graphics/filters/FEBlend.h \
@@ -2372,11 +2384,13 @@ webcore_sources += \
 	Source/WebCore/platform/graphics/filters/Filter.h \
 	Source/WebCore/platform/graphics/filters/LightSource.cpp \
 	Source/WebCore/platform/graphics/filters/LightSource.h \
+	Source/WebCore/platform/graphics/filters/PointLightSource.cpp \
 	Source/WebCore/platform/graphics/filters/PointLightSource.h \
 	Source/WebCore/platform/graphics/filters/SourceAlpha.cpp \
 	Source/WebCore/platform/graphics/filters/SourceAlpha.h \
 	Source/WebCore/platform/graphics/filters/SourceGraphic.cpp \
 	Source/WebCore/platform/graphics/filters/SourceGraphic.h \
+	Source/WebCore/platform/graphics/filters/SpotLightSource.cpp \
 	Source/WebCore/platform/graphics/filters/SpotLightSource.h \
 	Source/WebCore/platform/graphics/FloatPoint3D.cpp \
 	Source/WebCore/platform/graphics/FloatPoint3D.h \
@@ -2402,11 +2416,13 @@ webcore_sources += \
 	Source/WebCore/platform/graphics/FontFamily.h \
 	Source/WebCore/platform/graphics/FontFastPath.cpp \
 	Source/WebCore/platform/graphics/Font.h \
+	Source/WebCore/platform/graphics/FontMetrics.h \
 	Source/WebCore/platform/graphics/FontOrientation.h \
 	Source/WebCore/platform/graphics/FontRenderingMode.h \
 	Source/WebCore/platform/graphics/FontSelector.h \
 	Source/WebCore/platform/graphics/FontSmoothingMode.h \
 	Source/WebCore/platform/graphics/FontTraitsMask.h \
+	Source/WebCore/platform/graphics/FontWidthVariant.h \
 	Source/WebCore/platform/graphics/GeneratedImage.cpp \
 	Source/WebCore/platform/graphics/GeneratedImage.h \
 	Source/WebCore/platform/graphics/Generator.h \
@@ -2609,11 +2625,12 @@ webcore_sources += \
 	Source/WebCore/platform/text/BidiContext.cpp \
 	Source/WebCore/platform/text/BidiContext.h \
 	Source/WebCore/platform/text/BidiResolver.h \
-	Source/WebCore/platform/text/CharacterNames.h \
 	Source/WebCore/platform/text/Hyphenation.cpp \
 	Source/WebCore/platform/text/Hyphenation.h \
 	Source/WebCore/platform/text/LineEnding.cpp \
 	Source/WebCore/platform/text/LineEnding.h \
+	Source/WebCore/platform/text/LocalizedNumber.h \
+	Source/WebCore/platform/text/LocalizedNumberNone.cpp \
 	Source/WebCore/platform/text/ParserUtilities.h \
 	Source/WebCore/platform/text/PlatformString.h \
 	Source/WebCore/platform/text/RegularExpression.cpp \
@@ -2633,6 +2650,8 @@ webcore_sources += \
 	Source/WebCore/platform/text/TextCodecUserDefined.h \
 	Source/WebCore/platform/text/TextCodecUTF16.cpp \
 	Source/WebCore/platform/text/TextCodecUTF16.h \
+	Source/WebCore/platform/text/TextCodecUTF8.cpp \
+	Source/WebCore/platform/text/TextCodecUTF8.h \
 	Source/WebCore/platform/text/TextDirection.h \
 	Source/WebCore/platform/text/TextEncoding.cpp \
 	Source/WebCore/platform/text/TextEncodingDetector.h \
@@ -2655,6 +2674,7 @@ webcore_sources += \
 	Source/WebCore/platform/Timer.cpp \
 	Source/WebCore/platform/Timer.h \
 	Source/WebCore/platform/TreeShared.h \
+	Source/WebCore/platform/URLString.h \
 	Source/WebCore/platform/UUID.cpp \
 	Source/WebCore/platform/UUID.h \
 	Source/WebCore/platform/Widget.cpp \
@@ -2734,6 +2754,8 @@ webcore_sources += \
 	Source/WebCore/rendering/RenderBR.h \
 	Source/WebCore/rendering/RenderButton.cpp \
 	Source/WebCore/rendering/RenderButton.h \
+	Source/WebCore/rendering/RenderCombineText.cpp \
+	Source/WebCore/rendering/RenderCombineText.h \
 	Source/WebCore/rendering/RenderCounter.cpp \
 	Source/WebCore/rendering/RenderCounter.h \
 	Source/WebCore/rendering/RenderDataGrid.cpp \
@@ -3723,8 +3745,6 @@ webcoregtk_sources += \
 	Source/WebCore/platform/gtk/GOwnPtrGtk.h \
 	Source/WebCore/platform/gtk/GRefPtrGtk.cpp \
 	Source/WebCore/platform/gtk/GRefPtrGtk.h \
-	Source/WebCore/platform/gtk/gtk2drawing.c \
-	Source/WebCore/platform/gtk/gtkdrawing.h \
 	Source/WebCore/platform/gtk/GtkPluginWidget.cpp \
 	Source/WebCore/platform/gtk/GtkPluginWidget.h \
 	Source/WebCore/platform/gtk/GtkVersioning.c \
@@ -3799,23 +3819,6 @@ webcoregtk_sources += \
 	Source/WebCore/platform/network/soup/SocketStreamHandleSoup.cpp \
 	Source/WebCore/platform/network/soup/SoupURIUtils.cpp \
 	Source/WebCore/platform/network/soup/SoupURIUtils.h \
-	Source/WebCore/platform/network/soup/cache/soup-directory-input-stream.c \
-	Source/WebCore/platform/network/soup/cache/soup-directory-input-stream.h \
-	Source/WebCore/platform/network/soup/cache/soup-http-input-stream.c \
-	Source/WebCore/platform/network/soup/cache/soup-http-input-stream.h \
-	Source/WebCore/platform/network/soup/cache/soup-request-data.c \
-	Source/WebCore/platform/network/soup/cache/soup-request-data.h \
-	Source/WebCore/platform/network/soup/cache/soup-request-file.c \
-	Source/WebCore/platform/network/soup/cache/soup-request-file.h \
-	Source/WebCore/platform/network/soup/cache/soup-request-http.c \
-	Source/WebCore/platform/network/soup/cache/soup-request-http.h \
-	Source/WebCore/platform/network/soup/cache/soup-request.c \
-	Source/WebCore/platform/network/soup/cache/soup-request.h \
-	Source/WebCore/platform/network/soup/cache/soup-requester.c \
-	Source/WebCore/platform/network/soup/cache/soup-requester.h \
-	Source/WebCore/platform/network/soup/cache/webkit/soup-cache.c \
-	Source/WebCore/platform/network/soup/cache/webkit/soup-cache.h \
-	Source/WebCore/platform/network/soup/cache/webkit/soup-cache-private.h \
 	Source/WebCore/plugins/gtk/PluginDataGtk.cpp \
 	Source/WebCore/plugins/gtk/PluginPackageGtk.cpp \
 	Source/WebCore/plugins/gtk/PluginViewGtk.cpp
@@ -4170,6 +4173,16 @@ endif # END USE_GSTREAMER
 endif # END ENABLE_VIDEO
 
 # ----
+# Media Statistics Support
+# ----
+if ENABLE_MEDIA_STATISTICS
+FEATURE_DEFINES += ENABLE_MEDIA_STATISTICS=1
+webcore_cppflags += -DENABLE_MEDIA_STATISTICS=1
+else
+webcore_cppflags += -DENABLE_MEDIA_STATISTICS=0
+endif # END ENABLE_MEDIA_STATISTICS
+
+# ----
 # Javascript Fullscreen Support
 # ----
 if ENABLE_FULLSCREEN_API
@@ -4652,6 +4665,102 @@ DerivedSources/WebCore/XLinkNames.cpp : $(WebCore)/dom/make_names.pl $(WebCore)/
 if ENABLE_WEB_AUDIO
 FEATURE_DEFINES += ENABLE_WEB_AUDIO=1
 webcore_cppflags += -DENABLE_WEB_AUDIO=1
+webcore_sources += \
+	Source/WebCore/webaudio/AudioBasicProcessorNode.cpp \
+	Source/WebCore/webaudio/AudioBasicProcessorNode.h \
+	Source/WebCore/webaudio/AudioBuffer.cpp \
+	Source/WebCore/webaudio/AudioBuffer.h \
+	Source/WebCore/webaudio/AudioBufferSourceNode.cpp \
+	Source/WebCore/webaudio/AudioBufferSourceNode.h \
+	Source/WebCore/webaudio/AudioChannelMerger.cpp \
+	Source/WebCore/webaudio/AudioChannelMerger.h \
+	Source/WebCore/webaudio/AudioChannelSplitter.cpp \
+	Source/WebCore/webaudio/AudioChannelSplitter.h \
+	Source/WebCore/webaudio/AudioContext.cpp \
+	Source/WebCore/webaudio/AudioContext.h \
+	Source/WebCore/webaudio/AudioDestinationNode.cpp \
+	Source/WebCore/webaudio/AudioDestinationNode.h \
+	Source/WebCore/webaudio/AudioGain.h \
+	Source/WebCore/webaudio/AudioGainNode.cpp \
+	Source/WebCore/webaudio/AudioGainNode.h \
+	Source/WebCore/webaudio/AudioListener.cpp \
+	Source/WebCore/webaudio/AudioListener.h \
+	Source/WebCore/webaudio/AudioNode.cpp \
+	Source/WebCore/webaudio/AudioNode.h \
+	Source/WebCore/webaudio/AudioNodeInput.cpp \
+	Source/WebCore/webaudio/AudioNodeInput.h \
+	Source/WebCore/webaudio/AudioNodeOutput.cpp \
+	Source/WebCore/webaudio/AudioNodeOutput.h \
+	Source/WebCore/webaudio/AudioPannerNode.cpp \
+	Source/WebCore/webaudio/AudioPannerNode.h \
+	Source/WebCore/webaudio/AudioParam.cpp \
+	Source/WebCore/webaudio/AudioParam.h \
+	Source/WebCore/webaudio/AudioProcessingEvent.cpp \
+	Source/WebCore/webaudio/AudioProcessingEvent.h \
+	Source/WebCore/webaudio/AudioSourceNode.h \
+	Source/WebCore/webaudio/BiquadDSPKernel.cpp \
+	Source/WebCore/webaudio/BiquadDSPKernel.h \
+	Source/WebCore/webaudio/BiquadProcessor.cpp \
+	Source/WebCore/webaudio/BiquadProcessor.h \
+	Source/WebCore/webaudio/ConvolverNode.cpp \
+	Source/WebCore/webaudio/ConvolverNode.h \
+	Source/WebCore/webaudio/DelayDSPKernel.cpp \
+	Source/WebCore/webaudio/DelayDSPKernel.h \
+	Source/WebCore/webaudio/DelayNode.cpp \
+	Source/WebCore/webaudio/DelayNode.h \
+	Source/WebCore/webaudio/DelayProcessor.cpp \
+	Source/WebCore/webaudio/DelayProcessor.h \
+	Source/WebCore/webaudio/HighPass2FilterNode.cpp \
+	Source/WebCore/webaudio/HighPass2FilterNode.h \
+	Source/WebCore/webaudio/JavaScriptAudioNode.cpp \
+	Source/WebCore/webaudio/JavaScriptAudioNode.h \
+	Source/WebCore/webaudio/LowPass2FilterNode.cpp \
+	Source/WebCore/webaudio/LowPass2FilterNode.h \
+	Source/WebCore/webaudio/RealtimeAnalyser.cpp \
+	Source/WebCore/webaudio/RealtimeAnalyser.h \
+	Source/WebCore/webaudio/RealtimeAnalyserNode.cpp \
+	Source/WebCore/webaudio/RealtimeAnalyserNode.h
+webcore_built_sources += \
+	DerivedSources/WebCore/JSAudioBuffer.cpp \
+	DerivedSources/WebCore/JSAudioBuffer.h \
+	DerivedSources/WebCore/JSAudioBufferSourceNode.cpp \
+	DerivedSources/WebCore/JSAudioBufferSourceNode.h \
+	DerivedSources/WebCore/JSAudioChannelMerger.cpp \
+	DerivedSources/WebCore/JSAudioChannelMerger.h \
+	DerivedSources/WebCore/JSAudioChannelSplitter.cpp \
+	DerivedSources/WebCore/JSAudioChannelSplitter.h \
+	DerivedSources/WebCore/JSAudioContext.cpp \
+	DerivedSources/WebCore/JSAudioContext.h \
+	DerivedSources/WebCore/JSAudioDestinationNode.cpp \
+	DerivedSources/WebCore/JSAudioDestinationNode.h \
+	DerivedSources/WebCore/JSAudioGain.cpp \
+	DerivedSources/WebCore/JSAudioGain.h \
+	DerivedSources/WebCore/JSAudioGainNode.cpp \
+	DerivedSources/WebCore/JSAudioGainNode.h \
+	DerivedSources/WebCore/JSAudioListener.cpp \
+	DerivedSources/WebCore/JSAudioListener.h \
+	DerivedSources/WebCore/JSAudioNode.cpp \
+	DerivedSources/WebCore/JSAudioNode.h \
+	DerivedSources/WebCore/JSAudioPannerNode.cpp \
+	DerivedSources/WebCore/JSAudioPannerNode.h \
+	DerivedSources/WebCore/JSAudioParam.cpp \
+	DerivedSources/WebCore/JSAudioParam.h \
+	DerivedSources/WebCore/JSAudioProcessingEvent.cpp \
+	DerivedSources/WebCore/JSAudioProcessingEvent.h \
+	DerivedSources/WebCore/JSAudioSourceNode.cpp \
+	DerivedSources/WebCore/JSAudioSourceNode.h \
+	DerivedSources/WebCore/JSConvolverNode.cpp \
+	DerivedSources/WebCore/JSConvolverNode.h \
+	DerivedSources/WebCore/JSDelayNode.cpp \
+	DerivedSources/WebCore/JSDelayNode.h \
+	DerivedSources/WebCore/JSHighPass2FilterNode.cpp \
+	DerivedSources/WebCore/JSHighPass2FilterNode.h \
+	DerivedSources/WebCore/JSJavaScriptAudioNode.cpp \
+	DerivedSources/WebCore/JSJavaScriptAudioNode.h \
+	DerivedSources/WebCore/JSLowPass2FilterNode.cpp \
+	DerivedSources/WebCore/JSLowPass2FilterNode.h \
+	DerivedSources/WebCore/JSRealtimeAnalyserNode.cpp \
+	DerivedSources/WebCore/JSRealtimeAnalyserNode.h
 endif
 
 # ----
@@ -4678,9 +4787,9 @@ endif  # END ENABLE_BLOB
 # ---
 # 3D canvas (WebGL) support
 # ---
-if ENABLE_3D_CANVAS
-FEATURE_DEFINES += ENABLE_3D_CANVAS=1
-webcore_cppflags += -DENABLE_3D_CANVAS=1
+if ENABLE_WEBGL
+FEATURE_DEFINES += ENABLE_WEBGL=1
+webcore_cppflags += -DENABLE_WEBGL=1
 webcore_sources += \
 	Source/WebCore/html/canvas/WebGLActiveInfo.h \
 	Source/WebCore/html/canvas/WebGLBuffer.cpp \
@@ -4707,7 +4816,7 @@ webcore_sources += \
 	Source/WebCore/html/canvas/WebGLTexture.h \
 	Source/WebCore/html/canvas/WebGLUniformLocation.cpp \
 	Source/WebCore/html/canvas/WebGLUniformLocation.h
-endif  # END ENABLE_3D_CANVAS
+endif  # END ENABLE_WEBGL
 
 DerivedSources/WebCore/CSSPropertyNames.cpp: DerivedSources/WebCore/CSSPropertyNames.h
 DerivedSources/WebCore/CSSPropertyNames.h: $(WEBCORE_CSS_PROPERTY_NAMES) $(WebCore)/css/makeprop.pl
@@ -4935,6 +5044,8 @@ EXTRA_DIST += \
 	Source/WebCore/html/parser/HTMLEntityNames.in \
 	Source/WebCore/icu/LICENSE \
 	Source/WebCore/inspector/CodeGeneratorInspector.pm \
+	Source/WebCore/inspector/InjectedScriptSource.js \
+	Source/WebCore/inspector/xxd.pl \
 	Source/WebCore/LICENSE-APPLE \
 	Source/WebCore/LICENSE-LGPL-2 \
 	Source/WebCore/LICENSE-LGPL-2.1 \
diff --git a/Source/WebCore/WebCore.exp.in b/Source/WebCore/WebCore.exp.in
index 250b629..1c71a0f 100644
--- a/Source/WebCore/WebCore.exp.in
+++ b/Source/WebCore/WebCore.exp.in
@@ -215,6 +215,7 @@ __ZN7WebCore11memoryCacheEv
 __ZN7WebCore11toUserSpaceERK7_NSRectP8NSWindow
 __ZN7WebCore11writeToFileEiPKci
 __ZN7WebCore12ChromeClient20paintCustomScrollbarEPNS_15GraphicsContextERKNS_9FloatRectENS_20ScrollbarControlSizeEjNS_13ScrollbarPartEbffj
+__ZN7WebCore12ChromeClient23paintCustomOverhangAreaEPNS_15GraphicsContextERKNS_7IntRectES5_S5_
 __ZN7WebCore12ChromeClient23paintCustomScrollCornerEPNS_15GraphicsContextERKNS_9FloatRectE
 __ZN7WebCore12EditingStyleD1Ev
 __ZN7WebCore12EventHandler10mouseMovedEP7NSEvent
@@ -266,7 +267,7 @@ __ZN7WebCore12PrintContext16computePageRectsERKNS_9FloatRectEfffRfb
 __ZN7WebCore12PrintContext16isPageBoxVisibleEPNS_5FrameEi
 __ZN7WebCore12PrintContext20pageNumberForElementEPNS_7ElementERKNS_9FloatSizeE
 __ZN7WebCore12PrintContext26pageSizeAndMarginsInPixelsEPNS_5FrameEiiiiiii
-__ZN7WebCore12PrintContext27computeAutomaticScaleFactorEf
+__ZN7WebCore12PrintContext27computeAutomaticScaleFactorERKNS_9FloatSizeE
 __ZN7WebCore12PrintContext27spoolAllPagesWithBoundariesEPNS_5FrameERNS_15GraphicsContextERKNS_9FloatSizeE
 __ZN7WebCore12PrintContext28computePageRectsWithPageSizeERKNS_9FloatSizeEb
 __ZN7WebCore12PrintContext3endEv
@@ -343,6 +344,9 @@ __ZN7WebCore14SVGSMILElement13isSMILElementEPNS_4NodeE
 __ZN7WebCore14SchemeRegistry24registerURLSchemeAsLocalERKN3WTF6StringE
 __ZN7WebCore14SchemeRegistry25registerURLSchemeAsSecureERKN3WTF6StringE
 __ZN7WebCore14SchemeRegistry32registerURLSchemeAsEmptyDocumentERKN3WTF6StringE
+__ZN7WebCore14ScrollableArea17willEndLiveResizeEv
+__ZN7WebCore14ScrollableArea19willStartLiveResizeEv
+__ZN7WebCore14ScrollbarTheme11nativeThemeEv
 __ZN7WebCore14SecurityOrigin14threadsafeCopyEv
 __ZN7WebCore14SecurityOrigin16createFromStringERKN3WTF6StringE
 __ZN7WebCore14SecurityOrigin18setLocalLoadPolicyENS0_15LocalLoadPolicyE
@@ -408,7 +412,7 @@ __ZN7WebCore16DeviceMotionData12Acceleration6createEbdbdbd
 __ZN7WebCore16DeviceMotionData12RotationRate6createEbdbdbd
 __ZN7WebCore16DeviceMotionData6createEN3WTF10PassRefPtrINS0_12AccelerationEEES4_NS2_INS0_12RotationRateEEEbd
 __ZN7WebCore16FontFallbackList15releaseFontDataEv
-__ZN7WebCore16FontPlatformDataC1EP6NSFontfbbNS_15FontOrientationE
+__ZN7WebCore16FontPlatformDataC1EP6NSFontfbbNS_15FontOrientationENS_16FontWidthVariantE
 __ZN7WebCore16FontPlatformDataD1Ev
 __ZN7WebCore16HTMLInputElement13setAutofilledEb
 __ZN7WebCore16LegacyWebArchive19createFromSelectionEPNS_5FrameE
@@ -430,10 +434,10 @@ __ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_14NavigationTypeE
 __ZN7WebCore16NavigationActionC1Ev
 __ZN7WebCore16ScriptController10initScriptEPNS_15DOMWrapperWorldE
 __ZN7WebCore16ScriptController11createWorldEv
-__ZN7WebCore16ScriptController13executeScriptERKN3WTF6StringEbNS_14ShouldAllowXSSE
+__ZN7WebCore16ScriptController13executeScriptERKN3WTF6StringEb
 __ZN7WebCore16ScriptController17canExecuteScriptsENS_33ReasonForCallingCanExecuteScriptsE
 __ZN7WebCore16ScriptController18windowScriptObjectEv
-__ZN7WebCore16ScriptController20executeScriptInWorldEPNS_15DOMWrapperWorldERKN3WTF6StringEbNS_14ShouldAllowXSSE
+__ZN7WebCore16ScriptController20executeScriptInWorldEPNS_15DOMWrapperWorldERKN3WTF6StringEb
 __ZN7WebCore16ScriptController24jsObjectForPluginElementEPNS_17HTMLPlugInElementE
 __ZN7WebCore16ThreadGlobalData10staticDataE
 __ZN7WebCore16ThreadGlobalDataC1Ev
@@ -446,7 +450,6 @@ __ZN7WebCore16createFullMarkupEPKNS_5RangeE
 __ZN7WebCore16enclosingIntRectERK7_NSRect
 __ZN7WebCore16enclosingIntRectERKNS_9FloatRectE
 __ZN7WebCore16isEndOfParagraphERKNS_15VisiblePositionENS_27EditingBoundaryCrossingRuleE
-__ZN7WebCore16jsStringSlowCaseEPN3JSC9ExecStateERNS0_9WeakGCMapIPN3WTF10StringImplEPNS0_8JSStringEEES6_
 __ZN7WebCore17CredentialStorage3getERKNS_15ProtectionSpaceE
 __ZN7WebCore17DOMImplementation13isXMLMIMETypeERKN3WTF6StringE
 __ZN7WebCore17DOMImplementation14isTextMIMETypeERKN3WTF6StringE
@@ -535,7 +538,7 @@ __ZN7WebCore23ReplaceSelectionCommandC1EPNS_8DocumentEN3WTF10PassRefPtrINS_16Doc
 __ZN7WebCore23createFragmentFromNodesEPNS_8DocumentERKN3WTF6VectorIPNS_4NodeELm0EEE
 __ZN7WebCore23overrideDefaultLanguageERKN3WTF6StringE
 __ZN7WebCore24BinaryPropertyListWriter17writePropertyListEv
-__ZN7WebCore24DocumentMarkerController13removeMarkersENS_14DocumentMarker10MarkerTypeE
+__ZN7WebCore24DocumentMarkerController13removeMarkersEj
 __ZN7WebCore24DocumentMarkerController14markersForNodeEPNS_4NodeE
 __ZN7WebCore24DocumentMarkerController14markersForNodeEPNS_4NodeE
 __ZN7WebCore24DocumentMarkerController23renderedRectsForMarkersENS_14DocumentMarker10MarkerTypeE
@@ -621,6 +624,7 @@ __ZN7WebCore4FontaSERKS0_
 __ZN7WebCore4Icon18createIconForFilesERKN3WTF6VectorINS1_6StringELm0EEE
 __ZN7WebCore4IconD1Ev
 __ZN7WebCore4KURL10invalidateEv
+__ZN7WebCore4KURLC1ENS_18ParsedURLStringTagEPKc
 __ZN7WebCore4KURLC1ENS_18ParsedURLStringTagERKN3WTF6StringE
 __ZN7WebCore4KURLC1EP5NSURL
 __ZN7WebCore4KURLC1EPK7__CFURL
@@ -751,6 +755,7 @@ __ZN7WebCore6WidgetD2Ev
 __ZN7WebCore6toNodeEN3JSC7JSValueE
 __ZN7WebCore7Console21shouldPrintExceptionsEv
 __ZN7WebCore7Console24setShouldPrintExceptionsEb
+__ZN7WebCore7IntRect5scaleEf
 __ZN7WebCore7IntRect5uniteERKS0_
 __ZN7WebCore7IntRect9intersectERKS0_
 __ZN7WebCore7IntRectC1ERKNS_9FloatRectE
@@ -781,7 +786,6 @@ __ZN7WebCore8GradientC1ERKNS_10FloatPointES3_
 __ZN7WebCore8IntPointC1ERK8_NSPoint
 __ZN7WebCore8PositionC1EN3WTF10PassRefPtrINS_4NodeEEEi
 __ZN7WebCore8Settings14setJavaEnabledEb
-__ZN7WebCore8Settings18setWebAudioEnabledEb
 __ZN7WebCore8Settings15setWebGLEnabledEb
 __ZN7WebCore8Settings16setUsesPageCacheEb
 __ZN7WebCore8Settings17setPluginsEnabledEb
@@ -790,6 +794,7 @@ __ZN7WebCore8Settings18setDefaultFontSizeEi
 __ZN7WebCore8Settings18setFixedFontFamilyERKN3WTF12AtomicStringE
 __ZN7WebCore8Settings18setMinimumFontSizeEi
 __ZN7WebCore8Settings18setSerifFontFamilyERKN3WTF12AtomicStringE
+__ZN7WebCore8Settings18setWebAudioEnabledEb
 __ZN7WebCore8Settings19setShowDebugBordersEb
 __ZN7WebCore8Settings20setCursiveFontFamilyERKN3WTF12AtomicStringE
 __ZN7WebCore8Settings20setFantasyFontFamilyERKN3WTF12AtomicStringE
@@ -867,6 +872,7 @@ __ZN7WebCore9FrameView14setNeedsLayoutEv
 __ZN7WebCore9FrameView14setTransparentEb
 __ZN7WebCore9FrameView15setMarginHeightEi
 __ZN7WebCore9FrameView16setPaintBehaviorEj
+__ZN7WebCore9FrameView17setScrollPositionERKNS_8IntPointE
 __ZN7WebCore9FrameView18updateControlTintsEv
 __ZN7WebCore9FrameView20enterCompositingModeEv
 __ZN7WebCore9FrameView21flushDeferredRepaintsEv
@@ -875,9 +881,9 @@ __ZN7WebCore9FrameView23updateCanHaveScrollbarsEv
 __ZN7WebCore9FrameView24forceLayoutForPaginationERKNS_9FloatSizeEfNS_5Frame19AdjustViewSizeOrNotE
 __ZN7WebCore9FrameView26adjustPageHeightDeprecatedEPffff
 __ZN7WebCore9FrameView29setShouldUpdateWhileOffscreenEb
-__ZN7WebCore9FrameView38syncCompositingStateIncludingSubframesEv
 __ZN7WebCore9FrameView37updateLayoutAndStyleIfNeededRecursiveEv
 __ZN7WebCore9FrameView38scrollPositionChangedViaPlatformWidgetEv
+__ZN7WebCore9FrameView38syncCompositingStateIncludingSubframesEv
 __ZN7WebCore9FrameView6createEPNS_5FrameE
 __ZN7WebCore9FrameView6createEPNS_5FrameERKNS_7IntSizeE
 __ZN7WebCore9HTMLNames10listingTagE
@@ -954,6 +960,10 @@ __ZNK7WebCore10PluginData16supportsMimeTypeERKN3WTF6StringE
 __ZNK7WebCore10RenderText16linesBoundingBoxEv
 __ZNK7WebCore10RenderText9firstRunXEv
 __ZNK7WebCore10RenderText9firstRunYEv
+__ZNK7WebCore10RenderView6docTopEv
+__ZNK7WebCore10RenderView7docLeftEv
+__ZNK7WebCore10RenderView8docRightEv
+__ZNK7WebCore10RenderView9docBottomEv
 __ZNK7WebCore10ScrollView12contentsSizeEv
 __ZNK7WebCore10ScrollView12documentViewEv
 __ZNK7WebCore10ScrollView14scrollbarModesERNS_13ScrollbarModeES2_
@@ -980,6 +990,7 @@ __ZNK7WebCore11HistoryItem12isTargetItemEv
 __ZNK7WebCore11HistoryItem12redirectURLsEv
 __ZNK7WebCore11HistoryItem14alternateTitleEv
 __ZNK7WebCore11HistoryItem15lastVisitedTimeEv
+__ZNK7WebCore11HistoryItem15pageScaleFactorEv
 __ZNK7WebCore11HistoryItem17originalURLStringEv
 __ZNK7WebCore11HistoryItem20getTransientPropertyERKN3WTF6StringE
 __ZNK7WebCore11HistoryItem21encodeBackForwardTreeERN3WTF7EncoderE
@@ -1001,6 +1012,7 @@ __ZNK7WebCore12IconDatabase24shouldStopThreadActivityEv
 __ZNK7WebCore12IconDatabase9isEnabledEv
 __ZNK7WebCore12RenderObject14enclosingLayerEv
 __ZNK7WebCore12RenderObject15localToAbsoluteENS_10FloatPointEbb
+__ZNK7WebCore12RenderObject4viewEv
 __ZNK7WebCore12RenderObject7childAtEj
 __ZNK7WebCore12RenderWidget14windowClipRectEv
 __ZNK7WebCore12SharedBuffer11getSomeDataERPKcj
@@ -1078,6 +1090,7 @@ __ZNK7WebCore19AnimationController24numberOfActiveAnimationsEv
 __ZNK7WebCore19ResourceRequestBase10httpMethodEv
 __ZNK7WebCore19ResourceRequestBase15httpHeaderFieldEPKc
 __ZNK7WebCore19ResourceRequestBase3urlEv
+__ZNK7WebCore19ResourceRequestBase6isNullEv
 __ZNK7WebCore19ResourceRequestBase7isEmptyEv
 __ZNK7WebCore19SelectionController11currentFormEv
 __ZNK7WebCore19SelectionController15copyTypingStyleEv
@@ -1118,6 +1131,7 @@ __ZNK7WebCore4KURL14fileSystemPathEv
 __ZNK7WebCore4KURL17lastPathComponentEv
 __ZNK7WebCore4KURL4hostEv
 __ZNK7WebCore4KURL4pathEv
+__ZNK7WebCore4KURL8protocolEv
 __ZNK7WebCore4KURLcvP5NSURLEv
 __ZNK7WebCore4Node14isDescendantOfEPKS0_
 __ZNK7WebCore4Node18getSubresourceURLsERN3WTF11ListHashSetINS_4KURLELm256ENS_8KURLHashEEE
@@ -1126,6 +1140,7 @@ __ZNK7WebCore4Page10pluginDataEv
 __ZNK7WebCore4Page15backForwardListEv
 __ZNK7WebCore4Page34inLowQualityImageInterpolationModeEv
 __ZNK7WebCore4Page9groupNameEv
+__ZNK7WebCore5Color7getRGBAERdS1_S1_S1_
 __ZNK7WebCore5Frame13ownerRendererEv
 __ZNK7WebCore5Frame14selectionImageEb
 __ZNK7WebCore5Frame15contentRendererEv
@@ -1183,6 +1198,7 @@ __ZNK7WebCore7IntRect8containsERKS0_
 __ZNK7WebCore7IntRectcv6CGRectEv
 __ZNK7WebCore7IntRectcv7_NSRectEv
 __ZNK7WebCore7IntSizecv7_NSSizeEv
+__ZNK7WebCore8Document10renderViewEv
 __ZNK7WebCore8Document11completeURLERKN3WTF6StringE
 __ZNK7WebCore8Document13axObjectCacheEv
 __ZNK7WebCore8Document13nodesFromRectEiijjjjb
@@ -1218,6 +1234,7 @@ __ZTVN7WebCore12ChromeClientE
 __ZTVN7WebCore17FileChooserClientE
 __ZTVN7WebCore17FrameLoaderClientE
 __ZTVN7WebCore25HistoryPropertyListWriterE
+__ZTVN7WebCore28InspectorFrontendClientLocal8SettingsE
 _filenameByFixingIllegalCharacters
 _hasCaseInsensitiveSubstring
 _hasCaseInsensitiveSuffix
@@ -1246,6 +1263,7 @@ _wkGetFontInLanguageForCharacter
 _wkGetFontInLanguageForRange
 _wkGetGlyphTransformedAdvances
 _wkGetGlyphsForCharacters
+_wkGetHTTPPipeliningPriority
 _wkGetHyphenationLocationBeforeIndex
 _wkGetMIMETypeForExtension
 _wkGetNSURLResponseCalculatedExpiration
@@ -1276,6 +1294,7 @@ _wkSetCONNECTProxyAuthorizationForStream
 _wkSetCONNECTProxyForStream
 _wkSetCookieStoragePrivateBrowsingEnabled
 _wkSetDragImage
+_wkSetHTTPPipeliningPriority
 _wkSetNSURLConnectionDefersCallbacks
 _wkSetNSURLRequestShouldContentSniff
 _wkSetPatternBaseCTM
@@ -1286,13 +1305,51 @@ _wkSignalCFReadStreamError
 _wkSignalCFReadStreamHasBytes
 
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+_wkContentAreaDidHide
+_wkContentAreaDidShow
+_wkContentAreaResized
+_wkContentAreaScrolled
+_wkContentAreaWillPaint
 _wkCreateCTTypesetterWithUniCharProviderAndOptions
+_wkHorizontalScrollbarPainterForController
 _wkIOSurfaceContextCreate
 _wkIOSurfaceContextCreateImage
 _wkMakeScrollbarPainter
+_wkMakeScrollbarPainterController
+_wkMakeScrollbarReplacementPainter
+_wkMouseEnteredContentArea
+_wkMouseExitedContentArea
+_wkMouseMovedInContentArea
+_wkScrollbarMinimumThumbLength
+_wkScrollbarMinimumTotalLengthNeededForThumb
+_wkScrollbarPainterIsHorizontal
+_wkScrollbarPainterKnobAlpha
 _wkScrollbarPainterPaint
+_wkScrollbarPainterSetDelegate
+_wkScrollbarPainterSetOverlayState
+_wkScrollbarPainterTrackAlpha
+_wkScrollbarPainterUsesOverlayScrollers
+_wkScrollbarThickness
+_wkSetPainterForPainterController
+_wkSetScrollbarPainterControllerStyle
+_wkSetScrollbarPainterKnobAlpha
+_wkSetScrollbarPainterTrackAlpha
+_wkVerticalScrollbarPainterForController
+_wkWillEndLiveResize
+_wkWillStartLiveResize
 #endif
 
+_wkUnregisterUniqueIdForElement
+_wkAccessibilityHandleFocusChanged
+_wkGetAXTextMarkerTypeID
+_wkGetAXTextMarkerRangeTypeID
+_wkCreateAXTextMarkerRange
+_wkCopyAXTextMarkerRangeStart
+_wkCopyAXTextMarkerRangeEnd 
+_wkCreateAXTextMarker
+_wkGetBytesFromAXTextMarker
+_wkCreateAXUIElementRef
+
 #if ENABLE(3D_RENDERING)
 _WebCoreHas3DRendering
 #endif
@@ -1357,28 +1414,23 @@ __ZN7WebCore22GeolocationServiceMock8setErrorEN3WTF10PassRefPtrINS_13PositionErr
 
 #if ENABLE(INSPECTOR)
 __ZN7WebCore15InspectorClient31doDispatchMessageOnFrontendPageEPNS_4PageERKN3WTF6StringE
-__ZN7WebCore19InspectorController12ConsolePanelE
-__ZN7WebCore19InspectorController12ScriptsPanelE
-__ZN7WebCore19InspectorController13ProfilesPanelE
-__ZN7WebCore19InspectorController21showAndEnableDebuggerEv
-__ZN7WebCore19InspectorController14enableProfilerEbb
-__ZN7WebCore19InspectorController15disableDebuggerEb
-__ZN7WebCore19InspectorController15disableProfilerEb
+__ZN7WebCore19InspectorController14enableProfilerEv
+__ZN7WebCore19InspectorController15debuggerEnabledEv
+__ZN7WebCore19InspectorController15disableDebuggerEv
+__ZN7WebCore19InspectorController15disableProfilerEv
+__ZN7WebCore19InspectorController15profilerEnabledEv
 __ZN7WebCore19InspectorController18disconnectFrontendEv
 __ZN7WebCore19InspectorController20stopTimelineProfilerEv
+__ZN7WebCore19InspectorController21showAndEnableDebuggerEv
+__ZN7WebCore19InspectorController11showConsoleEv
 __ZN7WebCore19InspectorController21startTimelineProfilerEv
-__ZN7WebCore19InspectorController23inspectorStartsAttachedEv
+__ZN7WebCore19InspectorController23timelineProfilerEnabledEv
 __ZN7WebCore19InspectorController25evaluateForTestInFrontendElRKN3WTF6StringE
 __ZN7WebCore19InspectorController26setInspectorFrontendClientEN3WTF10PassOwnPtrINS_23InspectorFrontendClientEEE
-__ZN7WebCore19InspectorController26setInspectorStartsAttachedEb
-__ZN7WebCore19InspectorController27startUserInitiatedProfilingEv
 __ZN7WebCore19InspectorController26stopUserInitiatedProfilingEv
-__ZNK7WebCore19InspectorController31isRecordingUserInitiatedProfileEv
-__ZNK7WebCore19InspectorController15profilerEnabledEv
+__ZN7WebCore19InspectorController27startUserInitiatedProfilingEv
 __ZN7WebCore19InspectorController4showEv
 __ZN7WebCore19InspectorController5closeEv
-__ZN7WebCore19InspectorController7inspectEPNS_4NodeE
-__ZN7WebCore19InspectorController9showPanelERKN3WTF6StringE
 __ZN7WebCore28InspectorFrontendClientLocal12moveWindowByEff
 __ZN7WebCore28InspectorFrontendClientLocal14frontendLoadedEv
 __ZN7WebCore28InspectorFrontendClientLocal15canAttachWindowEv
@@ -1388,10 +1440,10 @@ __ZN7WebCore28InspectorFrontendClientLocal19requestDetachWindowEv
 __ZN7WebCore28InspectorFrontendClientLocal19windowObjectClearedEv
 __ZN7WebCore28InspectorFrontendClientLocal26changeAttachedWindowHeightEj
 __ZN7WebCore28InspectorFrontendClientLocal27restoreAttachedWindowHeightEv
-__ZN7WebCore28InspectorFrontendClientLocalC2EPNS_19InspectorControllerEPNS_4PageE
+__ZN7WebCore28InspectorFrontendClientLocalC2EPNS_19InspectorControllerEPNS_4PageEN3WTF10PassOwnPtrINS0_8SettingsEEE
 __ZN7WebCore28InspectorFrontendClientLocalD2Ev
 __ZNK7WebCore19InspectorController17drawNodeHighlightERNS_15GraphicsContextE
-__ZNK7WebCore19InspectorController7enabledEv
+__ZNK7WebCore19InspectorController31isRecordingUserInitiatedProfileEv
 #endif
 
 #if ENABLE(JAVA_BRIDGE)
@@ -1431,8 +1483,8 @@ __NPN_SetProperty
 __NPN_UTF8FromIdentifier
 __ZN7WebCore16ScriptController20windowScriptNPObjectEv
 __ZN7WebCore16ScriptController29cleanupScriptObjectsForPluginEPv
+__ZN7WebCore16jsStringSlowCaseEPN3JSC9ExecStateERNS0_9WeakGCMapIPN3WTF10StringImplENS0_8JSStringEEES6_
 __ZN7WebCore17HTMLPlugInElement11getNPObjectEv
-__ZNK7WebCore12RenderObject4viewEv
 __ZNK7WebCore14SecurityOrigin9canAccessEPKS0_
 __ZNK7WebCore4KURL10protocolIsEPKc
 __ZNK7WebCore4KURL7hasPathEv
@@ -1686,3 +1738,6 @@ __ZN7WebCore6Editor13uppercaseWordEv
 __ZN7WebCore6Editor14capitalizeWordEv
 #endif
 
+#if ENABLE(GESTURE_EVENTS)
+__ZN7WebCore12EventHandler18handleGestureEventERKNS_20PlatformGestureEventE
+#endif
diff --git a/Source/WebCore/WebCore.gyp/WebCore.gyp b/Source/WebCore/WebCore.gyp/WebCore.gyp
index f96753c..b155b50 100644
--- a/Source/WebCore/WebCore.gyp/WebCore.gyp
+++ b/Source/WebCore/WebCore.gyp/WebCore.gyp
@@ -45,7 +45,9 @@
       },
     },{
       # WebKit is checked out in src/chromium/third_party/WebKit
-      'variables': {'chromium_src_dir': '../../../../..'},
+      'variables': {
+        'chromium_src_dir': '../../../../..',
+      },
     }],
     ['OS == "mac"', {
       'targets': [
@@ -104,6 +106,13 @@
         'cflags!': ['-g'],
       },
     }],
+    ['OS=="linux" and target_arch=="arm"', {
+      # Due to a bug in gcc arm, we get warnings about uninitialized timesNewRoman.unstatic.3258
+      # and colorTransparent.unstatic.4879.
+      'target_defaults': {
+        'cflags': ['-Wno-uninitialized'],
+      },
+    }],
   ],  # conditions
 
   'variables': {
@@ -115,6 +124,10 @@
     # binary and increasing the speed of gdb.
     'enable_svg%': 1,
 
+    # Use v8 as default JavaScript engine. This makes sure that javascript_engine variable
+    # is set for both inside_chromium_build 0 and 1 cases.
+    'javascript_engine%': 'v8',
+
     'webcore_include_dirs': [
       '../',
       '../accessibility',
@@ -248,7 +261,6 @@
           # FIXME: Eliminate dependency on platform/graphics/mac and
           # related directories.
           # platform/graphics/cg may need to stick around, though.
-          '../loader/archive/cf',
           '../platform/audio/mac',
           '../platform/graphics/mac',
           '../platform/mac',
@@ -748,7 +760,7 @@
         'webcore_bindings_sources',
         'inspector_protocol_sources',
         'injected_script_source',
-        '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:pcre',
+        '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:yarr',
         '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:wtf',
         '<(chromium_src_dir)/build/temp_gyp/googleurl.gyp:googleurl',
         '<(chromium_src_dir)/skia/skia.gyp:skia',
@@ -852,12 +864,17 @@
           },
         }],
         # FIXME: (kbr) ideally this target should just depend on webcore_prerequisites
-        # to pick up this include directory, but I'm nervous about making that change.
+        # to pick up these include directories, but I'm nervous about making that change.
         ['(OS=="linux" or OS=="win") and "WTF_USE_WEBAUDIO_MKL=1" in feature_defines', {
           'include_dirs': [
             '<(chromium_src_dir)/third_party/mkl/include',
           ],
         }],
+        ['(OS=="linux" or OS=="win") and "WTF_USE_WEBAUDIO_FFTW=1" in feature_defines', {
+          'include_dirs': [
+            '<(chromium_src_dir)/third_party/fftw/api',
+          ],
+        }],
       ],
     },
     {
@@ -867,7 +884,7 @@
       'type': 'none',
       'dependencies': [
         'webcore_bindings',
-        '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:pcre',
+        '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:yarr',
         '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:wtf',
         '<(chromium_src_dir)/build/temp_gyp/googleurl.gyp:googleurl',
         '<(chromium_src_dir)/skia/skia.gyp:skia',
@@ -884,7 +901,7 @@
       ],
       'export_dependent_settings': [
         'webcore_bindings',
-        '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:pcre',
+        '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:yarr',
         '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:wtf',
         '<(chromium_src_dir)/build/temp_gyp/googleurl.gyp:googleurl',
         '<(chromium_src_dir)/skia/skia.gyp:skia',
@@ -936,9 +953,11 @@
           ],
           'conditions': [
             ['inside_chromium_build==1 and OS=="win" and component=="shared_library"', {
-              'defines': [
-                'USING_V8_SHARED',
-              ],
+              'direct_dependent_settings': {
+                'defines': [
+                  'USING_V8_SHARED',
+                ],
+              },
             }],
           ],
         }],
@@ -959,20 +978,24 @@
             '<(chromium_src_dir)/build/linux/system.gyp:fontconfig',
             '<(chromium_src_dir)/build/linux/system.gyp:gtk',
           ],
-          'cflags': [
-            # WebCore does not work with strict aliasing enabled.
-            # https://bugs.webkit.org/show_bug.cgi?id=25864
-            '-fno-strict-aliasing',
-          ],
+          'direct_dependent_settings': {
+            'cflags': [
+              # WebCore does not work with strict aliasing enabled.
+              # https://bugs.webkit.org/show_bug.cgi?id=25864
+              '-fno-strict-aliasing',
+            ],
+          },
         }],
         ['OS=="linux"', {
-          'defines': [
-            # Mozilla on Linux effectively uses uname -sm, but when running
-            # 32-bit x86 code on an x86_64 processor, it uses
-            # "Linux i686 (x86_64)".  Matching that would require making a
-            # run-time determination.
-            'WEBCORE_NAVIGATOR_PLATFORM="Linux i686"',
-          ],
+          'direct_dependent_settings': {
+            'defines': [
+              # Mozilla on Linux effectively uses uname -sm, but when running
+              # 32-bit x86 code on an x86_64 processor, it uses
+              # "Linux i686 (x86_64)".  Matching that would require making a
+              # run-time determination.
+              'WEBCORE_NAVIGATOR_PLATFORM="Linux i686"',
+            ],
+          },
         }],
         ['OS=="mac"', {
           'dependencies': [
@@ -981,34 +1004,56 @@
           'export_dependent_settings': [
             'webkit_system_interface',
           ],
-          'defines': [
-            # Match Safari and Mozilla on Mac x86.
-            'WEBCORE_NAVIGATOR_PLATFORM="MacIntel"',
-
-            # Chromium's version of WebCore includes the following Objective-C
-            # classes. The system-provided WebCore framework may also provide
-            # these classes. Because of the nature of Objective-C binding
-            # (dynamically at runtime), it's possible for the Chromium-provided
-            # versions to interfere with the system-provided versions.  This may
-            # happen when a system framework attempts to use WebCore.framework,
-            # such as when converting an HTML-flavored string to an
-            # NSAttributedString.  The solution is to force Objective-C class
-            # names that would conflict to use alternate names.
+          'direct_dependent_settings': {
+            'defines': [
+              # Match Safari and Mozilla on Mac x86.
+              'WEBCORE_NAVIGATOR_PLATFORM="MacIntel"',
 
-            # FIXME: This list will hopefully shrink but may also grow.
-            # Periodically run:
-            # nm libwebcore.a | grep -E '[atsATS] ([+-]\[|\.objc_class_name)'
-            # and make sure that everything listed there has the alternate
-            # ChromiumWebCoreObjC name, and that nothing extraneous is listed
-            # here. If all Objective-C can be eliminated from Chromium's WebCore
-            # library, these defines should be removed entirely.
-            'ScrollbarPrefsObserver=ChromiumWebCoreObjCScrollbarPrefsObserver',
-            'WebCoreRenderThemeNotificationObserver=ChromiumWebCoreObjCWebCoreRenderThemeNotificationObserver',
-            'WebFontCache=ChromiumWebCoreObjCWebFontCache',
-          ],
-          'include_dirs': [
-            '../../../WebKitLibraries',
-          ],
+              # Chromium's version of WebCore includes the following Objective-C
+              # classes. The system-provided WebCore framework may also provide
+              # these classes. Because of the nature of Objective-C binding
+              # (dynamically at runtime), it's possible for the
+              # Chromium-provided versions to interfere with the system-provided
+              # versions.  This may happen when a system framework attempts to
+              # use WebCore.framework, such as when converting an HTML-flavored
+              # string to an NSAttributedString.  The solution is to force
+              # Objective-C class names that would conflict to use alternate
+              # names.
+              #
+              # This list will hopefully shrink but may also grow.  Its
+              # performance is monitored by the "Check Objective-C Rename"
+              # postbuild step, and any suspicious-looking symbols not handled
+              # here or whitelisted in that step will cause a build failure.
+              #
+              # If this is unhandled, the console will receive log messages
+              # such as:
+              # com.google.Chrome[] objc[]: Class ScrollbarPrefsObserver is implemented in both .../Google Chrome.app/Contents/Versions/.../Google Chrome Helper.app/Contents/MacOS/../../../Google Chrome Framework.framework/Google Chrome Framework and /System/Library/Frameworks/WebKit.framework/Versions/A/Frameworks/WebCore.framework/Versions/A/WebCore. One of the two will be used. Which one is undefined.
+              'ScrollbarPrefsObserver=ChromiumWebCoreObjCScrollbarPrefsObserver',
+              'WebCoreRenderThemeNotificationObserver=ChromiumWebCoreObjCWebCoreRenderThemeNotificationObserver',
+              'WebFontCache=ChromiumWebCoreObjCWebFontCache',
+            ],
+            'include_dirs': [
+              '../../../WebKitLibraries',
+            ],
+            'postbuilds': [
+              {
+                # This step ensures that any Objective-C names that aren't
+                # redefined to be "safe" above will cause a build failure.
+                'postbuild_name': 'Check Objective-C Rename',
+                'variables': {
+                  'class_whitelist_regex':
+                      'ChromiumWebCoreObjC|TCMVisibleView|RTCMFlippedView',
+                  'category_whitelist_regex':
+                      'TCMInterposing',
+                },
+                'action': [
+                  'mac/check_objc_rename.sh',
+                  '<(class_whitelist_regex)',
+                  '<(category_whitelist_regex)',
+                ],
+              },
+            ],
+          },
         }],
         ['OS=="win"', {
           'dependencies': [
@@ -1017,14 +1062,16 @@
           'export_dependent_settings': [
             '<(chromium_src_dir)/build/win/system.gyp:cygwin'
           ],
-          'defines': [
-            # Match Safari and Mozilla on Windows.
-            'WEBCORE_NAVIGATOR_PLATFORM="Win32"',
-            '__PRETTY_FUNCTION__=__FUNCTION__',
-          ],
-          # This is needed because Event.h in this directory is blocked
-          # by a system header on windows.
-          'include_dirs++': ['../dom'],
+          'direct_dependent_settings': {
+            'defines': [
+              # Match Safari and Mozilla on Windows.
+              'WEBCORE_NAVIGATOR_PLATFORM="Win32"',
+              '__PRETTY_FUNCTION__=__FUNCTION__',
+            ],
+            # This is needed because Event.h in this directory is blocked
+            # by a system header on windows.
+            'include_dirs++': ['../dom'],
+          },
         }],
         ['(OS=="linux" or OS=="win") and "WTF_USE_WEBAUDIO_MKL=1" in feature_defines', {
           # This directory needs to be on the include path for multiple sub-targets of webcore.
@@ -1034,6 +1081,14 @@
             ],
           },
         }],
+        ['(OS=="linux" or OS=="win") and "WTF_USE_WEBAUDIO_FFTW=1" in feature_defines', {
+          # This directory needs to be on the include path for multiple sub-targets of webcore.
+          'direct_dependent_settings': {
+            'include_dirs': [
+              '<(chromium_src_dir)/third_party/fftw/api',
+            ],
+          },
+        }],
       ],
     },
     {
@@ -1096,7 +1151,7 @@
         # Exclude things that don't apply to the Chromium platform on the basis
         # of their enclosing directories and tags at the ends of their
         # filenames.
-        ['exclude', '(android|cairo|cf|cg|curl|gtk|haiku|linux|mac|mkl|opentype|posix|qt|soup|svg|symbian|win|wx)/'],
+        ['exclude', '(android|cairo|cf|cg|curl|fftw|gtk|haiku|linux|mac|mkl|opentype|posix|qt|soup|svg|symbian|win|wx)/'],
         ['exclude', '(?<!Chromium)(Android|Cairo|CF|CG|Curl|Gtk|Linux|Mac|OpenType|POSIX|Posix|Qt|Safari|Soup|Symbian|Win|Wx)\\.(cpp|mm?)$'],
 
         # A few things can't be excluded by patterns.  List them individually.
@@ -1136,10 +1191,6 @@
             '<(chromium_src_dir)/third_party/harfbuzz/harfbuzz.gyp:harfbuzz',
           ],
         }],
-        ['OS=="linux" and target_arch=="arm"', {
-          # Due to a bug in gcc arm, we get warnings about uninitialized timesNewRoman.unstatic.3258
-          'cflags': ['-Wno-uninitialized'],
-        }],
         ['OS=="mac"', {
           # Necessary for Mac .mm stuff.
           'include_dirs': [
@@ -1187,7 +1238,6 @@
             # Some of these are used instead of Chromium platform files, see
             # the specific exclusions in the "sources!" list below.
             ['include', 'rendering/RenderThemeMac\\.mm$'],
-            ['include', 'loader/archive/cf/LegacyWebArchive\\.cpp$'],
             ['include', 'platform/graphics/mac/ColorMac\\.mm$'],
             ['include', 'platform/graphics/mac/FloatPointMac\\.mm$'],
             ['include', 'platform/graphics/mac/FloatRectMac\\.mm$'],
@@ -1270,6 +1320,11 @@
             ['include', 'platform/audio/mkl/FFTFrameMKL\\.cpp$'],
           ],
         }],
+        ['(OS=="linux" or OS=="win") and "WTF_USE_WEBAUDIO_FFTW=1" in feature_defines', {
+          'sources/': [
+            ['include', 'platform/audio/fftw/FFTFrameFFTW\\.cpp$'],
+          ],
+        }],
       ],
     },
     {
@@ -1328,6 +1383,12 @@
         # Don't build IDBKeyPathBackendImpl.  We have our own implementation.
         ['exclude', 'storage/IDBKeyPathBackendImpl\\.cpp$'],
 
+        # Don't build files needed for WebArchive support, since we disable
+        # this feature.
+        ['exclude', 'loader/archive/cf/LegacyWebArchive\\.cpp$'],
+        ['exclude', 'loader/archive/cf/LegacyWebArchiveMac\\.mm$'],
+        ['exclude', 'loader/archive/ArchiveFactory\\.cpp$'],
+
         # Use loader/icon/IconDatabaseNone.cpp instead.
         ['exclude', 'loader/icon/IconDatabase\\.cpp$'],
 
@@ -1418,6 +1479,11 @@
             ['exclude', '/(Windows|Uniscribe)[^/]*\\.cpp$']
           ],
         }],
+        ['javascript_engine=="v8"', {
+          'dependencies': [
+            '<(chromium_src_dir)/v8/src/extensions/experimental/experimental.gyp:i18n_api',
+          ],
+        }],
       ],
     },
     {
@@ -1501,6 +1567,23 @@
             },
           },
         }],
+        ['OS=="linux" and "WTF_USE_WEBAUDIO_FFTW=1" in feature_defines', {
+          # FIXME: (kbr) figure out how to make these dependencies
+          # work in a cross-platform way. Attempts to use
+          # "link_settings" and "libraries" in conjunction with the
+          # msvs-specific settings didn't work so far.
+          'all_dependent_settings': {
+            'ldflags': [
+              # FIXME: (kbr) build the FFTW into PRODUCT_DIR using GYP.
+              '-Lthird_party/fftw/.libs',
+            ],
+            'link_settings': {
+              'libraries': [
+                '-lfftw3f'
+              ],
+            },
+          },
+        }],
         ['enable_svg!=0', {
           'dependencies': [
             'webcore_svg',
diff --git a/Source/WebCore/WebCore.gyp/mac/check_objc_rename.sh b/Source/WebCore/WebCore.gyp/mac/check_objc_rename.sh
new file mode 100755
index 0000000..ed3c119
--- /dev/null
+++ b/Source/WebCore/WebCore.gyp/mac/check_objc_rename.sh
@@ -0,0 +1,79 @@
+#!/bin/bash
+
+#
+# Copyright (C) 2011 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+# This script checks a WebCore static library for potential Objective-C
+# class name collisions with the system's copy of the WebCore framework.
+# See the postbuild action that calls it from ../WebCore.gyp for details.
+
+set -e
+set -o pipefail
+
+if [[ $# -ne 2 ]]; then
+  echo "usage: ${0} class_whitelist_pattern category_whitelist_pattern" >& 2
+  exit 1
+fi
+
+lib="${BUILT_PRODUCTS_DIR}/${FULL_PRODUCT_NAME}"
+nm_pattern='[atsATS] ([+-]\[|\.objc_class_name_)'
+
+class_whitelist_pattern="${1}"
+category_whitelist_pattern="${2}"
+
+# Send nm's stderr in the pipeline to /dev/null to avoid spewing
+# "nm: no name list" messages. This means that if the pipelined nm fails, there
+# won't be any output, so if the entire assignment fails, run nm again to get
+# some output.
+violators=$(nm -p "${lib}" 2> /dev/null | \
+    (grep -E "${nm_pattern}" || true) | \
+    (grep -Ev "${nm_pattern}(${class_whitelist_pattern})" || true) | \
+    (grep -Ev "\((${category_whitelist_pattern})\)" || true)) || nm -p "${lib}"
+
+if [[ -z "${violators}" ]]; then
+  # An empty list means that everything's clean.
+  exit 0
+fi
+
+cat << __EOF__ >&2
+These Objective-C symbols may clash with those provided by the system's own
+WebCore framework:
+${violators}
+
+These symbols were found in:
+${lib}
+
+This should be corrected by adding the appropriate definitions to
+$(dirname ${0})/../WebCore.gyp
+or by updating the whitelist in
+${0}
+__EOF__
+
+exit 1
diff --git a/Source/WebCore/WebCore.gypi b/Source/WebCore/WebCore.gypi
index ca52804..eb8016c 100644
--- a/Source/WebCore/WebCore.gypi
+++ b/Source/WebCore/WebCore.gypi
@@ -245,6 +245,7 @@
             'page/BarInfo.idl',
             'page/Console.idl',
             'page/Coordinates.idl',
+            'page/Crypto.idl',
             'page/DOMSelection.idl',
             'page/DOMWindow.idl',
             'page/EventSource.idl',
@@ -677,6 +678,7 @@
             'bindings/js/JSLocationCustom.h',
             'bindings/js/JSMainThreadExecState.cpp',
             'bindings/js/JSMainThreadExecState.h',
+            'bindings/js/JSMemoryInfoCustom.cpp',
             'bindings/js/JSMessageChannelCustom.cpp',
             'bindings/js/JSMessageEventCustom.cpp',
             'bindings/js/JSMessagePortCustom.cpp',
@@ -893,6 +895,7 @@
             'bindings/v8/DOMDataStore.h',
             'bindings/v8/DOMWrapperWorld.cpp',
             'bindings/v8/DOMWrapperWorld.h',
+            'bindings/v8/IntrusiveDOMWrapperMap.h',
             'bindings/v8/IsolatedWorld.cpp',
             'bindings/v8/IsolatedWorld.h',
             'bindings/v8/JavaScriptCallFrame.cpp',
@@ -1219,6 +1222,8 @@
             'dom/DocumentMarker.h',
             'dom/DocumentMarkerController.cpp',
             'dom/DocumentMarkerController.h',
+            'dom/DocumentOrderedMap.cpp',
+            'dom/DocumentOrderedMap.h',
             'dom/DocumentParser.cpp',
             'dom/DocumentParser.h',
             'dom/DocumentTiming.h',
@@ -1986,6 +1991,8 @@
             'html/parser/HTMLScriptRunner.cpp',
             'html/parser/HTMLScriptRunner.h',
             'html/parser/HTMLScriptRunnerHost.h',
+            'html/parser/HTMLSourceTracker.cpp',
+            'html/parser/HTMLSourceTracker.h',
             'html/parser/HTMLToken.h',
             'html/parser/HTMLTokenizer.cpp',
             'html/parser/HTMLTokenizer.h',
@@ -1998,6 +2005,11 @@
             'html/parser/TextDocumentParser.h',
             'html/parser/TextViewSourceParser.cpp',
             'html/parser/TextViewSourceParser.h',
+            'html/parser/XSSFilter.cpp',
+            'html/parser/XSSFilter.h',
+            'html/shadow/MediaControls.cpp',
+            'html/shadow/MediaControls.h',
+            'html/shadow/ProgressBarValueElement.h',
             'html/shadow/SliderThumbElement.cpp',
             'html/shadow/SliderThumbElement.h',
             'inspector/ConsoleMessage.cpp',
@@ -2006,6 +2018,8 @@
             'inspector/InjectedScript.h',
             'inspector/InjectedScriptHost.cpp',
             'inspector/InjectedScriptHost.h',
+            'inspector/InspectorAgent.cpp',
+            'inspector/InspectorAgent.h',
             'inspector/InspectorApplicationCacheAgent.cpp',
             'inspector/InspectorApplicationCacheAgent.h',
             'inspector/InspectorBrowserDebuggerAgent.cpp',
@@ -2014,12 +2028,14 @@
             'inspector/InspectorClient.h',
             'inspector/InspectorConsoleAgent.cpp',
             'inspector/InspectorConsoleAgent.h',
+            'inspector/InspectorConsoleInstrumentation.h',
             'inspector/InspectorController.cpp',
             'inspector/InspectorController.h',
             'inspector/InspectorCSSAgent.cpp',
             'inspector/InspectorCSSAgent.h',
             'inspector/InspectorDatabaseAgent.cpp',
             'inspector/InspectorDatabaseAgent.h',
+            'inspector/InspectorDatabaseInstrumentation.h',
             'inspector/InspectorDatabaseResource.cpp',
             'inspector/InspectorDatabaseResource.h',
             'inspector/InspectorDebuggerAgent.cpp',
@@ -2030,8 +2046,6 @@
             'inspector/InspectorDOMStorageAgent.h',
             'inspector/InspectorDOMStorageResource.cpp',
             'inspector/InspectorDOMStorageResource.h',
-            'inspector/InspectorFileSystemAgent.cpp',
-            'inspector/InspectorFileSystemAgent.h',
             'inspector/InspectorFrontendClient.h',
             'inspector/InspectorFrontendHost.cpp',
             'inspector/InspectorFrontendHost.h',
@@ -2044,8 +2058,6 @@
             'inspector/InspectorRuntimeAgent.cpp',
             'inspector/InspectorRuntimeAgent.h',
             'inspector/InspectorState.cpp',
-            'inspector/InspectorSettings.h',
-            'inspector/InspectorSettings.cpp',
             'inspector/InspectorState.h',
             'inspector/InspectorStyleSheet.cpp',
             'inspector/InspectorStyleSheet.h',
@@ -2054,7 +2066,6 @@
             'inspector/InspectorValues.cpp',
             'inspector/InspectorValues.h',
             'inspector/InspectorWorkerResource.h',
-            'inspector/ScriptBreakpoint.cpp',
             'inspector/ScriptBreakpoint.h',
             'inspector/ScriptArguments.cpp',
             'inspector/ScriptArguments.h',
@@ -2263,10 +2274,14 @@
             'page/ChromeClient.h',
             'page/Console.cpp',
             'page/Console.h',
+            'page/ContentSecurityPolicy.cpp',
+            'page/ContentSecurityPolicy.h',
             'page/ContextMenuClient.h',
             'page/ContextMenuController.cpp',
             'page/ContextMenuController.h',
             'page/ContextMenuProvider.h',
+            'page/Crypto.cpp',
+            'page/Crypto.h',
             'page/DOMSelection.cpp',
             'page/DOMSelection.h',
             'page/DOMTimer.cpp',
@@ -2373,8 +2388,6 @@
             'page/WindowFeatures.h',
             'page/WorkerNavigator.cpp',
             'page/WorkerNavigator.h',
-            'page/XSSAuditor.cpp',
-            'page/XSSAuditor.h',
             'platform/audio/AudioArray.h',
             'platform/audio/AudioBus.h',
             'platform/audio/AudioBus.cpp',
@@ -2431,6 +2444,7 @@
             'platform/audio/VectorMath.h',
             'platform/audio/VectorMath.cpp',
             'platform/audio/chromium/AudioBusChromium.cpp',
+            'platform/audio/fftw/FFTFrameFFTW.cpp',
             'platform/audio/mac/AudioBusMac.mm',
             'platform/audio/mac/AudioDestinationMac.h',
             'platform/audio/mac/AudioDestinationMac.cpp',
@@ -2580,9 +2594,7 @@
             'platform/graphics/chromium/GraphicsLayerChromium.h',
             'platform/graphics/chromium/HarfbuzzSkia.cpp',
             'platform/graphics/chromium/HarfbuzzSkia.h',
-            'platform/graphics/chromium/IconChromiumLinux.cpp',
-            'platform/graphics/chromium/IconChromiumMac.cpp',
-            'platform/graphics/chromium/IconChromiumWin.cpp',
+            'platform/graphics/chromium/IconChromium.cpp',
             'platform/graphics/chromium/ImageBufferData.h',
             'platform/graphics/chromium/ImageChromium.cpp',
             'platform/graphics/chromium/ImageChromiumMac.mm',
@@ -2622,6 +2634,7 @@
             'platform/graphics/chromium/WebGLLayerChromium.h',
             'platform/graphics/cocoa/FontPlatformData.h',
             'platform/graphics/cocoa/FontPlatformDataCocoa.mm',
+            'platform/graphics/filters/DistantLightSource.cpp',
             'platform/graphics/filters/DistantLightSource.h',
             'platform/graphics/filters/FEBlend.cpp',
             'platform/graphics/filters/FEBlend.h',
@@ -2657,7 +2670,9 @@
             'platform/graphics/filters/FETurbulence.h',
             'platform/graphics/filters/LightSource.cpp',
             'platform/graphics/filters/LightSource.h',
+            'platform/graphics/filters/PointLightSource.cpp',
             'platform/graphics/filters/PointLightSource.h',
+            'platform/graphics/filters/SpotLightSource.cpp',
             'platform/graphics/filters/SpotLightSource.h',
             'platform/graphics/filters/Filter.h',
             'platform/graphics/filters/FilterEffect.cpp',
@@ -2907,6 +2922,7 @@
             'platform/graphics/FontFamily.cpp',
             'platform/graphics/FontFamily.h',
             'platform/graphics/FontFastPath.cpp',
+            'platform/graphics/FontMetrics.h',
             'platform/graphics/FontRenderingMode.h',
             'platform/graphics/FontSelector.h',
             'platform/graphics/FontSmoothingMode.h',
@@ -2956,6 +2972,8 @@
             'platform/graphics/RoundedIntRect.h',
             'platform/graphics/SegmentedFontData.cpp',
             'platform/graphics/SegmentedFontData.h',
+            'platform/graphics/ShadowBlur.cpp',
+            'platform/graphics/ShadowBlur.h',
             'platform/graphics/SimpleFontData.cpp',
             'platform/graphics/SimpleFontData.h',
             'platform/graphics/StringTruncator.cpp',
@@ -3305,11 +3323,12 @@
             'platform/text/BidiContext.cpp',
             'platform/text/BidiContext.h',
             'platform/text/BidiResolver.h',
-            'platform/text/CharacterNames.h',
             'platform/text/Hyphenation.cpp',
             'platform/text/Hyphenation.h',
             'platform/text/LineEnding.cpp',
             'platform/text/LineEnding.h',
+            'platform/text/LocalizedNumber.h',
+            'platform/text/LocalizedNumberNone.cpp',
             'platform/text/ParserUtilities.h',
             'platform/text/PlatformString.h',
             'platform/text/RegularExpression.cpp',
@@ -3333,6 +3352,8 @@
             'platform/text/TextCodecLatin1.h',
             'platform/text/TextCodecUTF16.cpp',
             'platform/text/TextCodecUTF16.h',
+            'platform/text/TextCodecUTF8.cpp',
+            'platform/text/TextCodecUTF8.h',
             'platform/text/TextCodecUserDefined.cpp',
             'platform/text/TextCodecUserDefined.h',
             'platform/text/TextDirection.h',
@@ -3540,6 +3561,7 @@
             'platform/Timer.cpp',
             'platform/Timer.h',
             'platform/TreeShared.h',
+            'platform/URLString.h',
             'platform/UUID.cpp',
             'platform/UUID.h',
             'platform/Widget.cpp',
@@ -3575,6 +3597,8 @@
             'plugins/DOMPlugin.h',
             'plugins/DOMPluginArray.cpp',
             'plugins/DOMPluginArray.h',
+            'plugins/IFrameShimSupport.cpp',
+            'plugins/IFrameShimSupport.h',
             'plugins/PluginData.cpp',
             'plugins/PluginData.h',
             'plugins/PluginDatabase.cpp',
@@ -3814,6 +3838,8 @@
             'rendering/RenderBoxModelObject.h',
             'rendering/RenderButton.cpp',
             'rendering/RenderButton.h',
+            'rendering/RenderCombineText.cpp',
+            'rendering/RenderCombineText.h',
             'rendering/RenderCounter.cpp',
             'rendering/RenderCounter.h',
             'rendering/RenderDataGrid.cpp',
@@ -4047,8 +4073,6 @@
             'storage/IDBSQLiteDatabase.h',
             'storage/IDBSuccessEvent.cpp',
             'storage/IDBSuccessEvent.h',
-            'storage/IDBTimeoutEvent.cpp',
-            'storage/IDBTimeoutEvent.h',
             'storage/IDBTransaction.cpp',
             'storage/IDBTransaction.h',
             'storage/IDBTransactionBackendImpl.cpp',
@@ -4642,7 +4666,6 @@
             'inspector/front-end/BreakpointManager.js',
             'inspector/front-end/BreakpointsSidebarPane.js',
             'inspector/front-end/CallStackSidebarPane.js',
-            'inspector/front-end/ChangesView.js',
             'inspector/front-end/Checkbox.js',
             'inspector/front-end/Color.js',
             'inspector/front-end/ConsolePanel.js',
@@ -4659,6 +4682,7 @@
             'inspector/front-end/DatabaseTableView.js',
             'inspector/front-end/DataGrid.js',
             'inspector/front-end/DebuggerModel.js',
+            'inspector/front-end/DetailedHeapshotView.js',
             'inspector/front-end/DOMAgent.js',
             'inspector/front-end/DOMStorage.js',
             'inspector/front-end/DOMStorageItemsView.js',
@@ -4673,10 +4697,10 @@
             'inspector/front-end/ExtensionPanel.js',
             'inspector/front-end/ExtensionRegistryStub.js',
             'inspector/front-end/ExtensionServer.js',
-            'inspector/front-end/FileSystemView.js',
             'inspector/front-end/FontView.js',
             'inspector/front-end/GoToLineDialog.js',
             'inspector/front-end/HAREntry.js',
+            'inspector/front-end/HeapSnapshot.js',
             'inspector/front-end/HeapSnapshotView.js',
             'inspector/front-end/HelpScreen.js',
             'inspector/front-end/ImageView.js',
@@ -4693,6 +4717,7 @@
             'inspector/front-end/Panel.js',
             'inspector/front-end/PanelEnablerView.js',
             'inspector/front-end/Placard.js',
+            'inspector/front-end/PleaseWaitMessage.js',
             'inspector/front-end/Popover.js',
             'inspector/front-end/ProfileDataGridTree.js',
             'inspector/front-end/ProfilesPanel.js',
@@ -4713,18 +4738,18 @@
             'inspector/front-end/ScriptFormatter.js',
             'inspector/front-end/ScriptFormatterWorker.js',
             'inspector/front-end/ScriptsPanel.js',
-            'inspector/front-end/ScriptView.js',
             'inspector/front-end/ShortcutsHelp.js',
+            'inspector/front-end/ShowMoreDataGridNode.js',
             'inspector/front-end/Section.js',
             'inspector/front-end/Settings.js',
             'inspector/front-end/SidebarPane.js',
             'inspector/front-end/SidebarTreeElement.js',
             'inspector/front-end/SourceCSSTokenizer.js',
             'inspector/front-end/SourceFrame.js',
+            'inspector/front-end/SourceFrameContent.js',
             'inspector/front-end/SourceHTMLTokenizer.js',
             'inspector/front-end/SourceJavaScriptTokenizer.js',
             'inspector/front-end/SourceTokenizer.js',
-            'inspector/front-end/SourceView.js',
             'inspector/front-end/StatusBarButton.js',
             'inspector/front-end/StylesSidebarPane.js',
             'inspector/front-end/SummaryBar.js',
diff --git a/Source/WebCore/WebCore.pri b/Source/WebCore/WebCore.pri
index ad1835f..52e2738 100644
--- a/Source/WebCore/WebCore.pri
+++ b/Source/WebCore/WebCore.pri
@@ -1,5 +1,5 @@
 
-include(../../common.pri)
+include(../common.pri)
 include(features.pri)
 
 CONFIG(standalone_package) {
@@ -308,6 +308,7 @@ IDL_BINDINGS += \
     page/BarInfo.idl \
     page/Console.idl \
     page/Coordinates.idl \
+    page/Crypto.idl \
     page/DOMSelection.idl \
     page/DOMWindow.idl \
     page/EventSource.idl \
diff --git a/Source/WebCore/WebCore.pro b/Source/WebCore/WebCore.pro
index 7b953f3..748c032 100644
--- a/Source/WebCore/WebCore.pro
+++ b/Source/WebCore/WebCore.pro
@@ -79,12 +79,12 @@ symbian: {
 }
 
 isEmpty(OUTPUT_DIR): OUTPUT_DIR = ..
-include($$PWD/../../WebKit.pri)
+include($$PWD/../WebKit.pri)
 
 TEMPLATE = lib
 TARGET = QtWebKit
 
-contains(QT_CONFIG, embedded):CONFIG += embedded
+contains(QT_CONFIG, qpa):CONFIG += embedded
 
 CONFIG(standalone_package) {
     isEmpty(WC_GENERATED_SOURCES_DIR):WC_GENERATED_SOURCES_DIR = $$PWD/generated
@@ -114,9 +114,7 @@ moduleFile=$$PWD/../WebKit/qt/qt_webkit_version.pri
 isEmpty(QT_BUILD_TREE):include($$moduleFile)
 VERSION = $${QT_WEBKIT_MAJOR_VERSION}.$${QT_WEBKIT_MINOR_VERSION}.$${QT_WEBKIT_PATCH_VERSION}
 
-unix {
-    QMAKE_PKGCONFIG_REQUIRES = QtCore QtGui QtNetwork
-}
+unix|win32-g++*:QMAKE_PKGCONFIG_REQUIRES = QtCore QtGui QtNetwork
 
 unix:!mac:*-g++*:QMAKE_CXXFLAGS += -ffunction-sections -fdata-sections 
 unix:!mac:*-g++*:QMAKE_LFLAGS += -Wl,--gc-sections
@@ -339,7 +337,7 @@ SOURCES += \
     bindings/generic/RuntimeEnabledFeatures.cpp
 
 v8 {
-    include($$PWD/../JavaScriptCore/pcre/pcre.pri)
+    include($$PWD/../JavaScriptCore/yarr/yarr.pri)
     include($$PWD/../JavaScriptCore/wtf/wtf.pri)
 
     SOURCES += \
@@ -508,6 +506,7 @@ v8 {
         bindings/js/DOMObjectHashTableMap.cpp \
         bindings/js/DOMWrapperWorld.cpp \
         bindings/js/GCController.cpp \
+        bindings/js/JSArrayBufferCustom.cpp \
         bindings/js/JSAttrCustom.cpp \
         bindings/js/JSCDATASectionCustom.cpp \
         bindings/js/JSCSSFontFaceRuleCustom.cpp \
@@ -542,6 +541,7 @@ v8 {
         bindings/js/JSDOMWrapper.cpp \
         bindings/js/JSDataGridColumnListCustom.cpp \
         bindings/js/JSDataGridDataSource.cpp \
+        bindings/js/JSDataViewCustom.cpp \
         bindings/js/JSDebugWrapperSet.cpp \
         bindings/js/JSDesktopNotificationsCustom.cpp \
         bindings/js/JSDeviceMotionEventCustom.cpp \
@@ -555,6 +555,7 @@ v8 {
         bindings/js/JSEventTarget.cpp \
         bindings/js/JSExceptionBase.cpp \
         bindings/js/JSFileReaderCustom.cpp \
+        bindings/js/JSFloat32ArrayCustom.cpp \
         bindings/js/JSGeolocationCustom.cpp \
         bindings/js/JSHTMLAllCollectionCustom.cpp \
         bindings/js/JSHTMLAppletElementCustom.cpp \
@@ -579,9 +580,13 @@ v8 {
         bindings/js/JSImageDataCustom.cpp \
         bindings/js/JSInjectedScriptHostCustom.cpp \
         bindings/js/JSInspectorFrontendHostCustom.cpp \
+        bindings/js/JSInt16ArrayCustom.cpp \
+        bindings/js/JSInt32ArrayCustom.cpp \
+        bindings/js/JSInt8ArrayCustom.cpp \
         bindings/js/JSLazyEventListener.cpp \
         bindings/js/JSLocationCustom.cpp \
         bindings/js/JSMainThreadExecState.cpp \
+        bindings/js/JSMemoryInfoCustom.cpp \
         bindings/js/JSMessageChannelCustom.cpp \
         bindings/js/JSMessageEventCustom.cpp \
         bindings/js/JSMessagePortCustom.cpp \
@@ -603,6 +608,9 @@ v8 {
         bindings/js/JSTouchCustom.cpp \
         bindings/js/JSTouchListCustom.cpp \
         bindings/js/JSTreeWalkerCustom.cpp \
+        bindings/js/JSUint16ArrayCustom.cpp \
+        bindings/js/JSUint32ArrayCustom.cpp \
+        bindings/js/JSUint8ArrayCustom.cpp \
         bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp \
         bindings/js/JSWebKitCSSKeyframesRuleCustom.cpp \
         bindings/js/JSWebKitCSSMatrixCustom.cpp \
@@ -730,6 +738,7 @@ SOURCES += \
     dom/Document.cpp \
     dom/DocumentFragment.cpp \
     dom/DocumentMarkerController.cpp \
+    dom/DocumentOrderedMap.cpp \
     dom/DocumentParser.cpp \
     dom/DocumentType.cpp \
     dom/DOMImplementation.cpp \
@@ -1015,12 +1024,22 @@ SOURCES += \
     html/ValidationMessage.cpp \
     html/ValidityState.cpp \
     html/WeekInputType.cpp \
+    html/canvas/ArrayBuffer.cpp \
+    html/canvas/ArrayBufferView.cpp \
     html/canvas/CanvasGradient.cpp \
     html/canvas/CanvasPattern.cpp \
     html/canvas/CanvasPixelArray.cpp \
     html/canvas/CanvasRenderingContext.cpp \
     html/canvas/CanvasRenderingContext2D.cpp \
     html/canvas/CanvasStyle.cpp \
+    html/canvas/DataView.cpp \
+    html/canvas/Float32Array.cpp \
+    html/canvas/Int16Array.cpp \
+    html/canvas/Int32Array.cpp \
+    html/canvas/Int8Array.cpp \
+    html/canvas/Uint16Array.cpp \
+    html/canvas/Uint32Array.cpp \
+    html/canvas/Uint8Array.cpp \
     html/parser/CSSPreloadScanner.cpp \
     html/parser/HTMLConstructionSite.cpp \
     html/parser/HTMLDocumentParser.cpp \
@@ -1033,15 +1052,19 @@ SOURCES += \
     html/parser/HTMLParserScheduler.cpp \
     html/parser/HTMLPreloadScanner.cpp \
     html/parser/HTMLScriptRunner.cpp \
+    html/parser/HTMLSourceTracker.cpp \
     html/parser/HTMLTokenizer.cpp \
     html/parser/HTMLTreeBuilder.cpp \
     html/parser/HTMLViewSourceParser.cpp \
     html/parser/TextDocumentParser.cpp \
     html/parser/TextViewSourceParser.cpp \
+    html/parser/XSSFilter.cpp \
+    html/shadow/MediaControls.cpp \
     html/shadow/SliderThumbElement.cpp \
     inspector/ConsoleMessage.cpp \
     inspector/InjectedScript.cpp \
     inspector/InjectedScriptHost.cpp \
+    inspector/InspectorAgent.cpp \
     inspector/InspectorApplicationCacheAgent.cpp \
     inspector/InspectorBrowserDebuggerAgent.cpp \
     inspector/InspectorCSSAgent.cpp \
@@ -1054,24 +1077,20 @@ SOURCES += \
     inspector/InspectorDOMAgent.cpp \
     inspector/InspectorDOMStorageAgent.cpp \
     inspector/InspectorDOMStorageResource.cpp \
-    inspector/InspectorFileSystemAgent.cpp \
     inspector/InspectorFrontendClientLocal.cpp \
     inspector/InspectorFrontendHost.cpp \
     inspector/InspectorInstrumentation.cpp \
     inspector/InspectorProfilerAgent.cpp \
     inspector/InspectorResourceAgent.cpp \
     inspector/InspectorRuntimeAgent.cpp \
-    inspector/InspectorSettings.cpp \
     inspector/InspectorState.cpp \
     inspector/InspectorStyleSheet.cpp \
     inspector/InspectorTimelineAgent.cpp \
     inspector/InspectorValues.cpp \
     inspector/ScriptArguments.cpp \
-    inspector/ScriptBreakpoint.cpp \
     inspector/ScriptCallFrame.cpp \
     inspector/ScriptCallStack.cpp \
     inspector/TimelineRecordFactory.cpp \
-    loader/archive/ArchiveFactory.cpp \
     loader/archive/ArchiveResource.cpp \
     loader/archive/ArchiveResourceCollection.cpp \
     loader/cache/MemoryCache.cpp \
@@ -1125,12 +1144,12 @@ SOURCES += \
     page/BarInfo.cpp \
     page/Chrome.cpp \
     page/Console.cpp \
+    page/ContentSecurityPolicy.cpp \
     page/ContextMenuController.cpp \
+    page/Crypto.cpp \
     page/DOMSelection.cpp \
     page/DOMTimer.cpp \
     page/DOMWindow.cpp \
-    page/Navigator.cpp \
-    page/NavigatorBase.cpp \
     page/DragController.cpp \
     page/EventHandler.cpp \
     page/EventSource.cpp \
@@ -1146,6 +1165,8 @@ SOURCES += \
     page/Location.cpp \
     page/MemoryInfo.cpp \
     page/MouseEventWithHitTestResults.cpp \
+    page/Navigator.cpp \
+    page/NavigatorBase.cpp \
     page/OriginAccessEntry.cpp \
     page/Page.cpp \
     page/PageGroup.cpp \
@@ -1155,14 +1176,13 @@ SOURCES += \
     page/PerformanceTiming.cpp \
     page/PluginHalter.cpp \
     page/PrintContext.cpp \
-    page/SecurityOrigin.cpp \
     page/Screen.cpp \
+    page/SecurityOrigin.cpp \
     page/Settings.cpp \
     page/SpatialNavigation.cpp \
     page/SuspendableTimer.cpp \
     page/UserContentURLPattern.cpp \
     page/WindowFeatures.cpp \
-    page/XSSAuditor.cpp \
     plugins/PluginData.cpp \
     plugins/DOMPluginArray.cpp \
     plugins/DOMPlugin.cpp \
@@ -1175,6 +1195,7 @@ SOURCES += \
     platform/text/Base64.cpp \
     platform/text/BidiContext.cpp \
     platform/text/Hyphenation.cpp \
+    platform/text/LocalizedNumberNone.cpp \
     platform/ContentType.cpp \
     platform/CrossThreadCopier.cpp \
     platform/DeprecatedPtrListImpl.cpp \
@@ -1268,6 +1289,7 @@ SOURCES += \
     platform/text/TextCodecLatin1.cpp \
     platform/text/TextCodecUserDefined.cpp \
     platform/text/TextCodecUTF16.cpp \
+    platform/text/TextCodecUTF8.cpp \
     platform/text/TextEncoding.cpp \
     platform/text/TextEncodingDetectorNone.cpp \
     platform/text/TextEncodingRegistry.cpp \
@@ -1281,6 +1303,7 @@ SOURCES += \
     platform/Widget.cpp \
     platform/PlatformStrategies.cpp \
     platform/LocalizedStrings.cpp \
+    plugins/IFrameShimSupport.cpp \
     plugins/PluginDatabase.cpp \
     plugins/PluginDebug.cpp \
     plugins/PluginPackage.cpp \
@@ -1305,6 +1328,7 @@ SOURCES += \
     rendering/RenderBoxModelObject.cpp \
     rendering/RenderBR.cpp \
     rendering/RenderButton.cpp \
+    rendering/RenderCombineText.cpp \
     rendering/RenderCounter.cpp \
     rendering/RenderDataGrid.cpp \
     rendering/RenderDetails.cpp \
@@ -1492,15 +1516,14 @@ v8 {
         bindings/js/GCController.h \
         bindings/js/DOMObjectHashTableMap.h \
         bindings/js/DOMWrapperWorld.h \
-        bindings/js/JSCallbackData.h \
+        bindings/js/JSArrayBufferViewHelper.h \
         bindings/js/JSAudioConstructor.h \
         bindings/js/JSCSSStyleDeclarationCustom.h \
+        bindings/js/JSCallbackData.h \
         bindings/js/JSCustomPositionCallback.h \
         bindings/js/JSCustomPositionErrorCallback.h \
         bindings/js/JSCustomVoidCallback.h \
         bindings/js/JSCustomXPathNSResolver.h \
-        bindings/js/JSDataGridDataSource.h \
-        bindings/js/JSDebugWrapperSet.h \
         bindings/js/JSDOMBinding.h \
         bindings/js/JSDOMGlobalObject.h \
         bindings/js/JSDOMStringMapCustom.h \
@@ -1508,15 +1531,17 @@ v8 {
         bindings/js/JSDOMWindowCustom.h \
         bindings/js/JSDOMWindowShell.h \
         bindings/js/JSDOMWrapper.h \
+        bindings/js/JSDataGridDataSource.h \
+        bindings/js/JSDebugWrapperSet.h \
         bindings/js/JSErrorHandler.h \
         bindings/js/JSEventListener.h \
         bindings/js/JSEventTarget.h \
-        bindings/js/JSHistoryCustom.h \
         bindings/js/JSHTMLAppletElementCustom.h \
         bindings/js/JSHTMLEmbedElementCustom.h \
         bindings/js/JSHTMLInputElementCustom.h \
         bindings/js/JSHTMLObjectElementCustom.h \
         bindings/js/JSHTMLSelectElementCustom.h \
+        bindings/js/JSHistoryCustom.h \
         bindings/js/JSImageConstructor.h \
         bindings/js/JSLazyEventListener.h \
         bindings/js/JSLocationCustom.h \
@@ -1660,6 +1685,7 @@ HEADERS += \
     dom/DocumentFragment.h \
     dom/DocumentMarker.h \
     dom/DocumentMarkerController.h \
+    dom/DocumentOrderedMap.h \
     dom/DocumentType.h \
     dom/DOMImplementation.h \
     dom/DOMStringList.h \
@@ -1805,12 +1831,22 @@ HEADERS += \
     history/HistoryItem.h \
     history/PageCache.h \
     html/AsyncImageResizer.h \
+    html/canvas/ArrayBuffer.h \
+    html/canvas/ArrayBufferView.h \
     html/canvas/CanvasGradient.h \
     html/canvas/CanvasPattern.h \
     html/canvas/CanvasPixelArray.h \
     html/canvas/CanvasRenderingContext.h \
     html/canvas/CanvasRenderingContext2D.h \
     html/canvas/CanvasStyle.h \
+    html/canvas/DataView.h \
+    html/canvas/Float32Array.h \
+    html/canvas/Int16Array.h \
+    html/canvas/Int32Array.h \
+    html/canvas/Int8Array.h \
+    html/canvas/Uint16Array.h \
+    html/canvas/Uint32Array.h \
+    html/canvas/Uint8Array.h \
     html/ClassList.h \
     html/CollectionCache.h \
     html/DataGridColumn.h \
@@ -1937,20 +1973,23 @@ HEADERS += \
     html/parser/HTMLTokenizer.h \
     html/parser/HTMLTreeBuilder.h \
     html/parser/HTMLViewSourceParser.h \
+    html/parser/XSSFilter.h \
     inspector/ConsoleMessage.h \
     inspector/InjectedScript.h \
     inspector/InjectedScriptHost.h \
+    inspector/InspectorAgent.h \
     inspector/InspectorApplicationCacheAgent.h \
     inspector/InspectorBrowserDebuggerAgent.h \
     inspector/InspectorConsoleAgent.h \
+    inspector/InspectorConsoleInstrumentation.h \
     inspector/InspectorController.h \
     inspector/InspectorCSSAgent.h \
     inspector/InspectorDatabaseAgent.h \
+    inspector/InspectorDatabaseInstrumentation.h \
     inspector/InspectorDatabaseResource.h \
     inspector/InspectorDebuggerAgent.h \
     inspector/InspectorDOMStorageAgent.h \
     inspector/InspectorDOMStorageResource.h \
-    inspector/InspectorFileSystemAgent.h \
     inspector/InspectorFrontendClient.h \
     inspector/InspectorFrontendClientLocal.h \
     inspector/InspectorFrontendHost.h \
@@ -1958,7 +1997,6 @@ HEADERS += \
     inspector/InspectorProfilerAgent.h \
     inspector/InspectorResourceAgent.h \
     inspector/InspectorRuntimeAgent.h \
-    inspector/InspectorSettings.h \
     inspector/InspectorState.h \
     inspector/InspectorStyleSheet.h \
     inspector/InspectorTimelineAgent.h \
@@ -1971,7 +2009,6 @@ HEADERS += \
     loader/appcache/ApplicationCacheStorage.h \
     loader/appcache/DOMApplicationCache.h \
     loader/appcache/ManifestParser.h \
-    loader/archive/ArchiveFactory.h \
     loader/archive/ArchiveResourceCollection.h \
     loader/archive/ArchiveResource.h \
     loader/cache/CachedCSSStyleSheet.h \
@@ -2065,7 +2102,6 @@ HEADERS += \
     page/SpeechInputResultList.h \
     page/WindowFeatures.h \
     page/WorkerNavigator.h \
-    page/XSSAuditor.h \
     platform/animation/Animation.h \
     platform/animation/AnimationList.h \
     platform/Arena.h \
@@ -2117,6 +2153,7 @@ HEADERS += \
     platform/graphics/FontData.h \
     platform/graphics/FontDescription.h \
     platform/graphics/FontFamily.h \
+    platform/graphics/FontMetrics.h \
     platform/graphics/Font.h \
     platform/graphics/GeneratedImage.h \
     platform/graphics/Gradient.h \
@@ -2217,6 +2254,7 @@ HEADERS += \
     platform/text/TextCodecLatin1.h \
     platform/text/TextCodecUserDefined.h \
     platform/text/TextCodecUTF16.h \
+    platform/text/TextCodecUTF8.h \
     platform/text/TextEncoding.h \
     platform/text/TextEncodingRegistry.h \
     platform/text/TextStream.h \
@@ -2235,6 +2273,7 @@ HEADERS += \
     plugins/PluginData.h \
     plugins/PluginDebug.h \
     plugins/DOMPlugin.h \
+    plugins/IFrameShimSupport.h \
     plugins/PluginMainThreadScheduler.h \
     plugins/PluginPackage.h \
     plugins/PluginStream.h \
@@ -2271,6 +2310,7 @@ HEADERS += \
     rendering/RenderBoxModelObject.h \
     rendering/RenderBR.h \
     rendering/RenderButton.h \
+    rendering/RenderCombineText.h \
     rendering/RenderCounter.h \
     rendering/RenderDataGrid.h \
     rendering/RenderDetails.h \
@@ -2663,6 +2703,7 @@ HEADERS += \
     $$PWD/../WebKit/qt/Api/qwebplugindatabase_p.h \
     $$PWD/../WebKit/qt/WebCoreSupport/InspectorServerQt.h \
     $$PWD/../WebKit/qt/WebCoreSupport/QtFallbackWebPopup.h \
+    $$PWD/../WebKit/qt/WebCoreSupport/ChromeClientQt.h \
     $$PWD/../WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h \
     $$PWD/../WebKit/qt/WebCoreSupport/FrameNetworkingContextQt.h \
     $$PWD/../WebKit/qt/WebCoreSupport/GeolocationPermissionClientQt.h \
@@ -2839,14 +2880,20 @@ contains (CONFIG, text_breaking_with_icu) {
     LIBS += -licuuc
 }
 
+symbian {
+    SOURCES += \
+        plugins/symbian/PluginDatabaseSymbian.cpp \
+        plugins/symbian/PluginPackageSymbian.cpp
+
+    LIBS += -lefsrv
+}
+
 contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
 
     SOURCES += plugins/npapi.cpp
 
     symbian {
         SOURCES += \
-        plugins/symbian/PluginPackageSymbian.cpp \
-        plugins/symbian/PluginDatabaseSymbian.cpp \
         plugins/symbian/PluginViewSymbian.cpp \
         plugins/symbian/PluginContainerSymbian.cpp
 
@@ -2854,8 +2901,6 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
         plugins/symbian/PluginContainerSymbian.h \
         plugins/symbian/npinterface.h
 
-        LIBS += -lefsrv
-
     } else {
 
         unix {
@@ -3264,11 +3309,13 @@ contains(DEFINES, ENABLE_VIDEO=1) {
      } else:contains(MOBILITY_CONFIG, multimedia) {
         HEADERS += \ 
             platform/graphics/qt/MediaPlayerPrivateQt.h \
-            $$PWD/../WebKit/qt/WebCoreSupport/FullScreenVideoQt.h
+            $$PWD/../WebKit/qt/WebCoreSupport/FullScreenVideoQt.h \
+            $$PWD/../WebKit/qt/WebCoreSupport/FullScreenVideoWidget.h
 
         SOURCES += \
             platform/graphics/qt/MediaPlayerPrivateQt.cpp \
-            $$PWD/../WebKit/qt/WebCoreSupport/FullScreenVideoQt.cpp
+            $$PWD/../WebKit/qt/WebCoreSupport/FullScreenVideoQt.cpp \
+            $$PWD/../WebKit/qt/WebCoreSupport/FullScreenVideoWidget.cpp
 
         CONFIG *= mobility
         MOBILITY += multimedia
@@ -3334,6 +3381,7 @@ contains(DEFINES, ENABLE_XSLT=1) {
 
 contains(DEFINES, ENABLE_FILTERS=1) {
     SOURCES += \
+        platform/graphics/filters/DistantLightSource.cpp \
         platform/graphics/filters/FEBlend.cpp \
         platform/graphics/filters/FEColorMatrix.cpp \
         platform/graphics/filters/FEComponentTransfer.cpp \
@@ -3352,6 +3400,8 @@ contains(DEFINES, ENABLE_FILTERS=1) {
         platform/graphics/filters/FETurbulence.cpp \
         platform/graphics/filters/FilterEffect.cpp \
         platform/graphics/filters/LightSource.cpp \
+        platform/graphics/filters/PointLightSource.cpp \
+        platform/graphics/filters/SpotLightSource.cpp \
         platform/graphics/filters/SourceAlpha.cpp \
         platform/graphics/filters/SourceGraphic.cpp
 }
@@ -3751,50 +3801,7 @@ contains(DEFINES, ENABLE_WEB_SOCKETS=1) {
     }
 }
 
-contains(DEFINES, ENABLE_BLOB=1) | contains(DEFINES, ENABLE_3D_CANVAS=1) {
-    !v8 {
-        HEADERS += \
-            bindings/js/JSArrayBufferViewHelper.h
-    }
-
-    HEADERS += \
-        html/canvas/ArrayBuffer.h \
-        html/canvas/ArrayBufferView.h \
-        html/canvas/DataView.h \
-        html/canvas/Int8Array.h \
-        html/canvas/Float32Array.h \
-        html/canvas/Int32Array.h \
-        html/canvas/Int16Array.h \
-        html/canvas/Uint8Array.h \
-        html/canvas/Uint32Array.h \
-        html/canvas/Uint16Array.h
-
-    !v8 {
-        SOURCES += \
-            bindings/js/JSArrayBufferCustom.cpp \
-            bindings/js/JSDataViewCustom.cpp \
-            bindings/js/JSInt8ArrayCustom.cpp \
-            bindings/js/JSFloat32ArrayCustom.cpp \
-            bindings/js/JSInt32ArrayCustom.cpp \
-            bindings/js/JSInt16ArrayCustom.cpp \
-            bindings/js/JSUint8ArrayCustom.cpp \
-            bindings/js/JSUint32ArrayCustom.cpp \
-            bindings/js/JSUint16ArrayCustom.cpp
-    }
-    SOURCES += \
-        html/canvas/ArrayBuffer.cpp \
-        html/canvas/ArrayBufferView.cpp \
-        html/canvas/DataView.cpp \
-        html/canvas/Int8Array.cpp \
-        html/canvas/Float32Array.cpp \
-        html/canvas/Int32Array.cpp \
-        html/canvas/Int16Array.cpp \
-        html/canvas/Uint8Array.cpp \
-        html/canvas/Uint32Array.cpp \
-        html/canvas/Uint16Array.cpp
-    }
-
-contains(DEFINES, ENABLE_3D_CANVAS=1) {
+contains(DEFINES, ENABLE_WEBGL=1) {
     tobe|!tobe: QT += opengl
 
     HEADERS += \
diff --git a/Source/WebCore/WebCore.vcproj/QTMovieWinCommon.vsprops b/Source/WebCore/WebCore.vcproj/QTMovieWinCommon.vsprops
index d56a941..9b03fc9 100644
--- a/Source/WebCore/WebCore.vcproj/QTMovieWinCommon.vsprops
+++ b/Source/WebCore/WebCore.vcproj/QTMovieWinCommon.vsprops
@@ -12,7 +12,7 @@
 	/>
 	<Tool
 		Name="VCLinkerTool"
-		AdditionalDependencies="QTMLClient.lib CVClient.lib JavaScriptCore$(WebKitDLLConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"
+		AdditionalDependencies="QTMLClient.lib CVClient.lib JavaScriptCore$(WebKitDLLConfigSuffix).lib WebKitSystemInterface$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"
 		OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"
 		AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QTInternalSDK\Libraries&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"
 		IgnoreDefaultLibraryNames="LIBCMT"
diff --git a/Source/WebCore/WebCore.vcproj/WebCore.make b/Source/WebCore/WebCore.vcproj/WebCore.make
index 7bb6659..1be2edd 100644
--- a/Source/WebCore/WebCore.vcproj/WebCore.make
+++ b/Source/WebCore/WebCore.vcproj/WebCore.make
@@ -9,15 +9,15 @@ install:
 	set WebKitLibrariesDir=$(SRCROOT)\AppleInternal
 	set WebKitOutputDir=$(OBJROOT)
 	set ConfigurationBuildDir=$(OBJROOT)\$(BUILDSTYLE)
-	set WebKitVSPropsRedirectionDir=$(SRCROOT)\AppleInternal\tools\vsprops\OpenSource\1\2\ 
-	-mkdir 2>NUL "%WebKitOutputDir%\include\private\JavaScriptCore"
-	xcopy "%WebKitLibrariesDir%\include\private\JavaScriptCore\*" "%WebKitOutputDir%\include\private\JavaScriptCore" /e/v/i/h/y
+	set WebKitVSPropsRedirectionDir=$(SRCROOT)\AppleInternal\tools\vsprops\OpenSource\1\2\3\ 
+	-mkdir 2>NUL "%ConfigurationBuildDir%\include\private\JavaScriptCore"
+	xcopy "%WebKitLibrariesDir%\include\private\JavaScriptCore\*" "%ConfigurationBuildDir%\include\private\JavaScriptCore" /e/v/i/h/y
 	devenv "WebCore.submit.sln" /rebuild $(BUILDSTYLE)
-	xcopy "$(ConfigurationBuildDir)\include\*" "$(DSTROOT)\AppleInternal\include\" /e/v/i/h/y	
-	xcopy "$(ConfigurationBuildDir)\lib\*" "$(DSTROOT)\AppleInternal\lib\" /e/v/i/h/y	
-	xcopy "$(ConfigurationBuildDir)\bin\WebKit.resources\*" "$(DSTROOT)\AppleInternal\bin\WebKit.resources" /e/v/i/h/y
-	xcopy "$(ConfigurationBuildDir)\obj\WebCore\scripts\*" "$(DSTROOT)\AppleInternal\tools\scripts" /e/v/i/h/y
-	xcopy "$(ConfigurationBuildDir)\bin\*.pdb" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
-	xcopy "$(ConfigurationBuildDir)\bin\*.dll" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
+	xcopy "%ConfigurationBuildDir%\include\*" "$(DSTROOT)\AppleInternal\include\" /e/v/i/h/y	
+	xcopy "%ConfigurationBuildDir%\lib\*" "$(DSTROOT)\AppleInternal\lib\" /e/v/i/h/y	
+	xcopy "%ConfigurationBuildDir%\bin\WebKit.resources\*" "$(DSTROOT)\AppleInternal\bin\WebKit.resources" /e/v/i/h/y
+	xcopy "%ConfigurationBuildDir%\obj\WebCore\scripts\*" "$(DSTROOT)\AppleInternal\tools\scripts" /e/v/i/h/y
+	xcopy "%ConfigurationBuildDir%\bin\*.pdb" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
+	xcopy "%ConfigurationBuildDir%\bin\*.dll" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
 	-mkdir "$(DSTROOT)\AppleInternal\Sources\WebCore"
-	xcopy "$(ConfigurationBuildDir)\obj\WebCore\DerivedSources\*" "$(DSTROOT)\AppleInternal\Sources\WebCore" /e/v/i/h/y
+	xcopy "%ConfigurationBuildDir%\obj\WebCore\DerivedSources\*" "$(DSTROOT)\AppleInternal\Sources\WebCore" /e/v/i/h/y
diff --git a/Source/WebCore/WebCore.vcproj/WebCore.vcproj b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
index f1da922..2a8f340 100755
--- a/Source/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -1754,6 +1754,62 @@
 				>
 			</File>
 			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSCrypto.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_LTCG|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSCrypto.h"
+				>
+			</File>
+			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSCSSCharsetRule.cpp"
 				>
 				<FileConfiguration
@@ -24394,6 +24450,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\page\ContentSecurityPolicy.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\page\ContentSecurityPolicy.h"
+				>
+			</File>
+			<File
 				RelativePath="..\page\ContextMenuClient.h"
 				>
 			</File>
@@ -24414,6 +24478,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\page\Crypto.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\page\Crypto.h"
+				>
+			</File>
+			<File
 				RelativePath="..\page\DOMSelection.cpp"
 				>
 			</File>
@@ -24817,14 +24889,6 @@
 				RelativePath="..\page\WorkerNavigator.h"
 				>
 			</File>
-			<File
-				RelativePath="..\page\XSSAuditor.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\page\XSSAuditor.h"
-				>
-			</File>
 			<Filter
 				Name="win"
 				>
@@ -25738,27 +25802,27 @@
 				>
 			</File>
 			<File
-				RelativePath="..\platform\ScrollAnimator.cpp"
+				RelativePath="..\platform\ScrollableArea.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\platform\ScrollAnimator.h"
+				RelativePath="..\platform\ScrollableArea.h"
 				>
 			</File>
 			<File
-				RelativePath="..\platform\ScrollAnimatorWin.cpp"
+				RelativePath="..\platform\ScrollAnimator.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\platform\ScrollAnimatorWin.h"
+				RelativePath="..\platform\ScrollAnimator.h"
 				>
 			</File>
 			<File
-				RelativePath="..\platform\ScrollableArea.cpp"
+				RelativePath="..\platform\ScrollAnimatorWin.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\platform\ScrollableArea.h"
+				RelativePath="..\platform\ScrollAnimatorWin.h"
 				>
 			</File>
 			<File
@@ -26549,6 +26613,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\graphics\FontMetrics.h"
+					>
+				</File>
+				<File
 					RelativePath="..\platform\graphics\FontRenderingMode.h"
 					>
 				</File>
@@ -26765,6 +26833,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\graphics\ShadowBlur.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\graphics\ShadowBlur.h"
+					>
+				</File>
+				<File
 					RelativePath="..\platform\graphics\SimpleFontData.cpp"
 					>
 				</File>
@@ -28648,6 +28724,10 @@
 					Name="filters"
 					>
 					<File
+						RelativePath="..\platform\graphics\filters\DistantLightSource.cpp"
+						>
+					</File>
+					<File
 						RelativePath="..\platform\graphics\filters\DistantLightSource.h"
 						>
 					</File>
@@ -28800,6 +28880,10 @@
 						>
 					</File>
 					<File
+						RelativePath="..\platform\graphics\filters\PointLightSource.cpp"
+						>
+					</File>
+					<File
 						RelativePath="..\platform\graphics\filters\PointLightSource.h"
 						>
 					</File>
@@ -28820,6 +28904,10 @@
 						>
 					</File>
 					<File
+						RelativePath="..\platform\graphics\filters\SpotLightSource.cpp"
+						>
+					</File>
+					<File
 						RelativePath="..\platform\graphics\filters\SpotLightSource.h"
 						>
 					</File>
@@ -28895,6 +28983,10 @@
 							</FileConfiguration>
 						</File>
 						<File
+							RelativePath="..\platform\graphics\ca\win\CACFLayerTreeHostClient.h"
+							>
+						</File>
+						<File
 							RelativePath="..\platform\graphics\ca\win\LayerChangesFlusher.cpp"
 							>
 							<FileConfiguration
@@ -28935,6 +29027,14 @@
 							</FileConfiguration>
 						</File>
 						<File
+							RelativePath="..\platform\graphics\ca\win\LegacyCACFLayerTreeHost.cpp"
+							>
+						</File>
+						<File
+							RelativePath="..\platform\graphics\ca\win\LegacyCACFLayerTreeHost.h"
+							>
+						</File>
+						<File
 							RelativePath="..\platform\graphics\ca\win\PlatformCAAnimationWin.cpp"
 							>
 						</File>
@@ -28950,6 +29050,14 @@
 							RelativePath="..\platform\graphics\ca\win\PlatformCALayerWinInternal.h"
 							>
 						</File>
+						<File
+							RelativePath="..\platform\graphics\ca\win\WKCACFViewLayerTreeHost.cpp"
+							>
+						</File>
+						<File
+							RelativePath="..\platform\graphics\ca\win\WKCACFViewLayerTreeHost.h"
+							>
+						</File>
 					</Filter>
 				</Filter>
 			</Filter>
@@ -29312,6 +29420,10 @@
 						</FileConfiguration>
 					</File>
 					<File
+						RelativePath="..\platform\network\cf\DownloadBundle.h"
+						>
+					</File>
+					<File
 						RelativePath="..\platform\network\cf\FormDataStreamCFNet.cpp"
 						>
 						<FileConfiguration
@@ -29604,6 +29716,10 @@
 					Name="win"
 					>
 					<File
+						RelativePath="..\platform\network\win\DownloadBundleWin.cpp"
+						>
+					</File>
+					<File
 						RelativePath="..\platform\network\win\NetworkStateNotifierWin.cpp"
 						>
 					</File>
@@ -30157,10 +30273,6 @@
 					>
 				</File>
 				<File
-					RelativePath="..\platform\text\CharacterNames.h"
-					>
-				</File>
-				<File
 					RelativePath="..\platform\text\Hyphenation.h"
 					>
 				</File>
@@ -30173,6 +30285,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\text\LocalizedNumber.h"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\text\LocalizedNumberNone.cpp"
+					>
+				</File>
+				<File
 					RelativePath="..\platform\text\ParserUtilities.h"
 					>
 				</File>
@@ -30325,6 +30445,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\text\TextCodecUTF8.h"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\text\TextCodecUTF8.cpp"
+					>
+				</File>
+				<File
 					RelativePath="..\platform\text\TextCodecUTF16.h"
 					>
 				</File>
@@ -33026,6 +33154,62 @@
 				>
 			</File>
 			<File
+				RelativePath="..\rendering\RenderCombineText.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_LTCG|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\rendering\RenderCombineText.h"
+				>
+			</File>
+			<File
 				RelativePath="..\rendering\RenderCounter.cpp"
 				>
 				<FileConfiguration
@@ -42978,6 +43162,62 @@
 				>
 			</File>
 			<File
+				RelativePath="..\dom\DocumentOrderedMap.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_LTCG|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\dom\DocumentOrderedMap.h"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\DocumentParser.cpp"
 				>
 				<FileConfiguration
@@ -43697,7 +43937,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Debug_All|Win32"
+					Name="Debug_Cairo_CFLite|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43705,7 +43945,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Debug_Cairo_CFLite|Win32"
+					Name="Release_Cairo_CFLite|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43713,7 +43953,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_Cairo_CFLite|Win32"
+					Name="Debug_All|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43721,7 +43961,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Debug_All|Win32"
+					Name="Release_LTCG|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43776,17 +44016,9 @@
 						Name="VCCLCompilerTool"
 					/>
 				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_LTCG|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\dom\EventTarget.h"
+				RelativePath="..\dom\EventQueue.h"
 				>
 			</File>
 			<File
@@ -43809,7 +44041,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Debug_Internal|Win32"
+					Name="Debug_Cairo_CFLite|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43817,7 +44049,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Debug_Cairo|Win32"
+					Name="Release_Cairo_CFLite|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43825,7 +44057,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_Cairo|Win32"
+					Name="Debug_All|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43833,7 +44065,31 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Debug_All|Win32"
+					Name="Release_LTCG|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Internal|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43842,7 +44098,7 @@
 				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\dom\EventQueue.h"
+				RelativePath="..\dom\EventTarget.h"
 				>
 			</File>
 			<File
@@ -50190,6 +50446,22 @@
 				>
 			</File>
 			<File
+				RelativePath="..\html\canvas\ArrayBuffer.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\ArrayBuffer.h"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\ArrayBufferView.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\ArrayBufferView.h"
+				>
+			</File>
+			<File
 				RelativePath="..\html\canvas\CanvasGradient.cpp"
 				>
 			</File>
@@ -50238,6 +50510,70 @@
 				>
 			</File>
 			<File
+				RelativePath="..\html\canvas\DataView.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\DataView.h"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\Float32Array.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\Float32Array.h"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\Int32Array.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\Int32Array.h"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\Int16Array.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\Int16Array.h"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\Int8Array.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\Int8Array.h"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\UInt16Array.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\UInt16Array.h"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\UInt32Array.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\UInt32Array.h"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\UInt8Array.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\UInt8Array.h"
+				>
+			</File>
+			<File
 				RelativePath="..\html\CheckboxInputType.cpp"
 				>
 			</File>
@@ -55433,6 +55769,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\html\parser\HTMLSourceTracker.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\html\parser\HTMLSourceTracker.h"
+					>
+				</File>
+				<File
 					RelativePath="..\html\parser\HTMLToken.h"
 					>
 				</File>
@@ -55480,11 +55824,31 @@
 					RelativePath="..\html\parser\TextViewSourceParser.h"
 					>
 				</File>
+				<File
+					RelativePath="..\html\parser\XSSFilter.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\html\parser\XSSFilter.h"
+					>
+				</File>
 			</Filter>
 			<Filter
 				Name="shadow"
 				>
 				<File
+					RelativePath="..\html\shadow\MediaControls.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\html\shadow\MediaControls.h"
+					>
+				</File>
+				<File
+					RelativePath="..\html\shadow\ProgressBarValueElement.h"
+					>
+				</File>
+				<File
 					RelativePath="..\html\shadow\SliderThumbElement.cpp"
 					>
 				</File>
@@ -60029,6 +60393,58 @@
 					>
 				</File>
 				<File
+					RelativePath="..\bindings\js\JSMemoryInfoCustom.cpp"
+					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_LTCG|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+				</File>
+				<File
 					RelativePath="..\bindings\js\JSMessageChannelCustom.cpp"
 					>
 					<FileConfiguration
@@ -64310,10 +64726,18 @@
 				</File>
 			</Filter>
 			<Filter
-				Name="pcre"
+				Name="yarr"
 				>
 				<File
-					RelativePath="..\ForwardingHeaders\pcre\pcre.h"
+					RelativePath="..\ForwardingHeaders\yarr\Yarr.h"
+					>
+				</File>
+				<File
+					RelativePath="..\ForwardingHeaders\yarr\YarrInterpreter.h"
+					>
+				</File>
+				<File
+					RelativePath="..\ForwardingHeaders\yarr\YarrPattern.h"
 					>
 				</File>
 			</Filter>
@@ -64357,14 +64781,6 @@
 					>
 				</File>
 			</Filter>
-			<Filter
-				Name="wrec"
-				>
-				<File
-					RelativePath="..\ForwardingHeaders\wrec\WREC.h"
-					>
-				</File>
-			</Filter>
 		</Filter>
 		<Filter
 			Name="history"
@@ -65070,6 +65486,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\inspector\InspectorAgent.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\inspector\InspectorAgent.h"
+				>
+			</File>
+			<File
 				RelativePath="..\inspector\InspectorApplicationCacheAgent.cpp"
 				>
 			</File>
@@ -65102,6 +65526,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\inspector\InspectorConsoleInstrumentation.h"
+				>
+			</File>
+			<File
 				RelativePath="..\inspector\InspectorController.cpp"
 				>
 			</File>
@@ -65126,6 +65554,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\inspector\InspectorDatabaseInstrumentation.h"
+				>
+			</File>
+			<File
 				RelativePath="..\inspector\InspectorDatabaseResource.cpp"
 				>
 			</File>
@@ -65166,14 +65598,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\inspector\InspectorFileSystemAgent.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\inspector\InspectorFileSystemAgent.h"
-				>
-			</File>
-			<File
 				RelativePath="..\inspector\InspectorFrontendClient.h"
 				>
 			</File>
@@ -65226,14 +65650,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\inspector\InspectorSettings.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\inspector\InspectorSettings.h"
-				>
-			</File>
-			<File
 				RelativePath="..\inspector\InspectorState.cpp"
 				>
 			</File>
@@ -65278,10 +65694,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\inspector\ScriptBreakpoint.cpp"
-				>
-			</File>
-			<File
 				RelativePath="..\inspector\ScriptBreakpoint.h"
 				>
 			</File>
@@ -65373,10 +65785,6 @@
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\ChangesView.js"
-					>
-				</File>
-				<File
 					RelativePath="..\inspector\front-end\Checkbox.js"
 					>
 				</File>
@@ -65441,6 +65849,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\DetailedHeapshotView.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\DOMAgent.js"
 					>
 				</File>
@@ -65497,10 +65909,6 @@
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\FileSystemView.js"
-					>
-				</File>
-				<File
 					RelativePath="..\inspector\front-end\FontView.js"
 					>
 				</File>
@@ -65521,6 +65929,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\HeapSnapshot.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\HeapSnapshotView.js"
 					>
 				</File>
@@ -65593,10 +66005,18 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\UglifyJS\parse-js.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\Placard.js"
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\PleaseWaitMessage.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\popover.css"
 					>
 				</File>
@@ -65605,6 +66025,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\UglifyJS\process.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\ProfileDataGridTree.js"
 					>
 				</File>
@@ -65681,10 +66105,6 @@
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\ScriptView.js"
-					>
-				</File>
-				<File
 					RelativePath="..\inspector\front-end\Section.js"
 					>
 				</File>
@@ -65697,6 +66117,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\ShowMoreDataGridNode.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\SidebarPane.js"
 					>
 				</File>
@@ -65713,19 +66137,19 @@
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\SourceHTMLTokenizer.js"
+					RelativePath="..\inspector\front-end\SourceFrameContent.js"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\SourceJavaScriptTokenizer.js"
+					RelativePath="..\inspector\front-end\SourceHTMLTokenizer.js"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\SourceTokenizer.js"
+					RelativePath="..\inspector\front-end\SourceJavaScriptTokenizer.js"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\SourceView.js"
+					RelativePath="..\inspector\front-end\SourceTokenizer.js"
 					>
 				</File>
 				<File
@@ -65812,14 +66236,6 @@
 					RelativePath="..\inspector\front-end\WorkersSidebarPane.js"
 					>
 				</File>
-					<File
-					RelativePath="..\inspector\front-end\UglifyJS\parse-js.js"
-					>
-				</File>
-					<File
-					RelativePath="..\inspector\front-end\UglifyJS\process.js"
-					>
-				</File>
 			</Filter>
 		</Filter>
 		<Filter
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj b/Source/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
index 115189d..60bf017 100644
--- a/Source/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
+++ b/Source/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
@@ -85,6 +85,10 @@
 			>
 		</File>
 		<File
+			RelativePath="..\DerivedSources.make"
+			>
+		</File>
+		<File
 			RelativePath=".\migrate-scripts.sh"
 			>
 		</File>
diff --git a/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd b/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
index b3f19c6..3351e60 100755
--- a/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
+++ b/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
@@ -7,13 +7,12 @@ mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\bindings"
 mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\parser"
 mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\runtime"
 mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\masm"
-mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\pcre"
 mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\profiler"
-mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\wrec"
 mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\wtf"
 mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\wtf\text"
 mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\wtf\unicode"
 mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\wtf\unicode\icu"
+mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\yarr"
 
 xcopy /y /d "%ProjectDir%..\config.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%CONFIGURATIONBUILDDIR%\obj\WebCore\DerivedSources\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
@@ -75,12 +74,11 @@ xcopy /y /d "%ProjectDir%..\ForwardingHeaders\bindings\*.h" "%CONFIGURATIONBUILD
 xcopy /y /d "%ProjectDir%..\ForwardingHeaders\parser\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\parser"
 xcopy /y /d "%ProjectDir%..\ForwardingHeaders\runtime\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\runtime"
 xcopy /y /d "%ProjectDir%..\ForwardingHeaders\masm\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\masm"
-xcopy /y /d "%ProjectDir%..\ForwardingHeaders\pcre\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\pcre"
 xcopy /y /d "%ProjectDir%..\ForwardingHeaders\profiler\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\profiler"
-xcopy /y /d "%ProjectDir%..\ForwardingHeaders\wrec\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\wrec"
 xcopy /y /d "%ProjectDir%..\ForwardingHeaders\wtf\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\wtf"
 xcopy /y /d "%ProjectDir%..\ForwardingHeaders\wtf\text\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\wtf\text"
 xcopy /y /d "%ProjectDir%..\ForwardingHeaders\wtf\unicode\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\wtf\unicode"
 xcopy /y /d "%ProjectDir%..\ForwardingHeaders\wtf\unicode\icu\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\wtf\unicode\icu"
+xcopy /y /d "%ProjectDir%..\ForwardingHeaders\yarr\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\yarr"
 
 if exist "%CONFIGURATIONBUILDDIR%\buildfailed" del "%CONFIGURATIONBUILDDIR%\buildfailed"
diff --git a/Source/WebCore/WebCore.xcodeproj/project.pbxproj b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
index 4f01530..fc17927 100644
--- a/Source/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -53,10 +53,8 @@
 		066C77310AB603FD00238CC4 /* RenderFileUploadControl.h in Headers */ = {isa = PBXBuildFile; fileRef = 066C772F0AB603FD00238CC4 /* RenderFileUploadControl.h */; };
 		06E81ED70AB5D5E900C87837 /* LocalCurrentGraphicsContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 06E81ED60AB5D5E900C87837 /* LocalCurrentGraphicsContext.h */; };
 		06E81EEC0AB5DA9700C87837 /* LocalCurrentGraphicsContext.mm in Sources */ = {isa = PBXBuildFile; fileRef = 06E81EEB0AB5DA9700C87837 /* LocalCurrentGraphicsContext.mm */; };
-		0709FC4C1025DED80059CDBA /* AccessibilitySlider.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0709FC4B1025DED80059CDBA /* AccessibilitySlider.cpp */; };
 		0709FC4E1025DEE30059CDBA /* AccessibilitySlider.h in Headers */ = {isa = PBXBuildFile; fileRef = 0709FC4D1025DEE30059CDBA /* AccessibilitySlider.h */; };
 		0735EE6A0F40C5E4004A2604 /* MediaPlayerProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 0735EE690F40C5E4004A2604 /* MediaPlayerProxy.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		07B0113D1032241900FBDC33 /* AccessibilityMediaControls.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 07B0113C1032241900FBDC33 /* AccessibilityMediaControls.cpp */; };
 		07B0113F1032242200FBDC33 /* AccessibilityMediaControls.h in Headers */ = {isa = PBXBuildFile; fileRef = 07B0113E1032242200FBDC33 /* AccessibilityMediaControls.h */; };
 		080081960ED3B2DD00C53BC0 /* WMLAnchorElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 080081940ED3B2DD00C53BC0 /* WMLAnchorElement.cpp */; };
 		080081970ED3B2DD00C53BC0 /* WMLAnchorElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 080081950ED3B2DD00C53BC0 /* WMLAnchorElement.h */; };
@@ -102,6 +100,7 @@
 		083DAEA70F01A7FB00342754 /* RenderTextControlMultiLine.h in Headers */ = {isa = PBXBuildFile; fileRef = 083DAEA30F01A7FB00342754 /* RenderTextControlMultiLine.h */; };
 		083DAEA80F01A7FB00342754 /* RenderTextControlSingleLine.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 083DAEA40F01A7FB00342754 /* RenderTextControlSingleLine.cpp */; };
 		083DAEA90F01A7FB00342754 /* RenderTextControlSingleLine.h in Headers */ = {isa = PBXBuildFile; fileRef = 083DAEA50F01A7FB00342754 /* RenderTextControlSingleLine.h */; };
+		0845680812B90DA600960A9F /* FontMetrics.h in Headers */ = {isa = PBXBuildFile; fileRef = 0845680712B90DA600960A9F /* FontMetrics.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		084A0829128D7867002DB1F1 /* SVGPathSegListPropertyTearOff.h in Headers */ = {isa = PBXBuildFile; fileRef = 084A0828128D7867002DB1F1 /* SVGPathSegListPropertyTearOff.h */; };
 		084AEBE40FB505FA0038483E /* SelectElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 084AEBE20FB505FA0038483E /* SelectElement.cpp */; };
 		084AEBE50FB505FA0038483E /* SelectElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 084AEBE30FB505FA0038483E /* SelectElement.h */; };
@@ -253,6 +252,9 @@
 		0C45342810CDBBFA00869157 /* JSWebGLUniformLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 0C45342610CDBBFA00869157 /* JSWebGLUniformLocation.h */; };
 		0F11A54F0F39233100C37884 /* RenderSelectionInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F11A54E0F39233100C37884 /* RenderSelectionInfo.h */; };
 		0F15DA8A0F3AAEE70000CE47 /* AnimationControllerPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F15DA890F3AAEE70000CE47 /* AnimationControllerPrivate.h */; };
+		0F29C16E1300C2E2002D794E /* AccessibilityAllInOne.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F29C16D1300C2E2002D794E /* AccessibilityAllInOne.cpp */; };
+		0F3DD44F12F5EA1B000D9190 /* ShadowBlur.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F3DD44D12F5EA1B000D9190 /* ShadowBlur.cpp */; };
+		0F3DD45012F5EA1B000D9190 /* ShadowBlur.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F3DD44E12F5EA1B000D9190 /* ShadowBlur.h */; };
 		0F500AAF0F54DB1B00EEF928 /* TransformState.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F500AAE0F54DB1B00EEF928 /* TransformState.h */; };
 		0F500AB10F54DB3100EEF928 /* TransformState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F500AB00F54DB3100EEF928 /* TransformState.cpp */; };
 		0F56028F0E4B76580065B038 /* RenderMarquee.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F56028D0E4B76580065B038 /* RenderMarquee.h */; };
@@ -313,6 +315,8 @@
 		1479FAF4109AE37500DED655 /* RenderRubyText.h in Headers */ = {isa = PBXBuildFile; fileRef = 1479FAEC109AE37500DED655 /* RenderRubyText.h */; };
 		148AFDA50AF58360008CC700 /* ExceptionHandlers.h in Headers */ = {isa = PBXBuildFile; fileRef = 148AFDA30AF58360008CC700 /* ExceptionHandlers.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		148AFDA60AF58360008CC700 /* ExceptionHandlers.mm in Sources */ = {isa = PBXBuildFile; fileRef = 148AFDA40AF58360008CC700 /* ExceptionHandlers.mm */; };
+		14947FFD12F80CD200A0F631 /* DocumentOrderedMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14947FFB12F80CD200A0F631 /* DocumentOrderedMap.cpp */; };
+		14947FFE12F80CD200A0F631 /* DocumentOrderedMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 14947FFC12F80CD200A0F631 /* DocumentOrderedMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14993BE50B2F2B1C0050497F /* FocusController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14993BE30B2F2B1C0050497F /* FocusController.cpp */; };
 		14993BE60B2F2B1C0050497F /* FocusController.h in Headers */ = {isa = PBXBuildFile; fileRef = 14993BE40B2F2B1C0050497F /* FocusController.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14C9A5EA0B3D105F005A0232 /* Settings.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14C9A5E90B3D105F005A0232 /* Settings.cpp */; };
@@ -646,7 +650,6 @@
 		1CF6BE140E9BB4670025E1CD /* ObjCNodeFilterCondition.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1CF6BE120E9BB4670025E1CD /* ObjCNodeFilterCondition.mm */; };
 		1CF6BE150E9BB4670025E1CD /* ObjCNodeFilterCondition.h in Headers */ = {isa = PBXBuildFile; fileRef = 1CF6BE130E9BB4670025E1CD /* ObjCNodeFilterCondition.h */; };
 		1CFAE3230A6D6A3F0032593D /* libobjc.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 1CFAE3220A6D6A3F0032593D /* libobjc.dylib */; };
-		200B190911C277D900DCCD3A /* ScriptBreakpoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 200B190811C277D900DCCD3A /* ScriptBreakpoint.cpp */; };
 		20D629261253690B00081543 /* InspectorInstrumentation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 20D629241253690B00081543 /* InspectorInstrumentation.cpp */; };
 		20D629271253690B00081543 /* InspectorInstrumentation.h in Headers */ = {isa = PBXBuildFile; fileRef = 20D629251253690B00081543 /* InspectorInstrumentation.h */; };
 		228C284510D82500009D0D0E /* ScriptWrappable.h in Headers */ = {isa = PBXBuildFile; fileRef = 228C284410D82500009D0D0E /* ScriptWrappable.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -655,33 +658,17 @@
 		2542F4DA1166C25A00E89A86 /* UserGestureIndicator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2542F4D81166C25A00E89A86 /* UserGestureIndicator.cpp */; };
 		2542F4DB1166C25A00E89A86 /* UserGestureIndicator.h in Headers */ = {isa = PBXBuildFile; fileRef = 2542F4D91166C25A00E89A86 /* UserGestureIndicator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		29489FC712C00F0300D83F0F /* AccessibilityScrollView.h in Headers */ = {isa = PBXBuildFile; fileRef = 29489FC512C00F0300D83F0F /* AccessibilityScrollView.h */; };
-		29489FC812C00F0300D83F0F /* AccessibilityScrollView.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29489FC612C00F0300D83F0F /* AccessibilityScrollView.cpp */; };
-		29A812260FBB9C1D00510293 /* AccessibilityRenderObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A812080FBB9C1D00510293 /* AccessibilityRenderObject.cpp */; };
-		29A812270FBB9C1D00510293 /* AccessibilityTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A812090FBB9C1D00510293 /* AccessibilityTable.cpp */; };
-		29A812280FBB9C1D00510293 /* AccessibilityARIAGrid.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A8120A0FBB9C1D00510293 /* AccessibilityARIAGrid.cpp */; };
-		29A812290FBB9C1D00510293 /* AccessibilityTableRow.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A8120B0FBB9C1D00510293 /* AccessibilityTableRow.cpp */; };
-		29A8122A0FBB9C1D00510293 /* AccessibilityTableCell.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A8120C0FBB9C1D00510293 /* AccessibilityTableCell.cpp */; };
 		29A8122B0FBB9C1D00510293 /* AccessibilityTable.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A8120D0FBB9C1D00510293 /* AccessibilityTable.h */; };
 		29A8122C0FBB9C1D00510293 /* AccessibilityList.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A8120E0FBB9C1D00510293 /* AccessibilityList.h */; };
-		29A8122D0FBB9C1D00510293 /* AccessibilityARIAGridRow.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A8120F0FBB9C1D00510293 /* AccessibilityARIAGridRow.cpp */; };
 		29A8122E0FBB9C1D00510293 /* AccessibilityARIAGridCell.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812100FBB9C1D00510293 /* AccessibilityARIAGridCell.h */; };
-		29A8122F0FBB9C1D00510293 /* AccessibilityList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A812110FBB9C1D00510293 /* AccessibilityList.cpp */; };
-		29A812300FBB9C1D00510293 /* AccessibilityARIAGridCell.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A812120FBB9C1D00510293 /* AccessibilityARIAGridCell.cpp */; };
 		29A812310FBB9C1D00510293 /* AccessibilityTableRow.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812130FBB9C1D00510293 /* AccessibilityTableRow.h */; };
 		29A812320FBB9C1D00510293 /* AccessibilityTableCell.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812140FBB9C1D00510293 /* AccessibilityTableCell.h */; };
 		29A812330FBB9C1D00510293 /* AccessibilityARIAGridRow.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812150FBB9C1D00510293 /* AccessibilityARIAGridRow.h */; };
-		29A812350FBB9C1D00510293 /* AccessibilityTableColumn.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A812170FBB9C1D00510293 /* AccessibilityTableColumn.cpp */; };
 		29A812360FBB9C1D00510293 /* AccessibilityObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812180FBB9C1D00510293 /* AccessibilityObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		29A812370FBB9C1D00510293 /* AXObjectCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A812190FBB9C1D00510293 /* AXObjectCache.cpp */; };
 		29A812380FBB9C1D00510293 /* AXObjectCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A8121A0FBB9C1D00510293 /* AXObjectCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		29A812390FBB9C1D00510293 /* AccessibilityRenderObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A8121B0FBB9C1D00510293 /* AccessibilityRenderObject.h */; };
-		29A8123A0FBB9C1D00510293 /* AccessibilityImageMapLink.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A8121C0FBB9C1D00510293 /* AccessibilityImageMapLink.cpp */; };
 		29A8123B0FBB9C1D00510293 /* AccessibilityImageMapLink.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A8121D0FBB9C1D00510293 /* AccessibilityImageMapLink.h */; };
-		29A8123C0FBB9C1D00510293 /* AccessibilityObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A8121E0FBB9C1D00510293 /* AccessibilityObject.cpp */; };
-		29A8123D0FBB9C1D00510293 /* AccessibilityListBoxOption.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A8121F0FBB9C1D00510293 /* AccessibilityListBoxOption.cpp */; };
-		29A8123E0FBB9C1D00510293 /* AccessibilityListBox.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A812200FBB9C1D00510293 /* AccessibilityListBox.cpp */; };
 		29A8123F0FBB9C1D00510293 /* AccessibilityTableHeaderContainer.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812210FBB9C1D00510293 /* AccessibilityTableHeaderContainer.h */; };
-		29A812400FBB9C1D00510293 /* AccessibilityTableHeaderContainer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A812220FBB9C1D00510293 /* AccessibilityTableHeaderContainer.cpp */; };
 		29A812410FBB9C1D00510293 /* AccessibilityTableColumn.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812230FBB9C1D00510293 /* AccessibilityTableColumn.h */; };
 		29A812420FBB9C1D00510293 /* AccessibilityListBoxOption.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812240FBB9C1D00510293 /* AccessibilityListBoxOption.h */; };
 		29A812430FBB9C1D00510293 /* AccessibilityListBox.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812250FBB9C1D00510293 /* AccessibilityListBox.h */; };
@@ -873,8 +860,6 @@
 		37F818FD0D657606005E1F05 /* WebCoreURLResponse.h in Headers */ = {isa = PBXBuildFile; fileRef = 37F818FB0D657606005E1F05 /* WebCoreURLResponse.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		37F818FE0D657606005E1F05 /* WebCoreURLResponse.mm in Sources */ = {isa = PBXBuildFile; fileRef = 37F818FC0D657606005E1F05 /* WebCoreURLResponse.mm */; };
 		37FD4298118368460093C029 /* TreeDepthLimit.h in Headers */ = {isa = PBXBuildFile; fileRef = 37FD4297118368460093C029 /* TreeDepthLimit.h */; };
-		3888F6EE128C9889000CA8E0 /* InspectorFileSystemAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3888F6EC128C9889000CA8E0 /* InspectorFileSystemAgent.cpp */; };
-		3888F6EF128C9889000CA8E0 /* InspectorFileSystemAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 3888F6ED128C9889000CA8E0 /* InspectorFileSystemAgent.h */; };
 		3AC648B2129E146500C3EB25 /* EditingBoundary.h in Headers */ = {isa = PBXBuildFile; fileRef = 3AC648B1129E146500C3EB25 /* EditingBoundary.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		41002CCD0F66EDEF009E660D /* ScriptFunctionCall.h in Headers */ = {isa = PBXBuildFile; fileRef = 41002CCB0F66EDEF009E660D /* ScriptFunctionCall.h */; };
 		41002CCE0F66EDEF009E660D /* ScriptFunctionCall.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41002CCC0F66EDEF009E660D /* ScriptFunctionCall.cpp */; };
@@ -888,6 +873,8 @@
 		4138D3361244054800323D33 /* EventContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4138D3341244054800323D33 /* EventContext.cpp */; };
 		4150F9F112B6E0E70008C860 /* SliderThumbElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 4150F9EF12B6E0E70008C860 /* SliderThumbElement.h */; };
 		4150F9F212B6E0E70008C860 /* SliderThumbElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4150F9F012B6E0E70008C860 /* SliderThumbElement.cpp */; };
+		4157AF8012F1FB0400A8C6F5 /* MediaControls.h in Headers */ = {isa = PBXBuildFile; fileRef = 4157AF7E12F1FB0400A8C6F5 /* MediaControls.h */; };
+		4157AF8112F1FB0400A8C6F5 /* MediaControls.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4157AF7F12F1FB0400A8C6F5 /* MediaControls.cpp */; };
 		4162A450101145AE00DFF3ED /* DedicatedWorkerContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4162A44D101145AE00DFF3ED /* DedicatedWorkerContext.cpp */; };
 		4162A451101145AE00DFF3ED /* DedicatedWorkerContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 4162A44E101145AE00DFF3ED /* DedicatedWorkerContext.h */; };
 		4162A454101145E300DFF3ED /* JSDedicatedWorkerContextCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4162A453101145E300DFF3ED /* JSDedicatedWorkerContextCustom.cpp */; };
@@ -1264,6 +1251,8 @@
 		4E19592E0A39DACC00220FE5 /* MediaQueryExp.h in Headers */ = {isa = PBXBuildFile; fileRef = 4E1959280A39DACC00220FE5 /* MediaQueryExp.h */; };
 		4F1534DE11B532EC0021FD86 /* EditingBehavior.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F1534DD11B532EC0021FD86 /* EditingBehavior.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4F1534E011B533020021FD86 /* EditingBehaviorTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F1534DF11B533020021FD86 /* EditingBehaviorTypes.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		4F2D205412EAE7B3005C2874 /* InspectorAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F2D205212EAE7B3005C2874 /* InspectorAgent.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		4F2D205512EAE7B3005C2874 /* InspectorAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F2D205312EAE7B3005C2874 /* InspectorAgent.cpp */; };
 		4F3289B511A42AAB005ABE7E /* InspectorValues.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F3289B311A42AAB005ABE7E /* InspectorValues.cpp */; };
 		4F3289B611A42AAB005ABE7E /* InspectorValues.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F3289B411A42AAB005ABE7E /* InspectorValues.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4F4F5FFB11CBD2E100A186BF /* InspectorFrontend.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F4F5FFA11CBD2D200A186BF /* InspectorFrontend.cpp */; };
@@ -1657,8 +1646,6 @@
 		7A1F2B52126C61B20006A7E6 /* InspectorClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A1F2B51126C61B20006A7E6 /* InspectorClient.cpp */; };
 		7A24587B1021EAF4000A00AA /* InspectorDOMAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A2458791021EAF4000A00AA /* InspectorDOMAgent.cpp */; };
 		7A24587C1021EAF4000A00AA /* InspectorDOMAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A24587A1021EAF4000A00AA /* InspectorDOMAgent.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		7A5640BF12DF9E5E00F4536D /* InspectorSettings.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A5640BD12DF9E5E00F4536D /* InspectorSettings.cpp */; };
-		7A5640C012DF9E5E00F4536D /* InspectorSettings.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A5640BE12DF9E5E00F4536D /* InspectorSettings.h */; };
 		7A674BDB0F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A674BD90F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp */; };
 		7A674BDC0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A674BDA0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h */; };
 		7A74ECBA101839A600BF939E /* InspectorDOMStorageAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A74ECB8101839A500BF939E /* InspectorDOMStorageAgent.cpp */; };
@@ -2762,7 +2749,6 @@
 		8FAC774D119872CB0015AE94 /* JSMainThreadExecState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8F934D841189F1EE00508D5D /* JSMainThreadExecState.cpp */; };
 		9001774012E0347800648462 /* OESStandardDerivatives.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9001773D12E0347800648462 /* OESStandardDerivatives.cpp */; };
 		9001774112E0347800648462 /* OESStandardDerivatives.h in Headers */ = {isa = PBXBuildFile; fileRef = 9001773E12E0347800648462 /* OESStandardDerivatives.h */; };
-		9001774212E0347800648462 /* OESStandardDerivatives.idl in Resources */ = {isa = PBXBuildFile; fileRef = 9001773F12E0347800648462 /* OESStandardDerivatives.idl */; };
 		9001788012E0370700648462 /* JSOESStandardDerivatives.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9001787E12E0370700648462 /* JSOESStandardDerivatives.cpp */; };
 		9001788112E0370700648462 /* JSOESStandardDerivatives.h in Headers */ = {isa = PBXBuildFile; fileRef = 9001787F12E0370700648462 /* JSOESStandardDerivatives.h */; };
 		9302B0BD0D79F82900C7EE83 /* PageGroup.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9302B0BC0D79F82900C7EE83 /* PageGroup.cpp */; };
@@ -2859,6 +2845,8 @@
 		933A14AA0B7D1D0900A53FFD /* DOMTextEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = 933A14A90B7D1D0900A53FFD /* DOMTextEvent.mm */; };
 		933A14B80B7D1D5200A53FFD /* JSTextEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 933A14B60B7D1D5200A53FFD /* JSTextEvent.cpp */; };
 		933A14B90B7D1D5200A53FFD /* JSTextEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 933A14B70B7D1D5200A53FFD /* JSTextEvent.h */; };
+		9343CB8112F25E510033C5EE /* TextCodecUTF8.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9343CB7F12F25E510033C5EE /* TextCodecUTF8.cpp */; };
+		9343CB8212F25E510033C5EE /* TextCodecUTF8.h in Headers */ = {isa = PBXBuildFile; fileRef = 9343CB8012F25E510033C5EE /* TextCodecUTF8.h */; };
 		93442C9E0D2B335C00338FF9 /* HTMLTableRowsCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = 93442C9D0D2B335C00338FF9 /* HTMLTableRowsCollection.h */; };
 		93442CA00D2B336000338FF9 /* HTMLTableRowsCollection.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93442C9F0D2B336000338FF9 /* HTMLTableRowsCollection.cpp */; };
 		934907E4125BBBC8007F23A0 /* GraphicsContextCG.h in Headers */ = {isa = PBXBuildFile; fileRef = 934907E3125BBBC8007F23A0 /* GraphicsContextCG.h */; };
@@ -2940,7 +2928,6 @@
 		93C441EF0F813A1A00C1A634 /* CollectionCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93C441ED0F813A1A00C1A634 /* CollectionCache.cpp */; };
 		93C441F00F813A1A00C1A634 /* CollectionCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 93C441EE0F813A1A00C1A634 /* CollectionCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93C442000F813AE100C1A634 /* CollectionType.h in Headers */ = {isa = PBXBuildFile; fileRef = 93C441FF0F813AE100C1A634 /* CollectionType.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		93C4F6EA1108F9A50099D0DB /* AccessibilityScrollbar.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93C4F6E81108F9A50099D0DB /* AccessibilityScrollbar.cpp */; };
 		93C4F6EB1108F9A50099D0DB /* AccessibilityScrollbar.h in Headers */ = {isa = PBXBuildFile; fileRef = 93C4F6E91108F9A50099D0DB /* AccessibilityScrollbar.h */; };
 		93C841F809CE855C00DFF5E5 /* DOMImplementationFront.h in Headers */ = {isa = PBXBuildFile; fileRef = 93C841F709CE855C00DFF5E5 /* DOMImplementationFront.h */; };
 		93C841FF09CE858300DFF5E5 /* DOMImplementationFront.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93C841FE09CE858300DFF5E5 /* DOMImplementationFront.cpp */; };
@@ -3030,6 +3017,7 @@
 		97059978107D975200A50A7C /* PolicyCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 97059974107D975200A50A7C /* PolicyCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97059979107D975200A50A7C /* PolicyChecker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97059975107D975200A50A7C /* PolicyChecker.cpp */; };
 		9705997A107D975200A50A7C /* PolicyChecker.h in Headers */ = {isa = PBXBuildFile; fileRef = 97059976107D975200A50A7C /* PolicyChecker.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		971491DA12FD65E8001BFEB1 /* URLString.h in Headers */ = {isa = PBXBuildFile; fileRef = 971491D912FD65E8001BFEB1 /* URLString.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97205AAF123928CA00B17380 /* FTPDirectoryDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97205AAD123928CA00B17380 /* FTPDirectoryDocument.cpp */; };
 		97205AB0123928CA00B17380 /* FTPDirectoryDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = 97205AAE123928CA00B17380 /* FTPDirectoryDocument.h */; };
 		97205AB51239291000B17380 /* ImageDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97205AB11239291000B17380 /* ImageDocument.cpp */; };
@@ -3044,6 +3032,10 @@
 		973889A1116EA9DC00ADF313 /* DocumentWriter.h in Headers */ = {isa = PBXBuildFile; fileRef = 9738899F116EA9DC00ADF313 /* DocumentWriter.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		973E325610883B7C005BC493 /* ResourceLoadNotifier.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 973E325410883B7C005BC493 /* ResourceLoadNotifier.cpp */; };
 		973E325710883B7C005BC493 /* ResourceLoadNotifier.h in Headers */ = {isa = PBXBuildFile; fileRef = 973E325510883B7C005BC493 /* ResourceLoadNotifier.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		975CA28A130365F800E99AD9 /* Crypto.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 975CA287130365F800E99AD9 /* Crypto.cpp */; };
+		975CA28B130365F800E99AD9 /* Crypto.h in Headers */ = {isa = PBXBuildFile; fileRef = 975CA288130365F800E99AD9 /* Crypto.h */; };
+		975CA2A11303679D00E99AD9 /* JSCrypto.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 975CA29F1303679D00E99AD9 /* JSCrypto.cpp */; };
+		975CA2A21303679D00E99AD9 /* JSCrypto.h in Headers */ = {isa = PBXBuildFile; fileRef = 975CA2A01303679D00E99AD9 /* JSCrypto.h */; };
 		976D6C77122B8A3D001FD1F7 /* AsyncFileWriter.h in Headers */ = {isa = PBXBuildFile; fileRef = 976D6C58122B8A3D001FD1F7 /* AsyncFileWriter.h */; };
 		976D6C78122B8A3D001FD1F7 /* Blob.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 976D6C59122B8A3D001FD1F7 /* Blob.cpp */; };
 		976D6C79122B8A3D001FD1F7 /* Blob.h in Headers */ = {isa = PBXBuildFile; fileRef = 976D6C5A122B8A3D001FD1F7 /* Blob.h */; };
@@ -3096,6 +3088,10 @@
 		977B3878122883E900B81FF8 /* HTMLTokenizer.h in Headers */ = {isa = PBXBuildFile; fileRef = 977B385F122883E900B81FF8 /* HTMLTokenizer.h */; };
 		977B3879122883E900B81FF8 /* HTMLViewSourceParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 977B3860122883E900B81FF8 /* HTMLViewSourceParser.cpp */; };
 		977B387A122883E900B81FF8 /* HTMLViewSourceParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 977B3861122883E900B81FF8 /* HTMLViewSourceParser.h */; };
+		977E2DCD12F0E28300C13379 /* HTMLSourceTracker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 977E2DCB12F0E28300C13379 /* HTMLSourceTracker.cpp */; };
+		977E2DCE12F0E28300C13379 /* HTMLSourceTracker.h in Headers */ = {isa = PBXBuildFile; fileRef = 977E2DCC12F0E28300C13379 /* HTMLSourceTracker.h */; };
+		977E2E0E12F0FC9C00C13379 /* XSSFilter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 977E2E0B12F0FC9C00C13379 /* XSSFilter.cpp */; };
+		977E2E0F12F0FC9C00C13379 /* XSSFilter.h in Headers */ = {isa = PBXBuildFile; fileRef = 977E2E0C12F0FC9C00C13379 /* XSSFilter.h */; };
 		979F43D31075E44A0000F83B /* NavigationScheduler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 979F43D11075E44A0000F83B /* NavigationScheduler.cpp */; };
 		979F43D41075E44A0000F83B /* NavigationScheduler.h in Headers */ = {isa = PBXBuildFile; fileRef = 979F43D21075E44A0000F83B /* NavigationScheduler.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97BC84831236FD93000C6161 /* TextDocumentParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC84811236FD93000C6161 /* TextDocumentParser.cpp */; };
@@ -3106,10 +3102,10 @@
 		97BC84B312371180000C6161 /* TextDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC84B112371180000C6161 /* TextDocument.cpp */; };
 		97BC84B412371180000C6161 /* TextDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC84B212371180000C6161 /* TextDocument.h */; };
 		97C078501165D5BE003A32EF /* SuffixTree.h in Headers */ = {isa = PBXBuildFile; fileRef = 97C0784F1165D5BE003A32EF /* SuffixTree.h */; };
+		97C471DB12F925BD0086354B /* ContentSecurityPolicy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97C471D912F925BC0086354B /* ContentSecurityPolicy.cpp */; };
+		97C471DC12F925BD0086354B /* ContentSecurityPolicy.h in Headers */ = {isa = PBXBuildFile; fileRef = 97C471DA12F925BD0086354B /* ContentSecurityPolicy.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97DCE20110807C750057D394 /* HistoryController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97DCE1FF10807C750057D394 /* HistoryController.cpp */; };
 		97DCE20210807C750057D394 /* HistoryController.h in Headers */ = {isa = PBXBuildFile; fileRef = 97DCE20010807C750057D394 /* HistoryController.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		97DD4D860FDF4D6E00ECF9A4 /* XSSAuditor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97DD4D840FDF4D6D00ECF9A4 /* XSSAuditor.cpp */; };
-		97DD4D870FDF4D6E00ECF9A4 /* XSSAuditor.h in Headers */ = {isa = PBXBuildFile; fileRef = 97DD4D850FDF4D6E00ECF9A4 /* XSSAuditor.h */; };
 		97EF7DFE107E55B700D7C49C /* ScriptControllerBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97EF7DFD107E55B700D7C49C /* ScriptControllerBase.cpp */; };
 		9B417064125662B3006B28FC /* ApplyBlockElementCommand.h in Headers */ = {isa = PBXBuildFile; fileRef = 9B417062125662B3006B28FC /* ApplyBlockElementCommand.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9B417065125662B3006B28FC /* ApplyBlockElementCommand.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9B417063125662B3006B28FC /* ApplyBlockElementCommand.cpp */; };
@@ -3132,6 +3128,7 @@
 		9FA37EFB1172FDA600C4CD55 /* JSScriptProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 9FA37EF71172FD9300C4CD55 /* JSScriptProfile.h */; };
 		9FA37EFC1172FDA600C4CD55 /* JSScriptProfileNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9FA37EF81172FD9300C4CD55 /* JSScriptProfileNode.cpp */; };
 		9FA37EFD1172FDA600C4CD55 /* JSScriptProfileNode.h in Headers */ = {isa = PBXBuildFile; fileRef = 9FA37EF91172FD9300C4CD55 /* JSScriptProfileNode.h */; };
+		9FDC8FF212FAB0060099AB1C /* JSMemoryInfoCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9FDC8FF112FAB0060099AB1C /* JSMemoryInfoCustom.cpp */; };
 		9FFE3E7A11B59C5D0037874E /* MemoryInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9FFE3E7811B59C5D0037874E /* MemoryInfo.cpp */; };
 		9FFE3E7B11B59C5D0037874E /* MemoryInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 9FFE3E7911B59C5D0037874E /* MemoryInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9FFE3EA511B5A4390037874E /* JSMemoryInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9FFE3EA311B5A4390037874E /* JSMemoryInfo.cpp */; };
@@ -3141,6 +3138,9 @@
 		A136A00D1134DBD200CC8D50 /* XMLHttpRequestProgressEventThrottle.h in Headers */ = {isa = PBXBuildFile; fileRef = A136A00B1134DBD200CC8D50 /* XMLHttpRequestProgressEventThrottle.h */; };
 		A17C81220F2A5CF7005DAAEB /* HTMLElementFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A17C81200F2A5CF7005DAAEB /* HTMLElementFactory.cpp */; };
 		A17C81230F2A5CF7005DAAEB /* HTMLElementFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = A17C81210F2A5CF7005DAAEB /* HTMLElementFactory.h */; };
+		A1E1154413015C3D0054AC8C /* DistantLightSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1E1154313015C3D0054AC8C /* DistantLightSource.cpp */; };
+		A1E1154613015C4E0054AC8C /* PointLightSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1E1154513015C4E0054AC8C /* PointLightSource.cpp */; };
+		A1E1154813015C5D0054AC8C /* SpotLightSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1E1154713015C5D0054AC8C /* SpotLightSource.cpp */; };
 		A409C984116D0DDD007197BD /* AccessibilityProgressIndicator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A409C982116D0DDD007197BD /* AccessibilityProgressIndicator.cpp */; };
 		A409C985116D0DDD007197BD /* AccessibilityProgressIndicator.h in Headers */ = {isa = PBXBuildFile; fileRef = A409C983116D0DDD007197BD /* AccessibilityProgressIndicator.h */; };
 		A4226E5A1163D667008B8397 /* JSHTMLProgressElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A4226E591163D667008B8397 /* JSHTMLProgressElement.cpp */; };
@@ -3221,6 +3221,7 @@
 		A7DBF8DE1276919C006B6008 /* TextCheckingHelper.h in Headers */ = {isa = PBXBuildFile; fileRef = A7DBF8DC1276919C006B6008 /* TextCheckingHelper.h */; };
 		A7F338A311C0EFCA00A320A7 /* ShadowElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7F338A111C0EFCA00A320A7 /* ShadowElement.cpp */; };
 		A7F338A411C0EFCA00A320A7 /* ShadowElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A7F338A211C0EFCA00A320A7 /* ShadowElement.h */; };
+		A7FE819C12FA677700850C1E /* ProgressBarValueElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A7FE819B12FA677700850C1E /* ProgressBarValueElement.h */; };
 		A80A38FE0E50CC8200A25EBC /* PatternCG.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80A38FD0E50CC8200A25EBC /* PatternCG.cpp */; };
 		A80D67080E9E9DEB00E420F0 /* GraphicsContextPlatformPrivateCG.h in Headers */ = {isa = PBXBuildFile; fileRef = A80D67070E9E9DEB00E420F0 /* GraphicsContextPlatformPrivateCG.h */; };
 		A80E6CE40A1989CA007FB8C5 /* CSSValueList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E6CBA0A1989CA007FB8C5 /* CSSValueList.cpp */; };
@@ -3272,7 +3273,7 @@
 		A80E734F0A199C77007FB8C5 /* CSSSelector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E73480A199C77007FB8C5 /* CSSSelector.cpp */; };
 		A80E73500A199C77007FB8C5 /* StyleBase.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E73490A199C77007FB8C5 /* StyleBase.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A80E73510A199C77007FB8C5 /* StyleList.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E734A0A199C77007FB8C5 /* StyleList.h */; };
-		A80E73520A199C77007FB8C5 /* CSSSelector.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E734B0A199C77007FB8C5 /* CSSSelector.h */; };
+		A80E73520A199C77007FB8C5 /* CSSSelector.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E734B0A199C77007FB8C5 /* CSSSelector.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A80E73530A199C77007FB8C5 /* StyleBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E734C0A199C77007FB8C5 /* StyleBase.cpp */; };
 		A80E7A170A19C3D6007FB8C5 /* JSHTMLMetaElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E7A150A19C3D6007FB8C5 /* JSHTMLMetaElement.cpp */; };
 		A80E7A180A19C3D6007FB8C5 /* JSHTMLMetaElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E7A160A19C3D6007FB8C5 /* JSHTMLMetaElement.h */; };
@@ -4426,7 +4427,6 @@
 		B2C3DA230D006C1D00EF6F26 /* BidiContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B2C3D9F20D006C1D00EF6F26 /* BidiContext.cpp */; };
 		B2C3DA240D006C1D00EF6F26 /* BidiContext.h in Headers */ = {isa = PBXBuildFile; fileRef = B2C3D9F30D006C1D00EF6F26 /* BidiContext.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B2C3DA250D006C1D00EF6F26 /* BidiResolver.h in Headers */ = {isa = PBXBuildFile; fileRef = B2C3D9F40D006C1D00EF6F26 /* BidiResolver.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		B2C3DA260D006C1D00EF6F26 /* CharacterNames.h in Headers */ = {isa = PBXBuildFile; fileRef = B2C3D9F50D006C1D00EF6F26 /* CharacterNames.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B2C3DA2A0D006C1D00EF6F26 /* CharsetData.h in Headers */ = {isa = PBXBuildFile; fileRef = B2C3D9FA0D006C1D00EF6F26 /* CharsetData.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B2C3DA2B0D006C1D00EF6F26 /* PlatformString.h in Headers */ = {isa = PBXBuildFile; fileRef = B2C3D9FB0D006C1D00EF6F26 /* PlatformString.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B2C3DA2C0D006C1D00EF6F26 /* RegularExpression.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B2C3D9FC0D006C1D00EF6F26 /* RegularExpression.cpp */; };
@@ -5082,6 +5082,7 @@
 		BC94D14F0C275C68006BC617 /* JSHistory.h in Headers */ = {isa = PBXBuildFile; fileRef = BC94D14D0C275C68006BC617 /* JSHistory.h */; };
 		BC94D1530C275C8B006BC617 /* History.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC94D1500C275C8B006BC617 /* History.cpp */; };
 		BC94D1540C275C8B006BC617 /* History.h in Headers */ = {isa = PBXBuildFile; fileRef = BC94D1510C275C8B006BC617 /* History.h */; };
+		BC9585E112F0989500755821 /* PlatformGestureEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = BC9585DF12F0989500755821 /* PlatformGestureEvent.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC96DB430F3A880E00573CB3 /* RenderBoxModelObject.h in Headers */ = {isa = PBXBuildFile; fileRef = BC96DB420F3A880E00573CB3 /* RenderBoxModelObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC96DB460F3A882200573CB3 /* RenderBoxModelObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC96DB450F3A882200573CB3 /* RenderBoxModelObject.cpp */; };
 		BC97E23A109144950010D361 /* HTMLAllCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = BC97E238109144950010D361 /* HTMLAllCollection.h */; };
@@ -5199,6 +5200,9 @@
 		BCE1C4400D9830F4003B02F2 /* JSLocationCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCE1C43F0D9830F4003B02F2 /* JSLocationCustom.cpp */; };
 		BCE3BEC20D222B1D007E06E4 /* TagNodeList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCE3BEC00D222B1D007E06E4 /* TagNodeList.cpp */; };
 		BCE3BEC30D222B1D007E06E4 /* TagNodeList.h in Headers */ = {isa = PBXBuildFile; fileRef = BCE3BEC10D222B1D007E06E4 /* TagNodeList.h */; };
+		BCE4413312F748E2009B84B8 /* RenderCombineText.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCE4413112F748E2009B84B8 /* RenderCombineText.cpp */; };
+		BCE4413412F748E2009B84B8 /* RenderCombineText.h in Headers */ = {isa = PBXBuildFile; fileRef = BCE4413212F748E2009B84B8 /* RenderCombineText.h */; };
+		BCE4413612F7490B009B84B8 /* FontWidthVariant.h in Headers */ = {isa = PBXBuildFile; fileRef = BCE4413512F7490B009B84B8 /* FontWidthVariant.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCE658FF0EA9248A007E4533 /* Theme.h in Headers */ = {isa = PBXBuildFile; fileRef = BCE658FE0EA9248A007E4533 /* Theme.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCE659A90EA927B9007E4533 /* ThemeTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = BCE659A80EA927B9007E4533 /* ThemeTypes.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCE659E60EA92FB2007E4533 /* ThemeMac.h in Headers */ = {isa = PBXBuildFile; fileRef = BCE659E50EA92FB2007E4533 /* ThemeMac.h */; };
@@ -5475,6 +5479,7 @@
 		E1284BD61044A01E00EAEB52 /* DOMPageTransitionEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = E1284BD41044A01E00EAEB52 /* DOMPageTransitionEvent.h */; };
 		E12EDB7B0B308A78002704B6 /* EventTarget.h in Headers */ = {isa = PBXBuildFile; fileRef = E12EDB7A0B308A78002704B6 /* EventTarget.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E12EDBEA0B308E0B002704B6 /* EventTarget.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E12EDBE90B308E0B002704B6 /* EventTarget.cpp */; };
+		E134F5AB12EE343F004EC58D /* IntRectHash.h in Headers */ = {isa = PBXBuildFile; fileRef = E134F5AA12EE343F004EC58D /* IntRectHash.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E13F01F11270E19000DFBA71 /* CookieStorageMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = E13F01F01270E19000DFBA71 /* CookieStorageMac.mm */; };
 		E15A36D71104572000B7B639 /* XMLNSNames.h in Headers */ = {isa = PBXBuildFile; fileRef = E15A36D61104572000B7B639 /* XMLNSNames.h */; };
 		E15A36D91104572700B7B639 /* XMLNSNames.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E15A36D81104572700B7B639 /* XMLNSNames.cpp */; };
@@ -5584,7 +5589,7 @@
 		E446143C0CD689CC00FADA75 /* JSHTMLSourceElement.h in Headers */ = {isa = PBXBuildFile; fileRef = E4B423720CBFB6E000AF2ECE /* JSHTMLSourceElement.h */; };
 		E44614510CD68A3500FADA75 /* RenderVideo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4B41E330CBFB60900AF2ECE /* RenderVideo.cpp */; };
 		E44614520CD68A3500FADA75 /* RenderVideo.h in Headers */ = {isa = PBXBuildFile; fileRef = E4B41E340CBFB60900AF2ECE /* RenderVideo.h */; };
-		E462A4A1113E71BE004A4220 /* IntPointHash.h in Headers */ = {isa = PBXBuildFile; fileRef = E462A4A0113E71BE004A4220 /* IntPointHash.h */; };
+		E462A4A1113E71BE004A4220 /* IntPointHash.h in Headers */ = {isa = PBXBuildFile; fileRef = E462A4A0113E71BE004A4220 /* IntPointHash.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E4778B7F115A581A00B5D372 /* JSCustomEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4778B7D115A581A00B5D372 /* JSCustomEvent.cpp */; };
 		E4778B80115A581A00B5D372 /* JSCustomEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = E4778B7E115A581A00B5D372 /* JSCustomEvent.h */; };
 		E47B4BE80E71241600038854 /* CachedResourceHandle.h in Headers */ = {isa = PBXBuildFile; fileRef = E47B4BE60E71241600038854 /* CachedResourceHandle.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -5628,8 +5633,12 @@
 		F3D461491161D53200CA0D09 /* JSErrorHandler.h in Headers */ = {isa = PBXBuildFile; fileRef = F3D461471161D53200CA0D09 /* JSErrorHandler.h */; };
 		F3D4C47812E07663003DA150 /* InspectorBrowserDebuggerAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F3D4C47612E07663003DA150 /* InspectorBrowserDebuggerAgent.cpp */; };
 		F3D4C47912E07663003DA150 /* InspectorBrowserDebuggerAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = F3D4C47712E07663003DA150 /* InspectorBrowserDebuggerAgent.h */; };
+		F3F5CF1112ED81A80084C569 /* InspectorConsoleInstrumentation.h in Headers */ = {isa = PBXBuildFile; fileRef = F3F5CF1012ED81A80084C569 /* InspectorConsoleInstrumentation.h */; };
+		F3F5CF1312ED81B30084C569 /* InspectorDatabaseInstrumentation.h in Headers */ = {isa = PBXBuildFile; fileRef = F3F5CF1212ED81B30084C569 /* InspectorDatabaseInstrumentation.h */; };
 		F4EAF4AE10C742B1009100D3 /* OpenTypeSanitizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F4EAF4AC10C742B1009100D3 /* OpenTypeSanitizer.cpp */; };
 		F4EAF4AF10C742B1009100D3 /* OpenTypeSanitizer.h in Headers */ = {isa = PBXBuildFile; fileRef = F4EAF4AD10C742B1009100D3 /* OpenTypeSanitizer.h */; };
+		F5142C69123F12B000F5BD4C /* LocalizedNumber.h in Headers */ = {isa = PBXBuildFile; fileRef = F5142C68123F12B000F5BD4C /* LocalizedNumber.h */; };
+		F5142C6B123F12C500F5BD4C /* LocalizedNumberNone.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F5142C6A123F12C500F5BD4C /* LocalizedNumberNone.cpp */; };
 		F55B3DAD1251F12D003EF269 /* BaseTextInputType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F55B3D791251F12D003EF269 /* BaseTextInputType.cpp */; };
 		F55B3DAE1251F12D003EF269 /* BaseTextInputType.h in Headers */ = {isa = PBXBuildFile; fileRef = F55B3D7A1251F12D003EF269 /* BaseTextInputType.h */; };
 		F55B3DAF1251F12D003EF269 /* ButtonInputType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F55B3D7B1251F12D003EF269 /* ButtonInputType.cpp */; };
@@ -6366,13 +6375,11 @@
 		066C772F0AB603FD00238CC4 /* RenderFileUploadControl.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RenderFileUploadControl.h; sourceTree = "<group>"; };
 		06E81ED60AB5D5E900C87837 /* LocalCurrentGraphicsContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LocalCurrentGraphicsContext.h; sourceTree = "<group>"; };
 		06E81EEB0AB5DA9700C87837 /* LocalCurrentGraphicsContext.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = LocalCurrentGraphicsContext.mm; sourceTree = "<group>"; };
-		0709FC4B1025DED80059CDBA /* AccessibilitySlider.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilitySlider.cpp; sourceTree = "<group>"; };
 		0709FC4D1025DEE30059CDBA /* AccessibilitySlider.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilitySlider.h; sourceTree = "<group>"; };
 		070DD8F50F01868000727DEB /* mediaControls.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = mediaControls.css; sourceTree = "<group>"; };
 		0735EE690F40C5E4004A2604 /* MediaPlayerProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaPlayerProxy.h; sourceTree = "<group>"; };
 		079F5E4B0F3BEBEA005E0782 /* MediaPlayerPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaPlayerPrivate.h; sourceTree = "<group>"; };
 		07AFE5900F1446BD00841617 /* mediaControlsQuickTime.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.css; path = mediaControlsQuickTime.css; sourceTree = "<group>"; };
-		07B0113C1032241900FBDC33 /* AccessibilityMediaControls.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityMediaControls.cpp; sourceTree = "<group>"; };
 		07B0113E1032242200FBDC33 /* AccessibilityMediaControls.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityMediaControls.h; sourceTree = "<group>"; };
 		080081940ED3B2DD00C53BC0 /* WMLAnchorElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLAnchorElement.cpp; sourceTree = "<group>"; };
 		080081950ED3B2DD00C53BC0 /* WMLAnchorElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLAnchorElement.h; sourceTree = "<group>"; };
@@ -6416,6 +6423,7 @@
 		083DAEA30F01A7FB00342754 /* RenderTextControlMultiLine.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderTextControlMultiLine.h; sourceTree = "<group>"; };
 		083DAEA40F01A7FB00342754 /* RenderTextControlSingleLine.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderTextControlSingleLine.cpp; sourceTree = "<group>"; };
 		083DAEA50F01A7FB00342754 /* RenderTextControlSingleLine.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderTextControlSingleLine.h; sourceTree = "<group>"; };
+		0845680712B90DA600960A9F /* FontMetrics.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FontMetrics.h; sourceTree = "<group>"; };
 		084A0828128D7867002DB1F1 /* SVGPathSegListPropertyTearOff.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGPathSegListPropertyTearOff.h; sourceTree = "<group>"; };
 		084AEBE20FB505FA0038483E /* SelectElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SelectElement.cpp; sourceTree = "<group>"; };
 		084AEBE30FB505FA0038483E /* SelectElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SelectElement.h; sourceTree = "<group>"; };
@@ -6557,6 +6565,9 @@
 		0C45342610CDBBFA00869157 /* JSWebGLUniformLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLUniformLocation.h; sourceTree = "<group>"; };
 		0F11A54E0F39233100C37884 /* RenderSelectionInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSelectionInfo.h; sourceTree = "<group>"; };
 		0F15DA890F3AAEE70000CE47 /* AnimationControllerPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AnimationControllerPrivate.h; path = animation/AnimationControllerPrivate.h; sourceTree = "<group>"; };
+		0F29C16D1300C2E2002D794E /* AccessibilityAllInOne.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityAllInOne.cpp; sourceTree = "<group>"; };
+		0F3DD44D12F5EA1B000D9190 /* ShadowBlur.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ShadowBlur.cpp; sourceTree = "<group>"; };
+		0F3DD44E12F5EA1B000D9190 /* ShadowBlur.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ShadowBlur.h; sourceTree = "<group>"; };
 		0F500AAE0F54DB1B00EEF928 /* TransformState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TransformState.h; sourceTree = "<group>"; };
 		0F500AB00F54DB3100EEF928 /* TransformState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TransformState.cpp; sourceTree = "<group>"; };
 		0F56028D0E4B76580065B038 /* RenderMarquee.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderMarquee.h; sourceTree = "<group>"; };
@@ -6624,6 +6635,8 @@
 		14813BF309EDF88E00F757E1 /* IDLParser.pm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text.script.perl; name = IDLParser.pm; path = scripts/IDLParser.pm; sourceTree = "<group>"; };
 		148AFDA30AF58360008CC700 /* ExceptionHandlers.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = ExceptionHandlers.h; sourceTree = "<group>"; };
 		148AFDA40AF58360008CC700 /* ExceptionHandlers.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = ExceptionHandlers.mm; sourceTree = "<group>"; };
+		14947FFB12F80CD200A0F631 /* DocumentOrderedMap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DocumentOrderedMap.cpp; sourceTree = "<group>"; };
+		14947FFC12F80CD200A0F631 /* DocumentOrderedMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DocumentOrderedMap.h; sourceTree = "<group>"; };
 		14993BE30B2F2B1C0050497F /* FocusController.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = FocusController.cpp; sourceTree = "<group>"; };
 		14993BE40B2F2B1C0050497F /* FocusController.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = FocusController.h; sourceTree = "<group>"; };
 		14C9A5E90B3D105F005A0232 /* Settings.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Settings.cpp; sourceTree = "<group>"; };
@@ -6985,7 +6998,6 @@
 		1CF6BE120E9BB4670025E1CD /* ObjCNodeFilterCondition.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ObjCNodeFilterCondition.mm; sourceTree = "<group>"; };
 		1CF6BE130E9BB4670025E1CD /* ObjCNodeFilterCondition.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ObjCNodeFilterCondition.h; sourceTree = "<group>"; };
 		1CFAE3220A6D6A3F0032593D /* libobjc.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libobjc.dylib; path = /usr/lib/libobjc.dylib; sourceTree = "<absolute>"; };
-		200B190811C277D900DCCD3A /* ScriptBreakpoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptBreakpoint.cpp; sourceTree = "<group>"; };
 		20D629241253690B00081543 /* InspectorInstrumentation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorInstrumentation.cpp; sourceTree = "<group>"; };
 		20D629251253690B00081543 /* InspectorInstrumentation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorInstrumentation.h; sourceTree = "<group>"; };
 		228C284410D82500009D0D0E /* ScriptWrappable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptWrappable.h; sourceTree = "<group>"; };
@@ -6995,34 +7007,18 @@
 		2542F4D81166C25A00E89A86 /* UserGestureIndicator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UserGestureIndicator.cpp; sourceTree = "<group>"; };
 		2542F4D91166C25A00E89A86 /* UserGestureIndicator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UserGestureIndicator.h; sourceTree = "<group>"; };
 		29489FC512C00F0300D83F0F /* AccessibilityScrollView.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityScrollView.h; sourceTree = "<group>"; };
-		29489FC612C00F0300D83F0F /* AccessibilityScrollView.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityScrollView.cpp; sourceTree = "<group>"; };
-		29A812080FBB9C1D00510293 /* AccessibilityRenderObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityRenderObject.cpp; sourceTree = "<group>"; };
-		29A812090FBB9C1D00510293 /* AccessibilityTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityTable.cpp; sourceTree = "<group>"; };
-		29A8120A0FBB9C1D00510293 /* AccessibilityARIAGrid.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityARIAGrid.cpp; sourceTree = "<group>"; };
-		29A8120B0FBB9C1D00510293 /* AccessibilityTableRow.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityTableRow.cpp; sourceTree = "<group>"; };
-		29A8120C0FBB9C1D00510293 /* AccessibilityTableCell.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityTableCell.cpp; sourceTree = "<group>"; };
 		29A8120D0FBB9C1D00510293 /* AccessibilityTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityTable.h; sourceTree = "<group>"; };
 		29A8120E0FBB9C1D00510293 /* AccessibilityList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityList.h; sourceTree = "<group>"; };
-		29A8120F0FBB9C1D00510293 /* AccessibilityARIAGridRow.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityARIAGridRow.cpp; sourceTree = "<group>"; };
 		29A812100FBB9C1D00510293 /* AccessibilityARIAGridCell.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityARIAGridCell.h; sourceTree = "<group>"; };
-		29A812110FBB9C1D00510293 /* AccessibilityList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityList.cpp; sourceTree = "<group>"; };
-		29A812120FBB9C1D00510293 /* AccessibilityARIAGridCell.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityARIAGridCell.cpp; sourceTree = "<group>"; };
 		29A812130FBB9C1D00510293 /* AccessibilityTableRow.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityTableRow.h; sourceTree = "<group>"; };
 		29A812140FBB9C1D00510293 /* AccessibilityTableCell.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityTableCell.h; sourceTree = "<group>"; };
 		29A812150FBB9C1D00510293 /* AccessibilityARIAGridRow.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityARIAGridRow.h; sourceTree = "<group>"; };
 		29A812160FBB9C1D00510293 /* AccessibilityARIAGrid.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityARIAGrid.h; sourceTree = "<group>"; };
-		29A812170FBB9C1D00510293 /* AccessibilityTableColumn.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityTableColumn.cpp; sourceTree = "<group>"; };
 		29A812180FBB9C1D00510293 /* AccessibilityObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityObject.h; sourceTree = "<group>"; };
-		29A812190FBB9C1D00510293 /* AXObjectCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AXObjectCache.cpp; sourceTree = "<group>"; };
 		29A8121A0FBB9C1D00510293 /* AXObjectCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AXObjectCache.h; sourceTree = "<group>"; };
 		29A8121B0FBB9C1D00510293 /* AccessibilityRenderObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityRenderObject.h; sourceTree = "<group>"; };
-		29A8121C0FBB9C1D00510293 /* AccessibilityImageMapLink.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityImageMapLink.cpp; sourceTree = "<group>"; };
 		29A8121D0FBB9C1D00510293 /* AccessibilityImageMapLink.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityImageMapLink.h; sourceTree = "<group>"; };
-		29A8121E0FBB9C1D00510293 /* AccessibilityObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityObject.cpp; sourceTree = "<group>"; };
-		29A8121F0FBB9C1D00510293 /* AccessibilityListBoxOption.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityListBoxOption.cpp; sourceTree = "<group>"; };
-		29A812200FBB9C1D00510293 /* AccessibilityListBox.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityListBox.cpp; sourceTree = "<group>"; };
 		29A812210FBB9C1D00510293 /* AccessibilityTableHeaderContainer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityTableHeaderContainer.h; sourceTree = "<group>"; };
-		29A812220FBB9C1D00510293 /* AccessibilityTableHeaderContainer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityTableHeaderContainer.cpp; sourceTree = "<group>"; };
 		29A812230FBB9C1D00510293 /* AccessibilityTableColumn.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityTableColumn.h; sourceTree = "<group>"; };
 		29A812240FBB9C1D00510293 /* AccessibilityListBoxOption.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityListBoxOption.h; sourceTree = "<group>"; };
 		29A812250FBB9C1D00510293 /* AccessibilityListBox.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityListBox.h; sourceTree = "<group>"; };
@@ -7231,8 +7227,6 @@
 		37F818FC0D657606005E1F05 /* WebCoreURLResponse.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCoreURLResponse.mm; sourceTree = "<group>"; };
 		37FC96DA1104ED71003E1FAD /* TrailingFloatsRootInlineBox.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TrailingFloatsRootInlineBox.h; sourceTree = "<group>"; };
 		37FD4297118368460093C029 /* TreeDepthLimit.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TreeDepthLimit.h; sourceTree = "<group>"; };
-		3888F6EC128C9889000CA8E0 /* InspectorFileSystemAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorFileSystemAgent.cpp; sourceTree = "<group>"; };
-		3888F6ED128C9889000CA8E0 /* InspectorFileSystemAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorFileSystemAgent.h; sourceTree = "<group>"; };
 		3AC648B1129E146500C3EB25 /* EditingBoundary.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EditingBoundary.h; sourceTree = "<group>"; };
 		41002CCB0F66EDEF009E660D /* ScriptFunctionCall.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptFunctionCall.h; sourceTree = "<group>"; };
 		41002CCC0F66EDEF009E660D /* ScriptFunctionCall.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptFunctionCall.cpp; sourceTree = "<group>"; };
@@ -7246,6 +7240,8 @@
 		4138D3341244054800323D33 /* EventContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventContext.cpp; sourceTree = "<group>"; };
 		4150F9EF12B6E0E70008C860 /* SliderThumbElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SliderThumbElement.h; sourceTree = "<group>"; };
 		4150F9F012B6E0E70008C860 /* SliderThumbElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SliderThumbElement.cpp; sourceTree = "<group>"; };
+		4157AF7E12F1FB0400A8C6F5 /* MediaControls.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaControls.h; sourceTree = "<group>"; };
+		4157AF7F12F1FB0400A8C6F5 /* MediaControls.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MediaControls.cpp; sourceTree = "<group>"; };
 		4162A44D101145AE00DFF3ED /* DedicatedWorkerContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DedicatedWorkerContext.cpp; path = workers/DedicatedWorkerContext.cpp; sourceTree = "<group>"; };
 		4162A44E101145AE00DFF3ED /* DedicatedWorkerContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DedicatedWorkerContext.h; path = workers/DedicatedWorkerContext.h; sourceTree = "<group>"; };
 		4162A44F101145AE00DFF3ED /* DedicatedWorkerContext.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = DedicatedWorkerContext.idl; path = workers/DedicatedWorkerContext.idl; sourceTree = "<group>"; };
@@ -7665,6 +7661,8 @@
 		4E1959280A39DACC00220FE5 /* MediaQueryExp.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = MediaQueryExp.h; sourceTree = "<group>"; };
 		4F1534DD11B532EC0021FD86 /* EditingBehavior.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EditingBehavior.h; sourceTree = "<group>"; };
 		4F1534DF11B533020021FD86 /* EditingBehaviorTypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EditingBehaviorTypes.h; sourceTree = "<group>"; };
+		4F2D205212EAE7B3005C2874 /* InspectorAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorAgent.h; sourceTree = "<group>"; };
+		4F2D205312EAE7B3005C2874 /* InspectorAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorAgent.cpp; sourceTree = "<group>"; };
 		4F3289B311A42AAB005ABE7E /* InspectorValues.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorValues.cpp; sourceTree = "<group>"; };
 		4F3289B411A42AAB005ABE7E /* InspectorValues.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorValues.h; sourceTree = "<group>"; };
 		4F4F5FFA11CBD2D200A186BF /* InspectorFrontend.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorFrontend.cpp; sourceTree = "<group>"; };
@@ -8094,8 +8092,6 @@
 		7A24587A1021EAF4000A00AA /* InspectorDOMAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorDOMAgent.h; sourceTree = "<group>"; };
 		7A563E5412DE32B000F4536D /* InjectedScriptSource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScriptSource.h; sourceTree = "<group>"; };
 		7A563F9512DF5C9100F4536D /* InjectedScriptSource.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = InjectedScriptSource.js; sourceTree = "<group>"; };
-		7A5640BD12DF9E5E00F4536D /* InspectorSettings.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorSettings.cpp; sourceTree = "<group>"; };
-		7A5640BE12DF9E5E00F4536D /* InspectorSettings.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorSettings.h; sourceTree = "<group>"; };
 		7A674BD90F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageGroupLoadDeferrer.cpp; sourceTree = "<group>"; };
 		7A674BDA0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PageGroupLoadDeferrer.h; sourceTree = "<group>"; };
 		7A74ECB8101839A500BF939E /* InspectorDOMStorageAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorDOMStorageAgent.cpp; sourceTree = "<group>"; };
@@ -9253,6 +9249,8 @@
 		933A14A90B7D1D0900A53FFD /* DOMTextEvent.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMTextEvent.mm; sourceTree = "<group>"; };
 		933A14B60B7D1D5200A53FFD /* JSTextEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSTextEvent.cpp; sourceTree = "<group>"; };
 		933A14B70B7D1D5200A53FFD /* JSTextEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSTextEvent.h; sourceTree = "<group>"; };
+		9343CB7F12F25E510033C5EE /* TextCodecUTF8.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TextCodecUTF8.cpp; sourceTree = "<group>"; };
+		9343CB8012F25E510033C5EE /* TextCodecUTF8.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextCodecUTF8.h; sourceTree = "<group>"; };
 		93442C9D0D2B335C00338FF9 /* HTMLTableRowsCollection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLTableRowsCollection.h; sourceTree = "<group>"; };
 		93442C9F0D2B336000338FF9 /* HTMLTableRowsCollection.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLTableRowsCollection.cpp; sourceTree = "<group>"; };
 		934907E3125BBBC8007F23A0 /* GraphicsContextCG.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GraphicsContextCG.h; sourceTree = "<group>"; };
@@ -9338,7 +9336,6 @@
 		93C441ED0F813A1A00C1A634 /* CollectionCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CollectionCache.cpp; sourceTree = "<group>"; };
 		93C441EE0F813A1A00C1A634 /* CollectionCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CollectionCache.h; sourceTree = "<group>"; };
 		93C441FF0F813AE100C1A634 /* CollectionType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CollectionType.h; sourceTree = "<group>"; };
-		93C4F6E81108F9A50099D0DB /* AccessibilityScrollbar.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityScrollbar.cpp; sourceTree = "<group>"; };
 		93C4F6E91108F9A50099D0DB /* AccessibilityScrollbar.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityScrollbar.h; sourceTree = "<group>"; };
 		93C841F709CE855C00DFF5E5 /* DOMImplementationFront.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMImplementationFront.h; sourceTree = "<group>"; };
 		93C841FE09CE858300DFF5E5 /* DOMImplementationFront.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMImplementationFront.cpp; sourceTree = "<group>"; };
@@ -9408,6 +9405,7 @@
 		97059974107D975200A50A7C /* PolicyCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PolicyCallback.h; sourceTree = "<group>"; };
 		97059975107D975200A50A7C /* PolicyChecker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PolicyChecker.cpp; sourceTree = "<group>"; };
 		97059976107D975200A50A7C /* PolicyChecker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PolicyChecker.h; sourceTree = "<group>"; };
+		971491D912FD65E8001BFEB1 /* URLString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = URLString.h; sourceTree = "<group>"; };
 		97205AAD123928CA00B17380 /* FTPDirectoryDocument.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FTPDirectoryDocument.cpp; sourceTree = "<group>"; };
 		97205AAE123928CA00B17380 /* FTPDirectoryDocument.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FTPDirectoryDocument.h; sourceTree = "<group>"; };
 		97205AB11239291000B17380 /* ImageDocument.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ImageDocument.cpp; sourceTree = "<group>"; };
@@ -9422,6 +9420,11 @@
 		9738899F116EA9DC00ADF313 /* DocumentWriter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DocumentWriter.h; sourceTree = "<group>"; };
 		973E325410883B7C005BC493 /* ResourceLoadNotifier.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ResourceLoadNotifier.cpp; sourceTree = "<group>"; };
 		973E325510883B7C005BC493 /* ResourceLoadNotifier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ResourceLoadNotifier.h; sourceTree = "<group>"; };
+		975CA287130365F800E99AD9 /* Crypto.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Crypto.cpp; sourceTree = "<group>"; };
+		975CA288130365F800E99AD9 /* Crypto.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Crypto.h; sourceTree = "<group>"; };
+		975CA289130365F800E99AD9 /* Crypto.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Crypto.idl; sourceTree = "<group>"; };
+		975CA29F1303679D00E99AD9 /* JSCrypto.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCrypto.cpp; sourceTree = "<group>"; };
+		975CA2A01303679D00E99AD9 /* JSCrypto.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCrypto.h; sourceTree = "<group>"; };
 		976D6C58122B8A3D001FD1F7 /* AsyncFileWriter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AsyncFileWriter.h; path = fileapi/AsyncFileWriter.h; sourceTree = "<group>"; };
 		976D6C59122B8A3D001FD1F7 /* Blob.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = Blob.cpp; path = fileapi/Blob.cpp; sourceTree = "<group>"; };
 		976D6C5A122B8A3D001FD1F7 /* Blob.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Blob.h; path = fileapi/Blob.h; sourceTree = "<group>"; };
@@ -9475,6 +9478,10 @@
 		977B385F122883E900B81FF8 /* HTMLTokenizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HTMLTokenizer.h; path = parser/HTMLTokenizer.h; sourceTree = "<group>"; };
 		977B3860122883E900B81FF8 /* HTMLViewSourceParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = HTMLViewSourceParser.cpp; path = parser/HTMLViewSourceParser.cpp; sourceTree = "<group>"; };
 		977B3861122883E900B81FF8 /* HTMLViewSourceParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HTMLViewSourceParser.h; path = parser/HTMLViewSourceParser.h; sourceTree = "<group>"; };
+		977E2DCB12F0E28300C13379 /* HTMLSourceTracker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = HTMLSourceTracker.cpp; path = parser/HTMLSourceTracker.cpp; sourceTree = "<group>"; };
+		977E2DCC12F0E28300C13379 /* HTMLSourceTracker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HTMLSourceTracker.h; path = parser/HTMLSourceTracker.h; sourceTree = "<group>"; };
+		977E2E0B12F0FC9C00C13379 /* XSSFilter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = XSSFilter.cpp; path = parser/XSSFilter.cpp; sourceTree = "<group>"; };
+		977E2E0C12F0FC9C00C13379 /* XSSFilter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = XSSFilter.h; path = parser/XSSFilter.h; sourceTree = "<group>"; };
 		979F43D11075E44A0000F83B /* NavigationScheduler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NavigationScheduler.cpp; sourceTree = "<group>"; };
 		979F43D21075E44A0000F83B /* NavigationScheduler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NavigationScheduler.h; sourceTree = "<group>"; };
 		97BC84811236FD93000C6161 /* TextDocumentParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = TextDocumentParser.cpp; path = parser/TextDocumentParser.cpp; sourceTree = "<group>"; };
@@ -9486,10 +9493,10 @@
 		97BC84B212371180000C6161 /* TextDocument.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextDocument.h; sourceTree = "<group>"; };
 		97C0784F1165D5BE003A32EF /* SuffixTree.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SuffixTree.h; sourceTree = "<group>"; };
 		97C1F552122855CB00EDE616 /* HTMLToken.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HTMLToken.h; path = parser/HTMLToken.h; sourceTree = "<group>"; };
+		97C471D912F925BC0086354B /* ContentSecurityPolicy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ContentSecurityPolicy.cpp; sourceTree = "<group>"; };
+		97C471DA12F925BD0086354B /* ContentSecurityPolicy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ContentSecurityPolicy.h; sourceTree = "<group>"; };
 		97DCE1FF10807C750057D394 /* HistoryController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HistoryController.cpp; sourceTree = "<group>"; };
 		97DCE20010807C750057D394 /* HistoryController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HistoryController.h; sourceTree = "<group>"; };
-		97DD4D840FDF4D6D00ECF9A4 /* XSSAuditor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XSSAuditor.cpp; sourceTree = "<group>"; };
-		97DD4D850FDF4D6E00ECF9A4 /* XSSAuditor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = XSSAuditor.h; sourceTree = "<group>"; };
 		97EF7DFD107E55B700D7C49C /* ScriptControllerBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptControllerBase.cpp; sourceTree = "<group>"; };
 		9B417062125662B3006B28FC /* ApplyBlockElementCommand.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ApplyBlockElementCommand.h; sourceTree = "<group>"; };
 		9B417063125662B3006B28FC /* ApplyBlockElementCommand.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ApplyBlockElementCommand.cpp; sourceTree = "<group>"; };
@@ -9514,6 +9521,7 @@
 		9FA37EF71172FD9300C4CD55 /* JSScriptProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSScriptProfile.h; sourceTree = "<group>"; };
 		9FA37EF81172FD9300C4CD55 /* JSScriptProfileNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSScriptProfileNode.cpp; sourceTree = "<group>"; };
 		9FA37EF91172FD9300C4CD55 /* JSScriptProfileNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSScriptProfileNode.h; sourceTree = "<group>"; };
+		9FDC8FF112FAB0060099AB1C /* JSMemoryInfoCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMemoryInfoCustom.cpp; sourceTree = "<group>"; };
 		9FFE3E7811B59C5D0037874E /* MemoryInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MemoryInfo.cpp; sourceTree = "<group>"; };
 		9FFE3E7911B59C5D0037874E /* MemoryInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MemoryInfo.h; sourceTree = "<group>"; };
 		9FFE3E7C11B59C6E0037874E /* MemoryInfo.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = MemoryInfo.idl; sourceTree = "<group>"; };
@@ -9524,6 +9532,9 @@
 		A136A00B1134DBD200CC8D50 /* XMLHttpRequestProgressEventThrottle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = XMLHttpRequestProgressEventThrottle.h; sourceTree = "<group>"; };
 		A17C81200F2A5CF7005DAAEB /* HTMLElementFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLElementFactory.cpp; sourceTree = "<group>"; };
 		A17C81210F2A5CF7005DAAEB /* HTMLElementFactory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLElementFactory.h; sourceTree = "<group>"; };
+		A1E1154313015C3D0054AC8C /* DistantLightSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DistantLightSource.cpp; path = filters/DistantLightSource.cpp; sourceTree = "<group>"; };
+		A1E1154513015C4E0054AC8C /* PointLightSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = PointLightSource.cpp; path = filters/PointLightSource.cpp; sourceTree = "<group>"; };
+		A1E1154713015C5D0054AC8C /* SpotLightSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SpotLightSource.cpp; path = filters/SpotLightSource.cpp; sourceTree = "<group>"; };
 		A409C982116D0DDD007197BD /* AccessibilityProgressIndicator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityProgressIndicator.cpp; sourceTree = "<group>"; };
 		A409C983116D0DDD007197BD /* AccessibilityProgressIndicator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityProgressIndicator.h; sourceTree = "<group>"; };
 		A4226E591163D667008B8397 /* JSHTMLProgressElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLProgressElement.cpp; sourceTree = "<group>"; };
@@ -9609,6 +9620,7 @@
 		A7DBF8DC1276919C006B6008 /* TextCheckingHelper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextCheckingHelper.h; sourceTree = "<group>"; };
 		A7F338A111C0EFCA00A320A7 /* ShadowElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ShadowElement.cpp; sourceTree = "<group>"; };
 		A7F338A211C0EFCA00A320A7 /* ShadowElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ShadowElement.h; sourceTree = "<group>"; };
+		A7FE819B12FA677700850C1E /* ProgressBarValueElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProgressBarValueElement.h; sourceTree = "<group>"; };
 		A80A38FD0E50CC8200A25EBC /* PatternCG.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PatternCG.cpp; sourceTree = "<group>"; };
 		A80D67070E9E9DEB00E420F0 /* GraphicsContextPlatformPrivateCG.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GraphicsContextPlatformPrivateCG.h; sourceTree = "<group>"; };
 		A80E6CBA0A1989CA007FB8C5 /* CSSValueList.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CSSValueList.cpp; sourceTree = "<group>"; };
@@ -10706,7 +10718,6 @@
 		B2C3D9F20D006C1D00EF6F26 /* BidiContext.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = BidiContext.cpp; sourceTree = "<group>"; };
 		B2C3D9F30D006C1D00EF6F26 /* BidiContext.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = BidiContext.h; sourceTree = "<group>"; };
 		B2C3D9F40D006C1D00EF6F26 /* BidiResolver.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = BidiResolver.h; sourceTree = "<group>"; };
-		B2C3D9F50D006C1D00EF6F26 /* CharacterNames.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CharacterNames.h; sourceTree = "<group>"; };
 		B2C3D9FA0D006C1D00EF6F26 /* CharsetData.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CharsetData.h; sourceTree = "<group>"; };
 		B2C3D9FB0D006C1D00EF6F26 /* PlatformString.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = PlatformString.h; sourceTree = "<group>"; };
 		B2C3D9FC0D006C1D00EF6F26 /* RegularExpression.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RegularExpression.cpp; sourceTree = "<group>"; };
@@ -11363,6 +11374,7 @@
 		BC7FA6800D1F167900DB22A9 /* SelectorNodeList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SelectorNodeList.cpp; sourceTree = "<group>"; };
 		BC80C9850CD294EE00A0B7B3 /* CSSTimingFunctionValue.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CSSTimingFunctionValue.cpp; sourceTree = "<group>"; };
 		BC80C9860CD294EE00A0B7B3 /* CSSTimingFunctionValue.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSTimingFunctionValue.h; sourceTree = "<group>"; };
+		BC814A4112F8C34A007B2C32 /* HeaderDetection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeaderDetection.h; sourceTree = "<group>"; };
 		BC8243250D0CE8A200460C8F /* JSSQLError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLError.h; sourceTree = "<group>"; };
 		BC8243260D0CE8A200460C8F /* JSSQLTransaction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLTransaction.h; sourceTree = "<group>"; };
 		BC8243E60D0CFD7500460C8F /* WindowFeatures.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WindowFeatures.cpp; sourceTree = "<group>"; };
@@ -11392,6 +11404,7 @@
 		BC94D1500C275C8B006BC617 /* History.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = History.cpp; sourceTree = "<group>"; };
 		BC94D1510C275C8B006BC617 /* History.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = History.h; sourceTree = "<group>"; };
 		BC94D1520C275C8B006BC617 /* History.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = History.idl; sourceTree = "<group>"; };
+		BC9585DF12F0989500755821 /* PlatformGestureEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformGestureEvent.h; sourceTree = "<group>"; };
 		BC96DB420F3A880E00573CB3 /* RenderBoxModelObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderBoxModelObject.h; sourceTree = "<group>"; };
 		BC96DB450F3A882200573CB3 /* RenderBoxModelObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderBoxModelObject.cpp; sourceTree = "<group>"; };
 		BC97E238109144950010D361 /* HTMLAllCollection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLAllCollection.h; sourceTree = "<group>"; };
@@ -11517,6 +11530,9 @@
 		BCE1C43F0D9830F4003B02F2 /* JSLocationCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSLocationCustom.cpp; sourceTree = "<group>"; };
 		BCE3BEC00D222B1D007E06E4 /* TagNodeList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TagNodeList.cpp; sourceTree = "<group>"; };
 		BCE3BEC10D222B1D007E06E4 /* TagNodeList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TagNodeList.h; sourceTree = "<group>"; };
+		BCE4413112F748E2009B84B8 /* RenderCombineText.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderCombineText.cpp; sourceTree = "<group>"; };
+		BCE4413212F748E2009B84B8 /* RenderCombineText.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderCombineText.h; sourceTree = "<group>"; };
+		BCE4413512F7490B009B84B8 /* FontWidthVariant.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FontWidthVariant.h; sourceTree = "<group>"; };
 		BCE658FE0EA9248A007E4533 /* Theme.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Theme.h; sourceTree = "<group>"; };
 		BCE659A80EA927B9007E4533 /* ThemeTypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThemeTypes.h; sourceTree = "<group>"; };
 		BCE659E50EA92FB2007E4533 /* ThemeMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThemeMac.h; sourceTree = "<group>"; };
@@ -11821,6 +11837,7 @@
 		E1284BD41044A01E00EAEB52 /* DOMPageTransitionEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMPageTransitionEvent.h; sourceTree = "<group>"; };
 		E12EDB7A0B308A78002704B6 /* EventTarget.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventTarget.h; sourceTree = "<group>"; };
 		E12EDBE90B308E0B002704B6 /* EventTarget.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventTarget.cpp; sourceTree = "<group>"; };
+		E134F5AA12EE343F004EC58D /* IntRectHash.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntRectHash.h; sourceTree = "<group>"; };
 		E13F01EA1270E10D00DFBA71 /* CookieStorage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CookieStorage.h; sourceTree = "<group>"; };
 		E13F01F01270E19000DFBA71 /* CookieStorageMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = CookieStorageMac.mm; sourceTree = "<group>"; };
 		E15A36D61104572000B7B639 /* XMLNSNames.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = XMLNSNames.h; sourceTree = "<group>"; };
@@ -11988,8 +12005,12 @@
 		F3D461471161D53200CA0D09 /* JSErrorHandler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSErrorHandler.h; sourceTree = "<group>"; };
 		F3D4C47612E07663003DA150 /* InspectorBrowserDebuggerAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorBrowserDebuggerAgent.cpp; sourceTree = "<group>"; };
 		F3D4C47712E07663003DA150 /* InspectorBrowserDebuggerAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorBrowserDebuggerAgent.h; sourceTree = "<group>"; };
+		F3F5CF1012ED81A80084C569 /* InspectorConsoleInstrumentation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorConsoleInstrumentation.h; sourceTree = "<group>"; };
+		F3F5CF1212ED81B30084C569 /* InspectorDatabaseInstrumentation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorDatabaseInstrumentation.h; sourceTree = "<group>"; };
 		F4EAF4AC10C742B1009100D3 /* OpenTypeSanitizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = OpenTypeSanitizer.cpp; path = opentype/OpenTypeSanitizer.cpp; sourceTree = "<group>"; };
 		F4EAF4AD10C742B1009100D3 /* OpenTypeSanitizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = OpenTypeSanitizer.h; path = opentype/OpenTypeSanitizer.h; sourceTree = "<group>"; };
+		F5142C68123F12B000F5BD4C /* LocalizedNumber.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LocalizedNumber.h; sourceTree = "<group>"; };
+		F5142C6A123F12C500F5BD4C /* LocalizedNumberNone.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LocalizedNumberNone.cpp; sourceTree = "<group>"; };
 		F523D23B02DE4396018635CA /* HTMLDocument.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLDocument.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F523D23C02DE4396018635CA /* HTMLDocument.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = HTMLDocument.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F523D23E02DE4396018635CA /* HTMLElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLElement.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
@@ -12967,6 +12988,8 @@
 				7A0E76F710BF08ED00A0276E /* InjectedScriptHost.h */,
 				7A0E76F810BF08ED00A0276E /* InjectedScriptHost.idl */,
 				7A563F9512DF5C9100F4536D /* InjectedScriptSource.js */,
+				4F2D205312EAE7B3005C2874 /* InspectorAgent.cpp */,
+				4F2D205212EAE7B3005C2874 /* InspectorAgent.h */,
 				B885E8D211E06DD2009FFBF4 /* InspectorApplicationCacheAgent.cpp */,
 				B885E8D311E06DD2009FFBF4 /* InspectorApplicationCacheAgent.h */,
 				F3D4C47612E07663003DA150 /* InspectorBrowserDebuggerAgent.cpp */,
@@ -12975,12 +12998,14 @@
 				1C81B9580E97330800266E07 /* InspectorClient.h */,
 				F3335BF612E07DC300D33011 /* InspectorConsoleAgent.cpp */,
 				F3335BF712E07DC300D33011 /* InspectorConsoleAgent.h */,
+				F3F5CF1012ED81A80084C569 /* InspectorConsoleInstrumentation.h */,
 				1C81B9570E97330800266E07 /* InspectorController.cpp */,
 				1C81B9560E97330800266E07 /* InspectorController.h */,
 				82AB1741124B99EC00C5069D /* InspectorCSSAgent.cpp */,
 				82AB1742124B99EC00C5069D /* InspectorCSSAgent.h */,
 				7AB0B1BE1211A62200A76940 /* InspectorDatabaseAgent.cpp */,
 				7AB0B1BF1211A62200A76940 /* InspectorDatabaseAgent.h */,
+				F3F5CF1212ED81B30084C569 /* InspectorDatabaseInstrumentation.h */,
 				41F062130F5F192600A07EAC /* InspectorDatabaseResource.cpp */,
 				41F062120F5F192600A07EAC /* InspectorDatabaseResource.h */,
 				F33F053B120B0DA500E5743A /* InspectorDebuggerAgent.cpp */,
@@ -12991,8 +13016,6 @@
 				7A74ECB9101839A600BF939E /* InspectorDOMStorageAgent.h */,
 				41F061730F5F00AC00A07EAC /* InspectorDOMStorageResource.cpp */,
 				41F061720F5F00AC00A07EAC /* InspectorDOMStorageResource.h */,
-				3888F6EC128C9889000CA8E0 /* InspectorFileSystemAgent.cpp */,
-				3888F6ED128C9889000CA8E0 /* InspectorFileSystemAgent.h */,
 				F344C7121125B82C00F26EEE /* InspectorFrontendClient.h */,
 				F344C75711294FF600F26EEE /* InspectorFrontendClientLocal.cpp */,
 				F344C75211294D9D00F26EEE /* InspectorFrontendClientLocal.h */,
@@ -13007,8 +13030,6 @@
 				82AB1772125C826700C5069D /* InspectorResourceAgent.h */,
 				7AA365ED12E7265400DCA242 /* InspectorRuntimeAgent.cpp */,
 				7AF11A5912E727490061F23C /* InspectorRuntimeAgent.h */,
-				7A5640BD12DF9E5E00F4536D /* InspectorSettings.cpp */,
-				7A5640BE12DF9E5E00F4536D /* InspectorSettings.h */,
 				4FA3B908125CD12100300BAD /* InspectorState.cpp */,
 				4FA3B909125CD12200300BAD /* InspectorState.h */,
 				82AB176F125C826700C5069D /* InspectorStyleSheet.cpp */,
@@ -13022,7 +13043,6 @@
 				BCC64F5F0DCFB84E0081EF3B /* localizedStrings.js */,
 				F39BE95912673BF400E0A674 /* ScriptArguments.cpp */,
 				F39BE95A12673BF400E0A674 /* ScriptArguments.h */,
-				200B190811C277D900DCCD3A /* ScriptBreakpoint.cpp */,
 				7AFD4A8A1131C2760035B883 /* ScriptBreakpoint.h */,
 				416E75CA0EDF90C700360E1D /* ScriptCallFrame.cpp */,
 				416E75C90EDF90C700360E1D /* ScriptCallFrame.h */,
@@ -13057,21 +13077,14 @@
 			isa = PBXGroup;
 			children = (
 				29A812050FBB9B5200510293 /* mac */,
-				29A8120A0FBB9C1D00510293 /* AccessibilityARIAGrid.cpp */,
+				0F29C16D1300C2E2002D794E /* AccessibilityAllInOne.cpp */,
 				29A812160FBB9C1D00510293 /* AccessibilityARIAGrid.h */,
-				29A812120FBB9C1D00510293 /* AccessibilityARIAGridCell.cpp */,
 				29A812100FBB9C1D00510293 /* AccessibilityARIAGridCell.h */,
-				29A8120F0FBB9C1D00510293 /* AccessibilityARIAGridRow.cpp */,
 				29A812150FBB9C1D00510293 /* AccessibilityARIAGridRow.h */,
-				29A8121C0FBB9C1D00510293 /* AccessibilityImageMapLink.cpp */,
 				29A8121D0FBB9C1D00510293 /* AccessibilityImageMapLink.h */,
-				29A812110FBB9C1D00510293 /* AccessibilityList.cpp */,
 				29A8120E0FBB9C1D00510293 /* AccessibilityList.h */,
-				29A812200FBB9C1D00510293 /* AccessibilityListBox.cpp */,
 				29A812250FBB9C1D00510293 /* AccessibilityListBox.h */,
-				29A8121F0FBB9C1D00510293 /* AccessibilityListBoxOption.cpp */,
 				29A812240FBB9C1D00510293 /* AccessibilityListBoxOption.h */,
-				07B0113C1032241900FBDC33 /* AccessibilityMediaControls.cpp */,
 				07B0113E1032242200FBDC33 /* AccessibilityMediaControls.h */,
 				76CDD2EC1103DA6600680521 /* AccessibilityMenuList.cpp */,
 				76CDD2ED1103DA6600680521 /* AccessibilityMenuList.h */,
@@ -13079,29 +13092,18 @@
 				76CDD2F11103DA6600680521 /* AccessibilityMenuListOption.h */,
 				76CDD2EE1103DA6600680521 /* AccessibilityMenuListPopup.cpp */,
 				76CDD2EF1103DA6600680521 /* AccessibilityMenuListPopup.h */,
-				29A8121E0FBB9C1D00510293 /* AccessibilityObject.cpp */,
 				29A812180FBB9C1D00510293 /* AccessibilityObject.h */,
 				A409C982116D0DDD007197BD /* AccessibilityProgressIndicator.cpp */,
 				A409C983116D0DDD007197BD /* AccessibilityProgressIndicator.h */,
-				29A812080FBB9C1D00510293 /* AccessibilityRenderObject.cpp */,
 				29A8121B0FBB9C1D00510293 /* AccessibilityRenderObject.h */,
-				93C4F6E81108F9A50099D0DB /* AccessibilityScrollbar.cpp */,
 				93C4F6E91108F9A50099D0DB /* AccessibilityScrollbar.h */,
-				29489FC612C00F0300D83F0F /* AccessibilityScrollView.cpp */,
 				29489FC512C00F0300D83F0F /* AccessibilityScrollView.h */,
-				0709FC4B1025DED80059CDBA /* AccessibilitySlider.cpp */,
 				0709FC4D1025DEE30059CDBA /* AccessibilitySlider.h */,
-				29A812090FBB9C1D00510293 /* AccessibilityTable.cpp */,
 				29A8120D0FBB9C1D00510293 /* AccessibilityTable.h */,
-				29A8120C0FBB9C1D00510293 /* AccessibilityTableCell.cpp */,
 				29A812140FBB9C1D00510293 /* AccessibilityTableCell.h */,
-				29A812170FBB9C1D00510293 /* AccessibilityTableColumn.cpp */,
 				29A812230FBB9C1D00510293 /* AccessibilityTableColumn.h */,
-				29A812220FBB9C1D00510293 /* AccessibilityTableHeaderContainer.cpp */,
 				29A812210FBB9C1D00510293 /* AccessibilityTableHeaderContainer.h */,
-				29A8120B0FBB9C1D00510293 /* AccessibilityTableRow.cpp */,
 				29A812130FBB9C1D00510293 /* AccessibilityTableRow.h */,
-				29A812190FBB9C1D00510293 /* AXObjectCache.cpp */,
 				29A8121A0FBB9C1D00510293 /* AXObjectCache.h */,
 			);
 			path = accessibility;
@@ -13213,6 +13215,9 @@
 		4150F9ED12B6E0990008C860 /* shadow */ = {
 			isa = PBXGroup;
 			children = (
+				4157AF7F12F1FB0400A8C6F5 /* MediaControls.cpp */,
+				4157AF7E12F1FB0400A8C6F5 /* MediaControls.h */,
+				A7FE819B12FA677700850C1E /* ProgressBarValueElement.h */,
 				4150F9F012B6E0E70008C860 /* SliderThumbElement.cpp */,
 				4150F9EF12B6E0E70008C860 /* SliderThumbElement.h */,
 			);
@@ -13745,6 +13750,7 @@
 				6565814709D13043000E61D7 /* CSSValueKeywords.gperf */,
 				6565814809D13043000E61D7 /* CSSValueKeywords.h */,
 				E406F3FA1198304D009D59D6 /* DocTypeStrings.cpp */,
+				BC814A4112F8C34A007B2C32 /* HeaderDetection.h */,
 				A17C81200F2A5CF7005DAAEB /* HTMLElementFactory.cpp */,
 				A17C81210F2A5CF7005DAAEB /* HTMLElementFactory.h */,
 				A8BC04911214F69600B5F122 /* HTMLEntityTable.cpp */,
@@ -13951,12 +13957,17 @@
 				BC0B36A10CD3C67C00AC7EB5 /* Console.cpp */,
 				BC0B36A20CD3C67C00AC7EB5 /* Console.h */,
 				BC0B36A30CD3C67C00AC7EB5 /* Console.idl */,
+				97C471D912F925BC0086354B /* ContentSecurityPolicy.cpp */,
+				97C471DA12F925BD0086354B /* ContentSecurityPolicy.h */,
 				065AD4F20B0C2EDA005A2B1D /* ContextMenuClient.h */,
 				065AD4F30B0C2EDA005A2B1D /* ContextMenuController.cpp */,
 				065AD4F40B0C2EDA005A2B1D /* ContextMenuController.h */,
 				7ADE722510CBBB9B006B3B3A /* ContextMenuProvider.h */,
 				FE6FD4850F676E5700092873 /* Coordinates.h */,
 				FE6FD4860F676E5700092873 /* Coordinates.idl */,
+				975CA287130365F800E99AD9 /* Crypto.cpp */,
+				975CA288130365F800E99AD9 /* Crypto.h */,
+				975CA289130365F800E99AD9 /* Crypto.idl */,
 				BC5A86810C33676000EEA649 /* DOMSelection.cpp */,
 				BC5A86820C33676000EEA649 /* DOMSelection.h */,
 				BC5A86830C33676000EEA649 /* DOMSelection.idl */,
@@ -14083,8 +14094,6 @@
 				E1271A130EEEC80400F61213 /* WorkerNavigator.cpp */,
 				E1271A0A0EEEC77A00F61213 /* WorkerNavigator.h */,
 				E1271A510EEECD1C00F61213 /* WorkerNavigator.idl */,
-				97DD4D840FDF4D6D00ECF9A4 /* XSSAuditor.cpp */,
-				97DD4D850FDF4D6E00ECF9A4 /* XSSAuditor.h */,
 			);
 			path = page;
 			sourceTree = "<group>";
@@ -15929,6 +15938,8 @@
 				977B385B122883E900B81FF8 /* HTMLScriptRunner.cpp */,
 				977B385C122883E900B81FF8 /* HTMLScriptRunner.h */,
 				977B385D122883E900B81FF8 /* HTMLScriptRunnerHost.h */,
+				977E2DCB12F0E28300C13379 /* HTMLSourceTracker.cpp */,
+				977E2DCC12F0E28300C13379 /* HTMLSourceTracker.h */,
 				97C1F552122855CB00EDE616 /* HTMLToken.h */,
 				977B385E122883E900B81FF8 /* HTMLTokenizer.cpp */,
 				977B385F122883E900B81FF8 /* HTMLTokenizer.h */,
@@ -15941,6 +15952,8 @@
 				97BC84821236FD93000C6161 /* TextDocumentParser.h */,
 				97BC84A212370DC7000C6161 /* TextViewSourceParser.cpp */,
 				97BC84A312370DC8000C6161 /* TextViewSourceParser.h */,
+				977E2E0B12F0FC9C00C13379 /* XSSFilter.cpp */,
+				977E2E0C12F0FC9C00C13379 /* XSSFilter.h */,
 			);
 			name = parser;
 			sourceTree = "<group>";
@@ -15966,6 +15979,9 @@
 		A75E8B7F0E1DE2B0007F2481 /* filters */ = {
 			isa = PBXGroup;
 			children = (
+				A1E1154713015C5D0054AC8C /* SpotLightSource.cpp */,
+				A1E1154513015C4E0054AC8C /* PointLightSource.cpp */,
+				A1E1154313015C3D0054AC8C /* DistantLightSource.cpp */,
 				84730D5A1248F0B300D3A9C9 /* DistantLightSource.h */,
 				A75E8B800E1DE2D6007F2481 /* FEBlend.cpp */,
 				A75E8B810E1DE2D6007F2481 /* FEBlend.h */,
@@ -17459,11 +17475,13 @@
 				B2C3DA580D006CD600EF6F26 /* FontFamily.cpp */,
 				B2C3DA590D006CD600EF6F26 /* FontFamily.h */,
 				72626E010EF022FE00A07E20 /* FontFastPath.cpp */,
+				0845680712B90DA600960A9F /* FontMetrics.h */,
 				F7A034C3126BF6BE007DC19E /* FontOrientation.h */,
 				37ACCE410DA2980F0089E602 /* FontRenderingMode.h */,
 				B2C3DA5A0D006CD600EF6F26 /* FontSelector.h */,
 				37202198106213C600F25C4B /* FontSmoothingMode.h */,
 				3784C34A0E11AA34007D8D48 /* FontTraitsMask.h */,
+				BCE4413512F7490B009B84B8 /* FontWidthVariant.h */,
 				BCE04C930DAFF902007A0F41 /* GeneratedImage.cpp */,
 				BC23F0DA0DAFF4A4009FDC91 /* GeneratedImage.h */,
 				BCE04C890DAFF7A0007A0F41 /* Generator.h */,
@@ -17492,6 +17510,7 @@
 				E462A4A0113E71BE004A4220 /* IntPointHash.h */,
 				B27535450B053814002CE64F /* IntRect.cpp */,
 				B27535460B053814002CE64F /* IntRect.h */,
+				E134F5AA12EE343F004EC58D /* IntRectHash.h */,
 				B27535470B053814002CE64F /* IntSize.h */,
 				B27535480B053814002CE64F /* IntSizeHash.h */,
 				E4B41E0C0CBF90BD00AF2ECE /* MediaPlayer.cpp */,
@@ -17507,6 +17526,8 @@
 				A73F95FD12C97BFE0031AAF9 /* RoundedIntRect.h */,
 				371F4FFB0D25E7F300ECE0D5 /* SegmentedFontData.cpp */,
 				371F4FFA0D25E7F300ECE0D5 /* SegmentedFontData.h */,
+				0F3DD44D12F5EA1B000D9190 /* ShadowBlur.cpp */,
+				0F3DD44E12F5EA1B000D9190 /* ShadowBlur.h */,
 				B2C3DA530D006CD600EF6F26 /* SimpleFontData.cpp */,
 				B2C3DA540D006CD600EF6F26 /* SimpleFontData.h */,
 				B23540F00D00782E002382FA /* StringTruncator.cpp */,
@@ -17545,10 +17566,11 @@
 				B2C3D9F20D006C1D00EF6F26 /* BidiContext.cpp */,
 				B2C3D9F30D006C1D00EF6F26 /* BidiContext.h */,
 				B2C3D9F40D006C1D00EF6F26 /* BidiResolver.h */,
-				B2C3D9F50D006C1D00EF6F26 /* CharacterNames.h */,
 				375CD231119D43C800A2A859 /* Hyphenation.h */,
 				89B5EA9F11E8003D00F2367E /* LineEnding.cpp */,
 				89B5EAA011E8003D00F2367E /* LineEnding.h */,
+				F5142C68123F12B000F5BD4C /* LocalizedNumber.h */,
+				F5142C6A123F12C500F5BD4C /* LocalizedNumberNone.cpp */,
 				BC76AC110DD7AD5C00415F34 /* ParserUtilities.h */,
 				B2C3D9FB0D006C1D00EF6F26 /* PlatformString.h */,
 				B2C3D9FC0D006C1D00EF6F26 /* RegularExpression.cpp */,
@@ -17572,6 +17594,8 @@
 				B2C3DA100D006C1D00EF6F26 /* TextCodecUserDefined.h */,
 				B2C3DA110D006C1D00EF6F26 /* TextCodecUTF16.cpp */,
 				B2C3DA120D006C1D00EF6F26 /* TextCodecUTF16.h */,
+				9343CB7F12F25E510033C5EE /* TextCodecUTF8.cpp */,
+				9343CB8012F25E510033C5EE /* TextCodecUTF8.h */,
 				B2C3DA150D006C1D00EF6F26 /* TextDirection.h */,
 				B2C3DA160D006C1D00EF6F26 /* TextEncoding.cpp */,
 				B2C3DA170D006C1D00EF6F26 /* TextEncoding.h */,
@@ -17728,6 +17752,7 @@
 				3314ACEA10892086000F0E56 /* JSExceptionBase.h */,
 				8F934D841189F1EE00508D5D /* JSMainThreadExecState.cpp */,
 				8F934D831189F1EE00508D5D /* JSMainThreadExecState.h */,
+				9FDC8FF112FAB0060099AB1C /* JSMemoryInfoCustom.cpp */,
 				93B70D4F09EB0C7C009D8468 /* JSPluginElementFunctions.cpp */,
 				93B70D5009EB0C7C009D8468 /* JSPluginElementFunctions.h */,
 				14CD8D81106B529000A46D23 /* JSSharedWorkerCustom.cpp */,
@@ -18020,6 +18045,8 @@
 				BC124EFE0C26447A009E2349 /* JSBarInfo.h */,
 				BC98543B0CD3D98B00069BC1 /* JSConsole.cpp */,
 				BC98543C0CD3D98B00069BC1 /* JSConsole.h */,
+				975CA29F1303679D00E99AD9 /* JSCrypto.cpp */,
+				975CA2A01303679D00E99AD9 /* JSCrypto.h */,
 				BC5A86B30C3367E800EEA649 /* JSDOMSelection.cpp */,
 				BC5A86B40C3367E800EEA649 /* JSDOMSelection.h */,
 				1403BA0B09EB18C700797C7F /* JSDOMWindow.cpp */,
@@ -18275,6 +18302,7 @@
 				BC772C4C0C4EB3040083285F /* MIMETypeRegistry.cpp */,
 				BC772C4D0C4EB3040083285F /* MIMETypeRegistry.h */,
 				4B2708C50AF19EE40065127F /* Pasteboard.h */,
+				BC9585DF12F0989500755821 /* PlatformGestureEvent.h */,
 				935C476609AC4D4300A6AAB4 /* PlatformKeyboardEvent.h */,
 				932871BF0B20DEB70049035A /* PlatformMenuDescription.h */,
 				935C476709AC4D4300A6AAB4 /* PlatformMouseEvent.h */,
@@ -18323,6 +18351,7 @@
 				93309EA1099EB78C0056E581 /* Timer.cpp */,
 				9305B24C098F1B6B00C28855 /* Timer.h */,
 				1419D2C40CEA6F6100FF507A /* TreeShared.h */,
+				971491D912FD65E8001BFEB1 /* URLString.h */,
 				2E3BBF051162DA1100B9409A /* UUID.cpp */,
 				2E3BBF061162DA1100B9409A /* UUID.h */,
 				515788C01207852C00A37C4A /* VisitedLinkStrategy.h */,
@@ -18714,6 +18743,8 @@
 				BCEA4825097D93020094C9E4 /* RenderBR.h */,
 				BCEA4826097D93020094C9E4 /* RenderButton.cpp */,
 				BCEA4827097D93020094C9E4 /* RenderButton.h */,
+				BCE4413112F748E2009B84B8 /* RenderCombineText.cpp */,
+				BCE4413212F748E2009B84B8 /* RenderCombineText.h */,
 				9392F1430AD185FE00691BD4 /* RenderCounter.cpp */,
 				9392F1410AD185F400691BD4 /* RenderCounter.h */,
 				BC77CEC70FF01CBE0070887B /* RenderDataGrid.cpp */,
@@ -18950,6 +18981,8 @@
 				ED2BA83B09A24B91006C0AC4 /* DocumentMarker.h */,
 				CE057FA31220731100A476D5 /* DocumentMarkerController.cpp */,
 				CE057FA41220731100A476D5 /* DocumentMarkerController.h */,
+				14947FFB12F80CD200A0F631 /* DocumentOrderedMap.cpp */,
+				14947FFC12F80CD200A0F631 /* DocumentOrderedMap.h */,
 				A8C2280D11D4A59700D5A7D3 /* DocumentParser.cpp */,
 				BCCFBAE70B5152ED0001F1D7 /* DocumentParser.h */,
 				86D982F6125C154000AD9E3D /* DocumentTiming.h */,
@@ -19570,7 +19603,6 @@
 				6550B69E099DF0270090D781 /* CDATASection.h in Headers */,
 				514185EE0CD65F0400763C99 /* ChangeVersionWrapper.h in Headers */,
 				6550B6A0099DF0270090D781 /* CharacterData.h in Headers */,
-				B2C3DA260D006C1D00EF6F26 /* CharacterNames.h in Headers */,
 				B2C3DA2A0D006C1D00EF6F26 /* CharsetData.h in Headers */,
 				F55B3DB21251F12D003EF269 /* CheckboxInputType.h in Headers */,
 				A00B721A11DE6428008AB9FF /* CheckedInt.h in Headers */,
@@ -19608,6 +19640,7 @@
 				A818721C0977D3C0005826D9 /* ContainerNode.h in Headers */,
 				E1A1470811102B1500EEC0F3 /* ContainerNodeAlgorithms.h in Headers */,
 				BC5EB9810E82072500B25965 /* ContentData.h in Headers */,
+				97C471DC12F925BD0086354B /* ContentSecurityPolicy.h in Headers */,
 				41D015CA0F4B5C71004A662F /* ContentType.h in Headers */,
 				93B6A0E60B0BCA5C00F5027A /* ContextMenu.h in Headers */,
 				065AD4F50B0C2EDA005A2B1D /* ContextMenuClient.h in Headers */,
@@ -19745,6 +19778,7 @@
 				8A12E35D11FA33280025836A /* DocumentLoadTiming.h in Headers */,
 				ED2BA83C09A24B91006C0AC4 /* DocumentMarker.h in Headers */,
 				CE057FA61220731100A476D5 /* DocumentMarkerController.h in Headers */,
+				14947FFE12F80CD200A0F631 /* DocumentOrderedMap.h in Headers */,
 				BCCFBAE80B5152ED0001F1D7 /* DocumentParser.h in Headers */,
 				0B90561A0F2578BF0095FF6A /* DocumentThreadableLoader.h in Headers */,
 				86D982F7125C154000AD9E3D /* DocumentTiming.h in Headers */,
@@ -20630,6 +20664,7 @@
 				B2C3DA680D006CD600EF6F26 /* FontFallbackList.h in Headers */,
 				B2C3DA6A0D006CD600EF6F26 /* FontFamily.h in Headers */,
 				A80E6CF30A1989CA007FB8C5 /* FontFamilyValue.h in Headers */,
+				0845680812B90DA600960A9F /* FontMetrics.h in Headers */,
 				F7A034C4126BF6BE007DC19E /* FontOrientation.h in Headers */,
 				B5320D6B122A24E9002D1440 /* FontPlatformData.h in Headers */,
 				37ACCE420DA2980F0089E602 /* FontRenderingMode.h in Headers */,
@@ -20638,6 +20673,7 @@
 				3784C34B0E11AA34007D8D48 /* FontTraitsMask.h in Headers */,
 				B734B183119B991D006587BD /* FontTranscoder.h in Headers */,
 				A80E6CED0A1989CA007FB8C5 /* FontValue.h in Headers */,
+				BCE4413612F7490B009B84B8 /* FontWidthVariant.h in Headers */,
 				4A0DA2FF129B241900AB61E1 /* FormAssociatedElement.h in Headers */,
 				D05CED2A0A40BB2C00C5AF38 /* FormatBlockCommand.h in Headers */,
 				514C76700CE923A1007EF3CD /* FormData.h in Headers */,
@@ -20797,6 +20833,7 @@
 				977B3876122883E900B81FF8 /* HTMLScriptRunnerHost.h in Headers */,
 				A81369D8097374F600D74463 /* HTMLSelectElement.h in Headers */,
 				E44613A80CD6331000FADA75 /* HTMLSourceElement.h in Headers */,
+				977E2DCE12F0E28300C13379 /* HTMLSourceTracker.h in Headers */,
 				A871DC230A15205700B12A68 /* HTMLStyleElement.h in Headers */,
 				A871DB2B0A150BD600B12A68 /* HTMLTableCaptionElement.h in Headers */,
 				A871DB2A0A150BD600B12A68 /* HTMLTableCellElement.h in Headers */,
@@ -20881,20 +20918,22 @@
 				93309DEE099E64920056E581 /* InsertNodeBeforeCommand.h in Headers */,
 				93309DF0099E64920056E581 /* InsertParagraphSeparatorCommand.h in Headers */,
 				93309DF2099E64920056E581 /* InsertTextCommand.h in Headers */,
+				4F2D205412EAE7B3005C2874 /* InspectorAgent.h in Headers */,
 				B885E8D511E06DD2009FFBF4 /* InspectorApplicationCacheAgent.h in Headers */,
 				4F707A9A11EF679400ACDA69 /* InspectorBackendDispatcher.h in Headers */,
 				F3D4C47912E07663003DA150 /* InspectorBrowserDebuggerAgent.h in Headers */,
 				1C81B95C0E97330800266E07 /* InspectorClient.h in Headers */,
 				F3335BF912E07DC300D33011 /* InspectorConsoleAgent.h in Headers */,
+				F3F5CF1112ED81A80084C569 /* InspectorConsoleInstrumentation.h in Headers */,
 				1C81B95A0E97330800266E07 /* InspectorController.h in Headers */,
 				82AB1744124B99EC00C5069D /* InspectorCSSAgent.h in Headers */,
 				7AB0B1C11211A62200A76940 /* InspectorDatabaseAgent.h in Headers */,
+				F3F5CF1312ED81B30084C569 /* InspectorDatabaseInstrumentation.h in Headers */,
 				41F062140F5F192600A07EAC /* InspectorDatabaseResource.h in Headers */,
 				F33F053E120B0DA500E5743A /* InspectorDebuggerAgent.h in Headers */,
 				7A24587C1021EAF4000A00AA /* InspectorDOMAgent.h in Headers */,
 				7A74ECBB101839A600BF939E /* InspectorDOMStorageAgent.h in Headers */,
 				41F061740F5F00AC00A07EAC /* InspectorDOMStorageResource.h in Headers */,
-				3888F6EF128C9889000CA8E0 /* InspectorFileSystemAgent.h in Headers */,
 				F344C7141125B82C00F26EEE /* InspectorFrontendClient.h in Headers */,
 				F344C75311294D9D00F26EEE /* InspectorFrontendClientLocal.h in Headers */,
 				7A0E770F10C00A8800A0276E /* InspectorFrontendHost.h in Headers */,
@@ -20902,7 +20941,6 @@
 				9F0D6B2F121BFEBA006C0288 /* InspectorProfilerAgent.h in Headers */,
 				82AB1776125C826700C5069D /* InspectorResourceAgent.h in Headers */,
 				7AF11A5A12E727490061F23C /* InspectorRuntimeAgent.h in Headers */,
-				7A5640C012DF9E5E00F4536D /* InspectorSettings.h in Headers */,
 				4FA3B90B125CD12200300BAD /* InspectorState.h in Headers */,
 				82AB1774125C826700C5069D /* InspectorStyleSheet.h in Headers */,
 				754133A8102E00E800075D00 /* InspectorTimelineAgent.h in Headers */,
@@ -20915,6 +20953,7 @@
 				B27535720B053814002CE64F /* IntPoint.h in Headers */,
 				E462A4A1113E71BE004A4220 /* IntPointHash.h in Headers */,
 				B27535740B053814002CE64F /* IntRect.h in Headers */,
+				E134F5AB12EE343F004EC58D /* IntRectHash.h in Headers */,
 				B27535750B053814002CE64F /* IntSize.h in Headers */,
 				B27535760B053814002CE64F /* IntSizeHash.h in Headers */,
 				F55B3DC41251F12D003EF269 /* IsIndexInputType.h in Headers */,
@@ -21447,6 +21486,7 @@
 				06E81ED70AB5D5E900C87837 /* LocalCurrentGraphicsContext.h in Headers */,
 				89878568122CA064003AABDA /* LocalFileSystem.h in Headers */,
 				BC5CFCA911F793320099ED09 /* LocalizationStrategy.h in Headers */,
+				F5142C69123F12B000F5BD4C /* LocalizedNumber.h in Headers */,
 				935207BE09BD410A00F2038D /* LocalizedStrings.h in Headers */,
 				511F23180DC160DA004F0032 /* LocalStorageTask.h in Headers */,
 				511F231A0DC160DA004F0032 /* LocalStorageThread.h in Headers */,
@@ -21472,6 +21512,7 @@
 				49E911C70EF86D47009D0CAF /* MatrixTransformOperation.h in Headers */,
 				931BCC611124DFCB00BE70DD /* MediaCanStartListener.h in Headers */,
 				ABFE7E130D32FAF60066F4D2 /* MediaControlElements.h in Headers */,
+				4157AF8012F1FB0400A8C6F5 /* MediaControls.h in Headers */,
 				97205AB81239291000B17380 /* MediaDocument.h in Headers */,
 				E44613AD0CD6331000FADA75 /* MediaError.h in Headers */,
 				4E1959220A39DABA00220FE5 /* MediaFeatureNames.h in Headers */,
@@ -21583,6 +21624,7 @@
 				499B3EDD128DB50200E726C2 /* PlatformCAAnimation.h in Headers */,
 				499B3EC5128CCC4700E726C2 /* PlatformCALayer.h in Headers */,
 				493E5E0912D6420500020081 /* PlatformCALayerClient.h in Headers */,
+				BC9585E112F0989500755821 /* PlatformGestureEvent.h in Headers */,
 				935C476809AC4D4300A6AAB4 /* PlatformKeyboardEvent.h in Headers */,
 				932871C00B20DEB70049035A /* PlatformMenuDescription.h in Headers */,
 				41BF70100FE86F61005E8DEC /* PlatformMessagePortChannel.h in Headers */,
@@ -21619,6 +21661,7 @@
 				FE80D7D10E9C1F25000D6F75 /* PositionOptions.h in Headers */,
 				B71FE6DF11091CB300DAEF77 /* PrintContext.h in Headers */,
 				A8EA7EBC0A1945D000A8EF5F /* ProcessingInstruction.h in Headers */,
+				A7FE819C12FA677700850C1E /* ProgressBarValueElement.h in Headers */,
 				E44613EC0CD681B500FADA75 /* ProgressEvent.h in Headers */,
 				1A2A68240B5BEDE70002A480 /* ProgressTracker.h in Headers */,
 				514C76750CE923A1007EF3CD /* ProtectionSpace.h in Headers */,
@@ -21650,6 +21693,7 @@
 				BC96DB430F3A880E00573CB3 /* RenderBoxModelObject.h in Headers */,
 				BCEA4864097D93020094C9E4 /* RenderBR.h in Headers */,
 				BCEA4866097D93020094C9E4 /* RenderButton.h in Headers */,
+				BCE4413412F748E2009B84B8 /* RenderCombineText.h in Headers */,
 				9392F1420AD185F400691BD4 /* RenderCounter.h in Headers */,
 				BC77CEB30FF017F20070887B /* RenderDataGrid.h in Headers */,
 				D302754812A5FE84004BD828 /* RenderDetails.h in Headers */,
@@ -21824,6 +21868,7 @@
 				41C760B10EDE03D300C1655F /* ScriptState.h in Headers */,
 				934CC0E20ED39D6F00A658F2 /* ScriptValue.h in Headers */,
 				228C284510D82500009D0D0E /* ScriptWrappable.h in Headers */,
+				BC8AE34F12EA096A00EB3AE6 /* ScrollableArea.h in Headers */,
 				CA3BF67E10D99BAE00E6CE53 /* ScrollAnimator.h in Headers */,
 				BCAE1FA712939DB7004CB026 /* ScrollAnimatorMac.h in Headers */,
 				93F199B808245E59001E9ABC /* Scrollbar.h in Headers */,
@@ -21848,6 +21893,7 @@
 				93309E10099E64920056E581 /* SetNodeAttributeCommand.h in Headers */,
 				93F1994F08245E59001E9ABC /* Settings.h in Headers */,
 				498770E91242C535002226BA /* Shader.h in Headers */,
+				0F3DD45012F5EA1B000D9190 /* ShadowBlur.h in Headers */,
 				BC5EB8C40E82031B00B25965 /* ShadowData.h in Headers */,
 				A7F338A411C0EFCA00A320A7 /* ShadowElement.h in Headers */,
 				A80E6CE80A1989CA007FB8C5 /* ShadowValue.h in Headers */,
@@ -22246,6 +22292,7 @@
 				E4AFCFA50DAF29A300F5F55C /* UnitBezier.h in Headers */,
 				D086FE9809D53AAB005BC74D /* UnlinkCommand.h in Headers */,
 				F55B3DDE1251F12D003EF269 /* URLInputType.h in Headers */,
+				971491DA12FD65E8001BFEB1 /* URLString.h in Headers */,
 				656581B209D14EE6000E61D7 /* UserAgentStyleSheets.h in Headers */,
 				003F1FEA11E6AB43008258D9 /* UserContentTypes.h in Headers */,
 				BCACF3BD1072921A00C0C8A3 /* UserContentURLPattern.h in Headers */,
@@ -22409,8 +22456,10 @@
 				E1F1E8300C3C2BB9006DB391 /* XSLTExtensions.h in Headers */,
 				93F199ED08245E59001E9ABC /* XSLTProcessor.h in Headers */,
 				E1BE512E0CF6C512002EA959 /* XSLTUnicodeSort.h in Headers */,
-				97DD4D870FDF4D6E00ECF9A4 /* XSSAuditor.h in Headers */,
-				BC8AE34F12EA096A00EB3AE6 /* ScrollableArea.h in Headers */,
+				9343CB8212F25E510033C5EE /* TextCodecUTF8.h in Headers */,
+				977E2E0F12F0FC9C00C13379 /* XSSFilter.h in Headers */,
+				975CA28B130365F800E99AD9 /* Crypto.h in Headers */,
+				975CA2A21303679D00E99AD9 /* JSCrypto.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -22523,7 +22572,6 @@
 				85136CA20AED665900F90A3D /* northWestResizeCursor.png in Resources */,
 				85136CA30AED665900F90A3D /* northWestSouthEastResizeCursor.png in Resources */,
 				464EA2740B8A350B00A8E6E3 /* notAllowedCursor.png in Resources */,
-				9001774212E0347800648462 /* OESStandardDerivatives.idl in Resources */,
 				46F9D5DF0B0D60170028EE36 /* progressCursor.png in Resources */,
 				85136CA40AED665900F90A3D /* southEastResizeCursor.png in Resources */,
 				85136CA50AED665900F90A3D /* southResizeCursor.png in Resources */,
@@ -22588,7 +22636,7 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "if [ \"${ACTION}\" = \"installhdrs\" ]; then\n    exit 0;\nfi\n\nif [ -f ../Tools/Scripts/check-for-weak-vtables-and-externals ]; then\n    ../Tools/Scripts/check-for-weak-vtables-and-externals || exit $?\nfi";
+			shellScript = "if [ \"${ACTION}\" = \"installhdrs\" ]; then\n    exit 0;\nfi\n\nif [ -f ../../Tools/Scripts/check-for-weak-vtables-and-externals ]; then\n    ../../Tools/Scripts/check-for-weak-vtables-and-externals || exit $?\nfi";
 		};
 		5D2F7DA00C6879C600B5B72B /* Update Info.plist with version information */ = {
 			isa = PBXShellScriptBuildPhase;
@@ -22649,7 +22697,7 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "if [ \"${ACTION}\" = \"installhdrs\" ]; then\n    exit 0;\nfi\n\nif [ -f ../Tools/Scripts/check-for-inappropriate-files-in-framework ]; then\n    ../Tools/Scripts/check-for-inappropriate-files-in-framework || exit $?\nfi\n";
+			shellScript = "if [ \"${ACTION}\" = \"installhdrs\" ]; then\n    exit 0;\nfi\n\nif [ -f ../../Tools/Scripts/check-for-inappropriate-files-in-framework ]; then\n    ../../Tools/Scripts/check-for-inappropriate-files-in-framework || exit $?\nfi\n";
 		};
 		933457E60EBFDF6B00B80894 /* Check For Exit Time Destructors */ = {
 			isa = PBXShellScriptBuildPhase;
@@ -22664,7 +22712,7 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "if [ \"${ACTION}\" = \"installhdrs\" ]; then\n    exit 0;\nfi\n\nif [ -f ../Tools/Scripts/check-for-exit-time-destructors ]; then\n    ../Tools/Scripts/check-for-exit-time-destructors || exit $?\nfi";
+			shellScript = "if [ \"${ACTION}\" = \"installhdrs\" ]; then\n    exit 0;\nfi\n\nif [ -f ../../Tools/Scripts/check-for-exit-time-destructors ]; then\n    ../../Tools/Scripts/check-for-exit-time-destructors || exit $?\nfi";
 		};
 		939D050109D9FF6B00984996 /* Check For Global Initializers */ = {
 			isa = PBXShellScriptBuildPhase;
@@ -22679,7 +22727,7 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "if [ \"${ACTION}\" = \"installhdrs\" ]; then\n    exit 0;\nfi\n\nif [ -f ../Tools/Scripts/check-for-global-initializers ]; then\n    ../Tools/Scripts/check-for-global-initializers || exit $?\nfi";
+			shellScript = "if [ \"${ACTION}\" = \"installhdrs\" ]; then\n    exit 0;\nfi\n\nif [ -f ../../Tools/Scripts/check-for-global-initializers ]; then\n    ../../Tools/Scripts/check-for-global-initializers || exit $?\nfi";
 		};
 		DD041FBD09D9DDBE0010AF2A /* Generate Derived Sources */ = {
 			isa = PBXShellScriptBuildPhase;
@@ -22712,30 +22760,12 @@
 			files = (
 				B5B5DC69119BB3D5002A8790 /* AbstractDatabase.cpp in Sources */,
 				41E1B1D00FF5986900576B3B /* AbstractWorker.cpp in Sources */,
-				29A812280FBB9C1D00510293 /* AccessibilityARIAGrid.cpp in Sources */,
-				29A812300FBB9C1D00510293 /* AccessibilityARIAGridCell.cpp in Sources */,
-				29A8122D0FBB9C1D00510293 /* AccessibilityARIAGridRow.cpp in Sources */,
-				29A8123A0FBB9C1D00510293 /* AccessibilityImageMapLink.cpp in Sources */,
-				29A8122F0FBB9C1D00510293 /* AccessibilityList.cpp in Sources */,
-				29A8123E0FBB9C1D00510293 /* AccessibilityListBox.cpp in Sources */,
-				29A8123D0FBB9C1D00510293 /* AccessibilityListBoxOption.cpp in Sources */,
-				07B0113D1032241900FBDC33 /* AccessibilityMediaControls.cpp in Sources */,
 				76CDD2F21103DA6600680521 /* AccessibilityMenuList.cpp in Sources */,
 				76CDD2F61103DA6600680521 /* AccessibilityMenuListOption.cpp in Sources */,
 				76CDD2F41103DA6600680521 /* AccessibilityMenuListPopup.cpp in Sources */,
-				29A8123C0FBB9C1D00510293 /* AccessibilityObject.cpp in Sources */,
 				29A812480FBB9CA900510293 /* AccessibilityObjectMac.mm in Sources */,
 				29A8124A0FBB9CA900510293 /* AccessibilityObjectWrapper.mm in Sources */,
 				A409C984116D0DDD007197BD /* AccessibilityProgressIndicator.cpp in Sources */,
-				29A812260FBB9C1D00510293 /* AccessibilityRenderObject.cpp in Sources */,
-				93C4F6EA1108F9A50099D0DB /* AccessibilityScrollbar.cpp in Sources */,
-				29489FC812C00F0300D83F0F /* AccessibilityScrollView.cpp in Sources */,
-				0709FC4C1025DED80059CDBA /* AccessibilitySlider.cpp in Sources */,
-				29A812270FBB9C1D00510293 /* AccessibilityTable.cpp in Sources */,
-				29A8122A0FBB9C1D00510293 /* AccessibilityTableCell.cpp in Sources */,
-				29A812350FBB9C1D00510293 /* AccessibilityTableColumn.cpp in Sources */,
-				29A812400FBB9C1D00510293 /* AccessibilityTableHeaderContainer.cpp in Sources */,
-				29A812290FBB9C1D00510293 /* AccessibilityTableRow.cpp in Sources */,
 				B5D31DFA11CF610B009F22B4 /* ActiveDOMCallback.cpp in Sources */,
 				E1C4DE6E0EA75C650023CCD6 /* ActiveDOMObject.cpp in Sources */,
 				84D0C4041115F1D40018AA34 /* AffineTransform.cpp in Sources */,
@@ -22792,7 +22822,6 @@
 				514C764D0CE9234E007EF3CD /* AuthenticationMac.mm in Sources */,
 				51E1ECAF0C91C54600DC255B /* AutodrainedPool.mm in Sources */,
 				A8CFF0500A154F09000A4234 /* AutoTableLayout.cpp in Sources */,
-				29A812370FBB9C1D00510293 /* AXObjectCache.cpp in Sources */,
 				29A8124B0FBB9CA900510293 /* AXObjectCacheMac.mm in Sources */,
 				BCA8C81F11E3D36900812FB7 /* BackForwardController.cpp in Sources */,
 				BCA8CA5F11E4E6D100812FB7 /* BackForwardListImpl.cpp in Sources */,
@@ -22882,6 +22911,7 @@
 				41F0618F0F5F069800A07EAC /* ConsoleMessage.cpp in Sources */,
 				A818721F0977D3C0005826D9 /* ContainerNode.cpp in Sources */,
 				BC5EB9800E82072500B25965 /* ContentData.cpp in Sources */,
+				97C471DB12F925BD0086354B /* ContentSecurityPolicy.cpp in Sources */,
 				41D015CB0F4B5C71004A662F /* ContentType.cpp in Sources */,
 				065AD4F60B0C2EDA005A2B1D /* ContextMenuController.cpp in Sources */,
 				06027CB30B1CC03D00884B2D /* ContextMenuItemMac.mm in Sources */,
@@ -22995,6 +23025,7 @@
 				93E227E00AF589AD00D48324 /* DocumentLoader.cpp in Sources */,
 				1C26497A0D7E248A00BD10F2 /* DocumentLoaderMac.cpp in Sources */,
 				CE057FA51220731100A476D5 /* DocumentMarkerController.cpp in Sources */,
+				14947FFD12F80CD200A0F631 /* DocumentOrderedMap.cpp in Sources */,
 				A8C2280E11D4A59700D5A7D3 /* DocumentParser.cpp in Sources */,
 				0B9056190F2578BE0095FF6A /* DocumentThreadableLoader.cpp in Sources */,
 				A8185F3A09765766005826D9 /* DocumentType.cpp in Sources */,
@@ -23549,6 +23580,7 @@
 				977B3874122883E900B81FF8 /* HTMLScriptRunner.cpp in Sources */,
 				A81369D9097374F600D74463 /* HTMLSelectElement.cpp in Sources */,
 				E44613A70CD6331000FADA75 /* HTMLSourceElement.cpp in Sources */,
+				977E2DCD12F0E28300C13379 /* HTMLSourceTracker.cpp in Sources */,
 				A871DC260A15205700B12A68 /* HTMLStyleElement.cpp in Sources */,
 				A871DB320A150BD600B12A68 /* HTMLTableCaptionElement.cpp in Sources */,
 				A871DB2E0A150BD600B12A68 /* HTMLTableCellElement.cpp in Sources */,
@@ -23622,6 +23654,7 @@
 				93309DED099E64920056E581 /* InsertNodeBeforeCommand.cpp in Sources */,
 				93309DEF099E64920056E581 /* InsertParagraphSeparatorCommand.cpp in Sources */,
 				93309DF1099E64920056E581 /* InsertTextCommand.cpp in Sources */,
+				4F2D205512EAE7B3005C2874 /* InspectorAgent.cpp in Sources */,
 				B885E8D411E06DD2009FFBF4 /* InspectorApplicationCacheAgent.cpp in Sources */,
 				4F707A9911EF679400ACDA69 /* InspectorBackendDispatcher.cpp in Sources */,
 				F3D4C47812E07663003DA150 /* InspectorBrowserDebuggerAgent.cpp in Sources */,
@@ -23635,7 +23668,6 @@
 				7A24587B1021EAF4000A00AA /* InspectorDOMAgent.cpp in Sources */,
 				7A74ECBA101839A600BF939E /* InspectorDOMStorageAgent.cpp in Sources */,
 				41F061750F5F00AC00A07EAC /* InspectorDOMStorageResource.cpp in Sources */,
-				3888F6EE128C9889000CA8E0 /* InspectorFileSystemAgent.cpp in Sources */,
 				4F4F5FFB11CBD2E100A186BF /* InspectorFrontend.cpp in Sources */,
 				F344C75811294FF600F26EEE /* InspectorFrontendClientLocal.cpp in Sources */,
 				7A0E770E10C00A8800A0276E /* InspectorFrontendHost.cpp in Sources */,
@@ -23643,7 +23675,6 @@
 				9F0D6B2E121BFEBA006C0288 /* InspectorProfilerAgent.cpp in Sources */,
 				82AB1775125C826700C5069D /* InspectorResourceAgent.cpp in Sources */,
 				7AA365EE12E7265400DCA242 /* InspectorRuntimeAgent.cpp in Sources */,
-				7A5640BF12DF9E5E00F4536D /* InspectorSettings.cpp in Sources */,
 				4FA3B90A125CD12200300BAD /* InspectorState.cpp in Sources */,
 				82AB1773125C826700C5069D /* InspectorStyleSheet.cpp in Sources */,
 				754133AA102E00F400075D00 /* InspectorTimelineAgent.cpp in Sources */,
@@ -23993,6 +24024,7 @@
 				BC3C39B60C0D3D8D005F4D7A /* JSMediaList.cpp in Sources */,
 				D3A94A46122DC40F00A37BBC /* JSMediaQueryList.cpp in Sources */,
 				9FFE3EA511B5A4390037874E /* JSMemoryInfo.cpp in Sources */,
+				9FDC8FF212FAB0060099AB1C /* JSMemoryInfoCustom.cpp in Sources */,
 				E107400D0E77BDC00033AF24 /* JSMessageChannel.cpp in Sources */,
 				E1A5F99B0E7EAA2500AF85EA /* JSMessageChannelCustom.cpp in Sources */,
 				75793EC80D0CE72D007FC0AC /* JSMessageEvent.cpp in Sources */,
@@ -24295,6 +24327,7 @@
 				7EE6846812D26E3800E79415 /* LoaderRunLoopCF.cpp in Sources */,
 				06E81EEC0AB5DA9700C87837 /* LocalCurrentGraphicsContext.mm in Sources */,
 				89878567122CA064003AABDA /* LocalFileSystem.cpp in Sources */,
+				F5142C6B123F12C500F5BD4C /* LocalizedNumberNone.cpp in Sources */,
 				C046E1AC1208A9FE00BA2CF7 /* LocalizedStrings.cpp in Sources */,
 				511F23170DC160DA004F0032 /* LocalStorageTask.cpp in Sources */,
 				511F23190DC160DA004F0032 /* LocalStorageThread.cpp in Sources */,
@@ -24318,6 +24351,7 @@
 				49D5DC2B0F423A73008F20FD /* Matrix3DTransformOperation.cpp in Sources */,
 				49E911C60EF86D47009D0CAF /* MatrixTransformOperation.cpp in Sources */,
 				ABFE7E120D32FAF60066F4D2 /* MediaControlElements.cpp in Sources */,
+				4157AF8112F1FB0400A8C6F5 /* MediaControls.cpp in Sources */,
 				97205AB71239291000B17380 /* MediaDocument.cpp in Sources */,
 				4E1959210A39DABA00220FE5 /* MediaFeatureNames.cpp in Sources */,
 				A8EA80090A19516E00A8EF5F /* MediaList.cpp in Sources */,
@@ -24451,6 +24485,7 @@
 				BC96DB460F3A882200573CB3 /* RenderBoxModelObject.cpp in Sources */,
 				BCEA4863097D93020094C9E4 /* RenderBR.cpp in Sources */,
 				BCEA4865097D93020094C9E4 /* RenderButton.cpp in Sources */,
+				BCE4413312F748E2009B84B8 /* RenderCombineText.cpp in Sources */,
 				9392F1440AD185FE00691BD4 /* RenderCounter.cpp in Sources */,
 				BC77CEC80FF01CBE0070887B /* RenderDataGrid.cpp in Sources */,
 				D302754712A5FE84004BD828 /* RenderDetails.cpp in Sources */,
@@ -24599,7 +24634,6 @@
 				BCEC01BD0C274DAC009F4EC9 /* Screen.cpp in Sources */,
 				A84D82C211D3474800972990 /* ScriptableDocumentParser.cpp in Sources */,
 				F39BE95B12673BF400E0A674 /* ScriptArguments.cpp in Sources */,
-				200B190911C277D900DCCD3A /* ScriptBreakpoint.cpp in Sources */,
 				41F1D2200EF35C2A00DA8753 /* ScriptCachedFrameData.cpp in Sources */,
 				416E75CC0EDF90C700360E1D /* ScriptCallFrame.cpp in Sources */,
 				416E75BF0EDF8FD700360E1D /* ScriptCallStack.cpp in Sources */,
@@ -24618,6 +24652,7 @@
 				9F72305011184B4100AD0126 /* ScriptProfiler.cpp in Sources */,
 				4127D5370F8AAB1D00E424F5 /* ScriptState.cpp in Sources */,
 				934CC0E10ED39D6F00A658F2 /* ScriptValue.cpp in Sources */,
+				BC8AE34E12EA096A00EB3AE6 /* ScrollableArea.cpp in Sources */,
 				CA3BF67C10D99BAE00E6CE53 /* ScrollAnimator.cpp in Sources */,
 				BC51156E12B1749C00C96754 /* ScrollAnimatorMac.mm in Sources */,
 				BCAA90C30A7EBA60008B1229 /* Scrollbar.cpp in Sources */,
@@ -24640,6 +24675,7 @@
 				93309E0F099E64920056E581 /* SetNodeAttributeCommand.cpp in Sources */,
 				14C9A5EA0B3D105F005A0232 /* Settings.cpp in Sources */,
 				498770E81242C535002226BA /* Shader.cpp in Sources */,
+				0F3DD44F12F5EA1B000D9190 /* ShadowBlur.cpp in Sources */,
 				BC5EB8C30E82031B00B25965 /* ShadowData.cpp in Sources */,
 				A7F338A311C0EFCA00A320A7 /* ShadowElement.cpp in Sources */,
 				A80E6CF40A1989CA007FB8C5 /* ShadowValue.cpp in Sources */,
@@ -25104,8 +25140,14 @@
 				93F19B0408245E59001E9ABC /* XSLTProcessor.cpp in Sources */,
 				93F19B0508245E59001E9ABC /* XSLTProcessorLibxslt.cpp in Sources */,
 				E1BE512D0CF6C512002EA959 /* XSLTUnicodeSort.cpp in Sources */,
-				97DD4D860FDF4D6E00ECF9A4 /* XSSAuditor.cpp in Sources */,
-				BC8AE34E12EA096A00EB3AE6 /* ScrollableArea.cpp in Sources */,
+				9343CB8112F25E510033C5EE /* TextCodecUTF8.cpp in Sources */,
+				977E2E0E12F0FC9C00C13379 /* XSSFilter.cpp in Sources */,
+				0F29C16E1300C2E2002D794E /* AccessibilityAllInOne.cpp in Sources */,
+				975CA28A130365F800E99AD9 /* Crypto.cpp in Sources */,
+				975CA2A11303679D00E99AD9 /* JSCrypto.cpp in Sources */,
+				A1E1154413015C3D0054AC8C /* DistantLightSource.cpp in Sources */,
+				A1E1154613015C4E0054AC8C /* PointLightSource.cpp in Sources */,
+				A1E1154813015C5D0054AC8C /* SpotLightSource.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/WebCore/accessibility/AXObjectCache.h b/Source/WebCore/accessibility/AXObjectCache.h
index 00e7fbc..d2d40c1 100644
--- a/Source/WebCore/accessibility/AXObjectCache.h
+++ b/Source/WebCore/accessibility/AXObjectCache.h
@@ -34,12 +34,6 @@
 #include <wtf/HashSet.h>
 #include <wtf/RefPtr.h>
 
-#ifdef __OBJC__
-@class WebCoreTextMarker;
-#else
-class WebCoreTextMarker;
-#endif
-
 namespace WebCore {
 
 class Document;
diff --git a/Source/WebCore/accessibility/AccessibilityAllInOne.cpp b/Source/WebCore/accessibility/AccessibilityAllInOne.cpp
index 1c2836e..dd7f777 100644
--- a/Source/WebCore/accessibility/AccessibilityAllInOne.cpp
+++ b/Source/WebCore/accessibility/AccessibilityAllInOne.cpp
@@ -25,22 +25,22 @@
 
 // This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
 
-#include <AXObjectCache.cpp>
-#include <AccessibilityARIAGrid.cpp>
-#include <AccessibilityARIAGridCell.cpp>
-#include <AccessibilityARIAGridRow.cpp>
-#include <AccessibilityImageMapLink.cpp>
-#include <AccessibilityList.cpp>
-#include <AccessibilityListBox.cpp>
-#include <AccessibilityListBoxOption.cpp>
-#include <AccessibilityMediaControls.cpp>
-#include <AccessibilityObject.cpp>
-#include <AccessibilityRenderObject.cpp>
-#include <AccessibilityScrollView.cpp>
-#include <AccessibilityScrollbar.cpp>
-#include <AccessibilitySlider.cpp>
-#include <AccessibilityTable.cpp>
-#include <AccessibilityTableCell.cpp>
-#include <AccessibilityTableColumn.cpp>
-#include <AccessibilityTableHeaderContainer.cpp>
-#include <AccessibilityTableRow.cpp>
+#include "AXObjectCache.cpp"
+#include "AccessibilityARIAGrid.cpp"
+#include "AccessibilityARIAGridCell.cpp"
+#include "AccessibilityARIAGridRow.cpp"
+#include "AccessibilityImageMapLink.cpp"
+#include "AccessibilityList.cpp"
+#include "AccessibilityListBox.cpp"
+#include "AccessibilityListBoxOption.cpp"
+#include "AccessibilityMediaControls.cpp"
+#include "AccessibilityObject.cpp"
+#include "AccessibilityRenderObject.cpp"
+#include "AccessibilityScrollView.cpp"
+#include "AccessibilityScrollbar.cpp"
+#include "AccessibilitySlider.cpp"
+#include "AccessibilityTable.cpp"
+#include "AccessibilityTableCell.cpp"
+#include "AccessibilityTableColumn.cpp"
+#include "AccessibilityTableHeaderContainer.cpp"
+#include "AccessibilityTableRow.cpp"
diff --git a/Source/WebCore/accessibility/AccessibilityImageMapLink.cpp b/Source/WebCore/accessibility/AccessibilityImageMapLink.cpp
index 5676206..0844d02 100644
--- a/Source/WebCore/accessibility/AccessibilityImageMapLink.cpp
+++ b/Source/WebCore/accessibility/AccessibilityImageMapLink.cpp
@@ -133,7 +133,7 @@ IntRect AccessibilityImageMapLink::elementRect() const
     if (!renderer)
         return IntRect();
     
-    return m_areaElement->getRect(renderer);
+    return m_areaElement->computeRect(renderer);
 }
     
 String AccessibilityImageMapLink::stringValueForMSAA() const
diff --git a/Source/WebCore/accessibility/AccessibilityListBox.cpp b/Source/WebCore/accessibility/AccessibilityListBox.cpp
index 191a041..81ea503 100644
--- a/Source/WebCore/accessibility/AccessibilityListBox.cpp
+++ b/Source/WebCore/accessibility/AccessibilityListBox.cpp
@@ -79,7 +79,7 @@ void AccessibilityListBox::addChildren()
     for (unsigned i = 0; i < length; i++) {
         // The cast to HTMLElement below is safe because the only other possible listItem type
         // would be a WMLElement, but WML builds don't use accessibility features at all.
-        AccessibilityObject* listOption = listBoxOptionAccessibilityObject(static_cast<HTMLElement*>(listItems[i]));
+        AccessibilityObject* listOption = listBoxOptionAccessibilityObject(toHTMLElement(listItems[i]));
         if (listOption && !listOption->accessibilityIsIgnored())
             m_children.append(listOption);
     }
diff --git a/Source/WebCore/accessibility/AccessibilityMenuListPopup.cpp b/Source/WebCore/accessibility/AccessibilityMenuListPopup.cpp
index 515e02f..9e2ed6b 100644
--- a/Source/WebCore/accessibility/AccessibilityMenuListPopup.cpp
+++ b/Source/WebCore/accessibility/AccessibilityMenuListPopup.cpp
@@ -97,7 +97,7 @@ void AccessibilityMenuListPopup::addChildren()
     for (unsigned i = 0; i < length; i++) {
         // The cast to HTMLElement below is safe because the only other possible listItem type
         // would be a WMLElement, but WML builds don't use accessbility features at all.
-        AccessibilityMenuListOption* option = menuListOptionAccessibilityObject(static_cast<HTMLElement*>(listItems[i]));
+        AccessibilityMenuListOption* option = menuListOptionAccessibilityObject(toHTMLElement(listItems[i]));
         if (option) {
             option->setParent(this);
             m_children.append(option);
diff --git a/Source/WebCore/accessibility/AccessibilityObject.cpp b/Source/WebCore/accessibility/AccessibilityObject.cpp
index f2a2d7d..ba03ef4 100644
--- a/Source/WebCore/accessibility/AccessibilityObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityObject.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,7 +31,6 @@
 
 #include "AXObjectCache.h"
 #include "AccessibilityRenderObject.h"
-#include "CharacterNames.h"
 #include "FloatRect.h"
 #include "FocusController.h"
 #include "Frame.h"
@@ -53,6 +52,7 @@
 #include "htmlediting.h"
 #include "visible_units.h"
 #include <wtf/StdLibExtras.h>
+#include <wtf/unicode/CharacterNames.h>
 
 using namespace std;
 
@@ -718,6 +718,15 @@ unsigned AccessibilityObject::doAXLineForIndex(unsigned index)
 {
     return lineForPosition(visiblePositionForIndex(index, false));
 }
+    
+Document* AccessibilityObject::document() const
+{
+    FrameView* frameView = documentFrameView();
+    if (!frameView)
+        return 0;
+    
+    return frameView->frame()->document();
+}
 
 FrameView* AccessibilityObject::documentFrameView() const 
 { 
@@ -1042,6 +1051,17 @@ AccessibilityObject* AccessibilityObject::focusedUIElement() const
     return AXObjectCache::focusedUIElementForPage(page);
 }
     
+AccessibilitySortDirection AccessibilityObject::sortDirection() const
+{
+    const AtomicString& sortAttribute = getAttribute(aria_sortAttr);
+    if (equalIgnoringCase(sortAttribute, "ascending"))
+        return SortDirectionAscending;
+    if (equalIgnoringCase(sortAttribute, "descending"))
+        return SortDirectionDescending;
+    
+    return SortDirectionNone;
+}
+    
 bool AccessibilityObject::supportsARIAExpanded() const
 {
     return !getAttribute(aria_expandedAttr).isEmpty();
diff --git a/Source/WebCore/accessibility/AccessibilityObject.h b/Source/WebCore/accessibility/AccessibilityObject.h
index c8d887b..4687cae 100644
--- a/Source/WebCore/accessibility/AccessibilityObject.h
+++ b/Source/WebCore/accessibility/AccessibilityObject.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nuanti Ltd.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -214,6 +214,12 @@ enum AccessibilityButtonState {
     ButtonStateOn, 
     ButtonStateMixed,
 };
+    
+enum AccessibilitySortDirection {
+    SortDirectionNone,
+    SortDirectionAscending,
+    SortDirectionDescending,
+};
 
 struct VisiblePositionRange {
 
@@ -343,7 +349,6 @@ public:
     virtual void setAccessibleName(String&) { }
     
     virtual Node* node() const { return 0; }
-    bool accessibilityShouldUseUniqueId() const { return true; }
     virtual bool accessibilityIsIgnored() const  { return true; }
 
     virtual int headingLevel() const { return 0; }
@@ -366,6 +371,7 @@ public:
     bool ariaIsMultiline() const;
     virtual const AtomicString& invalidStatus() const;
     bool supportsARIAExpanded() const;
+    AccessibilitySortDirection sortDirection() const;
     
     // ARIA drag and drop
     virtual bool supportsARIADropping() const { return false; }
@@ -436,7 +442,7 @@ public:
     const String& actionVerb() const;
     virtual Widget* widget() const { return 0; }
     virtual Widget* widgetForAttachmentView() const { return 0; }
-    virtual Document* document() const { return 0; }
+    virtual Document* document() const;
     virtual FrameView* topDocumentFrameView() const { return 0; }
     virtual FrameView* documentFrameView() const;
     String language() const;
diff --git a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
index ca8d4a7..70ed839 100644
--- a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -32,7 +32,6 @@
 #include "AXObjectCache.h"
 #include "AccessibilityImageMapLink.h"
 #include "AccessibilityListBox.h"
-#include "CharacterNames.h"
 #include "EventNames.h"
 #include "FloatRect.h"
 #include "Frame.h"
@@ -77,6 +76,7 @@
 #include "htmlediting.h"
 #include "visible_units.h"
 #include <wtf/StdLibExtras.h>
+#include <wtf/unicode/CharacterNames.h>
 
 using namespace std;
 
@@ -1169,7 +1169,7 @@ static String accessibleNameForNode(Node* node)
         return static_cast<HTMLInputElement*>(node)->value();
 
     if (node->isHTMLElement()) {
-        const AtomicString& alt = static_cast<HTMLElement*>(node)->getAttribute(altAttr);
+        const AtomicString& alt = toHTMLElement(node)->getAttribute(altAttr);
         if (!alt.isEmpty())
             return alt;
     }
@@ -1357,7 +1357,7 @@ String AccessibilityRenderObject::accessibilityDescription() const
     if (isImage() || isInputImage() || isNativeImage()) {
         Node* node = m_renderer->node();
         if (node && node->isHTMLElement()) {
-            const AtomicString& alt = static_cast<HTMLElement*>(node)->getAttribute(altAttr);
+            const AtomicString& alt = toHTMLElement(node)->getAttribute(altAttr);
             if (alt.isEmpty())
                 return String();
             return alt;
@@ -1384,11 +1384,11 @@ String AccessibilityRenderObject::accessibilityDescription() const
                 return static_cast<HTMLFrameElementBase*>(owner)->getAttribute(nameAttr);
             }
             if (owner->isHTMLElement())
-                return static_cast<HTMLElement*>(owner)->getAttribute(nameAttr);
+                return toHTMLElement(owner)->getAttribute(nameAttr);
         }
         owner = document->body();
         if (owner && owner->isHTMLElement())
-            return static_cast<HTMLElement*>(owner)->getAttribute(nameAttr);
+            return toHTMLElement(owner)->getAttribute(nameAttr);
     }
 
     return String();
@@ -2519,7 +2519,7 @@ IntRect AccessibilityRenderObject::boundsForVisiblePositionRange(const VisiblePo
     ourrect.unite(rect2);
     
     // if the rectangle spans lines and contains multiple text chars, use the range's bounding box intead
-    if (rect1.bottom() != rect2.bottom()) {
+    if (rect1.maxY() != rect2.maxY()) {
         RefPtr<Range> dataRange = makeRange(range.start, range.end);
         IntRect boundingBox = dataRange->boundingBox();
         String rangeString = plainText(dataRange.get());
diff --git a/Source/WebCore/accessibility/AccessibilityScrollView.cpp b/Source/WebCore/accessibility/AccessibilityScrollView.cpp
index c9dcbb6..5b94fe3 100644
--- a/Source/WebCore/accessibility/AccessibilityScrollView.cpp
+++ b/Source/WebCore/accessibility/AccessibilityScrollView.cpp
@@ -136,20 +136,20 @@ AccessibilityObject* AccessibilityScrollView::accessibilityHitTest(const IntPoin
     
     return webArea->accessibilityHitTest(point);
 }
-    
-Document* AccessibilityScrollView::document() const
-{
-    if (!m_scrollView->isFrameView())
-        return 0;
-    
-    return static_cast<FrameView*>(m_scrollView.get())->frame()->document();
-}
 
 IntRect AccessibilityScrollView::elementRect() const
 {
     return m_scrollView->frameRect();
 }
 
+FrameView* AccessibilityScrollView::documentFrameView() const
+{
+    if (!m_scrollView->isFrameView())
+        return 0;
+    
+    return static_cast<FrameView*>(m_scrollView.get());
+}    
+
 AccessibilityObject* AccessibilityScrollView::parentObject() const
 {
     if (!m_scrollView->isFrameView())
diff --git a/Source/WebCore/accessibility/AccessibilityScrollView.h b/Source/WebCore/accessibility/AccessibilityScrollView.h
index e32cd1c..f19bde8 100644
--- a/Source/WebCore/accessibility/AccessibilityScrollView.h
+++ b/Source/WebCore/accessibility/AccessibilityScrollView.h
@@ -47,11 +47,11 @@ private:
     virtual bool isAccessibilityScrollView() const { return true; }
     virtual AccessibilityObject* scrollBar(AccessibilityOrientation) const;
     virtual void addChildren();
-    virtual Document* document() const;
     virtual AccessibilityObject* accessibilityHitTest(const IntPoint&) const;
     virtual const AccessibilityChildrenVector& children();
     virtual void updateChildrenIfNecessary();
     
+    virtual FrameView* documentFrameView() const;
     virtual IntRect elementRect() const;
     virtual AccessibilityObject* parentObject() const;
     
diff --git a/Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp b/Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp
index 9772b43..c8c1951 100644
--- a/Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp
+++ b/Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp
@@ -105,7 +105,7 @@ void AccessibilityObject::setWrapper(AccessibilityObjectWrapper* wrapper)
 
 bool AccessibilityObject::allowsTextRanges() const
 {
-    return isTextControl() || isWebArea() || isGroup() || isLink() || isHeading();
+    return isTextControl() || isWebArea() || isGroup() || isLink() || isHeading() || isListItem();
 }
 
 unsigned AccessibilityObject::getLengthForTextRange() const
diff --git a/Source/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp b/Source/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
index 7489034..8f39113 100644
--- a/Source/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
+++ b/Source/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
@@ -63,6 +63,7 @@
 #include "TextEncoding.h"
 #include "TextIterator.h"
 #include "WebKitAccessibleHyperlink.h"
+#include "visible_units.h"
 
 #include <atk/atk.h>
 #include <glib.h>
@@ -184,7 +185,7 @@ static const gchar* webkit_accessible_get_name(AtkObject* object)
         Node* node = renderObject->renderer()->node();
         if (node && node->isHTMLElement()) {
             // Get the attribute rather than altText String so as not to fall back on title.
-            String alt = static_cast<HTMLElement*>(node)->getAttribute(HTMLNames::altAttr);
+            String alt = toHTMLElement(node)->getAttribute(HTMLNames::altAttr);
             if (!alt.isEmpty())
                 return returnString(alt);
         }
@@ -211,7 +212,7 @@ static const gchar* webkit_accessible_get_description(AtkObject* object)
 
     // The title attribute should be reliably available as the object's descripton.
     // We do not want to fall back on other attributes in its absence. See bug 25524.
-    String title = static_cast<HTMLElement*>(node)->title();
+    String title = toHTMLElement(node)->title();
     if (!title.isEmpty())
         return returnString(title);
 
@@ -994,7 +995,7 @@ static gchar* utf8Substr(const gchar* string, gint start, gint end)
     if (start > strLen || end > strLen)
         return 0;
     gchar* startPtr = g_utf8_offset_to_pointer(string, start);
-    gsize lenInBytes = g_utf8_offset_to_pointer(string, end) -  startPtr + 1;
+    gsize lenInBytes = g_utf8_offset_to_pointer(string, end + 1) -  startPtr;
     gchar* output = static_cast<gchar*>(g_malloc0(lenInBytes + 1));
     return g_utf8_strncpy(output, startPtr, end - start + 1);
 }
@@ -1208,8 +1209,10 @@ static gint webkit_accessible_text_get_caret_offset(AtkText* text)
     // coreObject is the unignored object whose offset the caller is requesting.
     // focusedObject is the object with the caret. It is likely ignored -- unless it's a link.
     AccessibilityObject* coreObject = core(text);
-    Node* focusedNode = coreObject->selection().end().node();
+    if (!coreObject->isAccessibilityRenderObject())
+        return 0;
 
+    Node* focusedNode = coreObject->selection().end().node();
     if (!focusedNode)
         return 0;
 
@@ -1221,6 +1224,14 @@ static gint webkit_accessible_text_get_caret_offset(AtkText* text)
     if (!objectAndOffsetUnignored(focusedObject, offset, !coreObject->isLink()))
         return 0;
 
+    RenderObject* renderer = toAccessibilityRenderObject(coreObject)->renderer();
+    if (renderer && renderer->isListItem()) {
+        String markerText = toRenderListItem(renderer)->markerTextWithSuffix();
+
+        // We need to adjust the offset for the list item marker.
+        offset += markerText.length();
+    }
+
     // TODO: Verify this for RTL text.
     return offset;
 }
@@ -1230,8 +1241,8 @@ static int baselinePositionForAccessibilityRenderObject(RenderObject* renderObje
     // FIXME: This implementation of baselinePosition originates from RenderObject.cpp and was
     // removed in r70072. The implementation looks incorrect though, because this is not the
     // baseline of the underlying RenderObject, but of the AccessibilityRenderObject.
-    const Font& f = renderObject->firstLineStyle()->font();
-    return f.ascent() + (renderObject->firstLineStyle()->computedLineHeight() - f.height()) / 2;
+    const FontMetrics& fontMetrics = renderObject->firstLineStyle()->fontMetrics();
+    return fontMetrics.ascent() + (renderObject->firstLineStyle()->computedLineHeight() - fontMetrics.height()) / 2;
 }
 
 static AtkAttributeSet* getAttributeSetForAccessibilityObject(const AccessibilityObject* object)
@@ -1543,7 +1554,7 @@ static void webkit_accessible_text_get_character_extents(AtkText* text, gint off
 
 static void webkit_accessible_text_get_range_extents(AtkText* text, gint startOffset, gint endOffset, AtkCoordType coords, AtkTextRectangle* rect)
 {
-    IntRect extents = textExtents(text, startOffset, endOffset - startOffset + 1, coords);
+    IntRect extents = textExtents(text, startOffset, endOffset - startOffset, coords);
     rect->x = extents.x();
     rect->y = extents.y();
     rect->width = extents.width();
@@ -1699,10 +1710,26 @@ static gboolean webkit_accessible_text_set_caret_offset(AtkText* text, gint offs
 {
     AccessibilityObject* coreObject = core(text);
 
+    if (!coreObject->isAccessibilityRenderObject())
+        return FALSE;
+
+    RenderObject* renderer = toAccessibilityRenderObject(coreObject)->renderer();
+    if (renderer && renderer->isListItem()) {
+        String markerText = toRenderListItem(renderer)->markerTextWithSuffix();
+        int markerLength = markerText.length();
+        if (offset < markerLength)
+            return FALSE;
+
+        // We need to adjust the offset for list items.
+        offset -= markerLength;
+    }
+
     PlainTextRange textRange(offset, 0);
     VisiblePositionRange range = coreObject->visiblePositionRangeForRange(textRange);
-    coreObject->setSelectedVisiblePositionRange(range);
+    if (range.isNull())
+        return FALSE;
 
+    coreObject->setSelectedVisiblePositionRange(range);
     return TRUE;
 }
 
@@ -2457,8 +2484,6 @@ AtkObject* webkit_accessible_get_focused_element(WebKitAccessible* accessible)
 
 AccessibilityObject* objectAndOffsetUnignored(AccessibilityObject* coreObject, int& offset, bool ignoreLinks)
 {
-    Node* endNode = static_cast<AccessibilityRenderObject*>(coreObject)->renderer()->node();
-    int endOffset = coreObject->selection().end().computeOffsetInContainerNode();
     // Indication that something bogus has transpired.
     offset = -1;
 
@@ -2473,16 +2498,23 @@ AccessibilityObject* objectAndOffsetUnignored(AccessibilityObject* coreObject, i
     if (!realObject)
         return 0;
 
-    Node* node = static_cast<AccessibilityRenderObject*>(realObject)->renderer()->node();
+    Node* node = realObject->node();
     if (node) {
-        RefPtr<Range> range = rangeOfContents(node);
-        if (range->ownerDocument() == node->document()) {
-            ExceptionCode ec = 0;
-            range->setEndBefore(endNode, ec);
-            if (range->boundaryPointsValid())
-                offset = range->text().length() + endOffset;
+        VisiblePosition startPosition = VisiblePosition(node, 0, DOWNSTREAM);
+        VisiblePosition endPosition = realObject->selection().visibleEnd();
+
+        if (startPosition == endPosition)
+            offset = 0;
+        else if (!isStartOfLine(endPosition)) {
+            RefPtr<Range> range = makeRange(startPosition, endPosition.previous());
+            offset = TextIterator::rangeLength(range.get()) + 1;
+        } else {
+            RefPtr<Range> range = makeRange(startPosition, endPosition);
+            offset = TextIterator::rangeLength(range.get());
         }
+
     }
+
     return realObject;
 }
 
diff --git a/Source/WebCore/accessibility/mac/AXObjectCacheMac.mm b/Source/WebCore/accessibility/mac/AXObjectCacheMac.mm
index 13c8ec2..e223bf4 100644
--- a/Source/WebCore/accessibility/mac/AXObjectCacheMac.mm
+++ b/Source/WebCore/accessibility/mac/AXObjectCacheMac.mm
@@ -31,7 +31,7 @@
 #import "AccessibilityObject.h"
 #import "AccessibilityObjectWrapper.h"
 #import "RenderObject.h"
-#import "WebCoreViewFactory.h"
+#import "WebCoreSystemInterface.h"
 
 #import <wtf/PassRefPtr.h>
 
@@ -127,7 +127,7 @@ void AXObjectCache::nodeTextChangePlatformNotification(AccessibilityObject*, AXT
 
 void AXObjectCache::handleFocusedUIElementChanged(RenderObject*, RenderObject*)
 {
-    [[WebCoreViewFactory sharedFactory] accessibilityHandleFocusChanged];
+    wkAccessibilityHandleFocusChanged();
 }
 
 void AXObjectCache::handleScrolledToAnchor(const Node*)
diff --git a/Source/WebCore/accessibility/mac/AccessibilityObjectWrapper.h b/Source/WebCore/accessibility/mac/AccessibilityObjectWrapper.h
index b54d3fc..2d29e1e 100644
--- a/Source/WebCore/accessibility/mac/AccessibilityObjectWrapper.h
+++ b/Source/WebCore/accessibility/mac/AccessibilityObjectWrapper.h
@@ -29,14 +29,6 @@
 #ifndef AccessibilityObjectWrapper_h
 #define AccessibilityObjectWrapper_h
 
-#ifdef __OBJC__
-@class WebCoreTextMarker;
-@class WebCoreTextMarkerRange;
-#else
-class WebCoreTextMarker;
-class WebCoreTextMarkerRange;
-#endif
-
 namespace WebCore {
 class AccessibilityObject;
 class VisiblePosition;
diff --git a/Source/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm b/Source/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
index c2e3724..8fe3a49 100644
--- a/Source/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
+++ b/Source/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -61,7 +61,7 @@
 #import "TextIterator.h"
 #import "WebCoreFrameView.h"
 #import "WebCoreObjCExtras.h"
-#import "WebCoreViewFactory.h"
+#import "WebCoreSystemInterface.h"
 #import "htmlediting.h"
 #import "visible_units.h"
 
@@ -194,7 +194,7 @@ typedef unsigned NSUInteger;
 
 - (void)unregisterUniqueIdForUIElement
 {
-    [[WebCoreViewFactory sharedFactory] unregisterUniqueIdForUIElement:self];
+    wkUnregisterUniqueIdForElement(self);
 }
 
 - (void)detach
@@ -237,7 +237,52 @@ typedef unsigned NSUInteger;
     return NSAccessibilityUnignoredDescendant(widget->platformWidget());
 }
 
-static WebCoreTextMarker* textMarkerForVisiblePosition(AXObjectCache* cache, const VisiblePosition& visiblePos)
+#pragma mark SystemInterface wrappers
+
+static inline id CFAutoreleaseHelper(CFTypeRef obj)
+{
+    if (obj)
+        CFMakeCollectable(obj);
+    [(id)obj autorelease];
+    return (id)obj;
+}
+
+static inline BOOL AXObjectIsTextMarker(id obj)
+{
+    return obj != nil && CFGetTypeID(obj) == wkGetAXTextMarkerTypeID();    
+}
+
+static inline BOOL AXObjectIsTextMarkerRange(id obj)
+{
+    return obj != nil && CFGetTypeID(obj) == wkGetAXTextMarkerRangeTypeID();    
+}
+
+static id AXTextMarkerRange(id startMarker, id endMarker)
+{
+    ASSERT(startMarker != nil);
+    ASSERT(endMarker != nil);
+    ASSERT(CFGetTypeID(startMarker) == wkGetAXTextMarkerTypeID());
+    ASSERT(CFGetTypeID(endMarker) == wkGetAXTextMarkerTypeID());
+    return CFAutoreleaseHelper(wkCreateAXTextMarkerRange((CFTypeRef)startMarker, (CFTypeRef)endMarker));
+}
+
+static id AXTextMarkerRangeStart(id range)
+{
+    ASSERT(range != nil);
+    ASSERT(CFGetTypeID(range) == wkGetAXTextMarkerRangeTypeID());
+    return CFAutoreleaseHelper(wkCopyAXTextMarkerRangeStart(range));    
+}
+
+static id AXTextMarkerRangeEnd(id range)
+{
+    ASSERT(range != nil);
+    ASSERT(CFGetTypeID(range) == wkGetAXTextMarkerRangeTypeID());
+    return CFAutoreleaseHelper(wkCopyAXTextMarkerRangeEnd(range));    
+}
+
+#pragma mark Text Marker helpers
+
+static id textMarkerForVisiblePosition(AXObjectCache* cache, const VisiblePosition& visiblePos)
 {
     ASSERT(cache);
     
@@ -246,48 +291,48 @@ static WebCoreTextMarker* textMarkerForVisiblePosition(AXObjectCache* cache, con
     if (!textMarkerData.axID)
         return nil;
     
-    return [[WebCoreViewFactory sharedFactory] textMarkerWithBytes:&textMarkerData length:sizeof(textMarkerData)];
+    return CFAutoreleaseHelper(wkCreateAXTextMarker(&textMarkerData, sizeof(textMarkerData)));
 }
 
-- (WebCoreTextMarker *)textMarkerForVisiblePosition:(const VisiblePosition &)visiblePos
+- (id)textMarkerForVisiblePosition:(const VisiblePosition &)visiblePos
 {
     return textMarkerForVisiblePosition(m_object->axObjectCache(), visiblePos);
 }
 
-static VisiblePosition visiblePositionForTextMarker(AXObjectCache* cache, WebCoreTextMarker* textMarker)
+static VisiblePosition visiblePositionForTextMarker(AXObjectCache* cache, CFTypeRef textMarker)
 {
     ASSERT(cache);
 
     if (!textMarker)
         return VisiblePosition();
     TextMarkerData textMarkerData;
-    if (![[WebCoreViewFactory sharedFactory] getBytes:&textMarkerData fromTextMarker:textMarker length:sizeof(textMarkerData)])
+    if (!wkGetBytesFromAXTextMarker(textMarker, &textMarkerData, sizeof(textMarkerData)))
         return VisiblePosition();
     
     return cache->visiblePositionForTextMarkerData(textMarkerData);
 }
 
-- (VisiblePosition)visiblePositionForTextMarker:(WebCoreTextMarker *)textMarker
+- (VisiblePosition)visiblePositionForTextMarker:(id)textMarker
 {
     return visiblePositionForTextMarker(m_object->axObjectCache(), textMarker);
 }
 
-static VisiblePosition visiblePositionForStartOfTextMarkerRange(AXObjectCache *cache, WebCoreTextMarkerRange* textMarkerRange)
+static VisiblePosition visiblePositionForStartOfTextMarkerRange(AXObjectCache *cache, id textMarkerRange)
 {
-    return visiblePositionForTextMarker(cache, [[WebCoreViewFactory sharedFactory] startOfTextMarkerRange:textMarkerRange]);
+    return visiblePositionForTextMarker(cache, AXTextMarkerRangeStart(textMarkerRange));
 }
 
-static VisiblePosition visiblePositionForEndOfTextMarkerRange(AXObjectCache *cache, WebCoreTextMarkerRange* textMarkerRange)
+static VisiblePosition visiblePositionForEndOfTextMarkerRange(AXObjectCache *cache, id textMarkerRange)
 {
-    return visiblePositionForTextMarker(cache, [[WebCoreViewFactory sharedFactory] endOfTextMarkerRange:textMarkerRange]);
+    return visiblePositionForTextMarker(cache, AXTextMarkerRangeEnd(textMarkerRange));
 }
 
-static WebCoreTextMarkerRange* textMarkerRangeFromMarkers(WebCoreTextMarker* textMarker1, WebCoreTextMarker* textMarker2)
+static id textMarkerRangeFromMarkers(id textMarker1, id textMarker2)
 {
     if (!textMarker1 || !textMarker2)
         return nil;
         
-    return [[WebCoreViewFactory sharedFactory] textMarkerRangeWithStart:textMarker1 end:textMarker2];
+    return AXTextMarkerRange(textMarker1, textMarker2);
 }
 
 static void AXAttributeStringSetFont(NSMutableAttributedString* attrString, NSString* attribute, NSFont* font, NSRange range)
@@ -484,7 +529,7 @@ static void AXAttributeStringSetElement(NSMutableAttributedString* attrString, N
         if (!cache)
             return;
 
-        AXUIElementRef axElement = [[WebCoreViewFactory sharedFactory] AXUIElementForElement:object->wrapper()];
+        AXUIElementRef axElement = wkCreateAXUIElementRef(object->wrapper());
         if (axElement) {
             [attrString addAttribute:attribute value:(id)axElement range:range];
             CFRelease(axElement);
@@ -543,7 +588,7 @@ static NSString* nsStringForReplacedNode(Node* replacedNode)
     return [NSString stringWithCharacters:&attachmentChar length:1];
 }
 
-- (NSAttributedString*)doAXAttributedStringForTextMarkerRange:(WebCoreTextMarkerRange*)textMarkerRange
+- (NSAttributedString*)doAXAttributedStringForTextMarkerRange:(id)textMarkerRange
 {
     if (!m_object)
         return nil;
@@ -599,14 +644,14 @@ static NSString* nsStringForReplacedNode(Node* replacedNode)
     return [attrString autorelease];
 }
 
-static WebCoreTextMarkerRange* textMarkerRangeFromVisiblePositions(AXObjectCache *cache, VisiblePosition startPosition, VisiblePosition endPosition)
+static id textMarkerRangeFromVisiblePositions(AXObjectCache *cache, VisiblePosition startPosition, VisiblePosition endPosition)
 {
-    WebCoreTextMarker* startTextMarker = textMarkerForVisiblePosition(cache, startPosition);
-    WebCoreTextMarker* endTextMarker = textMarkerForVisiblePosition(cache, endPosition);
+    id startTextMarker = textMarkerForVisiblePosition(cache, startPosition);
+    id endTextMarker = textMarkerForVisiblePosition(cache, endPosition);
     return textMarkerRangeFromMarkers(startTextMarker, endTextMarker);
 }
 
-- (WebCoreTextMarkerRange *)textMarkerRangeFromVisiblePositions:(VisiblePosition)startPosition endPosition:(VisiblePosition)endPosition
+- (id)textMarkerRangeFromVisiblePositions:(VisiblePosition)startPosition endPosition:(VisiblePosition)endPosition
 {
     return textMarkerRangeFromVisiblePositions(m_object->axObjectCache(), startPosition, endPosition);
 }
@@ -664,6 +709,9 @@ static WebCoreTextMarkerRange* textMarkerRangeFromVisiblePositions(AXObjectCache
         [additional addObject:NSAccessibilityARIALiveAttribute];
         [additional addObject:NSAccessibilityARIARelevantAttribute];
     }
+    
+    if (m_object->sortDirection() != SortDirectionNone)
+        [additional addObject:NSAccessibilitySortDirectionAttribute];
         
     // If an object is a child of a live region, then add these
     if (m_object->isInsideARIALiveRegion()) {
@@ -1035,7 +1083,7 @@ static WebCoreTextMarkerRange* textMarkerRangeFromVisiblePositions(AXObjectCache
     return objectAttributes;
 }
 
-- (VisiblePositionRange)visiblePositionRangeForTextMarkerRange:(WebCoreTextMarkerRange*) textMarkerRange
+- (VisiblePositionRange)visiblePositionRangeForTextMarkerRange:(id)textMarkerRange
 {
     if (!textMarkerRange)
         return VisiblePositionRange();
@@ -1089,7 +1137,7 @@ static NSMutableArray* convertToNSArray(const AccessibilityObject::Accessibility
     return array;
 }
 
-- (WebCoreTextMarkerRange*)textMarkerRangeForSelection
+- (id)textMarkerRangeForSelection
 {
     VisibleSelection selection = m_object->selection();
     if (selection.isNone())
@@ -1125,7 +1173,7 @@ static NSMutableArray* convertToNSArray(const AccessibilityObject::Accessibility
         point.y = screenHeight - (point.y + remotePosition.y + rect.height() - scrollPosition.y);
     } else {
         // The Cocoa accessibility API wants the lower-left corner.
-        point = NSMakePoint(rect.x(), rect.bottom());
+        point = NSMakePoint(rect.x(), rect.maxY());
         
         if (frameView) {
             NSView* view = frameView->documentView();
@@ -1976,6 +2024,17 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return nil;
     }
     
+    if ([attributeName isEqualToString:NSAccessibilitySortDirectionAttribute]) {
+        switch (m_object->sortDirection()) {
+        case SortDirectionAscending:
+            return NSAccessibilityAscendingSortDirectionValue;
+        case SortDirectionDescending:
+            return NSAccessibilityDescendingSortDirectionValue;
+        default:
+            return NSAccessibilityUnknownSortDirectionValue;
+        }
+    }
+    
     if ([attributeName isEqualToString:NSAccessibilityLanguageAttribute]) 
         return m_object->language();
     
@@ -2312,15 +2371,15 @@ static NSString* roleValueToNSString(AccessibilityRole value)
     if (![self updateObjectBackingStore])
         return;
 
-    WebCoreTextMarkerRange* textMarkerRange = nil;
+    id textMarkerRange = nil;
     NSNumber*               number = nil;
     NSString*               string = nil;
     NSRange                 range = {0, 0};
     NSArray*                array = nil;
     
     // decode the parameter
-    if ([[WebCoreViewFactory sharedFactory] objectIsTextMarkerRange:value])
-        textMarkerRange = (WebCoreTextMarkerRange*) value;
+    if (AXObjectIsTextMarkerRange(value))
+        textMarkerRange = value;
 
     else if ([value isKindOfClass:[NSNumber self]])
         number = value;
@@ -2429,8 +2488,8 @@ static RenderObject* rendererForView(NSView* view)
 
 - (id)accessibilityAttributeValue:(NSString*)attribute forParameter:(id)parameter
 {
-    WebCoreTextMarker* textMarker = nil;
-    WebCoreTextMarkerRange* textMarkerRange = nil;
+    id textMarker = nil;
+    id textMarkerRange = nil;
     NSNumber* number = nil;
     NSArray* array = nil;
     RefPtr<AccessibilityObject> uiElement = 0;
@@ -2449,11 +2508,11 @@ static RenderObject* rendererForView(NSView* view)
     // common parameter type check/casting.  Nil checks in handlers catch wrong type case.
     // NOTE: This assumes nil is not a valid parameter, because it is indistinguishable from
     // a parameter of the wrong type.
-    if ([[WebCoreViewFactory sharedFactory] objectIsTextMarker:parameter])
-        textMarker = (WebCoreTextMarker*) parameter;
+    if (AXObjectIsTextMarker(parameter))
+        textMarker = parameter;
 
-    else if ([[WebCoreViewFactory sharedFactory] objectIsTextMarkerRange:parameter])
-        textMarkerRange = (WebCoreTextMarkerRange*) parameter;
+    else if (AXObjectIsTextMarkerRange(parameter))
+        textMarkerRange = parameter;
 
     else if ([parameter isKindOfClass:[AccessibilityObjectWrapper self]])
         uiElement = [(AccessibilityObjectWrapper*)parameter accessibilityObject];
@@ -2540,10 +2599,9 @@ static RenderObject* rendererForView(NSView* view)
         if ([array count] < 2)
             return nil;
 
-        WebCoreTextMarker* textMarker1 = (WebCoreTextMarker*) [array objectAtIndex:0];
-        WebCoreTextMarker* textMarker2 = (WebCoreTextMarker*) [array objectAtIndex:1];
-        if (![[WebCoreViewFactory sharedFactory] objectIsTextMarker:textMarker1] 
-            || ![[WebCoreViewFactory sharedFactory] objectIsTextMarker:textMarker2])
+        id textMarker1 = [array objectAtIndex:0];
+        id textMarker2 = [array objectAtIndex:1];
+        if (!AXObjectIsTextMarker(textMarker1) || !AXObjectIsTextMarker(textMarker2))
             return nil;
 
         VisiblePosition visiblePos1 = [self visiblePositionForTextMarker:(textMarker1)];
@@ -2731,9 +2789,15 @@ static RenderObject* rendererForView(NSView* view)
     return [super accessibilityAttributeValue:attribute forParameter:parameter];
 }
 
+- (BOOL)accessibilitySupportsOverriddenAttributes
+{
+    return YES;
+}
+
 - (BOOL)accessibilityShouldUseUniqueId
 {
-    return m_object->accessibilityShouldUseUniqueId();
+    // All AX object wrappers should use unique ID's because it's faster within AppKit to look them up.
+    return YES;
 }
 
 // API that AppKit uses for faster access
diff --git a/Source/WebCore/bindings/ScriptControllerBase.cpp b/Source/WebCore/bindings/ScriptControllerBase.cpp
index a77ff9c..e128d11 100644
--- a/Source/WebCore/bindings/ScriptControllerBase.cpp
+++ b/Source/WebCore/bindings/ScriptControllerBase.cpp
@@ -27,7 +27,6 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "Settings.h"
-#include "XSSAuditor.h"
 
 namespace WebCore {
 
@@ -44,12 +43,12 @@ bool ScriptController::canExecuteScripts(ReasonForCallingCanExecuteScripts reaso
     return allowed;
 }
 
-ScriptValue ScriptController::executeScript(const String& script, bool forceUserGesture, ShouldAllowXSS shouldAllowXSS)
+ScriptValue ScriptController::executeScript(const String& script, bool forceUserGesture)
 {
-    return executeScript(ScriptSourceCode(script, forceUserGesture ? KURL() : m_frame->document()->url()), shouldAllowXSS);
+    return executeScript(ScriptSourceCode(script, forceUserGesture ? KURL() : m_frame->document()->url()));
 }
 
-ScriptValue ScriptController::executeScript(const ScriptSourceCode& sourceCode, ShouldAllowXSS shouldAllowXSS)
+ScriptValue ScriptController::executeScript(const ScriptSourceCode& sourceCode)
 {
     if (!canExecuteScripts(AboutToExecuteScript) || isPaused())
         return ScriptValue();
@@ -57,7 +56,7 @@ ScriptValue ScriptController::executeScript(const ScriptSourceCode& sourceCode,
     bool wasInExecuteScript = m_inExecuteScript;
     m_inExecuteScript = true;
 
-    ScriptValue result = evaluate(sourceCode, shouldAllowXSS);
+    ScriptValue result = evaluate(sourceCode);
 
     if (!wasInExecuteScript) {
         m_inExecuteScript = false;
@@ -88,9 +87,7 @@ bool ScriptController::executeIfJavaScriptURL(const KURL& url, ShouldReplaceDocu
     const int javascriptSchemeLength = sizeof("javascript:") - 1;
 
     String decodedURL = decodeURLEscapeSequences(url.string());
-    ScriptValue result;
-    if (xssAuditor()->canEvaluateJavaScriptURL(decodedURL))
-        result = executeScript(decodedURL.substring(javascriptSchemeLength), processingUserGesture(), AllowXSS);
+    ScriptValue result = executeScript(decodedURL.substring(javascriptSchemeLength), false);
 
     // If executing script caused this frame to be removed from the page, we
     // don't want to try to replace its document!
@@ -112,7 +109,7 @@ bool ScriptController::executeIfJavaScriptURL(const KURL& url, ShouldReplaceDocu
     //        synchronously can cause crashes:
     //        http://bugs.webkit.org/show_bug.cgi?id=16782
     if (shouldReplaceDocumentIfJavaScriptURL == ReplaceDocumentIfJavaScriptURL)
-        m_frame->loader()->writer()->replaceDocument(scriptResult);
+        m_frame->document()->loader()->writer()->replaceDocument(scriptResult);
 
     return true;
 }
diff --git a/Source/WebCore/bindings/ScriptControllerBase.h b/Source/WebCore/bindings/ScriptControllerBase.h
index ed6ca62..489c8a8 100644
--- a/Source/WebCore/bindings/ScriptControllerBase.h
+++ b/Source/WebCore/bindings/ScriptControllerBase.h
@@ -37,12 +37,6 @@ enum ReasonForCallingCanExecuteScripts {
     NotAboutToExecuteScript
 };
 
-// Whether to call the XSSAuditor to audit a script before passing it to the JavaScript engine.
-enum ShouldAllowXSS {
-    AllowXSS,
-    DoNotAllowXSS
-};
-
-} // namespace WebCore
+}
 
-#endif // ScriptControllerBase_h
+#endif
diff --git a/Source/WebCore/bindings/cpp/WebDOMHTMLDocumentCustom.cpp b/Source/WebCore/bindings/cpp/WebDOMHTMLDocumentCustom.cpp
index d608b0f..d12f824 100644
--- a/Source/WebCore/bindings/cpp/WebDOMHTMLDocumentCustom.cpp
+++ b/Source/WebCore/bindings/cpp/WebDOMHTMLDocumentCustom.cpp
@@ -20,18 +20,17 @@
 #include "config.h"
 #include "WebDOMHTMLDocument.h"
 
-#include "CharacterNames.h"
 #include "HTMLDocument.h"
 #include "SegmentedString.h"
 #include "WebExceptionHandler.h"
-
 #include <wtf/Forward.h>
+#include <wtf/unicode/CharacterNames.h>
 
 static inline void documentWrite(const WebDOMString& text, WebCore::HTMLDocument* document, bool addNewline)
 {
     WebCore::SegmentedString segmentedString = WTF::String(text);
     if (addNewline)
-        segmentedString.append(WebCore::SegmentedString(WTF::String(&WebCore::newlineCharacter)));
+        segmentedString.append(WebCore::SegmentedString(WTF::String(&WTF::Unicode::newlineCharacter)));
     document->write(segmentedString);
 }
 
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
index dadcc1c..14e4ac8 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
@@ -69,6 +69,15 @@ bool RuntimeEnabledFeatures::fileSystemEnabled()
 }
 #endif
 
+#if ENABLE(JAVASCRIPT_I18N_API)
+bool RuntimeEnabledFeatures::isJavaScriptI18NAPIEnabled = false;
+
+bool RuntimeEnabledFeatures::javaScriptI18NAPIEnabled()
+{
+    return isJavaScriptI18NAPIEnabled;
+}
+#endif
+
 #if ENABLE(VIDEO)
 
 bool RuntimeEnabledFeatures::audioEnabled()
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
index c1b9b8a..4f9a21e 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
@@ -97,17 +97,8 @@ public:
     static bool webkitAudioContextEnabled() { return isWebAudioEnabled; }
 #endif
 
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
+#if ENABLE(WEBGL) || ENABLE(BLOB)
     static void setWebGLEnabled(bool isEnabled) { isWebGLEnabled = isEnabled; }
-    static bool arrayBufferEnabled() { return isWebGLEnabled; }
-    static bool int8ArrayEnabled() { return isWebGLEnabled; }
-    static bool uint8ArrayEnabled() { return isWebGLEnabled; }
-    static bool int16ArrayEnabled() { return isWebGLEnabled; }
-    static bool uint16ArrayEnabled() { return isWebGLEnabled; }
-    static bool int32ArrayEnabled() { return isWebGLEnabled; }
-    static bool uint32ArrayEnabled() { return isWebGLEnabled; }
-    static bool float32ArrayEnabled() { return isWebGLEnabled; }
-    static bool dataViewEnabled() { return isWebGLEnabled; }
     static bool webGLRenderingContextEnabled() { return isWebGLEnabled; }
     static bool webGLArrayBufferEnabled() { return isWebGLEnabled; }
     static bool webGLByteArrayEnabled() { return isWebGLEnabled; }
@@ -169,6 +160,11 @@ public:
     static void setFileSystemEnabled(bool isEnabled) { isFileSystemEnabled = isEnabled; }
 #endif
 
+#if ENABLE(JAVASCRIPT_I18N_API)
+    static bool javaScriptI18NAPIEnabled();
+    static void setJavaScriptI18NAPIEnabled(bool isEnabled) { isJavaScriptI18NAPIEnabled = isEnabled; }
+#endif
+
 private:
     // Never instantiate.
     RuntimeEnabledFeatures() { }
@@ -193,6 +189,10 @@ private:
 #if ENABLE(FILE_SYSTEM)
     static bool isFileSystemEnabled;
 #endif
+
+#if ENABLE(JAVASCRIPT_I18N_API)
+    static bool isJavaScriptI18NAPIEnabled;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/gobject/GNUmakefile.am b/Source/WebCore/bindings/gobject/GNUmakefile.am
index 4067dbc..881f45a 100644
--- a/Source/WebCore/bindings/gobject/GNUmakefile.am
+++ b/Source/WebCore/bindings/gobject/GNUmakefile.am
@@ -395,10 +395,13 @@ endif
 
 if ENABLE_VIDEO
 webkitgtk_built_h_api += \
-	$(top_builddir)/DerivedSources/webkit/WebKitDOMHTMLAudioElement.h
+	$(top_builddir)/DerivedSources/webkit/WebKitDOMHTMLAudioElement.h \
+	$(top_builddir)/DerivedSources/webkit/WebKitDOMHTMLVideoElement.h
 webkitgtk_gdom_built_sources += \
 	DerivedSources/webkit/WebKitDOMHTMLAudioElement.cpp \
-	DerivedSources/webkit/WebKitDOMHTMLAudioElementPrivate.h
+	DerivedSources/webkit/WebKitDOMHTMLAudioElementPrivate.h \
+	DerivedSources/webkit/WebKitDOMHTMLVideoElement.cpp \
+	DerivedSources/webkit/WebKitDOMHTMLVideoElementPrivate.h
 endif
 
 gdom_class_list := $(subst WebKitDOM,, $(filter-out %Private, $(basename $(notdir $(webkitgtk_gdom_built_sources)))))
@@ -424,7 +427,8 @@ $(top_builddir)/DerivedSources/webkit/WebKitDOMEventTargetPrivate.h: $(WebCore)/
 	$(AM_V_GEN)cp -f $< $@
 
 # Filter out SVG for now
-gdom_feature_defines := $(filter-out ENABLE-SVG%, $(FEATURE_DEFINES))
-DerivedSources/webkit/WebKitDOM%.cpp DerivedSources/webkit/WebKitDOM%.h DerivedSources/webkit/WebKitDOM%Private.h:: %.idl $(SCRIPTS_BINDINGS) $(WebCore)/bindings/scripts/CodeGeneratorGObject.pm
+gdom_feature_defines := $(filter-out ENABLE_INDEXED_DATABASE=1, $(filter-out ENABLE_SVG%, $(FEATURE_DEFINES)))
+DerivedSources/webkit/WebKitDOM%.cpp DerivedSources/webkit/WebKitDOM%.h DerivedSources/webkit/WebKitDOM%Private.h:: %.idl $(SCRIPTS_BINDINGS) $(WebCore)/bindings/scripts/CodeGeneratorGObject.pm $(WebCore)/bindings/gobject/GNUmakefile.am
+	echo $(gdom_feature_defines)
 	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/generate-bindings.pl --include $(WebCore)/dom --include $(WebCore)/html --include $(WebCore)/css --include $(WebCore)/page --include $(WebCore)/xml --include $(WebCore)/svg --outputDir "$(GENSOURCES_WEBKIT)" --defines "LANGUAGE_GOBJECT=1 $(gdom_feature_defines)" --generator GObject $<
 
diff --git a/Source/WebCore/bindings/gobject/WebKitDOMBinding.cpp b/Source/WebCore/bindings/gobject/WebKitDOMBinding.cpp
index a9b0897..aff3434 100644
--- a/Source/WebCore/bindings/gobject/WebKitDOMBinding.cpp
+++ b/Source/WebCore/bindings/gobject/WebKitDOMBinding.cpp
@@ -57,7 +57,7 @@ static gpointer createWrapper(Node* node)
     switch (node->nodeType()) {
     case Node::ELEMENT_NODE:
         if (node->isHTMLElement())
-            wrappedNode = createHTMLElementWrapper(static_cast<HTMLElement*>(node));
+            wrappedNode = createHTMLElementWrapper(toHTMLElement(node));
         else
             wrappedNode = wrapElement(static_cast<Element*>(node));
         break;
@@ -93,7 +93,7 @@ WebKitDOMElement* kit(Element* element)
     gpointer wrappedElement;
 
     if (element->isHTMLElement())
-        wrappedElement = createHTMLElementWrapper(static_cast<HTMLElement*>(element));
+        wrappedElement = createHTMLElementWrapper(toHTMLElement(element));
     else
         wrappedElement = wrapElement(element);
 
diff --git a/Source/WebCore/bindings/gobject/WebKitHTMLElementWrapperFactory.cpp b/Source/WebCore/bindings/gobject/WebKitHTMLElementWrapperFactory.cpp
index 3ac13d1..0a869fd 100644
--- a/Source/WebCore/bindings/gobject/WebKitHTMLElementWrapperFactory.cpp
+++ b/Source/WebCore/bindings/gobject/WebKitHTMLElementWrapperFactory.cpp
@@ -93,6 +93,7 @@
 #include "HTMLTextAreaElement.h"
 #include "HTMLTitleElement.h"
 #include "HTMLUListElement.h"
+#include "HTMLVideoElement.h"
 
 #include "webkit/WebKitDOMHTMLAnchorElementPrivate.h"
 #include "webkit/WebKitDOMHTMLAppletElementPrivate.h"
@@ -156,6 +157,7 @@
 
 #if ENABLE(VIDEO)
 #include "webkit/WebKitDOMHTMLAudioElementPrivate.h"
+#include "webkit/WebKitDOMHTMLVideoElementPrivate.h"
 #endif
 
 #include <wtf/text/CString.h>
@@ -187,6 +189,11 @@ static gpointer createAudioWrapper(PassRefPtr<HTMLElement> element)
 {
     return wrapHTMLAudioElement(static_cast<HTMLAudioElement*>(element.get()));
 }
+
+static gpointer createVideoWrapper(PassRefPtr<HTMLElement> element)
+{
+    return wrapHTMLVideoElement(static_cast<HTMLVideoElement*>(element.get()));
+}
 #endif
 
 static gpointer createBaseWrapper(PassRefPtr<HTMLElement> element)
@@ -467,6 +474,7 @@ gpointer createHTMLElementWrapper(PassRefPtr<WebCore::HTMLElement> element)
        map.set(appletTag.localName().impl(), createAppletWrapper);
 #if ENABLE(VIDEO)
        map.set(audioTag.localName().impl(), createAudioWrapper);
+       map.set(videoTag.localName().impl(), createVideoWrapper);
 #endif
        map.set(areaTag.localName().impl(), createAreaWrapper);
        map.set(baseTag.localName().impl(), createBaseWrapper);
diff --git a/Source/WebCore/bindings/js/CachedScriptSourceProvider.h b/Source/WebCore/bindings/js/CachedScriptSourceProvider.h
index 9bae8ca..8f63a69 100644
--- a/Source/WebCore/bindings/js/CachedScriptSourceProvider.h
+++ b/Source/WebCore/bindings/js/CachedScriptSourceProvider.h
@@ -57,7 +57,7 @@ namespace WebCore {
 
     private:
         CachedScriptSourceProvider(CachedScript* cachedScript)
-            : ScriptSourceProvider(stringToUString(cachedScript->url()), cachedScript->sourceProviderCache())
+            : ScriptSourceProvider(stringToUString(cachedScript->response().url()), cachedScript->sourceProviderCache())
             , m_cachedScript(cachedScript)
         {
             m_cachedScript->addClient(this);
diff --git a/Source/WebCore/bindings/js/DOMWrapperWorld.h b/Source/WebCore/bindings/js/DOMWrapperWorld.h
index 5e7b551..9825a08 100644
--- a/Source/WebCore/bindings/js/DOMWrapperWorld.h
+++ b/Source/WebCore/bindings/js/DOMWrapperWorld.h
@@ -32,8 +32,8 @@ namespace WebCore {
 
 class ScriptController;
 
-typedef JSC::WeakGCMap<void*, DOMObject*> DOMObjectWrapperMap;
-typedef JSC::WeakGCMap<StringImpl*, JSC::JSString*> JSStringCache; 
+typedef JSC::WeakGCMap<void*, DOMObject> DOMObjectWrapperMap;
+typedef JSC::WeakGCMap<StringImpl*, JSC::JSString> JSStringCache; 
 
 class DOMWrapperWorld : public RefCounted<DOMWrapperWorld> {
 public:
@@ -58,6 +58,8 @@ public:
 
     bool isNormal() const { return m_isNormal; }
 
+    JSC::JSGlobalData* globalData() const { return m_globalData; }
+
 protected:
     DOMWrapperWorld(JSC::JSGlobalData*, bool isNormal);
 
diff --git a/Source/WebCore/bindings/js/JSArrayBufferCustom.cpp b/Source/WebCore/bindings/js/JSArrayBufferCustom.cpp
index 68edc5c..52332c9 100644
--- a/Source/WebCore/bindings/js/JSArrayBufferCustom.cpp
+++ b/Source/WebCore/bindings/js/JSArrayBufferCustom.cpp
@@ -24,9 +24,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "JSArrayBuffer.h"
 
 #include "ArrayBuffer.h"
@@ -53,5 +50,3 @@ EncodedJSValue JSC_HOST_CALL JSArrayBufferConstructor::constructJSArrayBuffer(Ex
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/js/JSArrayBufferViewHelper.h b/Source/WebCore/bindings/js/JSArrayBufferViewHelper.h
index 73229da..a7ef436 100644
--- a/Source/WebCore/bindings/js/JSArrayBufferViewHelper.h
+++ b/Source/WebCore/bindings/js/JSArrayBufferViewHelper.h
@@ -137,7 +137,7 @@ PassRefPtr<C> constructArrayBufferView(JSC::ExecState* exec)
     // JavaScript DOM bindings can distinguish between "new
     // <Type>Array()" and what occurs when a previously-constructed
     // ArrayBufferView is returned to JavaScript; e.g., from
-    // "array.slice()".
+    // "array.subset()".
     if (exec->argumentCount() < 1)
         return C::create(0);
     
diff --git a/Source/WebCore/bindings/js/JSAudioConstructor.cpp b/Source/WebCore/bindings/js/JSAudioConstructor.cpp
index 1ea5ae4..c19d795 100644
--- a/Source/WebCore/bindings/js/JSAudioConstructor.cpp
+++ b/Source/WebCore/bindings/js/JSAudioConstructor.cpp
@@ -42,8 +42,8 @@ const ClassInfo JSAudioConstructor::s_info = { "AudioConstructor", 0, 0, 0 };
 JSAudioConstructor::JSAudioConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMConstructorWithDocument(JSAudioConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSHTMLAudioElementPrototype::self(exec, globalObject), None);
-    putDirect(exec->propertyNames().length, jsNumber(1), ReadOnly | DontDelete | DontEnum);
+    putDirect(exec->globalData(), exec->propertyNames().prototype, JSHTMLAudioElementPrototype::self(exec, globalObject), None);
+    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(1), ReadOnly | DontDelete | DontEnum);
 }
 
 static EncodedJSValue JSC_HOST_CALL constructAudio(ExecState* exec)
diff --git a/Source/WebCore/bindings/js/JSAudioContextCustom.cpp b/Source/WebCore/bindings/js/JSAudioContextCustom.cpp
index 04644bc..382d0cb 100644
--- a/Source/WebCore/bindings/js/JSAudioContextCustom.cpp
+++ b/Source/WebCore/bindings/js/JSAudioContextCustom.cpp
@@ -28,12 +28,18 @@
 
 #include "AudioContext.h"
 
+#include "ArrayBuffer.h"
+#include "AudioBuffer.h"
+#include "JSArrayBuffer.h"
+#include "JSAudioBuffer.h"
 #include "JSAudioContext.h"
 #include <runtime/Error.h>
 
+using namespace JSC;
+
 namespace WebCore {
 
-JSC::EncodedJSValue JSC_HOST_CALL JSAudioContextConstructor::constructJSAudioContext(JSC::ExecState* exec)
+EncodedJSValue JSC_HOST_CALL JSAudioContextConstructor::constructJSAudioContext(ExecState* exec)
 {
     JSAudioContextConstructor* jsConstructor = static_cast<JSAudioContextConstructor*>(exec->callee());
     if (!jsConstructor)
@@ -49,7 +55,48 @@ JSC::EncodedJSValue JSC_HOST_CALL JSAudioContextConstructor::constructJSAudioCon
     Document* document = static_cast<Document*>(scriptExecutionContext);
 
     RefPtr<AudioContext> context = AudioContext::create(document);
-    return JSC::JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), context.get())));
+    return JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), context.get())));
+}
+
+JSValue JSAudioContext::createBuffer(ExecState* exec)
+{
+    if (exec->argumentCount() < 2)
+        return throwError(exec, createSyntaxError(exec, "Not enough arguments"));
+
+    AudioContext* audioContext = static_cast<AudioContext*>(impl());
+    ASSERT(audioContext);
+
+    // AudioBuffer createBuffer(in ArrayBuffer buffer, in boolean mixToMono);
+    JSValue val = exec->argument(0);
+    if (val.inherits(&JSArrayBuffer::s_info)) {
+        ArrayBuffer* arrayBuffer = toArrayBuffer(val);
+        ASSERT(arrayBuffer);
+        if (arrayBuffer) {
+            bool mixToMono = exec->argument(1).toBoolean(exec);
+
+            RefPtr<AudioBuffer> audioBuffer = audioContext->createBuffer(arrayBuffer, mixToMono);
+            if (!audioBuffer.get())
+                return throwError(exec, createSyntaxError(exec, "Error decoding audio file data"));
+
+            return toJS(exec, globalObject(), audioBuffer.get());
+        }
+
+        return jsUndefined();
+    }
+    
+    // AudioBuffer createBuffer(in unsigned long numberOfChannels, in unsigned long numberOfFrames, in float sampleRate);
+    if (exec->argumentCount() < 3)
+        return throwError(exec, createSyntaxError(exec, "Not enough arguments"));
+    
+    unsigned numberOfChannels = exec->argument(0).toInt32(exec);
+    unsigned numberOfFrames = exec->argument(1).toInt32(exec);
+    float sampleRate = exec->argument(2).toFloat(exec);
+
+    RefPtr<AudioBuffer> audioBuffer = audioContext->createBuffer(numberOfChannels, numberOfFrames, sampleRate);
+    if (!audioBuffer.get())
+        return throwError(exec, createSyntaxError(exec, "Error creating AudioBuffer"));
+
+    return toJS(exec, globalObject(), audioBuffer.get());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
index af74e8c..7c5edc6 100644
--- a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
+++ b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
@@ -28,6 +28,7 @@
 #include "DOMObjectHashTableMap.cpp"
 #include "DOMWrapperWorld.cpp"
 #include "GCController.cpp"
+#include "JSArrayBufferCustom.cpp"
 #include "JSAttrCustom.cpp"
 #include "JSAudioConstructor.cpp"
 #include "JSCDATASectionCustom.cpp"
@@ -65,6 +66,7 @@
 #include "JSDOMWrapper.cpp"
 #include "JSDataGridColumnListCustom.cpp"
 #include "JSDataGridDataSource.cpp"
+#include "JSDataViewCustom.cpp"
 #include "JSDebugWrapperSet.cpp"
 #include "JSDedicatedWorkerContextCustom.cpp"
 #include "JSDesktopNotificationsCustom.cpp"
@@ -77,6 +79,7 @@
 #include "JSEventSourceCustom.cpp"
 #include "JSEventTarget.cpp"
 #include "JSExceptionBase.cpp"
+#include "JSFloat32ArrayCustom.cpp"
 #include "JSGeolocationCustom.cpp"
 #include "JSHTMLAllCollectionCustom.cpp"
 #include "JSHTMLAppletElementCustom.cpp"
@@ -101,10 +104,14 @@
 #include "JSImageDataCustom.cpp"
 #include "JSInjectedScriptHostCustom.cpp"
 #include "JSInspectorFrontendHostCustom.cpp"
+#include "JSInt16ArrayCustom.cpp"
+#include "JSInt32ArrayCustom.cpp"
+#include "JSInt8ArrayCustom.cpp"
 #include "JSJavaScriptCallFrameCustom.cpp"
 #include "JSLazyEventListener.cpp"
 #include "JSLocationCustom.cpp"
 #include "JSMainThreadExecState.cpp"
+#include "JSMemoryInfoCustom.cpp"
 #include "JSMessageChannelCustom.cpp"
 #include "JSMessageEventCustom.cpp"
 #include "JSMessagePortCustom.cpp"
@@ -133,6 +140,9 @@
 #include "JSTouchCustom.cpp"
 #include "JSTouchListCustom.cpp"
 #include "JSTreeWalkerCustom.cpp"
+#include "JSUint16ArrayCustom.cpp"
+#include "JSUint32ArrayCustom.cpp"
+#include "JSUint8ArrayCustom.cpp"
 #include "JSWebKitCSSKeyframeRuleCustom.cpp"
 #include "JSWebKitCSSKeyframesRuleCustom.cpp"
 #include "JSWebKitCSSMatrixCustom.cpp"
diff --git a/Source/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp b/Source/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
index df24eb7..cab7ba3 100644
--- a/Source/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
+++ b/Source/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
@@ -28,7 +28,7 @@
 
 #include "CanvasRenderingContext2D.h"
 #include "JSCanvasRenderingContext2D.h"
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 #include "WebGLRenderingContext.h"
 #include "JSWebGLRenderingContext.h"
 #endif
@@ -42,7 +42,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasR
     if (!object)
         return jsUndefined();
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
     if (object->is3d())
         return getDOMObjectWrapper<JSWebGLRenderingContext>(exec, globalObject, static_cast<WebGLRenderingContext*>(object));
 #endif
diff --git a/Source/WebCore/bindings/js/JSDOMBinding.cpp b/Source/WebCore/bindings/js/JSDOMBinding.cpp
index e53dcfb..7de2719 100644
--- a/Source/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/Source/WebCore/bindings/js/JSDOMBinding.cpp
@@ -335,9 +335,9 @@ void markDOMNodesForDocument(MarkStack& markStack, Document* document)
 
         JSWrapperCache::iterator nodeEnd = nodeDict->uncheckedEnd();
         for (JSWrapperCache::iterator nodeIt = nodeDict->uncheckedBegin(); nodeIt != nodeEnd; ++nodeIt) {
-            JSNode* jsNode = nodeIt->second;
-            if (isObservableThroughDOM(jsNode, world))
-                markStack.append(jsNode);
+            DeprecatedPtr<JSNode>& jsNode = nodeIt->second;
+            if (isObservableThroughDOM(jsNode.get(), world))
+                markStack.append(&jsNode);
         }
     }
 }
@@ -416,8 +416,8 @@ void markDOMObjectWrapper(MarkStack& markStack, JSGlobalData& globalData, void*
         return;
 
     for (JSGlobalDataWorldIterator worldIter(&globalData); worldIter; ++worldIter) {
-        if (DOMObject* wrapper = worldIter->m_wrappers.uncheckedGet(object))
-            markStack.append(wrapper);
+        if (DeprecatedPtr<DOMObject>* wrapperSlot = worldIter->m_wrappers.uncheckedGetSlot(object))
+            markStack.append(wrapperSlot);
     }
 }
 
@@ -426,15 +426,15 @@ void markDOMNodeWrapper(MarkStack& markStack, Document* document, Node* node)
     if (document) {
         JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
         for (JSWrapperCacheMap::iterator iter = wrapperCacheMap.begin(); iter != wrapperCacheMap.end(); ++iter) {
-            if (JSNode* wrapper = iter->second->uncheckedGet(node))
-                markStack.append(wrapper);
+            if (DeprecatedPtr<JSNode>* wrapperSlot = iter->second->uncheckedGetSlot(node))
+                markStack.append(wrapperSlot);
         }
         return;
     }
 
     for (JSGlobalDataWorldIterator worldIter(JSDOMWindow::commonJSGlobalData()); worldIter; ++worldIter) {
-        if (DOMObject* wrapper = worldIter->m_wrappers.uncheckedGet(node))
-            markStack.append(wrapper);
+        if (DeprecatedPtr<DOMObject>* wrapperSlot = worldIter->m_wrappers.uncheckedGetSlot(node))
+            markStack.append(wrapperSlot);
     }
 }
 
diff --git a/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp b/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp
index e0b5b89..a328ee9 100644
--- a/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp
+++ b/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp
@@ -53,14 +53,14 @@ void JSDOMGlobalObject::markChildren(MarkStack& markStack)
 
     JSDOMStructureMap::iterator end = structures().end();
     for (JSDOMStructureMap::iterator it = structures().begin(); it != end; ++it)
-        markStack.append(it->second->storedPrototype());
+        markStack.append(it->second->storedPrototypeSlot());
 
     JSDOMConstructorMap::iterator end2 = constructors().end();
     for (JSDOMConstructorMap::iterator it2 = constructors().begin(); it2 != end2; ++it2)
-        markStack.append(it2->second);
+        markStack.append(&it2->second);
 
     if (d()->m_injectedScript)
-        markStack.append(d()->m_injectedScript);
+        markStack.append(&d()->m_injectedScript);
 }
 
 void JSDOMGlobalObject::setCurrentEvent(Event* evt)
@@ -75,12 +75,12 @@ Event* JSDOMGlobalObject::currentEvent() const
 
 void JSDOMGlobalObject::setInjectedScript(JSObject* injectedScript)
 {
-    d()->m_injectedScript = injectedScript;
+    d()->m_injectedScript.set(globalData(), this, injectedScript);
 }
 
 JSObject* JSDOMGlobalObject::injectedScript() const
 {
-    return d()->m_injectedScript;
+    return d()->m_injectedScript.get();
 }
 
 void JSDOMGlobalObject::destroyJSDOMGlobalObjectData(void* jsDOMGlobalObjectData)
diff --git a/Source/WebCore/bindings/js/JSDOMGlobalObject.h b/Source/WebCore/bindings/js/JSDOMGlobalObject.h
index 8eb55c1..4dce7a5 100644
--- a/Source/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/Source/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -39,7 +39,7 @@ namespace WebCore {
     class ScriptExecutionContext;
 
     typedef HashMap<const JSC::ClassInfo*, RefPtr<JSC::Structure> > JSDOMStructureMap;
-    typedef HashMap<const JSC::ClassInfo*, JSC::JSObject*> JSDOMConstructorMap;
+    typedef HashMap<const JSC::ClassInfo*, JSC::WriteBarrier<JSC::JSObject> > JSDOMConstructorMap;
 
     class JSDOMGlobalObject : public JSC::JSGlobalObject {
         typedef JSC::JSGlobalObject Base;
@@ -76,7 +76,6 @@ namespace WebCore {
                 : JSGlobalObjectData(destructor)
                 , evt(0)
                 , m_world(world)
-                , m_injectedScript(0)
             {
             }
 
@@ -85,7 +84,7 @@ namespace WebCore {
 
             Event* evt;
             RefPtr<DOMWrapperWorld> m_world;
-            JSObject* m_injectedScript;
+            JSC::WriteBarrier<JSObject> m_injectedScript;
         };
 
     private:
@@ -97,11 +96,12 @@ namespace WebCore {
     template<class ConstructorClass>
     inline JSC::JSObject* getDOMConstructor(JSC::ExecState* exec, const JSDOMGlobalObject* globalObject)
     {
-        if (JSC::JSObject* constructor = globalObject->constructors().get(&ConstructorClass::s_info))
+        if (JSC::JSObject* constructor = globalObject->constructors().get(&ConstructorClass::s_info).get())
             return constructor;
         JSC::JSObject* constructor = new (exec) ConstructorClass(exec, const_cast<JSDOMGlobalObject*>(globalObject));
         ASSERT(!globalObject->constructors().contains(&ConstructorClass::s_info));
-        globalObject->constructors().set(&ConstructorClass::s_info, constructor);
+        JSC::WriteBarrier<JSC::JSObject> temp;
+        globalObject->constructors().add(&ConstructorClass::s_info, temp).first->second.set(exec->globalData(), globalObject, constructor);
         return constructor;
     }
 
diff --git a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp b/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
index c8d8db6..c12d1c4 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -24,17 +24,26 @@
 #include "HTMLCollection.h"
 #include "HTMLDocument.h"
 #include "History.h"
+#include "JSArrayBuffer.h"
 #include "JSAudioConstructor.h"
+#include "JSDataView.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
 #include "JSEventSource.h"
+#include "JSFloat32Array.h"
 #include "JSHTMLCollection.h"
 #include "JSHistory.h"
 #include "JSImageConstructor.h"
+#include "JSInt16Array.h"
+#include "JSInt32Array.h"
+#include "JSInt8Array.h"
 #include "JSLocation.h"
 #include "JSMessageChannel.h"
 #include "JSMessagePortCustom.h"
 #include "JSOptionConstructor.h"
+#include "JSUint16Array.h"
+#include "JSUint32Array.h"
+#include "JSUint8Array.h"
 #include "JSWebKitCSSMatrix.h"
 #include "JSWebKitPoint.h"
 #include "JSWorker.h"
@@ -48,18 +57,6 @@
 #include <runtime/JSFunction.h>
 #include <runtime/PrototypeFunction.h>
 
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-#include "JSArrayBuffer.h"
-#include "JSDataView.h"
-#include "JSFloat32Array.h"
-#include "JSInt16Array.h"
-#include "JSInt32Array.h"
-#include "JSInt8Array.h"
-#include "JSUint16Array.h"
-#include "JSUint32Array.h"
-#include "JSUint8Array.h"
-#endif
-
 #if ENABLE(SHARED_WORKERS)
 #include "JSSharedWorker.h"
 #endif
@@ -475,7 +472,7 @@ void JSDOMWindow::setLocation(ExecState* exec, JSValue value)
         if (Settings* settings = activeFrame->settings()) {
             if (settings->usesDashboardBackwardCompatibilityMode() && !activeFrame->tree()->parent()) {
                 if (allowsAccessFrom(exec))
-                    putDirect(Identifier(exec, "location"), value);
+                    putDirect(exec->globalData(), Identifier(exec, "location"), value);
                 return;
             }
         }
@@ -489,11 +486,6 @@ void JSDOMWindow::setLocation(ExecState* exec, JSValue value)
     impl()->setLocation(ustringToString(locationString), activeDOMWindow(exec), firstDOMWindow(exec));
 }
 
-JSValue JSDOMWindow::crypto(ExecState*) const
-{
-    return jsUndefined();
-}
-
 JSValue JSDOMWindow::event(ExecState* exec) const
 {
     Event* event = currentEvent();
@@ -538,7 +530,6 @@ JSValue JSDOMWindow::webKitCSSMatrix(ExecState* exec) const
     return getDOMConstructor<JSWebKitCSSMatrixConstructor>(exec, this);
 }
  
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 JSValue JSDOMWindow::arrayBuffer(ExecState* exec) const
 {
     return getDOMConstructor<JSArrayBufferConstructor>(exec, this);
@@ -583,8 +574,7 @@ JSValue JSDOMWindow::dataView(ExecState* exec) const
 {
     return getDOMConstructor<JSDataViewConstructor>(exec, this);
 }
-#endif
- 
+
 JSValue JSDOMWindow::xmlHttpRequest(ExecState* exec) const
 {
     return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, this);
@@ -682,7 +672,7 @@ inline void DialogHandler::dialogCreated(DOMWindow* dialog)
     //        world if dialogArguments comes from an isolated world.
     m_globalObject = toJSDOMWindow(dialog->frame(), normalWorld(m_exec->globalData()));
     if (JSValue dialogArguments = m_exec->argument(1))
-        m_globalObject->putDirect(Identifier(m_exec, "dialogArguments"), dialogArguments);
+        m_globalObject->putDirect(m_exec->globalData(), Identifier(m_exec, "dialogArguments"), dialogArguments);
 }
 
 inline JSValue DialogHandler::returnValue() const
diff --git a/Source/WebCore/bindings/js/JSDOMWindowShell.cpp b/Source/WebCore/bindings/js/JSDOMWindowShell.cpp
index 65096b9..40f9910 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -45,7 +45,6 @@ const ClassInfo JSDOMWindowShell::s_info = { "JSDOMWindowShell", 0, 0, 0 };
 
 JSDOMWindowShell::JSDOMWindowShell(PassRefPtr<DOMWindow> window, DOMWrapperWorld* world)
     : Base(JSDOMWindowShell::createStructure(jsNull()))
-    , m_window(0)
     , m_world(world)
 {
     setWindow(window);
@@ -65,8 +64,8 @@ void JSDOMWindowShell::setWindow(PassRefPtr<DOMWindow> domWindow)
 
     RefPtr<Structure> structure = JSDOMWindow::createStructure(prototype);
     JSDOMWindow* jsDOMWindow = new (JSDOMWindow::commonJSGlobalData()) JSDOMWindow(structure.release(), domWindow, this);
-    prototype->putAnonymousValue(0, jsDOMWindow);
-    setWindow(jsDOMWindow);
+    prototype->putAnonymousValue(*JSDOMWindow::commonJSGlobalData(), 0, jsDOMWindow);
+    setWindow(*JSDOMWindow::commonJSGlobalData(), jsDOMWindow);
 }
 
 // ----
@@ -77,7 +76,7 @@ void JSDOMWindowShell::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
     if (m_window)
-        markStack.append(m_window);
+        markStack.append(&m_window);
 }
 
 UString JSDOMWindowShell::className() const
@@ -147,7 +146,7 @@ JSValue JSDOMWindowShell::lookupSetter(ExecState* exec, const Identifier& proper
 
 JSObject* JSDOMWindowShell::unwrappedObject()
 {
-    return m_window;
+    return m_window.get();
 }
 
 // ----
diff --git a/Source/WebCore/bindings/js/JSDOMWindowShell.h b/Source/WebCore/bindings/js/JSDOMWindowShell.h
index 888325d..d585fd4 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/Source/WebCore/bindings/js/JSDOMWindowShell.h
@@ -43,11 +43,11 @@ namespace WebCore {
         JSDOMWindowShell(PassRefPtr<DOMWindow>, DOMWrapperWorld* world);
         virtual ~JSDOMWindowShell();
 
-        JSDOMWindow* window() const { return m_window; }
-        void setWindow(JSDOMWindow* window)
+        JSDOMWindow* window() const { return m_window.get(); }
+        void setWindow(JSC::JSGlobalData& globalData, JSDOMWindow* window)
         {
             ASSERT_ARG(window, window);
-            m_window = window;
+            m_window.set(globalData, this, window);
             setPrototype(window->prototype());
         }
         void setWindow(PassRefPtr<DOMWindow>);
@@ -85,7 +85,7 @@ namespace WebCore {
         virtual JSC::JSObject* unwrappedObject();
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 
-        JSDOMWindow* m_window;
+        JSC::WriteBarrier<JSDOMWindow> m_window;
         RefPtr<DOMWrapperWorld> m_world;
     };
 
diff --git a/Source/WebCore/bindings/js/JSDataViewCustom.cpp b/Source/WebCore/bindings/js/JSDataViewCustom.cpp
index ba48374..eaf57bd 100644
--- a/Source/WebCore/bindings/js/JSDataViewCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDataViewCustom.cpp
@@ -24,9 +24,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "JSDataView.h"
 
 #include "DataView.h"
@@ -160,5 +157,3 @@ JSValue JSDataView::setUint8(ExecState* exec)
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp b/Source/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
index 38334b9..16a962c 100644
--- a/Source/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
@@ -47,7 +47,7 @@ namespace WebCore {
 
 JSValue JSNotificationCenter::requestPermission(ExecState* exec)
 {
-    ScriptExecutionContext* context = impl()->context();
+    ScriptExecutionContext* context = impl()->scriptExecutionContext();
 
     // Make sure that script execution context is valid.
     if (!context) {
diff --git a/Source/WebCore/bindings/js/JSDeviceMotionEventCustom.cpp b/Source/WebCore/bindings/js/JSDeviceMotionEventCustom.cpp
index 503d64f..9142aa2 100644
--- a/Source/WebCore/bindings/js/JSDeviceMotionEventCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDeviceMotionEventCustom.cpp
@@ -114,18 +114,18 @@ static PassRefPtr<DeviceMotionData::RotationRate> readRotationRateArgument(JSVal
 static JSObject* createAccelerationObject(const DeviceMotionData::Acceleration* acceleration, ExecState* exec)
 {
     JSObject* object = constructEmptyObject(exec);
-    object->putDirect(Identifier(exec, "x"), acceleration->canProvideX() ? jsNumber(acceleration->x()) : jsNull());
-    object->putDirect(Identifier(exec, "y"), acceleration->canProvideY() ? jsNumber(acceleration->y()) : jsNull());
-    object->putDirect(Identifier(exec, "z"), acceleration->canProvideZ() ? jsNumber(acceleration->z()) : jsNull());
+    object->putDirect(exec->globalData(), Identifier(exec, "x"), acceleration->canProvideX() ? jsNumber(acceleration->x()) : jsNull());
+    object->putDirect(exec->globalData(), Identifier(exec, "y"), acceleration->canProvideY() ? jsNumber(acceleration->y()) : jsNull());
+    object->putDirect(exec->globalData(), Identifier(exec, "z"), acceleration->canProvideZ() ? jsNumber(acceleration->z()) : jsNull());
     return object;
 }
 
 static JSObject* createRotationRateObject(const DeviceMotionData::RotationRate* rotationRate, ExecState* exec)
 {
     JSObject* object = constructEmptyObject(exec);
-    object->putDirect(Identifier(exec, "alpha"), rotationRate->canProvideAlpha() ? jsNumber(rotationRate->alpha()) : jsNull());
-    object->putDirect(Identifier(exec, "beta"),  rotationRate->canProvideBeta()  ? jsNumber(rotationRate->beta())  : jsNull());
-    object->putDirect(Identifier(exec, "gamma"), rotationRate->canProvideGamma() ? jsNumber(rotationRate->gamma()) : jsNull());
+    object->putDirect(exec->globalData(), Identifier(exec, "alpha"), rotationRate->canProvideAlpha() ? jsNumber(rotationRate->alpha()) : jsNull());
+    object->putDirect(exec->globalData(), Identifier(exec, "beta"),  rotationRate->canProvideBeta()  ? jsNumber(rotationRate->beta())  : jsNull());
+    object->putDirect(exec->globalData(), Identifier(exec, "gamma"), rotationRate->canProvideGamma() ? jsNumber(rotationRate->gamma()) : jsNull());
     return object;
 }
 
diff --git a/Source/WebCore/bindings/js/JSDocumentCustom.cpp b/Source/WebCore/bindings/js/JSDocumentCustom.cpp
index 4cc176c..fa2b93c 100644
--- a/Source/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -25,7 +25,7 @@
 #include "FrameLoader.h"
 #include "HTMLDocument.h"
 #include "JSCanvasRenderingContext2D.h"
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 #include "JSWebGLRenderingContext.h"
 #endif
 #include "JSDOMWindowCustom.h"
diff --git a/Source/WebCore/bindings/js/JSElementCustom.cpp b/Source/WebCore/bindings/js/JSElementCustom.cpp
index 3bfe110..9ed3739 100644
--- a/Source/WebCore/bindings/js/JSElementCustom.cpp
+++ b/Source/WebCore/bindings/js/JSElementCustom.cpp
@@ -75,7 +75,7 @@ JSValue toJSNewlyCreated(ExecState* exec, JSDOMGlobalObject* globalObject, Eleme
 
     JSNode* wrapper;        
     if (element->isHTMLElement())
-        wrapper = createJSHTMLWrapper(exec, globalObject, static_cast<HTMLElement*>(element));
+        wrapper = createJSHTMLWrapper(exec, globalObject, toHTMLElement(element));
 #if ENABLE(SVG)
     else if (element->isSVGElement())
         wrapper = createJSSVGWrapper(exec, globalObject, static_cast<SVGElement*>(element));
diff --git a/Source/WebCore/bindings/js/JSEventListener.cpp b/Source/WebCore/bindings/js/JSEventListener.cpp
index 5604374..6427683 100644
--- a/Source/WebCore/bindings/js/JSEventListener.cpp
+++ b/Source/WebCore/bindings/js/JSEventListener.cpp
@@ -34,12 +34,12 @@ namespace WebCore {
 
 JSEventListener::JSEventListener(JSObject* function, JSObject* wrapper, bool isAttribute, DOMWrapperWorld* isolatedWorld)
     : EventListener(JSEventListenerType)
-    , m_jsFunction(function)
     , m_isAttribute(isAttribute)
     , m_isolatedWorld(isolatedWorld)
 {
     if (wrapper)
         m_wrapper = wrapper;
+    m_jsFunction.set(*m_isolatedWorld->globalData(), wrapper, function);
 }
 
 JSEventListener::~JSEventListener()
@@ -55,7 +55,7 @@ JSObject* JSEventListener::initializeJSFunction(ScriptExecutionContext*) const
 void JSEventListener::markJSFunction(MarkStack& markStack)
 {
     if (m_jsFunction)
-        markStack.append(m_jsFunction);
+        markStack.append(&m_jsFunction);
 }
 
 void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext, Event* event)
diff --git a/Source/WebCore/bindings/js/JSEventListener.h b/Source/WebCore/bindings/js/JSEventListener.h
index 83d0d2e..47ff44e 100644
--- a/Source/WebCore/bindings/js/JSEventListener.h
+++ b/Source/WebCore/bindings/js/JSEventListener.h
@@ -66,7 +66,7 @@ namespace WebCore {
         virtual void handleEvent(ScriptExecutionContext*, Event*);
 
     private:
-        mutable JSC::JSObject* m_jsFunction;
+        mutable JSC::WriteBarrier<JSC::JSObject> m_jsFunction;
         mutable JSC::WeakGCPtr<JSC::JSObject> m_wrapper;
 
         bool m_isAttribute;
@@ -76,7 +76,7 @@ namespace WebCore {
     inline JSC::JSObject* JSEventListener::jsFunction(ScriptExecutionContext* scriptExecutionContext) const
     {
         if (!m_jsFunction)
-            m_jsFunction = initializeJSFunction(scriptExecutionContext);
+            m_jsFunction.set(*scriptExecutionContext->globalData(), m_wrapper.get(), initializeJSFunction(scriptExecutionContext));
 
         // Verify that we have a valid wrapper protecting our function from
         // garbage collection.
@@ -86,9 +86,9 @@ namespace WebCore {
 
         // Try to verify that m_jsFunction wasn't recycled. (Not exact, since an
         // event listener can be almost anything, but this makes test-writing easier).
-        ASSERT(!m_jsFunction || static_cast<JSC::JSCell*>(m_jsFunction)->isObject());
+        ASSERT(!m_jsFunction || static_cast<JSC::JSCell*>(m_jsFunction.get())->isObject());
 
-        return m_jsFunction;
+        return m_jsFunction.get();
     }
 
     inline void JSEventListener::invalidateJSFunction(JSC::JSObject* wrapper)
diff --git a/Source/WebCore/bindings/js/JSFloat32ArrayCustom.cpp b/Source/WebCore/bindings/js/JSFloat32ArrayCustom.cpp
index eb4608c..5da69b4 100644
--- a/Source/WebCore/bindings/js/JSFloat32ArrayCustom.cpp
+++ b/Source/WebCore/bindings/js/JSFloat32ArrayCustom.cpp
@@ -24,9 +24,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "JSFloat32Array.h"
 
 #include "Float32Array.h"
@@ -62,5 +59,3 @@ EncodedJSValue JSC_HOST_CALL JSFloat32ArrayConstructor::constructJSFloat32Array(
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp b/Source/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
index ae9115e..84dd72e 100644
--- a/Source/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
+++ b/Source/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
@@ -30,7 +30,7 @@
 #include "CanvasContextAttributes.h"
 #include "HTMLCanvasElement.h"
 #include "JSCanvasRenderingContext2D.h"
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 #include "JSWebGLRenderingContext.h"
 #include "WebGLContextAttributes.h"
 #endif
@@ -55,7 +55,7 @@ JSValue JSHTMLCanvasElement::getContext(ExecState* exec)
     HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(impl());
     const UString& contextId = exec->argument(0).toString(exec);
     RefPtr<CanvasContextAttributes> attrs;
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
     if (contextId == "experimental-webgl" || contextId == "webkit-3d") {
         attrs = WebGLContextAttributes::create();
         WebGLContextAttributes* webGLAttrs = static_cast<WebGLContextAttributes*>(attrs.get());
diff --git a/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp b/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
index 0b40ef0..192ef5d 100644
--- a/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
+++ b/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
@@ -26,7 +26,6 @@
 #include "config.h"
 #include "JSHTMLDocument.h"
 
-#include "CharacterNames.h"
 #include "Frame.h"
 #include "HTMLAllCollection.h"
 #include "HTMLBodyElement.h"
@@ -43,6 +42,7 @@
 #include "DocumentParser.h"
 #include <runtime/Error.h>
 #include <runtime/JSCell.h>
+#include <wtf/unicode/CharacterNames.h>
 
 using namespace JSC;
 
@@ -96,7 +96,7 @@ JSValue JSHTMLDocument::all(ExecState* exec) const
 void JSHTMLDocument::setAll(ExecState* exec, JSValue value)
 {
     // Add "all" to the property map.
-    putDirect(Identifier(exec, "all"), value);
+    putDirect(exec->globalData(), Identifier(exec, "all"), value);
 }
 
 // Custom functions
diff --git a/Source/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp b/Source/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
index 617aaff..ea4f4c0 100644
--- a/Source/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
+++ b/Source/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
@@ -50,7 +50,7 @@ bool JSHTMLFrameSetElement::canGetItemsForName(ExecState*, HTMLFrameSetElement*
 JSValue JSHTMLFrameSetElement::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
     JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slotBase));
-    HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
+    HTMLElement* element = toHTMLElement(thisObj->impl());
 
     Node* frame = element->children()->namedItem(identifierToAtomicString(propertyName));
     if (Document* doc = static_cast<HTMLFrameElement*>(frame)->contentDocument()) {
diff --git a/Source/WebCore/bindings/js/JSImageConstructor.cpp b/Source/WebCore/bindings/js/JSImageConstructor.cpp
index f2ad803..5192e12 100644
--- a/Source/WebCore/bindings/js/JSImageConstructor.cpp
+++ b/Source/WebCore/bindings/js/JSImageConstructor.cpp
@@ -37,7 +37,7 @@ const ClassInfo JSImageConstructor::s_info = { "ImageConstructor", 0, 0, 0 };
 JSImageConstructor::JSImageConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMConstructorWithDocument(JSImageConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSHTMLImageElementPrototype::self(exec, globalObject), None);
+    putDirect(exec->globalData(), exec->propertyNames().prototype, JSHTMLImageElementPrototype::self(exec, globalObject), None);
 }
 
 static EncodedJSValue JSC_HOST_CALL constructImage(ExecState* exec)
diff --git a/Source/WebCore/bindings/js/JSImageDataCustom.cpp b/Source/WebCore/bindings/js/JSImageDataCustom.cpp
index 61c5112..878e1de 100644
--- a/Source/WebCore/bindings/js/JSImageDataCustom.cpp
+++ b/Source/WebCore/bindings/js/JSImageDataCustom.cpp
@@ -49,7 +49,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, ImageData* imageD
     Identifier dataName(exec, "data");
     DEFINE_STATIC_LOCAL(RefPtr<Structure>, cpaStructure, (JSByteArray::createStructure(jsNull())));
     static const ClassInfo cpaClassInfo = { "CanvasPixelArray", 0, 0, 0 };
-    wrapper->putDirect(dataName, new (exec) JSByteArray(exec, cpaStructure, imageData->data()->data(), &cpaClassInfo), DontDelete | ReadOnly);
+    wrapper->putDirect(exec->globalData(), dataName, new (exec) JSByteArray(exec, cpaStructure, imageData->data()->data(), &cpaClassInfo), DontDelete | ReadOnly);
     exec->heap()->reportExtraMemoryCost(imageData->data()->length());
     
     return wrapper;
diff --git a/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp b/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
index 971098d..dd36c2e 100644
--- a/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
+++ b/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
@@ -46,7 +46,7 @@
 #include "FrameLoader.h"
 #include "InjectedScript.h"
 #include "InjectedScriptHost.h"
-#include "InspectorController.h"
+#include "InspectorAgent.h"
 #include "InspectorValues.h"
 #include "JSDOMWindow.h"
 #include "JSDOMWindowCustom.h"
@@ -128,8 +128,7 @@ JSValue JSInjectedScriptHost::nodeForId(ExecState* exec)
     if (!node)
         return jsUndefined();
 
-    InspectorController* ic = impl()->inspectorController();
-    if (!ic)
+    if (!impl()->inspectorAgent())
         return jsUndefined();
 
     JSLock lock(SilenceAssertionsOnly);
@@ -177,8 +176,7 @@ JSValue JSInjectedScriptHost::selectDOMStorage(ExecState* exec)
 {
     if (exec->argumentCount() < 1)
         return jsUndefined();
-    InspectorController* ic = impl()->inspectorController();
-    if (!ic)
+    if (!impl()->inspectorAgent())
         return jsUndefined();
 
     Storage* storage = toStorage(exec->argument(0));
diff --git a/Source/WebCore/bindings/js/JSInt16ArrayCustom.cpp b/Source/WebCore/bindings/js/JSInt16ArrayCustom.cpp
index 2e56d0b..87ea6fe 100644
--- a/Source/WebCore/bindings/js/JSInt16ArrayCustom.cpp
+++ b/Source/WebCore/bindings/js/JSInt16ArrayCustom.cpp
@@ -24,9 +24,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "JSInt16Array.h"
 
 #include "Int16Array.h"
@@ -62,5 +59,3 @@ EncodedJSValue JSC_HOST_CALL JSInt16ArrayConstructor::constructJSInt16Array(Exec
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/js/JSInt32ArrayCustom.cpp b/Source/WebCore/bindings/js/JSInt32ArrayCustom.cpp
index eaf474a..8b824a7 100644
--- a/Source/WebCore/bindings/js/JSInt32ArrayCustom.cpp
+++ b/Source/WebCore/bindings/js/JSInt32ArrayCustom.cpp
@@ -24,9 +24,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "JSInt32Array.h"
 
 #include "Int32Array.h"
@@ -62,5 +59,3 @@ EncodedJSValue JSC_HOST_CALL JSInt32ArrayConstructor::constructJSInt32Array(Exec
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/js/JSInt8ArrayCustom.cpp b/Source/WebCore/bindings/js/JSInt8ArrayCustom.cpp
index c4bd007..dcbcc5a 100644
--- a/Source/WebCore/bindings/js/JSInt8ArrayCustom.cpp
+++ b/Source/WebCore/bindings/js/JSInt8ArrayCustom.cpp
@@ -24,9 +24,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "JSInt8Array.h"
 
 #include "Int8Array.h"
@@ -63,5 +60,3 @@ EncodedJSValue JSC_HOST_CALL JSInt8ArrayConstructor::constructJSInt8Array(ExecSt
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp b/Source/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
index 0f47b7b..7c00bd4 100644
--- a/Source/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
+++ b/Source/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
@@ -79,7 +79,7 @@ JSValue JSJavaScriptCallFrame::scopeChain(ExecState* exec) const
 
     MarkedArgumentBuffer list;
     do {
-        list.append(*iter);
+        list.append(iter->get());
         ++iter;
     } while (iter != end);
 
@@ -100,7 +100,7 @@ JSValue JSJavaScriptCallFrame::scopeType(ExecState* exec)
 
     bool foundLocalScope = false;
     for (ScopeChainIterator iter = scopeChain->begin(); iter != end; ++iter) {
-        JSObject* scope = *iter;
+        JSC::DeprecatedPtr<JSObject> scope = *iter;
         if (scope->isActivationObject()) {
             if (!foundLocalScope) {
                 // First activation object is local scope, each successive activation object is closure.
diff --git a/Source/WebCore/platform/graphics/chromium/IconChromiumLinux.cpp b/Source/WebCore/bindings/js/JSMemoryInfoCustom.cpp
index 16f55e2..94c0e8a 100644
--- a/Source/WebCore/platform/graphics/chromium/IconChromiumLinux.cpp
+++ b/Source/WebCore/bindings/js/JSMemoryInfoCustom.cpp
@@ -1,10 +1,10 @@
 /*
- * Copyright (c) 2008, 2009 Google Inc. All rights reserved.
- * 
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -29,26 +29,16 @@
  */
 
 #include "config.h"
-#include "Icon.h"
 
-#include "GraphicsContext.h"
-#include "NotImplemented.h"
-#include "PlatformString.h"
+#include "JSMemoryInfo.h"
 
-namespace WebCore {
-
-Icon::Icon(const PlatformIcon& icon)
-    : m_icon(icon)
-{
-}
+using namespace JSC;
 
-Icon::~Icon()
-{
-}
+namespace WebCore {
 
-void Icon::paint(GraphicsContext*, const IntRect&)
+JSValue JSMemoryInfo::jsHeapSizeLimit(ExecState*) const
 {
-    notImplemented();
+    return jsUndefined();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSNodeCustom.cpp b/Source/WebCore/bindings/js/JSNodeCustom.cpp
index a0963b8..8d00447 100644
--- a/Source/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/Source/WebCore/bindings/js/JSNodeCustom.cpp
@@ -169,7 +169,7 @@ static ALWAYS_INLINE JSValue createWrapperInline(ExecState* exec, JSDOMGlobalObj
     switch (node->nodeType()) {
         case Node::ELEMENT_NODE:
             if (node->isHTMLElement())
-                wrapper = createJSHTMLWrapper(exec, globalObject, static_cast<HTMLElement*>(node));
+                wrapper = createJSHTMLWrapper(exec, globalObject, toHTMLElement(node));
 #if ENABLE(SVG)
             else if (node->isSVGElement())
                 wrapper = createJSSVGWrapper(exec, globalObject, static_cast<SVGElement*>(node));
diff --git a/Source/WebCore/bindings/js/JSNodeFilterCondition.cpp b/Source/WebCore/bindings/js/JSNodeFilterCondition.cpp
index b269e5f..1cf72a5 100644
--- a/Source/WebCore/bindings/js/JSNodeFilterCondition.cpp
+++ b/Source/WebCore/bindings/js/JSNodeFilterCondition.cpp
@@ -39,14 +39,14 @@ JSNodeFilterCondition::JSNodeFilterCondition(JSValue filter)
 
 void JSNodeFilterCondition::markAggregate(MarkStack& markStack)
 {
-    markStack.append(m_filter);
+    markStack.append(&m_filter);
 }
 
 short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode) const
 {
     JSLock lock(SilenceAssertionsOnly);
 
-    if (!m_filter.isObject())
+    if (!m_filter->isObject())
         return NodeFilter::FILTER_ACCEPT;
 
    // The exec argument here should only be null if this was called from a
@@ -58,11 +58,11 @@ short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode)
     if (!exec)
         return NodeFilter::FILTER_REJECT;
 
-    JSValue function = m_filter;
+    JSValue function = m_filter.get();
     CallData callData;
     CallType callType = getCallData(function, callData);
     if (callType == CallTypeNone) {
-        function = m_filter.get(exec, Identifier(exec, "acceptNode"));
+        function = m_filter->get(exec, Identifier(exec, "acceptNode"));
         callType = getCallData(function, callData);
         if (callType == CallTypeNone) {
             throwError(exec, createTypeError(exec, "NodeFilter object does not have an acceptNode function"));
@@ -77,7 +77,7 @@ short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode)
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
-    JSValue result = JSC::call(exec, function, callType, callData, m_filter, args);
+    JSValue result = JSC::call(exec, function, callType, callData, m_filter.get(), args);
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
diff --git a/Source/WebCore/bindings/js/JSNodeFilterCondition.h b/Source/WebCore/bindings/js/JSNodeFilterCondition.h
index b96534a..14b0c1d 100644
--- a/Source/WebCore/bindings/js/JSNodeFilterCondition.h
+++ b/Source/WebCore/bindings/js/JSNodeFilterCondition.h
@@ -41,7 +41,7 @@ namespace WebCore {
         virtual short acceptNode(ScriptState*, Node*) const;
         virtual void markAggregate(JSC::MarkStack&);
 
-        mutable JSC::JSValue m_filter;
+        mutable JSC::DeprecatedPtr<JSC::Unknown> m_filter;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSNodeFilterCustom.cpp b/Source/WebCore/bindings/js/JSNodeFilterCustom.cpp
index bb90c4f..bc79e99 100644
--- a/Source/WebCore/bindings/js/JSNodeFilterCustom.cpp
+++ b/Source/WebCore/bindings/js/JSNodeFilterCustom.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "JSNodeFilter.h"
 
+#include "JSDOMWindowBase.h"
 #include "JSNode.h"
 #include "JSNodeFilterCondition.h"
 #include "NodeFilter.h"
diff --git a/Source/WebCore/bindings/js/JSOptionConstructor.cpp b/Source/WebCore/bindings/js/JSOptionConstructor.cpp
index 4ecfe58..e14fb6d 100644
--- a/Source/WebCore/bindings/js/JSOptionConstructor.cpp
+++ b/Source/WebCore/bindings/js/JSOptionConstructor.cpp
@@ -38,8 +38,8 @@ const ClassInfo JSOptionConstructor::s_info = { "OptionConstructor", 0, 0, 0 };
 JSOptionConstructor::JSOptionConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMConstructorWithDocument(JSOptionConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSHTMLOptionElementPrototype::self(exec, globalObject), None);
-    putDirect(exec->propertyNames().length, jsNumber(4), ReadOnly | DontDelete | DontEnum);
+    putDirect(exec->globalData(), exec->propertyNames().prototype, JSHTMLOptionElementPrototype::self(exec, globalObject), None);
+    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(4), ReadOnly | DontDelete | DontEnum);
 }
 
 static EncodedJSValue JSC_HOST_CALL constructHTMLOptionElement(ExecState* exec)
diff --git a/Source/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp b/Source/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp
index 7274cd0..0fcd1ea 100644
--- a/Source/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp
+++ b/Source/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp
@@ -74,7 +74,7 @@ JSValue JSSQLResultSetRowList::item(ExecState* exec)
               ASSERT_NOT_REACHED();
         }
 
-        object->putDirect(Identifier(exec, stringToUString(m_impl->columnNames()[i])), jsValue, DontDelete | ReadOnly);
+        object->putDirect(exec->globalData(), Identifier(exec, stringToUString(m_impl->columnNames()[i])), jsValue, DontDelete | ReadOnly);
     }
 
     return object;
diff --git a/Source/WebCore/bindings/js/JSUint16ArrayCustom.cpp b/Source/WebCore/bindings/js/JSUint16ArrayCustom.cpp
index 9e476f2..16f9db2 100644
--- a/Source/WebCore/bindings/js/JSUint16ArrayCustom.cpp
+++ b/Source/WebCore/bindings/js/JSUint16ArrayCustom.cpp
@@ -24,9 +24,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "JSUint16Array.h"
 
 #include "JSArrayBufferViewHelper.h"
@@ -62,5 +59,3 @@ EncodedJSValue JSC_HOST_CALL JSUint16ArrayConstructor::constructJSUint16Array(Ex
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/js/JSUint32ArrayCustom.cpp b/Source/WebCore/bindings/js/JSUint32ArrayCustom.cpp
index d221c2a..1e071c9 100644
--- a/Source/WebCore/bindings/js/JSUint32ArrayCustom.cpp
+++ b/Source/WebCore/bindings/js/JSUint32ArrayCustom.cpp
@@ -24,9 +24,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "JSUint32Array.h"
 
 #include "JSArrayBufferViewHelper.h"
@@ -62,5 +59,3 @@ EncodedJSValue JSC_HOST_CALL JSUint32ArrayConstructor::constructJSUint32Array(Ex
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/js/JSUint8ArrayCustom.cpp b/Source/WebCore/bindings/js/JSUint8ArrayCustom.cpp
index b37eea8..e90f8e9 100644
--- a/Source/WebCore/bindings/js/JSUint8ArrayCustom.cpp
+++ b/Source/WebCore/bindings/js/JSUint8ArrayCustom.cpp
@@ -24,9 +24,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "JSUint8Array.h"
 
 #include "JSArrayBufferViewHelper.h"
@@ -62,5 +59,3 @@ EncodedJSValue JSC_HOST_CALL JSUint8ArrayConstructor::constructJSUint8Array(Exec
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp b/Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
index dc32d5f..eb4f6e2 100644
--- a/Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
+++ b/Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "JSWebGLRenderingContext.h"
 
@@ -89,14 +89,14 @@ static JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, const WebG
     }
     case WebGLGetInfo::kTypeFloat:
         return jsNumber(info.getFloat());
-    case WebGLGetInfo::kTypeLong:
-        return jsNumber(info.getLong());
+    case WebGLGetInfo::kTypeInt:
+        return jsNumber(info.getInt());
     case WebGLGetInfo::kTypeNull:
         return jsNull();
     case WebGLGetInfo::kTypeString:
         return jsString(exec, info.getString());
-    case WebGLGetInfo::kTypeUnsignedLong:
-        return jsNumber(info.getUnsignedLong());
+    case WebGLGetInfo::kTypeUnsignedInt:
+        return jsNumber(info.getUnsignedInt());
     case WebGLGetInfo::kTypeWebGLBuffer:
         return toJS(exec, globalObject, info.getWebGLBuffer());
     case WebGLGetInfo::kTypeWebGLFloatArray:
@@ -703,4 +703,4 @@ JSC::JSValue JSWebGLRenderingContext::vertexAttrib4fv(JSC::ExecState* exec)
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
index a93db11..1d6f1cb 100644
--- a/Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
+++ b/Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -64,7 +64,7 @@ void JSXMLHttpRequest::markChildren(MarkStack& markStack)
     if (Document* responseDocument = m_impl->optionalResponseXML())
         markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), responseDocument);
 
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
+#if ENABLE(WEBGL) || ENABLE(BLOB)
     if (ArrayBuffer* responseArrayBuffer = m_impl->optionalResponseArrayBuffer())
         markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), responseArrayBuffer);
 #endif
@@ -124,7 +124,7 @@ JSValue JSXMLHttpRequest::send(ExecState* exec)
             impl()->send(toBlob(val), ec);
         else if (val.inherits(&JSDOMFormData::s_info))
             impl()->send(toDOMFormData(val), ec);
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
+#if ENABLE(WEBGL) || ENABLE(BLOB)
         else if (val.inherits(&JSArrayBuffer::s_info))
             impl()->send(toArrayBuffer(val), ec);
 #endif
@@ -189,7 +189,7 @@ JSValue JSXMLHttpRequest::response(ExecState* exec) const
 #endif
 
     case XMLHttpRequest::ResponseTypeArrayBuffer:
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
+#if ENABLE(WEBGL) || ENABLE(BLOB)
         {
             ExceptionCode ec = 0;
             ArrayBuffer* arrayBuffer = impl()->responseArrayBuffer(ec);
diff --git a/Source/WebCore/bindings/js/ScriptCachedFrameData.cpp b/Source/WebCore/bindings/js/ScriptCachedFrameData.cpp
index 16f18d3..d65bce2 100644
--- a/Source/WebCore/bindings/js/ScriptCachedFrameData.cpp
+++ b/Source/WebCore/bindings/js/ScriptCachedFrameData.cpp
@@ -84,7 +84,7 @@ void ScriptCachedFrameData::restore(Frame* frame)
         JSDOMWindowShell* windowShell = iter->second.get();
 
         if (JSDOMWindow* window = m_windows.get(world))
-            windowShell->setWindow(window);
+            windowShell->setWindow(window->globalData(), window);
         else {
             windowShell->setWindow(frame->domWindow());
 
diff --git a/Source/WebCore/bindings/js/ScriptController.cpp b/Source/WebCore/bindings/js/ScriptController.cpp
index cf55080..e7eafd0 100644
--- a/Source/WebCore/bindings/js/ScriptController.cpp
+++ b/Source/WebCore/bindings/js/ScriptController.cpp
@@ -40,7 +40,6 @@
 #include "StorageNamespace.h"
 #include "UserGestureIndicator.h"
 #include "WebCoreJSClientData.h"
-#include "XSSAuditor.h"
 #include "npruntime_impl.h"
 #include "runtime_root.h"
 #include <debugger/Debugger.h>
@@ -72,7 +71,6 @@ ScriptController::ScriptController(Frame* frame)
 #if PLATFORM(MAC)
     , m_windowScriptObject(0)
 #endif
-    , m_XSSAuditor(new XSSAuditor(frame))
 {
 #if PLATFORM(MAC) && ENABLE(JAVA_BRIDGE)
     static bool initializedJavaJSBindings;
@@ -116,16 +114,11 @@ JSDOMWindowShell* ScriptController::createWindowShell(DOMWrapperWorld* world)
     return windowShell;
 }
 
-ScriptValue ScriptController::evaluateInWorld(const ScriptSourceCode& sourceCode, DOMWrapperWorld* world, ShouldAllowXSS shouldAllowXSS)
+ScriptValue ScriptController::evaluateInWorld(const ScriptSourceCode& sourceCode, DOMWrapperWorld* world)
 {
     const SourceCode& jsSourceCode = sourceCode.jsSourceCode();
     String sourceURL = ustringToString(jsSourceCode.provider()->url());
 
-    if (shouldAllowXSS == DoNotAllowXSS && !m_XSSAuditor->canEvaluate(sourceCode.source())) {
-        // This script is not safe to be evaluated.
-        return JSValue();
-    }
-
     // evaluate code. Returns the JS return value or 0
     // if there was none, an error occurred or the type couldn't be converted.
 
@@ -166,9 +159,9 @@ ScriptValue ScriptController::evaluateInWorld(const ScriptSourceCode& sourceCode
     return JSValue();
 }
 
-ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode, ShouldAllowXSS shouldAllowXSS) 
+ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode) 
 {
-    return evaluateInWorld(sourceCode, mainThreadNormalWorld(), shouldAllowXSS);
+    return evaluateInWorld(sourceCode, mainThreadNormalWorld());
 }
 
 PassRefPtr<DOMWrapperWorld> ScriptController::createWorld()
@@ -497,7 +490,7 @@ void ScriptController::clearScriptObjects()
 #endif
 }
 
-ScriptValue ScriptController::executeScriptInWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture, ShouldAllowXSS shouldAllowXSS)
+ScriptValue ScriptController::executeScriptInWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture)
 {
     ScriptSourceCode sourceCode(script, forceUserGesture ? KURL() : m_frame->document()->url());
 
@@ -507,7 +500,7 @@ ScriptValue ScriptController::executeScriptInWorld(DOMWrapperWorld* world, const
     bool wasInExecuteScript = m_inExecuteScript;
     m_inExecuteScript = true;
 
-    ScriptValue result = evaluateInWorld(sourceCode, world, shouldAllowXSS);
+    ScriptValue result = evaluateInWorld(sourceCode, world);
 
     if (!wasInExecuteScript) {
         m_inExecuteScript = false;
diff --git a/Source/WebCore/bindings/js/ScriptController.h b/Source/WebCore/bindings/js/ScriptController.h
index 413b88a..19542af 100644
--- a/Source/WebCore/bindings/js/ScriptController.h
+++ b/Source/WebCore/bindings/js/ScriptController.h
@@ -59,7 +59,6 @@ class Node;
 class ScriptSourceCode;
 class ScriptValue;
 class Widget;
-class XSSAuditor;
 
 typedef HashMap<void*, RefPtr<JSC::Bindings::RootObject> > RootObjectMap;
 
@@ -93,9 +92,9 @@ public:
 
     static void getAllWorlds(Vector<DOMWrapperWorld*>&);
 
-    ScriptValue executeScript(const ScriptSourceCode&, ShouldAllowXSS shouldAllowXSS = DoNotAllowXSS);
-    ScriptValue executeScript(const String& script, bool forceUserGesture = false, ShouldAllowXSS shouldAllowXSS = DoNotAllowXSS);
-    ScriptValue executeScriptInWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture = false, ShouldAllowXSS shouldAllowXSS = DoNotAllowXSS);
+    ScriptValue executeScript(const ScriptSourceCode&);
+    ScriptValue executeScript(const String& script, bool forceUserGesture = false);
+    ScriptValue executeScriptInWorld(DOMWrapperWorld*, const String& script, bool forceUserGesture = false);
 
     // Returns true if argument is a JavaScript URL.
     bool executeIfJavaScriptURL(const KURL&, ShouldReplaceDocumentIfJavaScriptURL shouldReplaceDocumentIfJavaScriptURL = ReplaceDocumentIfJavaScriptURL);
@@ -104,8 +103,8 @@ public:
     // Darwin is an exception to this rule: it is OK to call this function from any thread, even reentrantly.
     static void initializeThreading();
 
-    ScriptValue evaluate(const ScriptSourceCode&, ShouldAllowXSS shouldAllowXSS = DoNotAllowXSS);
-    ScriptValue evaluateInWorld(const ScriptSourceCode&, DOMWrapperWorld*, ShouldAllowXSS shouldAllowXSS = DoNotAllowXSS);
+    ScriptValue evaluate(const ScriptSourceCode&);
+    ScriptValue evaluateInWorld(const ScriptSourceCode&, DOMWrapperWorld*);
 
     int eventHandlerLineNumber() const;
     
@@ -168,8 +167,6 @@ public:
     NPObject* createScriptObjectForPluginElement(HTMLPlugInElement*);
     NPObject* windowScriptNPObject();
 #endif
-    
-    XSSAuditor* xssAuditor() { return m_XSSAuditor.get(); }
 
 private:
     JSDOMWindowShell* initScript(DOMWrapperWorld* world);
@@ -202,9 +199,6 @@ private:
 #if PLATFORM(MAC)
     RetainPtr<WebScriptObject> m_windowScriptObject;
 #endif
-    
-    // The XSSAuditor associated with this ScriptController.
-    OwnPtr<XSSAuditor> m_XSSAuditor;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/ScriptDebugServer.cpp b/Source/WebCore/bindings/js/ScriptDebugServer.cpp
index b516f6d..aed2ad4 100644
--- a/Source/WebCore/bindings/js/ScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/js/ScriptDebugServer.cpp
@@ -117,20 +117,6 @@ void ScriptDebugServer::removeListener(ScriptDebugListener* listener, Page* page
     didRemoveListener(page);
 }
 
-void ScriptDebugServer::pageCreated(Page* page)
-{
-    ASSERT_ARG(page, page);
-
-    if (!hasListenersInterestedInPage(page))
-        return;
-    page->setDebugger(this);
-}
-
-bool ScriptDebugServer::isDebuggerAlwaysEnabled()
-{
-    return false;
-}
-
 bool ScriptDebugServer::hasListenersInterestedInPage(Page* page)
 {
     ASSERT_ARG(page, page);
@@ -138,19 +124,21 @@ bool ScriptDebugServer::hasListenersInterestedInPage(Page* page)
     return m_pageListenersMap.contains(page);
 }
 
-String ScriptDebugServer::setBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition, bool enabled, unsigned* actualLineNumber)
+String ScriptDebugServer::setBreakpoint(const String& sourceID, const ScriptBreakpoint& scriptBreakpoint, int* actualLineNumber, int* actualColumnNumber)
 {
     intptr_t sourceIDValue = sourceID.toIntPtr();
     if (!sourceIDValue)
         return "";
-    BreakpointsMap::iterator it = m_breakpoints.find(sourceIDValue);
-    if (it == m_breakpoints.end())
-        it = m_breakpoints.set(sourceIDValue, SourceBreakpoints()).first;
-    if (it->second.contains(lineNumber))
+    SourceIdToBreakpointsMap::iterator it = m_sourceIdToBreakpoints.find(sourceIDValue);
+    if (it == m_sourceIdToBreakpoints.end())
+        it = m_sourceIdToBreakpoints.set(sourceIDValue, LineToBreakpointMap()).first;
+    if (it->second.contains(scriptBreakpoint.lineNumber + 1))
         return "";
-    it->second.set(lineNumber, ScriptBreakpoint(enabled, condition));
-    *actualLineNumber = lineNumber;
-    return makeString(sourceID, ":", String::number(lineNumber));
+    it->second.set(scriptBreakpoint.lineNumber + 1, scriptBreakpoint);
+    *actualLineNumber = scriptBreakpoint.lineNumber;
+    // FIXME(WK53003): implement setting breakpoints by line:column.
+    *actualColumnNumber = 0;
+    return makeString(sourceID, ":", String::number(scriptBreakpoint.lineNumber));
 }
 
 void ScriptDebugServer::removeBreakpoint(const String& breakpointId)
@@ -166,9 +154,9 @@ void ScriptDebugServer::removeBreakpoint(const String& breakpointId)
     unsigned lineNumber = tokens[1].toUInt(&success);
     if (!success)
         return;
-    BreakpointsMap::iterator it = m_breakpoints.find(sourceIDValue);
-    if (it != m_breakpoints.end())
-        it->second.remove(lineNumber);
+    SourceIdToBreakpointsMap::iterator it = m_sourceIdToBreakpoints.find(sourceIDValue);
+    if (it != m_sourceIdToBreakpoints.end())
+        it->second.remove(lineNumber + 1);
 }
 
 bool ScriptDebugServer::hasBreakpoint(intptr_t sourceID, unsigned lineNumber) const
@@ -176,10 +164,10 @@ bool ScriptDebugServer::hasBreakpoint(intptr_t sourceID, unsigned lineNumber) co
     if (!m_breakpointsActivated)
         return false;
 
-    BreakpointsMap::const_iterator it = m_breakpoints.find(sourceID);
-    if (it == m_breakpoints.end())
+    SourceIdToBreakpointsMap::const_iterator it = m_sourceIdToBreakpoints.find(sourceID);
+    if (it == m_sourceIdToBreakpoints.end())
         return false;
-    SourceBreakpoints::const_iterator breakIt = it->second.find(lineNumber);
+    LineToBreakpointMap::const_iterator breakIt = it->second.find(lineNumber);
     if (breakIt == it->second.end() || !breakIt->second.enabled)
         return false;
 
@@ -198,7 +186,7 @@ bool ScriptDebugServer::hasBreakpoint(intptr_t sourceID, unsigned lineNumber) co
 
 void ScriptDebugServer::clearBreakpoints()
 {
-    m_breakpoints.clear();
+    m_sourceIdToBreakpoints.clear();
 }
 
 void ScriptDebugServer::setBreakpointsActivated(bool activated)
diff --git a/Source/WebCore/bindings/js/ScriptDebugServer.h b/Source/WebCore/bindings/js/ScriptDebugServer.h
index bde4736..428b254 100644
--- a/Source/WebCore/bindings/js/ScriptDebugServer.h
+++ b/Source/WebCore/bindings/js/ScriptDebugServer.h
@@ -64,7 +64,7 @@ public:
     void addListener(ScriptDebugListener*, Page*);
     void removeListener(ScriptDebugListener*, Page*);
 
-    String setBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition, bool enabled, unsigned* actualLineNumber);
+    String setBreakpoint(const String& sourceID, const ScriptBreakpoint&, int* actualLineNumber, int* actualColumnNumber);
     void removeBreakpoint(const String& breakpointId);
     void clearBreakpoints();
     void setBreakpointsActivated(bool activated);
@@ -93,10 +93,6 @@ public:
 
     JavaScriptCallFrame* currentCallFrame();
 
-    void pageCreated(Page*);
-
-    bool isDebuggerAlwaysEnabled();
-
 private:
     typedef HashSet<ScriptDebugListener*> ListenerSet;
     typedef void (ScriptDebugServer::*JavaScriptExecutionCallback)(ScriptDebugListener*);
@@ -138,7 +134,8 @@ private:
     void didRemoveListener(Page*);
 
     typedef HashMap<Page*, ListenerSet*> PageListenersMap;
-    typedef HashMap<intptr_t, SourceBreakpoints> BreakpointsMap;
+    typedef HashMap<long, ScriptBreakpoint> LineToBreakpointMap;
+    typedef HashMap<intptr_t, LineToBreakpointMap> SourceIdToBreakpointsMap;
 
     PageListenersMap m_pageListenersMap;
     bool m_callingListeners;
@@ -150,7 +147,7 @@ private:
     bool m_breakpointsActivated;
     JavaScriptCallFrame* m_pauseOnCallFrame;
     RefPtr<JavaScriptCallFrame> m_currentCallFrame;
-    BreakpointsMap m_breakpoints;
+    SourceIdToBreakpointsMap m_sourceIdToBreakpoints;
     Timer<ScriptDebugServer> m_recompileTimer;
 };
 
diff --git a/Source/WebCore/bindings/js/ScriptEventListener.cpp b/Source/WebCore/bindings/js/ScriptEventListener.cpp
index d2baf82..3a03f59 100644
--- a/Source/WebCore/bindings/js/ScriptEventListener.cpp
+++ b/Source/WebCore/bindings/js/ScriptEventListener.cpp
@@ -36,7 +36,6 @@
 #include "EventListener.h"
 #include "JSNode.h"
 #include "Frame.h"
-#include "XSSAuditor.h"
 #include <runtime/JSLock.h>
 
 using namespace JSC;
@@ -66,11 +65,6 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node* node, Attribu
         if (!scriptController->canExecuteScripts(AboutToExecuteScript))
             return 0;
 
-        if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
-            // This script is not safe to execute.
-            return 0;
-        }
-
         lineNumber = scriptController->eventHandlerLineNumber();
         sourceURL = node->document()->url().string();
     }
@@ -94,11 +88,6 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attri
     if (!scriptController->canExecuteScripts(AboutToExecuteScript))
         return 0;
 
-    if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
-        // This script is not safe to execute.
-        return 0;
-    }
-
     lineNumber = scriptController->eventHandlerLineNumber();
     sourceURL = frame->document()->url().string();
     JSObject* wrapper = toJSDOMWindow(frame, mainThreadNormalWorld());
diff --git a/Source/WebCore/bindings/js/ScriptGCEvent.cpp b/Source/WebCore/bindings/js/ScriptGCEvent.cpp
index b7fc7b3..dd027b4 100644
--- a/Source/WebCore/bindings/js/ScriptGCEvent.cpp
+++ b/Source/WebCore/bindings/js/ScriptGCEvent.cpp
@@ -42,12 +42,14 @@ namespace WebCore {
 
 using namespace JSC;
 
-void ScriptGCEvent::getHeapSize(size_t& usedHeapSize, size_t& totalHeapSize)
+void ScriptGCEvent::getHeapSize(size_t& usedHeapSize, size_t& totalHeapSize, size_t& heapSizeLimit)
 {
     JSGlobalData* globalData = JSDOMWindow::commonJSGlobalData();
-    totalHeapSize = globalData->heap.size();
-    usedHeapSize = totalHeapSize;
+    totalHeapSize = globalData->heap.capacity();
+    usedHeapSize = globalData->heap.size();
+    heapSizeLimit = 0;
 }
+
 } // namespace WebCore
 
 #endif // !ENABLE(INSPECTOR)
diff --git a/Source/WebCore/bindings/js/ScriptGCEvent.h b/Source/WebCore/bindings/js/ScriptGCEvent.h
index 86d4f68..6614b8e 100644
--- a/Source/WebCore/bindings/js/ScriptGCEvent.h
+++ b/Source/WebCore/bindings/js/ScriptGCEvent.h
@@ -42,7 +42,7 @@ class ScriptGCEvent
 public:
     static void addEventListener(ScriptGCEventListener*) { }
     static void removeEventListener(ScriptGCEventListener*) { }
-    static void getHeapSize(size_t& usedHeapSize, size_t& totalHeapSize);
+    static void getHeapSize(size_t& usedHeapSize, size_t& totalHeapSize, size_t& heapSizeLimit);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/ScriptObject.cpp b/Source/WebCore/bindings/js/ScriptObject.cpp
index e06eccb..b5c1f01 100644
--- a/Source/WebCore/bindings/js/ScriptObject.cpp
+++ b/Source/WebCore/bindings/js/ScriptObject.cpp
@@ -62,7 +62,7 @@ static bool handleException(ScriptState* scriptState)
 bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, const ScriptObject& value)
 {
     JSLock lock(SilenceAssertionsOnly);
-    scriptState->lexicalGlobalObject()->putDirect(Identifier(scriptState, name), value.jsObject());
+    scriptState->lexicalGlobalObject()->putDirect(scriptState->globalData(), Identifier(scriptState, name), value.jsObject());
     return handleException(scriptState);
 }
 
@@ -71,7 +71,7 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, Inspect
 {
     JSLock lock(SilenceAssertionsOnly);
     JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
-    globalObject->putDirect(Identifier(scriptState, name), toJS(scriptState, globalObject, value));
+    globalObject->putDirect(scriptState->globalData(), Identifier(scriptState, name), toJS(scriptState, globalObject, value));
     return handleException(scriptState);
 }
 
@@ -79,7 +79,7 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, Injecte
 {
     JSLock lock(SilenceAssertionsOnly);
     JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
-    globalObject->putDirect(Identifier(scriptState, name), toJS(scriptState, globalObject, value));
+    globalObject->putDirect(scriptState->globalData(), Identifier(scriptState, name), toJS(scriptState, globalObject, value));
     return handleException(scriptState);
 }
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/bindings/js/ScriptProfiler.cpp b/Source/WebCore/bindings/js/ScriptProfiler.cpp
index 62ae9ba..f372c3c 100644
--- a/Source/WebCore/bindings/js/ScriptProfiler.cpp
+++ b/Source/WebCore/bindings/js/ScriptProfiler.cpp
@@ -46,11 +46,6 @@ PassRefPtr<ScriptProfile> ScriptProfiler::stop(ScriptState* state, const String&
     return ScriptProfile::create(profile);
 }
 
-bool ScriptProfiler::isProfilerAlwaysEnabled()
-{
-    return false;
-}
-
 } // namespace WebCore
 
 #endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/Source/WebCore/bindings/js/ScriptProfiler.h b/Source/WebCore/bindings/js/ScriptProfiler.h
index d4dd606..d8ad482 100644
--- a/Source/WebCore/bindings/js/ScriptProfiler.h
+++ b/Source/WebCore/bindings/js/ScriptProfiler.h
@@ -38,10 +38,18 @@ namespace WebCore {
 class ScriptProfiler {
     WTF_MAKE_NONCOPYABLE(ScriptProfiler);
 public:
+    class HeapSnapshotProgress {
+    public:
+        virtual ~HeapSnapshotProgress() { }
+        virtual void Start(int totalWork) = 0;
+        virtual void Worked(int workDone) = 0;
+        virtual void Done() = 0;
+        virtual bool isCanceled() = 0;
+    };
+
     static void start(ScriptState* state, const String& title);
     static PassRefPtr<ScriptProfile> stop(ScriptState* state, const String& title);
-    static PassRefPtr<ScriptHeapSnapshot> takeHeapSnapshot(const String&) { return 0; }
-    static bool isProfilerAlwaysEnabled();
+    static PassRefPtr<ScriptHeapSnapshot> takeHeapSnapshot(const String&, HeapSnapshotProgress*) { return 0; }
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/SerializedScriptValue.cpp b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
index b02a4bb..f721334 100644
--- a/Source/WebCore/bindings/js/SerializedScriptValue.cpp
+++ b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
@@ -1040,14 +1040,14 @@ private:
     void putProperty(JSArray* array, unsigned index, JSValue value)
     {
         if (array->canSetIndex(index))
-            array->setIndex(index, value);
+            array->setIndex(m_exec->globalData(), index, value);
         else
             array->put(m_exec, index, value);
     }
 
     void putProperty(JSObject* object, const Identifier& property, JSValue value)
     {
-        object->putDirect(property, value);
+        object->putDirect(m_exec->globalData(), property, value);
     }
 
     bool readFile(RefPtr<File>& file)
diff --git a/Source/WebCore/bindings/js/WorkerScriptController.cpp b/Source/WebCore/bindings/js/WorkerScriptController.cpp
index 5872b2e..0c89632 100644
--- a/Source/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/Source/WebCore/bindings/js/WorkerScriptController.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2011 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -80,8 +81,8 @@ void WorkerScriptController::initScript()
         RefPtr<Structure> structure = JSDedicatedWorkerContext::createStructure(dedicatedContextPrototype);
 
         m_workerContextWrapper = new (m_globalData.get()) JSDedicatedWorkerContext(structure.release(), m_workerContext->toDedicatedWorkerContext());
-        workerContextPrototype->putAnonymousValue(0, m_workerContextWrapper);
-        dedicatedContextPrototype->putAnonymousValue(0, m_workerContextWrapper);
+        workerContextPrototype->putAnonymousValue(*m_globalData, 0, m_workerContextWrapper);
+        dedicatedContextPrototype->putAnonymousValue(*m_globalData, 0, m_workerContextWrapper);
 #if ENABLE(SHARED_WORKERS)
     } else {
         ASSERT(m_workerContext->isSharedWorkerContext());
@@ -90,8 +91,8 @@ void WorkerScriptController::initScript()
         RefPtr<Structure> structure = JSSharedWorkerContext::createStructure(sharedContextPrototype);
 
         m_workerContextWrapper = new (m_globalData.get()) JSSharedWorkerContext(structure.release(), m_workerContext->toSharedWorkerContext());
-        workerContextPrototype->putAnonymousValue(0, m_workerContextWrapper);
-        sharedContextPrototype->putAnonymousValue(0, m_workerContextWrapper);
+        workerContextPrototype->putAnonymousValue(*m_globalData, 0, m_workerContextWrapper);
+        sharedContextPrototype->putAnonymousValue(*m_globalData, 0, m_workerContextWrapper);
 #endif
     }
 }
@@ -131,8 +132,15 @@ ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode,
     if (comp.complType() == Normal || comp.complType() == ReturnValue)
         return comp.value();
 
-    if (comp.complType() == Throw)
-        *exception = comp.value();
+    if (comp.complType() == Throw) {
+        String errorMessage;
+        int lineNumber = 0;
+        String sourceURL = sourceCode.url().string();
+        if (m_workerContext->sanitizeScriptError(errorMessage, lineNumber, sourceURL))
+            *exception = ScriptValue(throwError(exec, createError(exec, errorMessage.impl())));
+        else
+            *exception = comp.value();
+    }
     return JSValue();
 }
 
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm b/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm
index 9b3f21e..7d3d613 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm
@@ -233,6 +233,7 @@ sub GetCPPType
     return "int" if $type eq "long";
     return "unsigned" if $name eq "unsigned long";
     return "unsigned short" if $type eq "CompareHow";
+    return "double" if $name eq "Date";
 
     if ($codeGenerator->IsStringType($type)) {
         if ($useConstReference) {
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
index abef04e..d2309e9 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -1434,7 +1434,7 @@ sub GenerateImplementation
     push(@implContent, "{\n");
     if ($numCachedAttributes > 0) {
         push(@implContent, "    for (unsigned i = Base::AnonymousSlotCount; i < AnonymousSlotCount; i++)\n");
-        push(@implContent, "        putAnonymousValue(i, JSValue());\n");
+        push(@implContent, "        putAnonymousValue(globalObject->globalData(), i, JSValue());\n");
     }
     push(@implContent, "}\n\n");
 
@@ -1602,7 +1602,7 @@ sub GenerateImplementation
                         }
                     }
                     
-                    push(@implContent, "    castedThis->putAnonymousValue(" . $className . "::" . $attribute->signature->name . "Slot, result);\n") if ($attribute->signature->extendedAttributes->{"CachedAttribute"});
+                    push(@implContent, "    castedThis->putAnonymousValue(exec->globalData(), " . $className . "::" . $attribute->signature->name . "Slot, result);\n") if ($attribute->signature->extendedAttributes->{"CachedAttribute"});
                     push(@implContent, "    return result;\n");
 
                 } else {
@@ -1735,13 +1735,13 @@ sub GenerateImplementation
                             }
                             push(@implContent, "    // Shadowing a built-in constructor\n");
                             if ($interfaceName eq "DOMWindow" && $className eq "JSblah") {
-                                push(@implContent, "    static_cast<$className*>(thisObject)->putDirect(exec->propertyNames().constructor, value);\n");
+                                push(@implContent, "    static_cast<$className*>(thisObject)->putDirect(exec->globalData(), exec->propertyNames().constructor, value);\n");
                             } else {
-                                push(@implContent, "    static_cast<$className*>(thisObject)->putDirect(Identifier(exec, \"$name\"), value);\n");
+                                push(@implContent, "    static_cast<$className*>(thisObject)->putDirect(exec->globalData(), Identifier(exec, \"$name\"), value);\n");
                             }
                         } elsif ($attribute->signature->extendedAttributes->{"Replaceable"}) {
                             push(@implContent, "    // Shadowing a built-in object\n");
-                            push(@implContent, "    static_cast<$className*>(thisObject)->putDirect(Identifier(exec, \"$name\"), value);\n");
+                            push(@implContent, "    static_cast<$className*>(thisObject)->putDirect(exec->globalData(), Identifier(exec, \"$name\"), value);\n");
                         } else {
                             push(@implContent, "    $className* castedThis = static_cast<$className*>(thisObject);\n");
                             push(@implContent, "    $implType* imp = static_cast<$implType*>(castedThis->impl());\n");
@@ -1824,9 +1824,9 @@ sub GenerateImplementation
                 push(@implContent, "    // Shadowing a built-in constructor\n");
 
                 if ($interfaceName eq "DOMWindow") {
-                    push(@implContent, "    static_cast<$className*>(thisObject)->putDirect(exec->propertyNames().constructor, value);\n");
+                    push(@implContent, "    static_cast<$className*>(thisObject)->putDirect(exec->globalData(), exec->propertyNames().constructor, value);\n");
                 } else {
-                    push(@implContent, "    static_cast<$className*>(thisObject)->putDirect(Identifier(exec, \"$name\"), value);\n");
+                    push(@implContent, "    static_cast<$className*>(thisObject)->putDirect(exec->globalData(), Identifier(exec, \"$name\"), value);\n");
                 }
                 push(@implContent, "}\n");
                 push(@implContent, "\n");
@@ -2942,11 +2942,11 @@ sub GenerateConstructorDefinition
     push(@$outputArray, "    : DOMConstructorObject(${constructorClassName}::createStructure(globalObject->objectPrototype()), globalObject)\n");
     push(@$outputArray, "{\n");
     if ($interfaceName eq "DOMWindow") {
-        push(@$outputArray, "    putDirect(exec->propertyNames().prototype, globalObject->prototype(), DontDelete | ReadOnly);\n");
+        push(@$outputArray, "    putDirect(exec->globalData(), exec->propertyNames().prototype, globalObject->prototype(), DontDelete | ReadOnly);\n");
     } else {
-        push(@$outputArray, "    putDirect(exec->propertyNames().prototype, ${protoClassName}::self(exec, globalObject), DontDelete | ReadOnly);\n");
+        push(@$outputArray, "    putDirect(exec->globalData(), exec->propertyNames().prototype, ${protoClassName}::self(exec, globalObject), DontDelete | ReadOnly);\n");
     }
-    push(@$outputArray, "    putDirect(exec->propertyNames().length, jsNumber(${numberOfconstructParameters}), ReadOnly | DontDelete | DontEnum);\n") if $numberOfconstructParameters;
+    push(@$outputArray, "    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(${numberOfconstructParameters}), ReadOnly | DontDelete | DontEnum);\n") if $numberOfconstructParameters;
     push(@$outputArray, "}\n\n");
 
     push(@$outputArray, "bool ${constructorClassName}::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)\n");
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 7d36db1..f393230 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -2393,7 +2393,7 @@ END
             @args = ();
             foreach my $param (@params) {
                 my $paramName = $param->name;
-                push(@implContent, "    v8::Handle<v8::Value> ${paramName}Handle = toV8(${paramName});\n");
+                push(@implContent, "    v8::Handle<v8::Value> ${paramName}Handle = " . NativeToJSValue($param, $paramName) . ";\n");
                 push(@implContent, "    if (${paramName}Handle.IsEmpty()) {\n");
                 push(@implContent, "        CRASH();\n");
                 push(@implContent, "        return true;\n");
@@ -2565,6 +2565,7 @@ sub IsActiveDomType
     return 1 if $type eq "Worker";
     return 1 if $type eq "SharedWorker";
     return 1 if $type eq "IDBRequest";
+    return 1 if $type eq "IDBTransaction";
     return 1 if $type eq "FileReader";
     return 1 if $type eq "FileWriter";
     return 0;
@@ -2832,6 +2833,8 @@ sub GetNativeType
 
     return "RefPtr<MediaQueryListListener>" if $type eq "MediaQueryListListener";
 
+    return "RefPtr<DOMStringList>" if $type eq "DOMStringList";
+
     # Default, assume native type is a pointer with same type name as idl type
     return "${type}*";
 }
@@ -2885,6 +2888,7 @@ sub JSValueToNative
     return "static_cast<Range::CompareHow>($value->Int32Value())" if $type eq "CompareHow";
     return "static_cast<SVGPaint::SVGPaintType>($value->ToInt32()->Int32Value())" if $type eq "SVGPaintType";
     return "toWebCoreDate($value)" if $type eq "Date";
+    return "v8ValueToWebCoreDOMStringList($value)" if $type eq "DOMStringList";
 
     if ($type eq "DOMString" or $type eq "DOMUserData") {
         return $value;
@@ -3086,76 +3090,81 @@ sub IsDOMNodeType
 }
 
 
-sub ReturnNativeToJSValue
+sub NativeToJSValue
 {
     my $signature = shift;
     my $value = shift;
     my $indent = shift;
     my $type = GetTypeFromSignature($signature);
 
-    return "return v8Boolean($value)" if $type eq "boolean";
-    return "return v8::Handle<v8::Value>()" if $type eq "void";     # equivalent to v8::Undefined()
+    return "v8Boolean($value)" if $type eq "boolean";
+    return "v8::Handle<v8::Value>()" if $type eq "void";     # equivalent to v8::Undefined()
 
     # HTML5 says that unsigned reflected attributes should be in the range
     # [0, 2^31). When a value isn't in this range, a default value (or 0)
     # should be returned instead.
     if ($signature->extendedAttributes->{"Reflect"} and ($type eq "unsigned long" or $type eq "unsigned short")) {
         $value =~ s/getUnsignedIntegralAttribute/getIntegralAttribute/g;
-        return "return v8::Integer::NewFromUnsigned(std::max(0, " . $value . "))";
+        return "v8::Integer::NewFromUnsigned(std::max(0, " . $value . "))";
     }
 
     # For all the types where we use 'int' as the representation type,
     # we use Integer::New which has a fast Smi conversion check.
     my $nativeType = GetNativeType($type);
-    return "return v8::Integer::New($value)" if $nativeType eq "int";
-    return "return v8::Integer::NewFromUnsigned($value)" if $nativeType eq "unsigned";
+    return "v8::Integer::New($value)" if $nativeType eq "int";
+    return "v8::Integer::NewFromUnsigned($value)" if $nativeType eq "unsigned";
 
-    return "return v8DateOrNull($value)" if $type eq "Date";
+    return "v8DateOrNull($value)" if $type eq "Date";
     # long long and unsigned long long are not representable in ECMAScript.
-    return "return v8::Number::New(static_cast<double>($value))" if $type eq "long long" or $type eq "unsigned long long" or $type eq "DOMTimeStamp";
-    return "return v8::Number::New($value)" if $codeGenerator->IsPrimitiveType($type) or $type eq "SVGPaintType";
-    return "return $value.v8Value()" if $nativeType eq "ScriptValue";
+    return "v8::Number::New(static_cast<double>($value))" if $type eq "long long" or $type eq "unsigned long long" or $type eq "DOMTimeStamp";
+    return "v8::Number::New($value)" if $codeGenerator->IsPrimitiveType($type) or $type eq "SVGPaintType";
+    return "$value.v8Value()" if $nativeType eq "ScriptValue";
 
     if ($codeGenerator->IsStringType($type)) {
         my $conv = $signature->extendedAttributes->{"ConvertNullStringTo"};
         if (defined $conv) {
-            return "return v8StringOrNull($value)" if $conv eq "Null";
-            return "return v8StringOrUndefined($value)" if $conv eq "Undefined";
-            return "return v8StringOrFalse($value)" if $conv eq "False";
+            return "v8StringOrNull($value)" if $conv eq "Null";
+            return "v8StringOrUndefined($value)" if $conv eq "Undefined";
+            return "v8StringOrFalse($value)" if $conv eq "False";
 
             die "Unknown value for ConvertNullStringTo extended attribute";
         }
         $conv = $signature->extendedAttributes->{"ConvertScriptString"};
-        return "return v8StringOrNull($value)" if $conv;
-        return "return v8String($value)";
+        return "v8StringOrNull($value)" if $conv;
+        return "v8String($value)";
     }
 
     AddIncludesForType($type);
 
     # special case for non-DOM node interfaces
     if (IsDOMNodeType($type)) {
-        return "return toV8(${value}" . ($signature->extendedAttributes->{"ReturnsNew"} ? ", true)" : ")");
+        return "toV8(${value}" . ($signature->extendedAttributes->{"ReturnsNew"} ? ", true)" : ")");
     }
 
     if ($type eq "EventTarget") {
-        return "return V8DOMWrapper::convertEventTargetToV8Object($value)";
+        return "V8DOMWrapper::convertEventTargetToV8Object($value)";
     }
 
     if ($type eq "EventListener") {
         $implIncludes{"V8AbstractEventListener.h"} = 1;
-        return "return ${value} ? v8::Handle<v8::Value>(static_cast<V8AbstractEventListener*>(${value})->getListenerObject(imp->scriptExecutionContext())) : v8::Handle<v8::Value>(v8::Null())";
+        return "${value} ? v8::Handle<v8::Value>(static_cast<V8AbstractEventListener*>(${value})->getListenerObject(imp->scriptExecutionContext())) : v8::Handle<v8::Value>(v8::Null())";
     }
 
     if ($type eq "SerializedScriptValue") {
         $implIncludes{"$type.h"} = 1;
-        return "return $value->deserialize()";
+        return "$value->deserialize()";
     }
 
     $implIncludes{"wtf/RefCounted.h"} = 1;
     $implIncludes{"wtf/RefPtr.h"} = 1;
     $implIncludes{"wtf/GetPtr.h"} = 1;
 
-    return "return toV8($value)";
+    return "toV8($value)";
+}
+
+sub ReturnNativeToJSValue
+{
+    return "return " . NativeToJSValue(@_);
 }
 
 # Internal helper
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp
index 36a5ca2..057302d 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp
@@ -29,6 +29,9 @@
 #include "V8CustomVoidCallback.h"
 #include "V8DOMString.h"
 #include "V8Proxy.h"
+#include <wtf/GetPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
 
 #include <wtf/Assertions.h>
 
@@ -113,7 +116,7 @@ bool V8TestCallback::callbackWithClass2Param(Class2* class2Param, const String&
         CRASH();
         return true;
     }
-    v8::Handle<v8::Value> strArgHandle = toV8(strArg);
+    v8::Handle<v8::Value> strArgHandle = v8String(strArg);
     if (strArgHandle.IsEmpty()) {
         CRASH();
         return true;
diff --git a/Source/WebCore/bindings/v8/DOMDataStore.cpp b/Source/WebCore/bindings/v8/DOMDataStore.cpp
index 5393bd9..21b47a4 100644
--- a/Source/WebCore/bindings/v8/DOMDataStore.cpp
+++ b/Source/WebCore/bindings/v8/DOMDataStore.cpp
@@ -173,20 +173,6 @@ void DOMDataStore::weakNodeCallback(v8::Persistent<v8::Value> value, void* domOb
     node->deref(); // Nobody overrides Node::deref so it's safe
 }
 
-bool DOMDataStore::IntrusiveDOMWrapperMap::removeIfPresent(Node* obj, v8::Persistent<v8::Object> value)
-{
-    ASSERT(obj);
-    v8::Persistent<v8::Object>* entry = obj->wrapper();
-    if (!entry)
-        return false;
-    if (*entry != value)
-        return false;
-    obj->clearWrapper();
-    m_table.remove(entry);
-    value.Dispose();
-    return true;
-}
-
 #if ENABLE(SVG)
 
 void DOMDataStore::weakSVGElementInstanceCallback(v8::Persistent<v8::Value> v8Object, void* domObject)
diff --git a/Source/WebCore/bindings/v8/DOMDataStore.h b/Source/WebCore/bindings/v8/DOMDataStore.h
index dbead9c..ffb9df5 100644
--- a/Source/WebCore/bindings/v8/DOMDataStore.h
+++ b/Source/WebCore/bindings/v8/DOMDataStore.h
@@ -51,95 +51,6 @@ namespace WebCore {
 
     typedef WTF::Vector<DOMDataStore*> DOMDataList;
 
-    template <class T, int CHUNK_SIZE, class Traits>
-    class ChunkedTable {
-      public:
-        ChunkedTable() : m_chunks(0), m_current(0), m_last(0) { }
-
-        T* add(T element)
-        {
-            if (m_current == m_last) {
-                m_chunks = new Chunk(m_chunks);
-                m_current = m_chunks->m_entries;
-                m_last = m_current + CHUNK_SIZE;
-            }
-            ASSERT((m_chunks->m_entries <= m_current) && (m_current < m_last));
-            T* p = m_current++;
-            *p = element;
-            return p;
-        }
-
-        void remove(T* element)
-        {
-            ASSERT(element);
-            ASSERT(m_current > m_chunks->m_entries);
-            m_current--;
-            if (element != m_current)
-                Traits::move(element, m_current);
-            if (m_current == m_chunks->m_entries) {
-                Chunk* toDelete = m_chunks;
-                m_chunks = toDelete->m_previous;
-                m_current = m_last = m_chunks ? m_chunks->m_entries + CHUNK_SIZE : 0;
-                delete toDelete;
-            }
-            ASSERT(!m_chunks || ((m_chunks->m_entries < m_current) && (m_current <= m_last)));
-        }
-
-        void clear()
-        {
-            if (!m_chunks)
-                return;
-
-            clearEntries(m_chunks->m_entries, m_current);
-            Chunk* last = m_chunks;
-            while (true) {
-                Chunk* previous = last->m_previous;
-                if (!previous)
-                    break;
-                delete last;
-                clearEntries(previous->m_entries, previous->m_entries + CHUNK_SIZE);
-                last = previous;
-            }
-
-            m_chunks = last;
-            m_current = m_chunks->m_entries;
-            m_last = m_current + CHUNK_SIZE;
-        }
-
-        void visit(DOMDataStore* store, typename Traits::Visitor* visitor)
-        {
-            if (!m_chunks)
-                return;
-
-            visitEntries(store, m_chunks->m_entries, m_current, visitor);
-            for (Chunk* chunk = m_chunks->m_previous; chunk; chunk = chunk->m_previous)
-                visitEntries(store, chunk->m_entries, chunk->m_entries + CHUNK_SIZE, visitor);
-        }
-
-      private:
-        struct Chunk {
-            explicit Chunk(Chunk* previous) : m_previous(previous) { }
-            Chunk* const m_previous;
-            T m_entries[CHUNK_SIZE];
-        };
-
-        static void clearEntries(T* first, T* last)
-        {
-            for (T* entry = first; entry < last; entry++)
-                Traits::clear(entry);
-        }
-
-        static void visitEntries(DOMDataStore* store, T* first, T* last, typename Traits::Visitor* visitor)
-        {
-            for (T* entry = first; entry < last; entry++)
-                Traits::visit(store, entry, visitor);
-        }
-
-        Chunk* m_chunks;
-        T* m_current;
-        T* m_last;
-    };
-
     // DOMDataStore
     //
     // DOMDataStore is the backing store that holds the maps between DOM objects
@@ -161,79 +72,6 @@ namespace WebCore {
 #endif
         };
 
-        class IntrusiveDOMWrapperMap : public AbstractWeakReferenceMap<Node, v8::Object> {
-        public:
-            IntrusiveDOMWrapperMap(v8::WeakReferenceCallback callback)
-                : AbstractWeakReferenceMap<Node, v8::Object>(callback) { }
-
-            virtual v8::Persistent<v8::Object> get(Node* obj)
-            {
-                v8::Persistent<v8::Object>* wrapper = obj->wrapper();
-                return wrapper ? *wrapper : v8::Persistent<v8::Object>();
-            }
-
-            virtual void set(Node* obj, v8::Persistent<v8::Object> wrapper)
-            {
-                ASSERT(obj);
-                ASSERT(!obj->wrapper());
-                v8::Persistent<v8::Object>* entry = m_table.add(wrapper);
-                obj->setWrapper(entry);
-                wrapper.MakeWeak(obj, weakReferenceCallback());
-            }
-
-            virtual bool contains(Node* obj)
-            {
-                return obj->wrapper();
-            }
-
-            virtual void visit(DOMDataStore* store, Visitor* visitor)
-            {
-                m_table.visit(store, visitor);
-            }
-
-            virtual bool removeIfPresent(Node*, v8::Persistent<v8::Object>);
-
-            virtual void clear()
-            {
-                m_table.clear();
-            }
-
-        private:
-            static int const numberOfEntries = (1 << 10) - 1;
-
-            struct ChunkedTableTraits {
-                typedef IntrusiveDOMWrapperMap::Visitor Visitor;
-
-                static void move(v8::Persistent<v8::Object>* target, v8::Persistent<v8::Object>* source)
-                {
-                    *target = *source;
-                    Node* node = V8Node::toNative(*target);
-                    ASSERT(node);
-                    node->setWrapper(target);
-                }
-
-                static void clear(v8::Persistent<v8::Object>* entry)
-                {
-                    Node* node = V8Node::toNative(*entry);
-                    ASSERT(node->wrapper() == entry);
-
-                    node->clearWrapper();
-                    entry->Dispose();
-                }
-
-                static void visit(DOMDataStore* store, v8::Persistent<v8::Object>* entry, Visitor* visitor)
-                {
-                    Node* node = V8Node::toNative(*entry);
-                    ASSERT(node->wrapper() == entry);
-
-                    visitor->visitDOMWrapper(store, node, *entry);
-                }
-            };
-
-            typedef ChunkedTable<v8::Persistent<v8::Object>, numberOfEntries, ChunkedTableTraits> Table;
-            Table m_table;
-        };
-
         DOMDataStore(DOMData*);
         virtual ~DOMDataStore();
 
diff --git a/Source/WebCore/bindings/v8/DebuggerScript.js b/Source/WebCore/bindings/v8/DebuggerScript.js
index eb9de2f..1798352 100644
--- a/Source/WebCore/bindings/v8/DebuggerScript.js
+++ b/Source/WebCore/bindings/v8/DebuggerScript.js
@@ -91,15 +91,15 @@ DebuggerScript._formatScript = function(script)
 
 DebuggerScript.setBreakpoint = function(execState, args)
 {
-    args.lineNumber = DebuggerScript._webkitToV8LineNumber(args.lineNumber);
-    var breakId = Debug.setScriptBreakPointById(args.scriptId, args.lineNumber, 0 /* column */, args.condition);
+    var breakId = Debug.setScriptBreakPointById(args.scriptId, args.lineNumber, args.columnNumber, args.condition);
     if (!args.enabled)
         Debug.disableScriptBreakPoint(breakId);
 
     var locations = Debug.findBreakPointActualLocations(breakId);
     if (!locations.length)
         return undefined;
-    args.lineNumber = DebuggerScript._v8ToWebkitLineNumber(locations[0].line);
+    args.lineNumber = locations[0].line;
+    args.columnNumber = locations[0].column;
     return breakId.toString();
 }
 
@@ -263,11 +263,6 @@ DebuggerScript._frameMirrorToJSCallFrame = function(frameMirror, callerFrame)
     };
 }
 
-DebuggerScript._webkitToV8LineNumber = function(line)
-{
-    return line - 1;
-};
-
 DebuggerScript._v8ToWebkitLineNumber = function(line)
 {
     return line + 1;
diff --git a/Source/WebCore/bindings/v8/IntrusiveDOMWrapperMap.h b/Source/WebCore/bindings/v8/IntrusiveDOMWrapperMap.h
new file mode 100644
index 0000000..5c066f0
--- /dev/null
+++ b/Source/WebCore/bindings/v8/IntrusiveDOMWrapperMap.h
@@ -0,0 +1,217 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef IntrusiveDOMWrapperMap_h
+#define IntrusiveDOMWrapperMap_h
+
+#include "DOMDataStore.h"
+#include "V8Node.h"
+
+namespace WebCore {
+
+template <class T, int CHUNK_SIZE, class Traits>
+class ChunkedTable {
+  public:
+    ChunkedTable() : m_chunks(0), m_current(0), m_last(0) { }
+
+    T* add(T element)
+    {
+        if (m_current == m_last) {
+            m_chunks = new Chunk(m_chunks);
+            m_current = m_chunks->m_entries;
+            m_last = m_current + CHUNK_SIZE;
+        }
+        ASSERT((m_chunks->m_entries <= m_current) && (m_current < m_last));
+        T* p = m_current++;
+        *p = element;
+        return p;
+    }
+
+    void remove(T* element)
+    {
+        ASSERT(element);
+        ASSERT(m_current > m_chunks->m_entries);
+        m_current--;
+        if (element != m_current)
+            Traits::move(element, m_current);
+        if (m_current == m_chunks->m_entries) {
+            Chunk* toDelete = m_chunks;
+            m_chunks = toDelete->m_previous;
+            m_current = m_last = m_chunks ? m_chunks->m_entries + CHUNK_SIZE : 0;
+            delete toDelete;
+        }
+        ASSERT(!m_chunks || ((m_chunks->m_entries < m_current) && (m_current <= m_last)));
+    }
+
+    void clear()
+    {
+        if (!m_chunks)
+            return;
+
+        clearEntries(m_chunks->m_entries, m_current);
+        Chunk* last = m_chunks;
+        while (true) {
+            Chunk* previous = last->m_previous;
+            if (!previous)
+                break;
+            delete last;
+            clearEntries(previous->m_entries, previous->m_entries + CHUNK_SIZE);
+            last = previous;
+        }
+
+        m_chunks = last;
+        m_current = m_chunks->m_entries;
+        m_last = m_current + CHUNK_SIZE;
+    }
+
+    void visit(DOMDataStore* store, typename Traits::Visitor* visitor)
+    {
+        if (!m_chunks)
+            return;
+
+        visitEntries(store, m_chunks->m_entries, m_current, visitor);
+        for (Chunk* chunk = m_chunks->m_previous; chunk; chunk = chunk->m_previous)
+            visitEntries(store, chunk->m_entries, chunk->m_entries + CHUNK_SIZE, visitor);
+    }
+
+  private:
+    struct Chunk {
+        explicit Chunk(Chunk* previous) : m_previous(previous) { }
+        Chunk* const m_previous;
+        T m_entries[CHUNK_SIZE];
+    };
+
+    static void clearEntries(T* first, T* last)
+    {
+        for (T* entry = first; entry < last; entry++)
+            Traits::clear(entry);
+    }
+
+    static void visitEntries(DOMDataStore* store, T* first, T* last, typename Traits::Visitor* visitor)
+    {
+        for (T* entry = first; entry < last; entry++)
+            Traits::visit(store, entry, visitor);
+    }
+
+    Chunk* m_chunks;
+    T* m_current;
+    T* m_last;
+};
+
+
+class IntrusiveDOMWrapperMap : public AbstractWeakReferenceMap<Node, v8::Object> {
+public:
+    IntrusiveDOMWrapperMap(v8::WeakReferenceCallback callback)
+        : AbstractWeakReferenceMap<Node, v8::Object>(callback) { }
+
+    virtual v8::Persistent<v8::Object> get(Node* obj)
+    {
+        v8::Persistent<v8::Object>* wrapper = obj->wrapper();
+        return wrapper ? *wrapper : v8::Persistent<v8::Object>();
+    }
+
+    virtual void set(Node* obj, v8::Persistent<v8::Object> wrapper)
+    {
+        ASSERT(obj);
+        ASSERT(!obj->wrapper());
+        v8::Persistent<v8::Object>* entry = m_table.add(wrapper);
+        obj->setWrapper(entry);
+        wrapper.MakeWeak(obj, weakReferenceCallback());
+    }
+
+    virtual bool contains(Node* obj)
+    {
+        return obj->wrapper();
+    }
+
+    virtual void visit(DOMDataStore* store, Visitor* visitor)
+    {
+        m_table.visit(store, visitor);
+    }
+
+    virtual bool removeIfPresent(Node* obj, v8::Persistent<v8::Object> value)
+    {
+        ASSERT(obj);
+        v8::Persistent<v8::Object>* entry = obj->wrapper();
+        if (!entry)
+            return false;
+        if (*entry != value)
+            return false;
+        obj->clearWrapper();
+        m_table.remove(entry);
+        value.Dispose();
+        return true;
+    }
+
+
+    virtual void clear()
+    {
+        m_table.clear();
+    }
+
+private:
+    static int const numberOfEntries = (1 << 10) - 1;
+
+    struct ChunkedTableTraits {
+        typedef IntrusiveDOMWrapperMap::Visitor Visitor;
+
+        static void move(v8::Persistent<v8::Object>* target, v8::Persistent<v8::Object>* source)
+        {
+            *target = *source;
+            Node* node = V8Node::toNative(*target);
+            ASSERT(node);
+            node->setWrapper(target);
+        }
+
+        static void clear(v8::Persistent<v8::Object>* entry)
+        {
+            Node* node = V8Node::toNative(*entry);
+            ASSERT(node->wrapper() == entry);
+
+            node->clearWrapper();
+            entry->Dispose();
+        }
+
+        static void visit(DOMDataStore* store, v8::Persistent<v8::Object>* entry, Visitor* visitor)
+        {
+            Node* node = V8Node::toNative(*entry);
+            ASSERT(node->wrapper() == entry);
+
+            visitor->visitDOMWrapper(store, node, *entry);
+        }
+    };
+
+    typedef ChunkedTable<v8::Persistent<v8::Object>, numberOfEntries, ChunkedTableTraits> Table;
+    Table m_table;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/bindings/v8/NPV8Object.cpp b/Source/WebCore/bindings/v8/NPV8Object.cpp
index e4be0d8..0ecb3c7 100644
--- a/Source/WebCore/bindings/v8/NPV8Object.cpp
+++ b/Source/WebCore/bindings/v8/NPV8Object.cpp
@@ -78,14 +78,14 @@ static void freeV8NPObject(NPObject* npObject)
     free(v8NpObject);
 }
 
-static v8::Handle<v8::Value>* createValueListFromVariantArgs(const NPVariant* arguments, uint32_t argumentCount, NPObject* owner)
+static PassOwnArrayPtr<v8::Handle<v8::Value> > createValueListFromVariantArgs(const NPVariant* arguments, uint32_t argumentCount, NPObject* owner)
 {
-    v8::Handle<v8::Value>* argv = new v8::Handle<v8::Value>[argumentCount];
+    OwnArrayPtr<v8::Handle<v8::Value> > argv = adoptArrayPtr(new v8::Handle<v8::Value>[argumentCount]);
     for (uint32_t index = 0; index < argumentCount; index++) {
         const NPVariant* arg = &arguments[index];
         argv[index] = convertNPVariantToV8Object(arg, owner);
     }
-    return argv;
+    return argv.release();
 }
 
 // Create an identifier (null terminated utf8 char*) from the NPIdentifier.
@@ -188,7 +188,7 @@ bool _NPN_Invoke(NPP npp, NPObject* npObject, NPIdentifier methodName, const NPV
 
     // Call the function object.
     v8::Handle<v8::Function> function = v8::Handle<v8::Function>::Cast(functionObject);
-    OwnArrayPtr<v8::Handle<v8::Value> > argv(createValueListFromVariantArgs(arguments, argumentCount, npObject));
+    OwnArrayPtr<v8::Handle<v8::Value> > argv = createValueListFromVariantArgs(arguments, argumentCount, npObject);
     v8::Local<v8::Value> resultObject = proxy->callFunction(function, v8NpObject->v8Object, argumentCount, argv.get());
 
     // If we had an error, return false.  The spec is a little unclear here, but says "Returns true if the method was
@@ -237,7 +237,7 @@ bool _NPN_InvokeDefault(NPP npp, NPObject* npObject, const NPVariant* arguments,
         V8Proxy* proxy = toV8Proxy(npObject);
         ASSERT(proxy);
 
-        OwnArrayPtr<v8::Handle<v8::Value> > argv(createValueListFromVariantArgs(arguments, argumentCount, npObject));
+        OwnArrayPtr<v8::Handle<v8::Value> > argv = createValueListFromVariantArgs(arguments, argumentCount, npObject);
         resultObject = proxy->callFunction(function, functionObject, argumentCount, argv.get());
     }
     // If we had an error, return false.  The spec is a little unclear here, but says "Returns true if the method was
@@ -537,7 +537,7 @@ bool _NPN_Construct(NPP npp, NPObject* npObject, const NPVariant* arguments, uin
             V8Proxy* proxy = toV8Proxy(npObject);
             ASSERT(proxy);
 
-            OwnArrayPtr<v8::Handle<v8::Value> > argv(createValueListFromVariantArgs(arguments, argumentCount, npObject));
+            OwnArrayPtr<v8::Handle<v8::Value> > argv = createValueListFromVariantArgs(arguments, argumentCount, npObject);
             resultObject = proxy->newInstance(ctor, argumentCount, argv.get());
         }
 
diff --git a/Source/WebCore/bindings/v8/ScriptController.cpp b/Source/WebCore/bindings/v8/ScriptController.cpp
index fcbf40d..55f127b 100644
--- a/Source/WebCore/bindings/v8/ScriptController.cpp
+++ b/Source/WebCore/bindings/v8/ScriptController.cpp
@@ -61,7 +61,6 @@
 #include "V8NPObject.h"
 #include "V8Proxy.h"
 #include "Widget.h"
-#include "XSSAuditor.h"
 #include <wtf/StdLibExtras.h>
 #include <wtf/text/CString.h>
 
@@ -117,7 +116,6 @@ ScriptController::ScriptController(Frame* frame)
 #if ENABLE(NETSCAPE_PLUGIN_API)
     , m_windowScriptNPObject(0)
 #endif
-    , m_XSSAuditor(new XSSAuditor(frame))
 {
 }
 
@@ -219,17 +217,12 @@ void ScriptController::evaluateInIsolatedWorld(unsigned worldID, const Vector<Sc
 }
 
 // Evaluate a script file in the environment of this proxy.
-ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode, ShouldAllowXSS shouldAllowXSS)
+ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
 {
     String sourceURL = sourceCode.url();
     const String* savedSourceURL = m_sourceURL;
     m_sourceURL = &sourceURL;
 
-    if (shouldAllowXSS == DoNotAllowXSS && !m_XSSAuditor->canEvaluate(sourceCode.source())) {
-        // This script is not safe to be evaluated.
-        return ScriptValue();
-    }
-
     v8::HandleScope handleScope;
     v8::Handle<v8::Context> v8Context = V8Proxy::mainWorldContext(m_proxy->frame());
     if (v8Context.IsEmpty())
diff --git a/Source/WebCore/bindings/v8/ScriptController.h b/Source/WebCore/bindings/v8/ScriptController.h
index 7664846..b20e7fd 100644
--- a/Source/WebCore/bindings/v8/ScriptController.h
+++ b/Source/WebCore/bindings/v8/ScriptController.h
@@ -61,7 +61,6 @@ class Frame;
 class HTMLPlugInElement;
 class ScriptSourceCode;
 class Widget;
-class XSSAuditor;
 
 class ScriptController {
 public:
@@ -72,8 +71,8 @@ public:
     // or this accessor should be made JSProxy*
     V8Proxy* proxy() { return m_proxy.get(); }
 
-    ScriptValue executeScript(const ScriptSourceCode&, ShouldAllowXSS shouldAllowXSS = DoNotAllowXSS);
-    ScriptValue executeScript(const String& script, bool forceUserGesture = false, ShouldAllowXSS shouldAllowXSS = DoNotAllowXSS);
+    ScriptValue executeScript(const ScriptSourceCode&);
+    ScriptValue executeScript(const String& script, bool forceUserGesture = false);
 
     // Returns true if argument is a JavaScript URL.
     bool executeIfJavaScriptURL(const KURL&, ShouldReplaceDocumentIfJavaScriptURL shouldReplaceDocumentIfJavaScriptURL = ReplaceDocumentIfJavaScriptURL);
@@ -84,7 +83,7 @@ public:
     // Evaluate a script file in the environment of this proxy.
     // If succeeded, 'succ' is set to true and result is returned
     // as a string.
-    ScriptValue evaluate(const ScriptSourceCode&, ShouldAllowXSS shouldAllowXSS = DoNotAllowXSS);
+    ScriptValue evaluate(const ScriptSourceCode&);
 
     void evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>&);
 
@@ -106,8 +105,6 @@ public:
     ScriptController* windowShell(DOMWrapperWorld*) { return this; }
     ScriptController* existingWindowShell(DOMWrapperWorld*) { return this; }
 
-    XSSAuditor* xssAuditor() { return m_XSSAuditor.get(); }
-
     void collectGarbage();
 
     // Notify V8 that the system is running low on memory.
@@ -215,8 +212,6 @@ private:
 #if ENABLE(NETSCAPE_PLUGIN_API)
     NPObject* m_windowScriptNPObject;
 #endif
-    // The XSSAuditor associated with this ScriptController.
-    OwnPtr<XSSAuditor> m_XSSAuditor;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/ScriptDebugServer.cpp b/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
index 1c70a0e..cc7fba8 100644
--- a/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
@@ -143,7 +143,7 @@ void ScriptDebugServer::removeListener(ScriptDebugListener* listener, Page* page
     // FIXME: Remove all breakpoints set by the agent.
 }
 
-String ScriptDebugServer::setBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition, bool enabled, unsigned* actualLineNumber)
+String ScriptDebugServer::setBreakpoint(const String& sourceID, const ScriptBreakpoint& scriptBreakpoint, int* actualLineNumber, int* actualColumnNumber)
 {
     v8::HandleScope scope;
     v8::Local<v8::Context> debuggerContext = v8::Debug::GetDebugContext();
@@ -151,15 +151,17 @@ String ScriptDebugServer::setBreakpoint(const String& sourceID, unsigned lineNum
 
     v8::Local<v8::Object> args = v8::Object::New();
     args->Set(v8::String::New("scriptId"), v8String(sourceID));
-    args->Set(v8::String::New("lineNumber"), v8::Integer::New(lineNumber));
-    args->Set(v8::String::New("condition"), v8String(condition));
-    args->Set(v8::String::New("enabled"), v8::Boolean::New(enabled));
+    args->Set(v8::String::New("lineNumber"), v8::Integer::New(scriptBreakpoint.lineNumber));
+    args->Set(v8::String::New("columnNumber"), v8::Integer::New(scriptBreakpoint.columnNumber));
+    args->Set(v8::String::New("condition"), v8String(scriptBreakpoint.condition));
+    args->Set(v8::String::New("enabled"), v8::Boolean::New(scriptBreakpoint.enabled));
 
     v8::Handle<v8::Function> setBreakpointFunction = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("setBreakpoint")));
     v8::Handle<v8::Value> breakpointId = v8::Debug::Call(setBreakpointFunction, args);
     if (!breakpointId->IsString())
         return "";
     *actualLineNumber = args->Get(v8::String::New("lineNumber"))->Int32Value();
+    *actualColumnNumber = args->Get(v8::String::New("columnNumber"))->Int32Value();
     return v8StringToWebCoreString(breakpointId->ToString());
 }
 
@@ -340,11 +342,6 @@ void ScriptDebugServer::setEnabled(bool value)
      m_enabled = value;
 }
 
-bool ScriptDebugServer::isDebuggerAlwaysEnabled()
-{
-    return m_enabled;
-}
-
 void ScriptDebugServer::interruptAndRun(PassOwnPtr<Task> task)
 {
     v8::Debug::DebugBreakForCommand(new ClientDataImpl(task));
diff --git a/Source/WebCore/bindings/v8/ScriptDebugServer.h b/Source/WebCore/bindings/v8/ScriptDebugServer.h
index 8fa723f..af3d2ab 100644
--- a/Source/WebCore/bindings/v8/ScriptDebugServer.h
+++ b/Source/WebCore/bindings/v8/ScriptDebugServer.h
@@ -56,7 +56,7 @@ public:
     void addListener(ScriptDebugListener*, Page*);
     void removeListener(ScriptDebugListener*, Page*);
 
-    String setBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition, bool enabled, unsigned* actualLineNumber);
+    String setBreakpoint(const String& sourceID, const ScriptBreakpoint&, int* actualLineNumber, int* actualColumnNumber);
     void removeBreakpoint(const String& breakpointId);
     void clearBreakpoints();
     void setBreakpointsActivated(bool activated);
@@ -99,7 +99,6 @@ public:
     PassRefPtr<JavaScriptCallFrame> currentCallFrame();
 
     void setEnabled(bool);
-    bool isDebuggerAlwaysEnabled();
 
     class Task {
     public:
diff --git a/Source/WebCore/bindings/v8/ScriptEventListener.cpp b/Source/WebCore/bindings/v8/ScriptEventListener.cpp
index b46fc5a..0d758d9 100644
--- a/Source/WebCore/bindings/v8/ScriptEventListener.cpp
+++ b/Source/WebCore/bindings/v8/ScriptEventListener.cpp
@@ -39,7 +39,6 @@
 #include "DocumentParser.h"
 #include "V8AbstractEventListener.h"
 #include "V8Binding.h"
-#include "XSSAuditor.h"
 
 namespace WebCore {
 
@@ -59,11 +58,6 @@ PassRefPtr<V8LazyEventListener> createAttributeEventListener(Node* node, Attribu
         if (!scriptController->canExecuteScripts(AboutToExecuteScript))
             return 0;
 
-        if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
-            // This script is not safe to execute.
-            return 0;
-        }
-
         position = scriptController->eventHandlerPosition();
         sourceURL = node->document()->url().string();
     }
@@ -84,11 +78,6 @@ PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame* frame, Attri
     if (!scriptController->canExecuteScripts(AboutToExecuteScript))
         return 0;
 
-    if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
-        // This script is not safe to execute.
-        return 0;
-    }
-
     TextPosition0 position = scriptController->eventHandlerPosition();
     String sourceURL = frame->document()->url().string();
     return V8LazyEventListener::create(attr->localName().string(), frame->document()->isSVGDocument(), attr->value(), sourceURL, position, WorldContextHandle(UseMainWorld));
diff --git a/Source/WebCore/bindings/v8/ScriptFunctionCall.cpp b/Source/WebCore/bindings/v8/ScriptFunctionCall.cpp
index 3ea536e..aec742c 100644
--- a/Source/WebCore/bindings/v8/ScriptFunctionCall.cpp
+++ b/Source/WebCore/bindings/v8/ScriptFunctionCall.cpp
@@ -126,7 +126,7 @@ ScriptValue ScriptFunctionCall::call(bool& hadException, bool reportExceptions)
     ASSERT(value->IsFunction());
 
     v8::Local<v8::Function> function(v8::Function::Cast(*value));
-    OwnArrayPtr<v8::Handle<v8::Value> > args(new v8::Handle<v8::Value>[m_arguments.size()]);
+    OwnArrayPtr<v8::Handle<v8::Value> > args = adoptArrayPtr(new v8::Handle<v8::Value>[m_arguments.size()]);
     for (size_t i = 0; i < m_arguments.size(); ++i)
         args[i] = m_arguments[i].v8Value();
 
@@ -159,7 +159,7 @@ ScriptObject ScriptFunctionCall::construct(bool& hadException, bool reportExcept
     ASSERT(value->IsFunction());
 
     v8::Local<v8::Function> constructor(v8::Function::Cast(*value));
-    OwnArrayPtr<v8::Handle<v8::Value> > args(new v8::Handle<v8::Value>[m_arguments.size()]);
+    OwnArrayPtr<v8::Handle<v8::Value> > args = adoptArrayPtr(new v8::Handle<v8::Value>[m_arguments.size()]);
     for (size_t i = 0; i < m_arguments.size(); ++i)
         args[i] = m_arguments[i].v8Value();
 
@@ -193,7 +193,7 @@ ScriptValue ScriptCallback::call(bool& hadException)
     v8::Handle<v8::Object> object = v8::Context::GetCurrent()->Global();
     v8::Handle<v8::Function> function = v8::Handle<v8::Function>::Cast(m_function.v8Value());
 
-    OwnArrayPtr<v8::Handle<v8::Value> > args(new v8::Handle<v8::Value>[m_arguments.size()]);
+    OwnArrayPtr<v8::Handle<v8::Value> > args = adoptArrayPtr(new v8::Handle<v8::Value>[m_arguments.size()]);
     for (size_t i = 0; i < m_arguments.size(); ++i)
         args[i] = m_arguments[i].v8Value();
 
diff --git a/Source/WebCore/bindings/v8/ScriptGCEvent.cpp b/Source/WebCore/bindings/v8/ScriptGCEvent.cpp
index a58a0cd..55a803f 100644
--- a/Source/WebCore/bindings/v8/ScriptGCEvent.cpp
+++ b/Source/WebCore/bindings/v8/ScriptGCEvent.cpp
@@ -66,12 +66,13 @@ void ScriptGCEvent::removeEventListener(ScriptGCEventListener* eventListener)
     }
 }
 
-void ScriptGCEvent::getHeapSize(size_t& usedHeapSize, size_t& totalHeapSize)
+void ScriptGCEvent::getHeapSize(size_t& usedHeapSize, size_t& totalHeapSize, size_t& heapSizeLimit)
 {
     v8::HeapStatistics heapStatistics;
     v8::V8::GetHeapStatistics(&heapStatistics);
     usedHeapSize = heapStatistics.used_heap_size();
     totalHeapSize = heapStatistics.total_heap_size();
+    heapSizeLimit = heapStatistics.heap_size_limit();
 }
 
 size_t ScriptGCEvent::getUsedHeapSize()
diff --git a/Source/WebCore/bindings/v8/ScriptGCEvent.h b/Source/WebCore/bindings/v8/ScriptGCEvent.h
index 80a5a38..2ffd940 100644
--- a/Source/WebCore/bindings/v8/ScriptGCEvent.h
+++ b/Source/WebCore/bindings/v8/ScriptGCEvent.h
@@ -45,7 +45,7 @@ class ScriptGCEvent
 public:
     static void addEventListener(ScriptGCEventListener*);
     static void removeEventListener(ScriptGCEventListener*);
-    static void getHeapSize(size_t&, size_t&);
+    static void getHeapSize(size_t&, size_t&, size_t&);
 private:
     typedef Vector<ScriptGCEventListener*> GCEventListeners;
     static GCEventListeners s_eventListeners;
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.cpp b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
index 02dea14..615dcfc 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.cpp
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
@@ -53,16 +53,41 @@ PassRefPtr<ScriptProfile> ScriptProfiler::stop(ScriptState* state, const String&
     return profile ? ScriptProfile::create(profile) : 0;
 }
 
-PassRefPtr<ScriptHeapSnapshot> ScriptProfiler::takeHeapSnapshot(const String& title)
+namespace {
+
+class ActivityControlAdapter : public v8::ActivityControl {
+public:
+    ActivityControlAdapter(ScriptProfiler::HeapSnapshotProgress* progress)
+            : m_progress(progress), m_firstReport(true) { }
+    ControlOption ReportProgressValue(int done, int total)
+    {
+        ControlOption result = m_progress->isCanceled() ? kAbort : kContinue;
+        if (m_firstReport) {
+            m_firstReport = false;
+            m_progress->Start(total);
+        } else
+            m_progress->Worked(done);
+        if (done >= total)
+            m_progress->Done();
+        return result;
+    }
+private:
+    ScriptProfiler::HeapSnapshotProgress* m_progress;
+    bool m_firstReport;
+};
+
+} // namespace
+
+PassRefPtr<ScriptHeapSnapshot> ScriptProfiler::takeHeapSnapshot(const String& title, HeapSnapshotProgress* control)
 {
     v8::HandleScope hs;
-    const v8::HeapSnapshot* snapshot = v8::HeapProfiler::TakeSnapshot(v8String(title), v8::HeapSnapshot::kAggregated);
+    const v8::HeapSnapshot* snapshot = 0;
+    if (control) {
+        ActivityControlAdapter adapter(control);
+        snapshot = v8::HeapProfiler::TakeSnapshot(v8String(title), v8::HeapSnapshot::kFull, &adapter);
+    } else
+        snapshot = v8::HeapProfiler::TakeSnapshot(v8String(title), v8::HeapSnapshot::kAggregated);
     return snapshot ? ScriptHeapSnapshot::create(snapshot) : 0;
 }
 
-bool ScriptProfiler::isProfilerAlwaysEnabled()
-{
-    return true;
-}
-
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.h b/Source/WebCore/bindings/v8/ScriptProfiler.h
index e0969e1..9016668 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.h
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.h
@@ -44,10 +44,18 @@ class InspectorObject;
 class ScriptProfiler {
     WTF_MAKE_NONCOPYABLE(ScriptProfiler);
 public:
+    class HeapSnapshotProgress {
+    public:
+        virtual ~HeapSnapshotProgress() { }
+        virtual void Start(int totalWork) = 0;
+        virtual void Worked(int workDone) = 0;
+        virtual void Done() = 0;
+        virtual bool isCanceled() = 0;
+    };
+
     static void start(ScriptState* state, const String& title);
     static PassRefPtr<ScriptProfile> stop(ScriptState* state, const String& title);
-    static PassRefPtr<ScriptHeapSnapshot> takeHeapSnapshot(const String& title);
-    static bool isProfilerAlwaysEnabled();
+    static PassRefPtr<ScriptHeapSnapshot> takeHeapSnapshot(const String& title, HeapSnapshotProgress*);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/ScriptSourceCode.h b/Source/WebCore/bindings/v8/ScriptSourceCode.h
index 2478151..d7d1510 100644
--- a/Source/WebCore/bindings/v8/ScriptSourceCode.h
+++ b/Source/WebCore/bindings/v8/ScriptSourceCode.h
@@ -63,7 +63,12 @@ public:
 
     const String& source() const { return m_source; }
     CachedScript* cachedScript() const { return m_cachedScript.get(); }
-    const KURL& url() const { return m_url; }
+    const KURL& url() const
+    {
+        if (m_cachedScript)
+            return m_cachedScript->response().url();
+        return m_url;
+    }
     int startLine() const { return m_startPosition.m_line.oneBasedInt(); }
     const TextPosition1& startPosition() const { return m_startPosition; }
 
diff --git a/Source/WebCore/bindings/v8/SerializedScriptValue.cpp b/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
index 666e619..1c5e4e7 100644
--- a/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
+++ b/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
@@ -1118,12 +1118,15 @@ PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(v8::Handle<v8::V
 
 PassRefPtr<SerializedScriptValue> SerializedScriptValue::createFromWire(String data)
 {
-    return adoptRef(new SerializedScriptValue(data, WireData));
+    return adoptRef(new SerializedScriptValue(data));
 }
 
 PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(String data)
 {
-    return adoptRef(new SerializedScriptValue(data, StringValue));
+    Writer writer;
+    writer.writeWebCoreString(data);
+    String wireData = StringImpl::adopt(writer.data());
+    return adoptRef(new SerializedScriptValue(wireData));
 }
 
 PassRefPtr<SerializedScriptValue> SerializedScriptValue::create()
@@ -1133,19 +1136,31 @@ PassRefPtr<SerializedScriptValue> SerializedScriptValue::create()
 
 SerializedScriptValue* SerializedScriptValue::nullValue()
 {
-    DEFINE_STATIC_LOCAL(RefPtr<SerializedScriptValue>, nullValue, (SerializedScriptValue::create()));
+    DEFINE_STATIC_LOCAL(RefPtr<SerializedScriptValue>, nullValue, (0));
+    if (!nullValue) {
+        Writer writer;
+        writer.writeNull();
+        String wireData = StringImpl::adopt(writer.data());
+        nullValue = adoptRef(new SerializedScriptValue(wireData));
+    }
     return nullValue.get();
 }
 
 SerializedScriptValue* SerializedScriptValue::undefinedValue()
 {
-    DEFINE_STATIC_LOCAL(RefPtr<SerializedScriptValue>, undefinedValue, (SerializedScriptValue::create(v8::Undefined())));
+    DEFINE_STATIC_LOCAL(RefPtr<SerializedScriptValue>, undefinedValue, (0));
+    if (!undefinedValue) {
+        Writer writer;
+        writer.writeUndefined();
+        String wireData = StringImpl::adopt(writer.data());
+        undefinedValue = adoptRef(new SerializedScriptValue(wireData));
+    }
     return undefinedValue.get();
 }
 
 PassRefPtr<SerializedScriptValue> SerializedScriptValue::release()
 {
-    RefPtr<SerializedScriptValue> result = adoptRef(new SerializedScriptValue(m_data, WireData));
+    RefPtr<SerializedScriptValue> result = adoptRef(new SerializedScriptValue(m_data));
     m_data = String().crossThreadString();
     return result.release();
 }
@@ -1167,16 +1182,9 @@ SerializedScriptValue::SerializedScriptValue(v8::Handle<v8::Value> value, bool&
     m_data = String(StringImpl::adopt(writer.data())).crossThreadString();
 }
 
-SerializedScriptValue::SerializedScriptValue(String data, StringDataMode mode)
+SerializedScriptValue::SerializedScriptValue(String wireData)
 {
-    if (mode == WireData)
-        m_data = data.crossThreadString();
-    else {
-        ASSERT(mode == StringValue);
-        Writer writer;
-        writer.writeWebCoreString(data);
-        m_data = String(StringImpl::adopt(writer.data())).crossThreadString();
-    }
+    m_data = wireData.crossThreadString();
 }
 
 v8::Handle<v8::Value> SerializedScriptValue::deserialize()
diff --git a/Source/WebCore/bindings/v8/SerializedScriptValue.h b/Source/WebCore/bindings/v8/SerializedScriptValue.h
index ead9511..d0d8575 100644
--- a/Source/WebCore/bindings/v8/SerializedScriptValue.h
+++ b/Source/WebCore/bindings/v8/SerializedScriptValue.h
@@ -72,7 +72,7 @@ private:
 
     SerializedScriptValue();
     SerializedScriptValue(v8::Handle<v8::Value>, bool& didThrow);
-    SerializedScriptValue(String data, StringDataMode mode);
+    explicit SerializedScriptValue(String wireData);
 
     String m_data;
 };
diff --git a/Source/WebCore/bindings/v8/StaticDOMDataStore.h b/Source/WebCore/bindings/v8/StaticDOMDataStore.h
index fb6aa42..940646e 100644
--- a/Source/WebCore/bindings/v8/StaticDOMDataStore.h
+++ b/Source/WebCore/bindings/v8/StaticDOMDataStore.h
@@ -32,6 +32,7 @@
 #define StaticDOMDataStore_h
 
 #include "DOMDataStore.h"
+#include "IntrusiveDOMWrapperMap.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/V8Binding.cpp b/Source/WebCore/bindings/v8/V8Binding.cpp
index 52b23bd..2acd29a 100644
--- a/Source/WebCore/bindings/v8/V8Binding.cpp
+++ b/Source/WebCore/bindings/v8/V8Binding.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "V8Binding.h"
 
+#include "DOMStringList.h"
 #include "Element.h"
 #include "MathExtras.h"
 #include "PlatformString.h"
@@ -412,6 +413,13 @@ String v8NonStringValueToWebCoreString(v8::Handle<v8::Value> object)
         throwError(block.Exception());
         return StringImpl::empty();
     }
+    // This path is unexpected.  However there is hypothesis that it
+    // might be combination of v8 and v8 bindings bugs.  For now
+    // just bailout as we'll crash if attempt to convert empty handle into a string.
+    if (v8String.IsEmpty()) {
+        ASSERT_NOT_REACHED();
+        return StringImpl::empty();
+    }
     return v8StringToWebCoreString<String>(v8String, DoNotExternalize);
 }
 
@@ -578,4 +586,19 @@ void setElementStringAttr(const v8::AccessorInfo& info,
     imp->setAttribute(name, v);
 }
 
+PassRefPtr<DOMStringList> v8ValueToWebCoreDOMStringList(v8::Handle<v8::Value> value)
+{
+    v8::Local<v8::Value> v8Value(v8::Local<v8::Value>::New(value));
+    if (!v8Value->IsArray())
+        return 0;
+
+    RefPtr<DOMStringList> ret = DOMStringList::create();
+    v8::Local<v8::Array> v8Array = v8::Local<v8::Array>::Cast(v8Value);
+    for (size_t i = 0; i < v8Array->Length(); ++i) {
+        v8::Local<v8::Value> indexedValue = v8Array->Get(v8::Integer::New(i));
+        ret->append(v8ValueToWebCoreString(indexedValue));
+    }
+    return ret.release();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/V8Binding.h b/Source/WebCore/bindings/v8/V8Binding.h
index b2d5daa..7873b54 100644
--- a/Source/WebCore/bindings/v8/V8Binding.h
+++ b/Source/WebCore/bindings/v8/V8Binding.h
@@ -41,6 +41,7 @@
 
 namespace WebCore {
 
+    class DOMStringList;
     class EventListener;
     class EventTarget;
 
@@ -206,6 +207,8 @@ namespace WebCore {
 
     String int32ToWebCoreString(int value);
 
+    PassRefPtr<DOMStringList> v8ValueToWebCoreDOMStringList(v8::Handle<v8::Value>);
+
     class V8ParameterBase {
     public:
         operator String() { return toString<String>(); }
@@ -233,6 +236,14 @@ namespace WebCore {
                 return false;
             }
 
+            // This path is unexpected.  However there is hypothesis that it
+            // might be combination of v8 and v8 bindings bugs.  For now
+            // just bailout as we'll crash if attempt to convert empty handle into a string.
+            if (m_v8Object.IsEmpty()) {
+                ASSERT_NOT_REACHED();
+                return false;
+            }
+
             return true;
         }
 
diff --git a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
index f53e1b7..d88d8a6 100644
--- a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
@@ -39,6 +39,7 @@
 #include "FrameLoaderClient.h"
 #include "Page.h"
 #include "PageGroup.h"
+#include "RuntimeEnabledFeatures.h"
 #include "ScriptCallStack.h"
 #include "ScriptCallStackFactory.h"
 #include "ScriptController.h"
@@ -62,6 +63,11 @@
 #include <utility>
 #include <v8-debug.h>
 #include <v8.h>
+
+#if ENABLE(JAVASCRIPT_I18N_API)
+#include <v8/src/extensions/experimental/i18n-extension.h>
+#endif
+
 #include <wtf/Assertions.h>
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/StdLibExtras.h>
@@ -368,9 +374,15 @@ v8::Persistent<v8::Context> V8DOMWindowShell::createNewContext(v8::Handle<v8::Ob
     if (!V8Proxy::registeredExtensionWithV8(DateExtension::get()))
         V8Proxy::registerExtension(DateExtension::get());
 
+#if ENABLE(JAVASCRIPT_I18N_API)
+    // Enables experimental i18n API in V8.
+    if (RuntimeEnabledFeatures::javaScriptI18NAPIEnabled() && !V8Proxy::registeredExtensionWithV8(v8::internal::I18NExtension::get()))
+        V8Proxy::registerExtension(v8::internal::I18NExtension::get());
+#endif
+
     // Dynamically tell v8 about our extensions now.
     const V8Extensions& extensions = V8Proxy::extensions();
-    OwnArrayPtr<const char*> extensionNames(new const char*[extensions.size()]);
+    OwnArrayPtr<const char*> extensionNames = adoptArrayPtr(new const char*[extensions.size()]);
     int index = 0;
     for (size_t i = 0; i < extensions.size(); ++i) {
         // Ensure our date extension is always allowed.
diff --git a/Source/WebCore/bindings/v8/V8DOMWrapper.cpp b/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
index b51c5a5..b439274 100644
--- a/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
@@ -51,6 +51,7 @@
 #include "V8FileWriter.h"
 #include "V8HTMLCollection.h"
 #include "V8HTMLDocument.h"
+#include "V8IDBDatabase.h"
 #include "V8IDBRequest.h"
 #include "V8IDBTransaction.h"
 #include "V8IsolatedContext.h"
@@ -381,6 +382,8 @@ v8::Handle<v8::Value> V8DOMWrapper::convertEventTargetToV8Object(EventTarget* ta
 #endif
 
 #if ENABLE(INDEXED_DATABASE)
+    if (IDBDatabase* idbDatabase = target->toIDBDatabase())
+        return toV8(idbDatabase);
     if (IDBRequest* idbRequest = target->toIDBRequest())
         return toV8(idbRequest);
     if (IDBTransaction* idbTransaction = target->toIDBTransaction())
diff --git a/Source/WebCore/bindings/v8/V8EventListener.cpp b/Source/WebCore/bindings/v8/V8EventListener.cpp
index 808d342..319da42 100644
--- a/Source/WebCore/bindings/v8/V8EventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8EventListener.cpp
@@ -54,7 +54,9 @@ v8::Local<v8::Function> V8EventListener::getListenerFunction(ScriptExecutionCont
 
     if (listener->IsObject()) {
         v8::Local<v8::Value> property = listener->Get(v8::String::NewSymbol("handleEvent"));
-        if (property->IsFunction())
+        // Check that no exceptions were thrown when getting the
+        // handleEvent property and that the value is a function.
+        if (!property.IsEmpty() && property->IsFunction())
             return v8::Local<v8::Function>::Cast(property);
     }
 
diff --git a/Source/WebCore/bindings/v8/V8NPObject.cpp b/Source/WebCore/bindings/v8/V8NPObject.cpp
index 0b1d25e..36640b7 100644
--- a/Source/WebCore/bindings/v8/V8NPObject.cpp
+++ b/Source/WebCore/bindings/v8/V8NPObject.cpp
@@ -101,7 +101,7 @@ static v8::Handle<v8::Value> npObjectInvokeImpl(const v8::Arguments& args, Invok
 
     // Wrap up parameters.
     int numArgs = args.Length();
-    OwnArrayPtr<NPVariant> npArgs(new NPVariant[numArgs]);
+    OwnArrayPtr<NPVariant> npArgs = adoptArrayPtr(new NPVariant[numArgs]);
 
     for (int i = 0; i < numArgs; i++)
         convertV8ObjectToNPVariant(args[i], npObject, &npArgs[i]);
diff --git a/Source/WebCore/bindings/v8/V8NodeFilterCondition.cpp b/Source/WebCore/bindings/v8/V8NodeFilterCondition.cpp
index 4e0240d..a8ca878 100644
--- a/Source/WebCore/bindings/v8/V8NodeFilterCondition.cpp
+++ b/Source/WebCore/bindings/v8/V8NodeFilterCondition.cpp
@@ -80,7 +80,7 @@ short V8NodeFilterCondition::acceptNode(ScriptState* state, Node* node) const
     }
 
     v8::Handle<v8::Object> object = v8::Context::GetCurrent()->Global();
-    OwnArrayPtr<v8::Handle<v8::Value> > args(new v8::Handle<v8::Value>[1]);
+    OwnArrayPtr<v8::Handle<v8::Value> > args = adoptArrayPtr(new v8::Handle<v8::Value>[1]);
     args[0] = toV8(node);
 
     v8::Handle<v8::Value> result = V8Proxy::callFunctionWithoutFrame(callback, object, 1, args.get());
diff --git a/Source/WebCore/bindings/v8/V8Proxy.cpp b/Source/WebCore/bindings/v8/V8Proxy.cpp
index 831a6ef..ca57fa8 100644
--- a/Source/WebCore/bindings/v8/V8Proxy.cpp
+++ b/Source/WebCore/bindings/v8/V8Proxy.cpp
@@ -161,10 +161,15 @@ void V8Proxy::reportUnsafeAccessTo(Frame* target)
         return;
 
     Frame* source = V8Proxy::retrieveFrameForEnteredContext();
-    if (!source || !source->document())
-        return; // Ignore error if the source document is gone.
+    if (!source)
+        return;
+    Page* page = source->page();
+    if (!page)
+        return;
 
     Document* sourceDocument = source->document();
+    if (!sourceDocument)
+        return; // Ignore error if the source document is gone.
 
     // FIXME: This error message should contain more specifics of why the same
     // origin check has failed.
@@ -178,7 +183,7 @@ void V8Proxy::reportUnsafeAccessTo(Frame* target)
     // NOTE: Safari prints the message in the target page, but it seems like
     // it should be in the source page. Even for delayed messages, we put it in
     // the source page.
-    addMessageToConsole(source->page(), str, kSourceID, kLineNumber);
+    addMessageToConsole(page, str, kSourceID, kLineNumber);
 }
 
 static void handleFatalErrorInV8()
@@ -430,6 +435,8 @@ v8::Local<v8::Value> V8Proxy::runScriptInternal(v8::Handle<v8::Script> script, b
 
     // Run the script and keep track of the current recursion depth.
     v8::Local<v8::Value> result;
+    v8::TryCatch tryCatch;
+    tryCatch.SetVerbose(true);
     {
         // See comment in V8Proxy::callFunction.
         m_frame->keepAlive();
@@ -446,6 +453,11 @@ v8::Local<v8::Value> V8Proxy::runScriptInternal(v8::Handle<v8::Script> script, b
         ASSERT(result.IsEmpty());
 
     // Handle V8 internal error situation (Out-of-memory).
+    if (tryCatch.HasCaught()) {
+        ASSERT(result.IsEmpty());
+        return notHandledByInterceptor();
+    }
+
     if (result.IsEmpty())
         return notHandledByInterceptor();
 
diff --git a/Source/WebCore/bindings/v8/V8Proxy.h b/Source/WebCore/bindings/v8/V8Proxy.h
index 746d8f8..fc52b19 100644
--- a/Source/WebCore/bindings/v8/V8Proxy.h
+++ b/Source/WebCore/bindings/v8/V8Proxy.h
@@ -116,7 +116,7 @@ namespace WebCore {
                                  const BatchedCallback*, 
                                  size_t callbackCount);
 
-    const int kMaxRecursionDepth = 20;
+    const int kMaxRecursionDepth = 22;
 
     // The list of extensions that are registered for use with V8.
     typedef WTF::Vector<v8::Extension*> V8Extensions;
diff --git a/Source/WebCore/bindings/v8/V8WindowErrorHandler.cpp b/Source/WebCore/bindings/v8/V8WindowErrorHandler.cpp
index 4203ad5..e33a183 100644
--- a/Source/WebCore/bindings/v8/V8WindowErrorHandler.cpp
+++ b/Source/WebCore/bindings/v8/V8WindowErrorHandler.cpp
@@ -54,8 +54,10 @@ v8::Local<v8::Value> V8WindowErrorHandler::callListenerFunction(ScriptExecutionC
         v8::Local<v8::Function> callFunction = v8::Local<v8::Function>::Cast(listener);
         v8::Local<v8::Object> thisValue = v8::Context::GetCurrent()->Global();
         v8::Handle<v8::Value> parameters[3] = { v8String(errorEvent->message()), v8String(errorEvent->filename()), v8::Integer::New(errorEvent->lineno()) };
+        v8::TryCatch tryCatch;
+        tryCatch.SetVerbose(true);
         returnValue = callFunction->Call(thisValue, 3, parameters);
-        if (!returnValue.IsEmpty() && returnValue->IsBoolean() && !returnValue->BooleanValue())
+        if (!tryCatch.HasCaught() && !returnValue.IsEmpty() && returnValue->IsBoolean() && !returnValue->BooleanValue())
             event->preventDefault();
     }
     return returnValue;
diff --git a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
index aef892a..eb7252b 100644
--- a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
+++ b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -49,6 +49,7 @@
 #include "WorkerContext.h"
 #include "WorkerScriptController.h"
 #include "WrapperTypeInfo.h"
+#include <wtf/text/CString.h>
 
 namespace WebCore {
 
@@ -205,10 +206,14 @@ ScriptValue WorkerContextExecutionProxy::evaluate(const String& script, const St
     if (exceptionCatcher.HasCaught()) {
         v8::Local<v8::Message> message = exceptionCatcher.Message();
         state->hadException = true;
-        state->exception = ScriptValue(exceptionCatcher.Exception());
         state->errorMessage = toWebCoreString(message->Get());
         state->lineNumber = message->GetLineNumber();
         state->sourceURL = toWebCoreString(message->GetScriptResourceName());
+        if (m_workerContext->sanitizeScriptError(state->errorMessage, state->lineNumber, state->sourceURL))
+            state->exception = V8Proxy::throwError(V8Proxy::GeneralError, state->errorMessage.utf8().data());
+        else
+            state->exception = ScriptValue(exceptionCatcher.Exception());
+
         exceptionCatcher.Reset();
     } else
         state->hadException = false;
diff --git a/Source/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp
index 99edc8b..9d8907b 100644
--- a/Source/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp
@@ -29,9 +29,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "ArrayBuffer.h"
 
 #include "ExceptionCode.h"
@@ -77,5 +74,3 @@ v8::Handle<v8::Value> V8ArrayBuffer::constructorCallback(const v8::Arguments& ar
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h b/Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
index 6881a01..f842b6d 100644
--- a/Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
+++ b/Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
@@ -31,8 +31,6 @@
 #ifndef V8ArrayBufferViewCustom_h
 #define V8ArrayBufferViewCustom_h
 
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "ArrayBuffer.h"
 
 #include "V8ArrayBuffer.h"
@@ -87,7 +85,7 @@ v8::Handle<v8::Value> constructWebGLArray(const v8::Arguments& args, WrapperType
     int argLen = args.Length();
     if (!argLen) {
         // This happens when we return a previously constructed
-        // ArrayBufferView, e.g. from the call to <Type>Array.slice().
+        // ArrayBufferView, e.g. from the call to <Type>Array.subset().
         // The V8DOMWrapper will set the internal pointer in the
         // created object. Unfortunately it doesn't look like it's
         // possible to distinguish between this case and that where
@@ -99,7 +97,7 @@ v8::Handle<v8::Value> constructWebGLArray(const v8::Arguments& args, WrapperType
         V8DOMWrapper::setDOMWrapper(args.Holder(), type, array.get());
         // Do not call SetIndexedPropertiesToExternalArrayData on this
         // object. Not only is there no point from a performance
-        // perspective, but doing so causes errors in the slice() case.
+        // perspective, but doing so causes errors in the subset() case.
         return toV8(array.release(), args.Holder());
     }
 
@@ -209,6 +207,4 @@ v8::Handle<v8::Value> setWebGLArrayHelper(const v8::Arguments& args)
 
 }
 
-#endif // ENABLE(3D_CANVAS)
-
 #endif // V8ArrayBufferViewCustom_h
diff --git a/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp b/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp
index e1a1ba4..419cd60 100644
--- a/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp
@@ -28,8 +28,13 @@
 
 #include "V8AudioContext.h"
 
+#include "ArrayBuffer.h"
+#include "AudioBuffer.h"
 #include "AudioContext.h"
 #include "Frame.h"
+#include "V8ArrayBuffer.h"
+#include "V8AudioBuffer.h"
+#include "V8Binding.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
@@ -55,6 +60,58 @@ v8::Handle<v8::Value> V8AudioContext::constructorCallback(const v8::Arguments& a
     return args.Holder();
 }
 
+v8::Handle<v8::Value> V8AudioContext::createBufferCallback(const v8::Arguments& args)
+{
+    if (args.Length() < 2)
+        return throwError("Not enough arguments", V8Proxy::SyntaxError);
+
+    AudioContext* audioContext = toNative(args.Holder());
+    ASSERT(audioContext);
+
+    v8::Handle<v8::Value> arg = args[0];
+    
+    // AudioBuffer createBuffer(in ArrayBuffer buffer, in boolean mixToMono);
+    if (V8ArrayBuffer::HasInstance(arg)) {
+        v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(arg);
+        ArrayBuffer* arrayBuffer = V8ArrayBuffer::toNative(object);
+        ASSERT(arrayBuffer);
+
+        if (arrayBuffer) {
+            bool mixToMono = args[1]->ToBoolean()->Value();
+
+            RefPtr<AudioBuffer> audioBuffer = audioContext->createBuffer(arrayBuffer, mixToMono);
+            if (!audioBuffer.get())
+                return throwError("Error decoding audio file data", V8Proxy::SyntaxError);
+
+            return toV8(audioBuffer.get());
+        }
+        
+        return v8::Undefined();
+    }
+    
+    // AudioBuffer createBuffer(in unsigned long numberOfChannels, in unsigned long numberOfFrames, in float sampleRate);
+    if (args.Length() < 3)
+        return throwError("Not enough arguments", V8Proxy::SyntaxError);
+
+    bool ok = false;
+    
+    unsigned numberOfChannels = toInt32(args[0], ok);
+    if (!ok)
+        return throwError("Invalid number of channels", V8Proxy::SyntaxError);
+    
+    unsigned numberOfFrames = toInt32(args[1], ok);
+    if (!ok)
+        return throwError("Invalid number of frames", V8Proxy::SyntaxError);
+    
+    float sampleRate = toFloat(args[2]);
+    
+    RefPtr<AudioBuffer> audioBuffer = audioContext->createBuffer(numberOfChannels, numberOfFrames, sampleRate);
+    if (!audioBuffer.get())
+        return throwError("Error creating AudioBuffer", V8Proxy::SyntaxError);
+
+    return toV8(audioBuffer.get());
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(WEB_AUDIO)
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
index 328a9c1..85ae322 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
@@ -183,12 +183,6 @@ void V8DOMWindow::eventAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::
     context->Global()->SetHiddenValue(eventSymbol, value);
 }
 
-v8::Handle<v8::Value> V8DOMWindow::cryptoAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
-{
-    // FIXME: Implement me.
-    return v8::Undefined();
-}
-
 void V8DOMWindow::locationAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
 {
     DOMWindow* imp = V8DOMWindow::toNative(info.Holder());
diff --git a/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
index 60ce7ce..14f13cb 100755
--- a/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
@@ -24,9 +24,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "DataView.h"
 
 #include "V8ArrayBufferViewCustom.h"
@@ -120,5 +117,3 @@ v8::Handle<v8::Value> V8DataView::setUint8Callback(const v8::Arguments& args)
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
index cda0737..c435863 100644
--- a/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
@@ -49,7 +49,7 @@
 #include "V8Proxy.h"
 #include "V8Touch.h"
 #include "V8TouchList.h"
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 #include "V8WebGLRenderingContext.h"
 #endif
 #include "V8XPathNSResolver.h"
@@ -110,10 +110,10 @@ v8::Handle<v8::Value> V8Document::getCSSCanvasContextCallback(const v8::Argument
         return v8::Undefined();
     if (result->is2d())
         return toV8(static_cast<CanvasRenderingContext2D*>(result));
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
     else if (result->is3d())
         return toV8(static_cast<WebGLRenderingContext*>(result));
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
     ASSERT_NOT_REACHED();
     return v8::Undefined();
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8ElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ElementCustom.cpp
index 02fc457..e9b9336 100644
--- a/Source/WebCore/bindings/v8/custom/V8ElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ElementCustom.cpp
@@ -58,7 +58,7 @@ v8::Handle<v8::Value> toV8(Element* impl, bool forceNewObject)
     if (!impl)
         return v8::Null();
     if (impl->isHTMLElement())
-        return toV8(static_cast<HTMLElement*>(impl), forceNewObject);
+        return toV8(toHTMLElement(impl), forceNewObject);
 #if ENABLE(SVG)
     if (impl->isSVGElement())
         return toV8(static_cast<SVGElement*>(impl), forceNewObject);
diff --git a/Source/WebCore/bindings/v8/custom/V8Float32ArrayCustom.cpp b/Source/WebCore/bindings/v8/custom/V8Float32ArrayCustom.cpp
index c3dbe3b..178307e 100644
--- a/Source/WebCore/bindings/v8/custom/V8Float32ArrayCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8Float32ArrayCustom.cpp
@@ -29,9 +29,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "ArrayBuffer.h"
 #include "Float32Array.h"
 
@@ -67,5 +64,3 @@ v8::Handle<v8::Value> toV8(Float32Array* impl)
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
index e154f7f..8fd2d62 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
@@ -41,7 +41,7 @@
 #include "V8CanvasRenderingContext2D.h"
 #include "V8Node.h"
 #include "V8Proxy.h"
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 #include "V8WebGLRenderingContext.h"
 #endif
 #include <wtf/MathExtras.h>
@@ -55,7 +55,7 @@ v8::Handle<v8::Value> V8HTMLCanvasElement::getContextCallback(const v8::Argument
     HTMLCanvasElement* imp = V8HTMLCanvasElement::toNative(holder);
     String contextId = toWebCoreString(args[0]);
     RefPtr<CanvasContextAttributes> attrs;
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
     if (contextId == "experimental-webgl" || contextId == "webkit-3d") {
         attrs = WebGLContextAttributes::create();
         WebGLContextAttributes* webGLAttrs = static_cast<WebGLContextAttributes*>(attrs.get());
@@ -84,7 +84,7 @@ v8::Handle<v8::Value> V8HTMLCanvasElement::getContextCallback(const v8::Argument
         return v8::Null();
     if (result->is2d())
         return toV8(static_cast<CanvasRenderingContext2D*>(result));
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
     else if (result->is3d())
         return toV8(static_cast<WebGLRenderingContext*>(result));
 #endif
diff --git a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
index 6bd5abb..ce1732b 100644
--- a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
@@ -36,7 +36,6 @@
 #include "Frame.h"
 #include "InjectedScript.h"
 #include "InjectedScriptHost.h"
-#include "InspectorController.h"
 #include "InspectorValues.h"
 #include "Node.h"
 #include "Page.h"
@@ -147,8 +146,7 @@ v8::Handle<v8::Value> V8InjectedScriptHost::nodeForIdCallback(const v8::Argument
     if (!node)
         return v8::Undefined();
 
-    InspectorController* ic = host->inspectorController();
-    if (!ic)
+    if (!host->inspectorAgent())
         return v8::Undefined();
 
     return toV8(node);
diff --git a/Source/WebCore/bindings/v8/custom/V8InspectorFrontendHostCustom.cpp b/Source/WebCore/bindings/v8/custom/V8InspectorFrontendHostCustom.cpp
index 94fa86e..a8d8d0b 100644
--- a/Source/WebCore/bindings/v8/custom/V8InspectorFrontendHostCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8InspectorFrontendHostCustom.cpp
@@ -32,6 +32,7 @@
 #include "V8InspectorFrontendHost.h"
 
 #include "InspectorController.h"
+#include "InspectorFrontendClient.h"
 #include "InspectorFrontendHost.h"
 #include "PlatformString.h"
 
diff --git a/Source/WebCore/bindings/v8/custom/V8Int16ArrayCustom.cpp b/Source/WebCore/bindings/v8/custom/V8Int16ArrayCustom.cpp
index 244a231..90a3c71 100644
--- a/Source/WebCore/bindings/v8/custom/V8Int16ArrayCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8Int16ArrayCustom.cpp
@@ -29,9 +29,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "ArrayBuffer.h"
 #include "Int16Array.h"
 
@@ -67,5 +64,3 @@ v8::Handle<v8::Value> toV8(Int16Array* impl)
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/v8/custom/V8Int32ArrayCustom.cpp b/Source/WebCore/bindings/v8/custom/V8Int32ArrayCustom.cpp
index a5001ed..8fa38a7 100644
--- a/Source/WebCore/bindings/v8/custom/V8Int32ArrayCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8Int32ArrayCustom.cpp
@@ -29,9 +29,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "ArrayBuffer.h"
 #include "Int32Array.h"
 
@@ -67,5 +64,3 @@ v8::Handle<v8::Value> toV8(Int32Array* impl)
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/v8/custom/V8Int8ArrayCustom.cpp b/Source/WebCore/bindings/v8/custom/V8Int8ArrayCustom.cpp
index 526d83e..33458dc 100644
--- a/Source/WebCore/bindings/v8/custom/V8Int8ArrayCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8Int8ArrayCustom.cpp
@@ -29,9 +29,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "ArrayBuffer.h"
 #include "Int8Array.h"
 
@@ -67,5 +64,3 @@ v8::Handle<v8::Value> toV8(Int8Array* impl)
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
index f1357bd..c94afd9 100644
--- a/Source/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
@@ -81,7 +81,7 @@ v8::Handle<v8::Value> V8NotificationCenter::requestPermissionCallback(const v8::
 {
     INC_STATS(L"DOM.NotificationCenter.RequestPermission()");
     NotificationCenter* notificationCenter = V8NotificationCenter::toNative(args.Holder());
-    ScriptExecutionContext* context = notificationCenter->context();
+    ScriptExecutionContext* context = notificationCenter->scriptExecutionContext();
 
     // Make sure that script execution context is valid.
     if (!context)
diff --git a/Source/WebCore/bindings/v8/custom/V8Uint16ArrayCustom.cpp b/Source/WebCore/bindings/v8/custom/V8Uint16ArrayCustom.cpp
index e3ae263..aebe310 100644
--- a/Source/WebCore/bindings/v8/custom/V8Uint16ArrayCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8Uint16ArrayCustom.cpp
@@ -29,9 +29,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "ArrayBuffer.h"
 #include "Uint16Array.h"
 
@@ -67,5 +64,3 @@ v8::Handle<v8::Value> toV8(Uint16Array* impl)
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/v8/custom/V8Uint32ArrayCustom.cpp b/Source/WebCore/bindings/v8/custom/V8Uint32ArrayCustom.cpp
index 6c60283..563df8e 100644
--- a/Source/WebCore/bindings/v8/custom/V8Uint32ArrayCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8Uint32ArrayCustom.cpp
@@ -29,9 +29,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "ArrayBuffer.h"
 #include "Uint32Array.h"
 
@@ -67,5 +64,3 @@ v8::Handle<v8::Value> toV8(Uint32Array* impl)
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/v8/custom/V8Uint8ArrayCustom.cpp b/Source/WebCore/bindings/v8/custom/V8Uint8ArrayCustom.cpp
index ea9f421..aa46863 100644
--- a/Source/WebCore/bindings/v8/custom/V8Uint8ArrayCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8Uint8ArrayCustom.cpp
@@ -29,9 +29,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "ArrayBuffer.h"
 #include "Uint8Array.h"
 
@@ -67,5 +64,3 @@ v8::Handle<v8::Value> toV8(Uint8Array* impl)
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
index 7fdfc55..5a3f873 100644
--- a/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
@@ -30,7 +30,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "V8WebGLRenderingContext.h"
 
@@ -120,14 +120,14 @@ static v8::Handle<v8::Value> toV8Object(const WebGLGetInfo& info)
     }
     case WebGLGetInfo::kTypeFloat:
         return v8::Number::New(info.getFloat());
-    case WebGLGetInfo::kTypeLong:
-        return v8::Integer::New(info.getLong());
+    case WebGLGetInfo::kTypeInt:
+        return v8::Integer::New(info.getInt());
     case WebGLGetInfo::kTypeNull:
         return v8::Null();
     case WebGLGetInfo::kTypeString:
         return v8::String::New(fromWebCoreString(info.getString()), info.getString().length());
-    case WebGLGetInfo::kTypeUnsignedLong:
-        return v8::Integer::NewFromUnsigned(info.getUnsignedLong());
+    case WebGLGetInfo::kTypeUnsignedInt:
+        return v8::Integer::NewFromUnsigned(info.getUnsignedInt());
     case WebGLGetInfo::kTypeWebGLBuffer:
         return toV8(info.getWebGLBuffer());
     case WebGLGetInfo::kTypeWebGLFloatArray:
@@ -773,4 +773,4 @@ v8::Handle<v8::Value> V8WebGLRenderingContext::vertexAttrib4fvCallback(const v8:
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp b/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
index 6a571ae..0548a4d 100644
--- a/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
@@ -95,7 +95,7 @@ v8::Handle<v8::Value> V8XMLHttpRequest::responseAccessorGetter(v8::Local<v8::Str
         return v8::Undefined();
 #endif
 
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
+#if ENABLE(WEBGL) || ENABLE(BLOB)
     case XMLHttpRequest::ResponseTypeArrayBuffer:
         {
             ExceptionCode ec = 0;
@@ -193,7 +193,7 @@ v8::Handle<v8::Value> V8XMLHttpRequest::sendCallback(const v8::Arguments& args)
             DOMFormData* domFormData = V8DOMFormData::toNative(object);
             ASSERT(domFormData);
             xmlHttpRequest->send(domFormData, ec);
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
+#if ENABLE(WEBGL) || ENABLE(BLOB)
         } else if (V8ArrayBuffer::HasInstance(arg)) {
             v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(arg);
             ArrayBuffer* arrayBuffer = V8ArrayBuffer::toNative(object);
diff --git a/Source/WebCore/bridge/jsc/BridgeJSC.cpp b/Source/WebCore/bridge/jsc/BridgeJSC.cpp
index 49ffb2a..2747c75 100644
--- a/Source/WebCore/bridge/jsc/BridgeJSC.cpp
+++ b/Source/WebCore/bridge/jsc/BridgeJSC.cpp
@@ -106,7 +106,6 @@ RuntimeObject* Instance::newRuntimeObject(ExecState* exec)
 void Instance::willDestroyRuntimeObject(RuntimeObject* object)
 {
     ASSERT(m_rootObject);
-    ASSERT(m_rootObject->isValid());
     m_rootObject->removeRuntimeObject(object);
     m_runtimeObject.clear(object);
 }
diff --git a/Source/WebCore/bridge/qt/qt_class.cpp b/Source/WebCore/bridge/qt/qt_class.cpp
index 4c29c69..3c1836a 100644
--- a/Source/WebCore/bridge/qt/qt_class.cpp
+++ b/Source/WebCore/bridge/qt/qt_class.cpp
@@ -74,7 +74,7 @@ JSValue QtClass::fallbackObject(ExecState* exec, Instance* inst, const Identifie
     const QByteArray name = QString(reinterpret_cast<const QChar*>(ustring.characters()), ustring.length()).toAscii();
 
     // First see if we have a cache hit
-    JSObject* val = qtinst->m_methods.value(name);
+    JSObject* val = qtinst->m_methods.value(name).get();
     if (val)
         return val;
 
diff --git a/Source/WebCore/bridge/qt/qt_instance.cpp b/Source/WebCore/bridge/qt/qt_instance.cpp
index 78263e9..b4d2117 100644
--- a/Source/WebCore/bridge/qt/qt_instance.cpp
+++ b/Source/WebCore/bridge/qt/qt_instance.cpp
@@ -34,6 +34,7 @@
 #include <qhash.h>
 #include <qmetaobject.h>
 #include <qmetatype.h>
+#include <qwebelement.h>
 
 namespace JSC {
 namespace Bindings {
@@ -82,9 +83,10 @@ QtInstance::QtInstance(QObject* o, PassRefPtr<RootObject> rootObject, QScriptEng
     , m_class(0)
     , m_object(o)
     , m_hashkey(o)
-    , m_defaultMethod(0)
     , m_ownership(ownership)
 {
+    // This is a good place to register Qt metatypes that are in the QtWebKit module, as this is class will initialize if we have a QObject bridge.
+    qRegisterMetaType<QWebElement>();
 }
 
 QtInstance::~QtInstance()
@@ -148,12 +150,12 @@ void QtInstance::put(JSObject* object, ExecState* exec, const Identifier& proper
 
 void QtInstance::removeCachedMethod(JSObject* method)
 {
-    if (m_defaultMethod == method)
-        m_defaultMethod = 0;
+    if (m_defaultMethod.get() == method)
+        m_defaultMethod.clear();
 
-    for (QHash<QByteArray, JSObject*>::Iterator it = m_methods.begin(),
+    for (QHash<QByteArray, DeprecatedPtr<JSObject> >::Iterator it = m_methods.begin(),
         end = m_methods.end(); it != end; ++it)
-        if (it.value() == method) {
+        if (it.value().get() == method) {
             m_methods.erase(it);
             return;
         }
@@ -188,10 +190,10 @@ RuntimeObject* QtInstance::newRuntimeObject(ExecState* exec)
 void QtInstance::markAggregate(MarkStack& markStack)
 {
     if (m_defaultMethod)
-        markStack.append(m_defaultMethod);
-    foreach (JSObject* val, m_methods.values()) {
+        markStack.append(&m_defaultMethod);
+    foreach (DeprecatedPtr<JSObject> val, m_methods.values()) {
         if (val)
-            markStack.append(val);
+            markStack.append(&val);
     }
 }
 
diff --git a/Source/WebCore/bridge/qt/qt_instance.h b/Source/WebCore/bridge/qt/qt_instance.h
index 25aea53..003c801 100644
--- a/Source/WebCore/bridge/qt/qt_instance.h
+++ b/Source/WebCore/bridge/qt/qt_instance.h
@@ -83,9 +83,9 @@ private:
     mutable QtClass* m_class;
     QPointer<QObject> m_object;
     QObject* m_hashkey;
-    mutable QHash<QByteArray, JSObject*> m_methods;
+    mutable QHash<QByteArray, DeprecatedPtr<JSObject> > m_methods;
     mutable QHash<QString, QtField*> m_fields;
-    mutable QtRuntimeMetaMethod* m_defaultMethod;
+    mutable WriteBarrier<QtRuntimeMetaMethod> m_defaultMethod;
     QScriptEngine::ValueOwnership m_ownership;
 };
 
diff --git a/Source/WebCore/bridge/qt/qt_runtime.cpp b/Source/WebCore/bridge/qt/qt_runtime.cpp
index 0fb811b..5507fc9 100644
--- a/Source/WebCore/bridge/qt/qt_runtime.cpp
+++ b/Source/WebCore/bridge/qt/qt_runtime.cpp
@@ -587,7 +587,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                     if (qstring.mid(lastSlash + 1).contains(QLatin1Char('i')))
                         realRe.setCaseSensitivity(Qt::CaseInsensitive);
 
-                    ret = qVariantFromValue(realRe);
+                    ret = QVariant::fromValue(realRe);
                     dist = 0;
                 } else {
                     qConvDebug() << "couldn't parse a JS regexp";
@@ -598,7 +598,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
 
                 QRegExp re(qstring);
                 if (re.isValid()) {
-                    ret = qVariantFromValue(re);
+                    ret = QVariant::fromValue(re);
                     dist = 10;
                 }
             }
@@ -610,7 +610,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 if (qtinst) {
                     if (qtinst->getObject()) {
                         qConvDebug() << "found instance, with object:" << (void*) qtinst->getObject();
-                        ret = qVariantFromValue(qtinst->getObject());
+                        ret = QVariant::fromValue(qtinst->getObject());
                         qConvDebug() << ret;
                         dist = 0;
                     } else {
@@ -621,7 +621,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 }
             } else if (type == Null) {
                 QObject* nullobj = 0;
-                ret = qVariantFromValue(nullobj);
+                ret = QVariant::fromValue(nullobj);
                 dist = 0;
             } else {
                 qConvDebug() << "previous type was not an object:" << type;
@@ -634,7 +634,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 if (qtinst) {
                     if (qtinst->getObject()) {
                         qConvDebug() << "found instance, with object:" << (void*) qtinst->getObject();
-                        ret = qVariantFromValue((void *)qtinst->getObject());
+                        ret = QVariant::fromValue((void *)qtinst->getObject());
                         qConvDebug() << ret;
                         dist = 0;
                     } else {
@@ -644,7 +644,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                     qConvDebug() << "wasn't a qtinstance";
                 }
             } else if (type == Null) {
-                ret = qVariantFromValue((void*)0);
+                ret = QVariant::fromValue((void*)0);
                 dist = 0;
             } else if (type == Number) {
                 // I don't think that converting a double to a pointer is a wise
@@ -1401,8 +1401,6 @@ QtRuntimeMetaMethod::QtRuntimeMetaMethod(ExecState* exec, const Identifier& iden
     QW_D(QtRuntimeMetaMethod);
     d->m_signature = signature;
     d->m_index = index;
-    d->m_connect = 0;
-    d->m_disconnect = 0;
     d->m_allowPrivate = allowPrivate;
 }
 
@@ -1411,9 +1409,9 @@ void QtRuntimeMetaMethod::markChildren(MarkStack& markStack)
     QtRuntimeMethod::markChildren(markStack);
     QW_D(QtRuntimeMetaMethod);
     if (d->m_connect)
-        markStack.append(d->m_connect);
+        markStack.append(&d->m_connect);
     if (d->m_disconnect)
-        markStack.append(d->m_disconnect);
+        markStack.append(&d->m_disconnect);
 }
 
 EncodedJSValue QtRuntimeMetaMethod::call(ExecState* exec)
@@ -1523,8 +1521,8 @@ JSValue QtRuntimeMetaMethod::connectGetter(ExecState* exec, JSValue slotBase, co
     QW_DS(QtRuntimeMetaMethod, thisObj);
 
     if (!d->m_connect)
-        d->m_connect = new (exec) QtRuntimeConnectionMethod(exec, ident, true, d->m_instance, d->m_index, d->m_signature);
-    return d->m_connect;
+        d->m_connect.set(exec->globalData(), thisObj, new (exec) QtRuntimeConnectionMethod(exec, ident, true, d->m_instance, d->m_index, d->m_signature));
+    return d->m_connect.get();
 }
 
 JSValue QtRuntimeMetaMethod::disconnectGetter(ExecState* exec, JSValue slotBase, const Identifier& ident)
@@ -1533,8 +1531,8 @@ JSValue QtRuntimeMetaMethod::disconnectGetter(ExecState* exec, JSValue slotBase,
     QW_DS(QtRuntimeMetaMethod, thisObj);
 
     if (!d->m_disconnect)
-        d->m_disconnect = new (exec) QtRuntimeConnectionMethod(exec, ident, false, d->m_instance, d->m_index, d->m_signature);
-    return d->m_disconnect;
+        d->m_disconnect.set(exec->globalData(), thisObj, new (exec) QtRuntimeConnectionMethod(exec, ident, false, d->m_instance, d->m_index, d->m_signature));
+    return d->m_disconnect.get();
 }
 
 // ===============
diff --git a/Source/WebCore/bridge/qt/qt_runtime.h b/Source/WebCore/bridge/qt/qt_runtime.h
index 8dab08c..c5abca7 100644
--- a/Source/WebCore/bridge/qt/qt_runtime.h
+++ b/Source/WebCore/bridge/qt/qt_runtime.h
@@ -129,8 +129,8 @@ class QtRuntimeMetaMethodData : public QtRuntimeMethodData {
         QByteArray m_signature;
         bool m_allowPrivate;
         int m_index;
-        QtRuntimeConnectionMethod *m_connect;
-        QtRuntimeConnectionMethod *m_disconnect;
+        WriteBarrier<QtRuntimeConnectionMethod> m_connect;
+        WriteBarrier<QtRuntimeConnectionMethod> m_disconnect;
 };
 
 class QtRuntimeConnectionMethodData : public QtRuntimeMethodData {
diff --git a/Source/WebCore/bridge/runtime_root.cpp b/Source/WebCore/bridge/runtime_root.cpp
index 515636d..5496e55 100644
--- a/Source/WebCore/bridge/runtime_root.cpp
+++ b/Source/WebCore/bridge/runtime_root.cpp
@@ -101,13 +101,15 @@ void RootObject::invalidate()
         return;
 
     {
-        HashSet<RuntimeObject*>::iterator end = m_runtimeObjects.end();
-        for (HashSet<RuntimeObject*>::iterator it = m_runtimeObjects.begin(); it != end; ++it)
-            (*it)->invalidate();
-        
+        WeakGCMap<RuntimeObject*, RuntimeObject>::iterator end = m_runtimeObjects.uncheckedEnd();
+        for (WeakGCMap<RuntimeObject*, RuntimeObject>::iterator it = m_runtimeObjects.uncheckedBegin(); it != end; ++it) {
+            if (m_runtimeObjects.isValid(it))
+                it->second->invalidate();
+        }
+
         m_runtimeObjects.clear();
     }
-    
+
     m_isValid = false;
 
     m_nativeHandle = 0;
@@ -176,17 +178,19 @@ void RootObject::updateGlobalObject(JSGlobalObject* globalObject)
 void RootObject::addRuntimeObject(RuntimeObject* object)
 {
     ASSERT(m_isValid);
-    ASSERT(!m_runtimeObjects.contains(object));
-    
-    m_runtimeObjects.add(object);
-}        
-    
+    ASSERT(!m_runtimeObjects.get(object));
+
+    m_runtimeObjects.set(object, object);
+}
+
 void RootObject::removeRuntimeObject(RuntimeObject* object)
 {
-    ASSERT(m_isValid);
-    ASSERT(m_runtimeObjects.contains(object));
-    
-    m_runtimeObjects.remove(object);
+    if (!m_isValid)
+        return;
+
+    ASSERT(m_runtimeObjects.uncheckedGet(object));
+
+    m_runtimeObjects.take(object);
 }
 
 } } // namespace JSC::Bindings
diff --git a/Source/WebCore/bridge/runtime_root.h b/Source/WebCore/bridge/runtime_root.h
index babd7ad..dde8a48 100644
--- a/Source/WebCore/bridge/runtime_root.h
+++ b/Source/WebCore/bridge/runtime_root.h
@@ -31,8 +31,8 @@
 #endif
 #include <runtime/Protect.h>
 
+#include <runtime/WeakGCMap.h>
 #include <wtf/Forward.h>
-#include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -89,7 +89,7 @@ private:
     ProtectedPtr<JSGlobalObject> m_globalObject;
 
     ProtectCountSet m_protectCountSet;
-    HashSet<RuntimeObject*> m_runtimeObjects;    
+    WeakGCMap<RuntimeObject*, RuntimeObject> m_runtimeObjects; // Really need a WeakGCSet, but this will do.
 
     HashSet<InvalidationCallback*> m_invalidationCallbacks;
 };
diff --git a/Source/WebCore/config.h b/Source/WebCore/config.h
index 3018e29..781762a 100644
--- a/Source/WebCore/config.h
+++ b/Source/WebCore/config.h
@@ -271,6 +271,10 @@
 #define USE_SYSTEM_MALLOC 1
 #endif
 
+#if OS(UNIX) || OS(WINDOWS)
+#define WTF_USE_OS_RANDOMNESS 1
+#endif
+
 #if PLATFORM(CHROMIUM)
 
 #if !OS(DARWIN)
diff --git a/Source/WebCore/css/CSSCanvasValue.cpp b/Source/WebCore/css/CSSCanvasValue.cpp
index e28def9..7f61d25 100644
--- a/Source/WebCore/css/CSSCanvasValue.cpp
+++ b/Source/WebCore/css/CSSCanvasValue.cpp
@@ -83,7 +83,7 @@ HTMLCanvasElement* CSSCanvasValue::element(Document* document)
     return m_element;
 }
 
-Image* CSSCanvasValue::image(RenderObject* renderer, const IntSize& /*size*/)
+PassRefPtr<Image> CSSCanvasValue::image(RenderObject* renderer, const IntSize& /*size*/)
 {
     ASSERT(m_clients.contains(renderer));
     HTMLCanvasElement* elt = element(renderer->document());
diff --git a/Source/WebCore/css/CSSCanvasValue.h b/Source/WebCore/css/CSSCanvasValue.h
index 4cd4280..27b8f2b 100644
--- a/Source/WebCore/css/CSSCanvasValue.h
+++ b/Source/WebCore/css/CSSCanvasValue.h
@@ -40,7 +40,7 @@ public:
 
     virtual String cssText() const;
 
-    virtual Image* image(RenderObject*, const IntSize&);
+    virtual PassRefPtr<Image> image(RenderObject*, const IntSize&);
     virtual bool isFixedSize() const { return true; }
     virtual IntSize fixedSize(const RenderObject*);
 
diff --git a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
index 89564c3..f1c7fdf 100644
--- a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -3,6 +3,7 @@
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
+ * Copyright (C) 2011 Sencha, Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -1148,26 +1149,30 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return CSSPrimitiveValue::create(style->listStylePosition());
         case CSSPropertyListStyleType:
             return CSSPrimitiveValue::create(style->listStyleType());
-        case CSSPropertyMarginTop:
-            if (renderer && renderer->isBox())
-                // FIXME: Supposed to return the percentage if percentage was specified.
-                return zoomAdjustedPixelValue(toRenderBox(renderer)->marginTop(), style.get());
-            return CSSPrimitiveValue::create(style->marginTop());
-        case CSSPropertyMarginRight:
-            if (renderer && renderer->isBox())
-                // FIXME: Supposed to return the percentage if percentage was specified.
-                return zoomAdjustedPixelValue(toRenderBox(renderer)->marginRight(), style.get());
-            return CSSPrimitiveValue::create(style->marginRight());
-        case CSSPropertyMarginBottom:
-            if (renderer && renderer->isBox())
-                // FIXME: Supposed to return the percentage if percentage was specified.
-                return zoomAdjustedPixelValue(toRenderBox(renderer)->marginBottom(), style.get());
-            return CSSPrimitiveValue::create(style->marginBottom());
-        case CSSPropertyMarginLeft:
-            if (renderer && renderer->isBox())
-                // FIXME: Supposed to return the percentage if percentage was specified.
-                return zoomAdjustedPixelValue(toRenderBox(renderer)->marginLeft(), style.get());
-            return CSSPrimitiveValue::create(style->marginLeft());
+        case CSSPropertyMarginTop: {
+            Length marginTop = style->marginTop();
+            if (marginTop.isPercent())
+                return CSSPrimitiveValue::create(marginTop);
+            return zoomAdjustedPixelValue(marginTop.value(), style.get());
+        }
+        case CSSPropertyMarginRight: {
+            Length marginRight = style->marginRight();
+            if (marginRight.isPercent())
+                return CSSPrimitiveValue::create(marginRight);
+            return zoomAdjustedPixelValue(marginRight.value(), style.get());
+        }
+        case CSSPropertyMarginBottom: {
+            Length marginBottom = style->marginBottom();
+            if (marginBottom.isPercent())
+                return CSSPrimitiveValue::create(marginBottom);
+            return zoomAdjustedPixelValue(marginBottom.value(), style.get());
+        }
+        case CSSPropertyMarginLeft: {
+            Length marginLeft = style->marginLeft();
+            if (marginLeft.isPercent())
+                return CSSPrimitiveValue::create(marginLeft);
+            return zoomAdjustedPixelValue(marginLeft.value(), style.get());
+        }
         case CSSPropertyWebkitMarqueeDirection:
             return CSSPrimitiveValue::create(style->marqueeDirection());
         case CSSPropertyWebkitMarqueeIncrement:
diff --git a/Source/WebCore/css/CSSFontFaceSource.cpp b/Source/WebCore/css/CSSFontFaceSource.cpp
index 034b22e..681a94b 100644
--- a/Source/WebCore/css/CSSFontFaceSource.cpp
+++ b/Source/WebCore/css/CSSFontFaceSource.cpp
@@ -115,7 +115,7 @@ SimpleFontData* CSSFontFaceSource::getFontData(const FontDescription& fontDescri
     }
 
     // See if we have a mapping in our FontData cache.
-    unsigned hashKey = (fontDescription.computedPixelSize() + 1) << 3 | (fontDescription.orientation() == Vertical ? 4 : 0) | (syntheticBold ? 2 : 0) | (syntheticItalic ? 1 : 0);
+    unsigned hashKey = (fontDescription.computedPixelSize() + 1) << 5 | fontDescription.widthVariant() << 3 | (fontDescription.orientation() == Vertical ? 4 : 0) | (syntheticBold ? 2 : 0) | (syntheticItalic ? 1 : 0);
     if (SimpleFontData* cachedData = m_fontDataTable.get(hashKey))
         return cachedData;
 
@@ -162,13 +162,13 @@ SimpleFontData* CSSFontFaceSource::getFontData(const FontDescription& fontDescri
                 if (!m_font->ensureCustomFontData())
                     return 0;
 
-                fontData.set(new SimpleFontData(m_font->platformDataFromCustomData(fontDescription.computedPixelSize(), syntheticBold, syntheticItalic, fontDescription.orientation(), fontDescription.renderingMode()), true, false));
+                fontData.set(new SimpleFontData(m_font->platformDataFromCustomData(fontDescription.computedPixelSize(), syntheticBold, syntheticItalic, fontDescription.orientation(), fontDescription.widthVariant(), fontDescription.renderingMode()), true, false));
             }
         } else {
 #if ENABLE(SVG_FONTS)
             // In-Document SVG Fonts
             if (m_svgFontFaceElement)
-                fontData.set(new SimpleFontData(adoptPtr(new SVGFontData(m_svgFontFaceElement)), fontDescription.computedPixelSize(), syntheticBold, syntheticItalic));
+                fontData.set(new SimpleFontData(adoptPtr(new SVGFontData(m_svgFontFaceElement.get())), fontDescription.computedPixelSize(), syntheticBold, syntheticItalic));
 #endif
         }
     } else {
@@ -190,6 +190,16 @@ SimpleFontData* CSSFontFaceSource::getFontData(const FontDescription& fontDescri
 }
 
 #if ENABLE(SVG_FONTS)
+SVGFontFaceElement* CSSFontFaceSource::svgFontFaceElement() const
+{
+    return m_svgFontFaceElement.get();
+}
+
+void CSSFontFaceSource::setSVGFontFaceElement(PassRefPtr<SVGFontFaceElement> element) 
+{ 
+    m_svgFontFaceElement = element;
+}
+
 bool CSSFontFaceSource::isSVGFontFaceSource() const
 {
     return m_svgFontFaceElement || (m_font && m_font->isSVGFont());
diff --git a/Source/WebCore/css/CSSFontFaceSource.h b/Source/WebCore/css/CSSFontFaceSource.h
index e2057cc..a5c3e61 100644
--- a/Source/WebCore/css/CSSFontFaceSource.h
+++ b/Source/WebCore/css/CSSFontFaceSource.h
@@ -63,8 +63,8 @@ public:
     void pruneTable();
 
 #if ENABLE(SVG_FONTS)
-    SVGFontFaceElement* svgFontFaceElement() const { return m_svgFontFaceElement; }
-    void setSVGFontFaceElement(SVGFontFaceElement* element) { m_svgFontFaceElement = element; }
+    SVGFontFaceElement* svgFontFaceElement() const;
+    void setSVGFontFaceElement(PassRefPtr<SVGFontFaceElement>);
     bool isSVGFontFaceSource() const;
 #endif
 
@@ -75,7 +75,7 @@ private:
     HashMap<unsigned, SimpleFontData*> m_fontDataTable; // The hash key is composed of size synthetic styles.
 
 #if ENABLE(SVG_FONTS)
-    SVGFontFaceElement* m_svgFontFaceElement;
+    RefPtr<SVGFontFaceElement> m_svgFontFaceElement;
     RefPtr<SVGFontElement> m_externalSVGFontElement;
 #endif
 };
diff --git a/Source/WebCore/css/CSSFunctionValue.cpp b/Source/WebCore/css/CSSFunctionValue.cpp
index 70e8174..52a2953 100644
--- a/Source/WebCore/css/CSSFunctionValue.cpp
+++ b/Source/WebCore/css/CSSFunctionValue.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "CSSFunctionValue.h"
 
+#include "CSSParserValues.h"
 #include "CSSValueList.h"
 #include <wtf/PassOwnPtr.h>
 
@@ -51,18 +52,4 @@ String CSSFunctionValue::cssText() const
     return result;
 }
 
-CSSParserValue CSSFunctionValue::parserValue() const
-{
-    CSSParserValue val;
-    val.id = 0;
-    val.isInt = false;
-    val.unit = CSSParserValue::Function;
-    val.function = new CSSParserFunction;
-    val.function->name.characters = const_cast<UChar*>(m_name.characters());
-    val.function->name.length = m_name.length();
-    if (m_args)
-        val.function->args = m_args->createParserValueList();
-    return val;
-}
-
 }
diff --git a/Source/WebCore/css/CSSFunctionValue.h b/Source/WebCore/css/CSSFunctionValue.h
index 1d73f33..be38206 100644
--- a/Source/WebCore/css/CSSFunctionValue.h
+++ b/Source/WebCore/css/CSSFunctionValue.h
@@ -44,8 +44,6 @@ public:
     
     virtual String cssText() const;
 
-    virtual CSSParserValue parserValue() const;
-
 private:
     explicit CSSFunctionValue(CSSParserFunction*);
     
diff --git a/Source/WebCore/css/CSSGradientValue.cpp b/Source/WebCore/css/CSSGradientValue.cpp
index b6b9ebe..ede76da 100644
--- a/Source/WebCore/css/CSSGradientValue.cpp
+++ b/Source/WebCore/css/CSSGradientValue.cpp
@@ -41,27 +41,28 @@ using namespace std;
 
 namespace WebCore {
 
-Image* CSSGradientValue::image(RenderObject* renderer, const IntSize& size)
+PassRefPtr<Image> CSSGradientValue::image(RenderObject* renderer, const IntSize& size)
 {
-    if (!m_clients.contains(renderer))
-        return 0;
-
-    // Need to look up our size.  Create a string of width*height to use as a hash key.
-    // FIXME: hashing based only on size is not sufficient. Color stops may use context-sensitive units (like em)
-    // that should force the color stop positions to be recomputed.
-    Image* result = getImage(renderer, size);
-    if (result)
-        return result;
-
     if (size.isEmpty())
         return 0;
 
+    bool cacheable = isCacheable();
+    if (cacheable) {
+        if (!m_clients.contains(renderer))
+            return 0;
+
+        // Need to look up our size.  Create a string of width*height to use as a hash key.
+        Image* result = getImage(renderer, size);
+        if (result)
+            return result;
+    }
+    
     // We need to create an image.
     RefPtr<Image> newImage = GeneratedImage::create(createGradient(renderer, size), size);
-    result = newImage.get();
-    putImage(size, newImage.release());
+    if (cacheable)
+        putImage(size, newImage);
 
-    return result;
+    return newImage.release();
 }
 
 // Should only ever be called for deprecated gradients.
@@ -280,7 +281,7 @@ void CSSGradientValue::addStops(Gradient* gradient, RenderObject* renderer, Rend
             float lastOffset = stops[stops.size() - 1].offset;
             if (lastOffset < maxExtent) {
                 float currOffset = lastOffset;
-                size_t srcStopOrdinal = 0;
+                size_t srcStopOrdinal = originalFirstStopIndex;
 
                 while (true) {
                     GradientStop newStop = stops[srcStopOrdinal];
@@ -289,7 +290,7 @@ void CSSGradientValue::addStops(Gradient* gradient, RenderObject* renderer, Rend
                     if (currOffset > maxExtent)
                         break;
                     if (srcStopOrdinal < originalNumStops - 1)
-                        currOffset += stops[originalFirstStopIndex + srcStopOrdinal + 1].offset - stops[originalFirstStopIndex + srcStopOrdinal].offset;
+                        currOffset += stops[srcStopOrdinal + 1].offset - stops[srcStopOrdinal].offset;
                     srcStopOrdinal = (srcStopOrdinal + 1) % originalNumStops;
                 }
             }
@@ -406,6 +407,21 @@ FloatPoint CSSGradientValue::computeEndPoint(CSSPrimitiveValue* first, CSSPrimit
     return result;
 }
 
+bool CSSGradientValue::isCacheable() const
+{
+    for (size_t i = 0; i < m_stops.size(); ++i) {
+        const CSSGradientColorStop& stop = m_stops[i];
+        if (!stop.m_position)
+            continue;
+
+        unsigned short unitType = stop.m_position->primitiveType();
+        if (unitType == CSSPrimitiveValue::CSS_EMS || unitType == CSSPrimitiveValue::CSS_EXS || unitType == CSSPrimitiveValue::CSS_REMS)
+            return false;
+    }
+    
+    return true;
+}
+
 String CSSLinearGradientValue::cssText() const
 {
     String result;
diff --git a/Source/WebCore/css/CSSGradientValue.h b/Source/WebCore/css/CSSGradientValue.h
index 0b5ca77..b19548e 100644
--- a/Source/WebCore/css/CSSGradientValue.h
+++ b/Source/WebCore/css/CSSGradientValue.h
@@ -46,7 +46,7 @@ struct CSSGradientColorStop {
 
 class CSSGradientValue : public CSSImageGeneratorValue {
 public:
-    virtual Image* image(RenderObject*, const IntSize&);
+    virtual PassRefPtr<Image> image(RenderObject*, const IntSize&);
 
     void setFirstX(PassRefPtr<CSSPrimitiveValue> val) { m_firstX = val; }
     void setFirstY(PassRefPtr<CSSPrimitiveValue> val) { m_firstY = val; }
@@ -81,6 +81,8 @@ protected:
 
     // Resolve points/radii to front end values.
     FloatPoint computeEndPoint(CSSPrimitiveValue*, CSSPrimitiveValue*, RenderStyle*, RenderStyle* rootStyle, const IntSize&);
+    
+    bool isCacheable() const;
 
     // Points. Some of these may be null for linear gradients.
     RefPtr<CSSPrimitiveValue> m_firstX;
diff --git a/Source/WebCore/css/CSSGrammar.y b/Source/WebCore/css/CSSGrammar.y
index a5fe795..03d25d9 100644
--- a/Source/WebCore/css/CSSGrammar.y
+++ b/Source/WebCore/css/CSSGrammar.y
@@ -69,8 +69,8 @@ using namespace HTMLNames;
 
     CSSRule* rule;
     CSSRuleList* ruleList;
-    CSSSelector* selector;
-    Vector<CSSSelector*>* selectorList;
+    CSSParserSelector* selector;
+    Vector<OwnPtr<CSSParserSelector> >* selectorList;
     CSSSelector::MarginBoxType marginBox;
     CSSSelector::Relation relation;
     MediaList* mediaList;
@@ -663,14 +663,14 @@ page_selector:
     IDENT {
         CSSParser* p = static_cast<CSSParser*>(parser);
         $$ = p->createFloatingSelector();
-        $$->m_tag = QualifiedName(nullAtom, $1, p->m_defaultNamespace);
+        $$->setTag(QualifiedName(nullAtom, $1, p->m_defaultNamespace));
         $$->setForPage();
     }
     | IDENT pseudo_page {
         CSSParser* p = static_cast<CSSParser*>(parser);
         $$ = $2;
         if ($$) {
-            $$->m_tag = QualifiedName(nullAtom, $1, p->m_defaultNamespace);
+            $$->setTag(QualifiedName(nullAtom, $1, p->m_defaultNamespace));
             $$->setForPage();
         }
     }
@@ -812,7 +812,6 @@ selector_list:
         if ($1) {
             CSSParser* p = static_cast<CSSParser*>(parser);
             $$ = p->reusableSelectorVector();
-            deleteAllValues(*$$);
             $$->shrink(0);
             $$->append(p->sinkFloatingSelector($1));
             p->updateLastSelectorLineAndPosition();
@@ -853,10 +852,10 @@ selector:
             $$ = 0;
         else if ($$) {
             CSSParser* p = static_cast<CSSParser*>(parser);
-            CSSSelector* end = $$;
+            CSSParserSelector* end = $$;
             while (end->tagHistory())
                 end = end->tagHistory();
-            end->m_relation = CSSSelector::Descendant;
+            end->setRelation(CSSSelector::Descendant);
             end->setTagHistory(p->sinkFloatingSelector($1));
             if (Document* doc = p->document())
                 doc->setUsesDescendantRules(true);
@@ -868,10 +867,10 @@ selector:
             $$ = 0;
         else if ($$) {
             CSSParser* p = static_cast<CSSParser*>(parser);
-            CSSSelector* end = $$;
+            CSSParserSelector* end = $$;
             while (end->tagHistory())
                 end = end->tagHistory();
-            end->m_relation = $2;
+            end->setRelation($2);
             end->setTagHistory(p->sinkFloatingSelector($1));
             if ($2 == CSSSelector::Child) {
                 if (Document* doc = p->document())
@@ -897,7 +896,7 @@ simple_selector:
     element_name {
         CSSParser* p = static_cast<CSSParser*>(parser);
         $$ = p->createFloatingSelector();
-        $$->m_tag = QualifiedName(nullAtom, $1, p->m_defaultNamespace);
+        $$->setTag(QualifiedName(nullAtom, $1, p->m_defaultNamespace));
     }
     | element_name specifier_list {
         $$ = $2;
@@ -914,10 +913,10 @@ simple_selector:
         CSSParser* p = static_cast<CSSParser*>(parser);
         $$ = p->createFloatingSelector();
         if (p->m_styleSheet)
-            $$->m_tag = QualifiedName(namespacePrefix, $2,
-                                      p->m_styleSheet->determineNamespace(namespacePrefix));
+            $$->setTag(QualifiedName(namespacePrefix, $2,
+                                      p->m_styleSheet->determineNamespace(namespacePrefix)));
         else // FIXME: Shouldn't this case be an error?
-            $$->m_tag = QualifiedName(nullAtom, $2, p->m_defaultNamespace);
+            $$->setTag(QualifiedName(nullAtom, $2, p->m_defaultNamespace));
     }
     | namespace_selector element_name specifier_list {
         $$ = $3;
@@ -956,8 +955,8 @@ specifier_list:
             $$ = 0;
         else if ($1) {
             CSSParser* p = static_cast<CSSParser*>(parser);
-            CSSSelector* end;
-            CSSSelector* history;
+            CSSParserSelector* end;
+            CSSParserSelector* history;
             // Ensure that unknown pseudo element always stays at the top of selector chain.
             if ($2->isUnknownPseudoElement()) {
                 end = $2;
@@ -969,7 +968,7 @@ specifier_list:
             $$ = end;
             while(end->tagHistory())
                 end = end->tagHistory();
-            end->m_relation = CSSSelector::SubSelector;
+            end->setRelation(CSSSelector::SubSelector);
             end->setTagHistory(p->sinkFloatingSelector(history));
         }
     }
@@ -982,10 +981,10 @@ specifier:
     IDSEL {
         CSSParser* p = static_cast<CSSParser*>(parser);
         $$ = p->createFloatingSelector();
-        $$->m_match = CSSSelector::Id;
+        $$->setMatch(CSSSelector::Id);
         if (!p->m_strict)
             $1.lower();
-        $$->m_value = $1;
+        $$->setValue($1);
     }
   | HEX {
         if ($1.characters[0] >= '0' && $1.characters[0] <= '9') {
@@ -993,10 +992,10 @@ specifier:
         } else {
             CSSParser* p = static_cast<CSSParser*>(parser);
             $$ = p->createFloatingSelector();
-            $$->m_match = CSSSelector::Id;
+            $$->setMatch(CSSSelector::Id);
             if (!p->m_strict)
                 $1.lower();
-            $$->m_value = $1;
+            $$->setValue($1);
         }
     }
   | class
@@ -1008,10 +1007,10 @@ class:
     '.' IDENT {
         CSSParser* p = static_cast<CSSParser*>(parser);
         $$ = p->createFloatingSelector();
-        $$->m_match = CSSSelector::Class;
+        $$->setMatch(CSSSelector::Class);
         if (!p->m_strict)
             $2.lower();
-        $$->m_value = $2;
+        $$->setValue($2);
     }
   ;
 
@@ -1030,13 +1029,13 @@ attrib:
     '[' maybe_space attr_name ']' {
         $$ = static_cast<CSSParser*>(parser)->createFloatingSelector();
         $$->setAttribute(QualifiedName(nullAtom, $3, nullAtom));
-        $$->m_match = CSSSelector::Set;
+        $$->setMatch(CSSSelector::Set);
     }
     | '[' maybe_space attr_name match maybe_space ident_or_string maybe_space ']' {
         $$ = static_cast<CSSParser*>(parser)->createFloatingSelector();
         $$->setAttribute(QualifiedName(nullAtom, $3, nullAtom));
-        $$->m_match = (CSSSelector::Match)$4;
-        $$->m_value = $6;
+        $$->setMatch((CSSSelector::Match)$4);
+        $$->setValue($6);
     }
     | '[' maybe_space namespace_selector attr_name ']' {
         AtomicString namespacePrefix = $3;
@@ -1044,7 +1043,7 @@ attrib:
         $$ = p->createFloatingSelector();
         $$->setAttribute(QualifiedName(namespacePrefix, $4,
                                    p->m_styleSheet->determineNamespace(namespacePrefix)));
-        $$->m_match = CSSSelector::Set;
+        $$->setMatch(CSSSelector::Set);
     }
     | '[' maybe_space namespace_selector attr_name match maybe_space ident_or_string maybe_space ']' {
         AtomicString namespacePrefix = $3;
@@ -1052,8 +1051,8 @@ attrib:
         $$ = p->createFloatingSelector();
         $$->setAttribute(QualifiedName(namespacePrefix, $4,
                                    p->m_styleSheet->determineNamespace(namespacePrefix)));
-        $$->m_match = (CSSSelector::Match)$5;
-        $$->m_value = $7;
+        $$->setMatch((CSSSelector::Match)$5);
+        $$->setValue($7);
     }
   ;
 
@@ -1086,9 +1085,9 @@ ident_or_string:
 pseudo_page:
     ':' IDENT {
         $$ = static_cast<CSSParser*>(parser)->createFloatingSelector();
-        $$->m_match = CSSSelector::PagePseudoClass;
+        $$->setMatch(CSSSelector::PagePseudoClass);
         $2.lower();
-        $$->m_value = $2;
+        $$->setValue($2);
         CSSSelector::PseudoType type = $$->pseudoType();
         if (type == CSSSelector::PseudoUnknown)
             $$ = 0;
@@ -1097,9 +1096,9 @@ pseudo_page:
 pseudo:
     ':' IDENT {
         $$ = static_cast<CSSParser*>(parser)->createFloatingSelector();
-        $$->m_match = CSSSelector::PseudoClass;
+        $$->setMatch(CSSSelector::PseudoClass);
         $2.lower();
-        $$->m_value = $2;
+        $$->setValue($2);
         CSSSelector::PseudoType type = $$->pseudoType();
         if (type == CSSSelector::PseudoUnknown)
             $$ = 0;
@@ -1131,9 +1130,9 @@ pseudo:
     }
     | ':' ':' IDENT {
         $$ = static_cast<CSSParser*>(parser)->createFloatingSelector();
-        $$->m_match = CSSSelector::PseudoElement;
+        $$->setMatch(CSSSelector::PseudoElement);
         $3.lower();
-        $$->m_value = $3;
+        $$->setValue($3);
         CSSSelector::PseudoType type = $$->pseudoType();
         if (type == CSSSelector::PseudoFirstLine) {
             CSSParser* p = static_cast<CSSParser*>(parser);
@@ -1150,9 +1149,9 @@ pseudo:
     | ':' FUNCTION maybe_space NTH maybe_space ')' {
         CSSParser *p = static_cast<CSSParser*>(parser);
         $$ = p->createFloatingSelector();
-        $$->m_match = CSSSelector::PseudoClass;
+        $$->setMatch(CSSSelector::PseudoClass);
         $$->setArgument($4);
-        $$->m_value = $2;
+        $$->setValue($2);
         CSSSelector::PseudoType type = $$->pseudoType();
         if (type == CSSSelector::PseudoUnknown)
             $$ = 0;
@@ -1168,9 +1167,9 @@ pseudo:
     | ':' FUNCTION maybe_space maybe_unary_operator INTEGER maybe_space ')' {
         CSSParser *p = static_cast<CSSParser*>(parser);
         $$ = p->createFloatingSelector();
-        $$->m_match = CSSSelector::PseudoClass;
+        $$->setMatch(CSSSelector::PseudoClass);
         $$->setArgument(String::number($4 * $5));
-        $$->m_value = $2;
+        $$->setValue($2);
         CSSSelector::PseudoType type = $$->pseudoType();
         if (type == CSSSelector::PseudoUnknown)
             $$ = 0;
@@ -1186,10 +1185,10 @@ pseudo:
     | ':' FUNCTION maybe_space IDENT maybe_space ')' {
         CSSParser *p = static_cast<CSSParser*>(parser);
         $$ = p->createFloatingSelector();
-        $$->m_match = CSSSelector::PseudoClass;
+        $$->setMatch(CSSSelector::PseudoClass);
         $$->setArgument($4);
         $2.lower();
-        $$->m_value = $2;
+        $$->setValue($2);
         CSSSelector::PseudoType type = $$->pseudoType();
         if (type == CSSSelector::PseudoUnknown)
             $$ = 0;
@@ -1211,10 +1210,10 @@ pseudo:
         else {
             CSSParser* p = static_cast<CSSParser*>(parser);
             $$ = p->createFloatingSelector();
-            $$->m_match = CSSSelector::PseudoClass;
-            $$->setSimpleSelector(p->sinkFloatingSelector($4));
+            $$->setMatch(CSSSelector::PseudoClass);
+            $$->setSimpleSelector(p->sinkFloatingSelector($4)->releaseSelector());
             $2.lower();
-            $$->m_value = $2;
+            $$->setValue($2);
         }
     }
   ;
diff --git a/Source/WebCore/css/CSSImageGeneratorValue.h b/Source/WebCore/css/CSSImageGeneratorValue.h
index c053bfe..f5c17f5 100644
--- a/Source/WebCore/css/CSSImageGeneratorValue.h
+++ b/Source/WebCore/css/CSSImageGeneratorValue.h
@@ -44,7 +44,7 @@ public:
 
     void addClient(RenderObject*, const IntSize&);
     void removeClient(RenderObject*);
-    virtual Image* image(RenderObject*, const IntSize&) = 0;
+    virtual PassRefPtr<Image> image(RenderObject*, const IntSize&) = 0;
 
     StyleGeneratedImage* generatedImage();
     
diff --git a/Source/WebCore/css/CSSImageValue.cpp b/Source/WebCore/css/CSSImageValue.cpp
index a9038b9..6896596 100644
--- a/Source/WebCore/css/CSSImageValue.cpp
+++ b/Source/WebCore/css/CSSImageValue.cpp
@@ -67,6 +67,10 @@ StyleCachedImage* CSSImageValue::cachedImage(CachedResourceLoader* loader)
 StyleCachedImage* CSSImageValue::cachedImage(CachedResourceLoader* loader, const String& url)
 {
     ASSERT(loader);
+    if (!loader) {
+        // FIXME: Remove when http://webkit.org/b/53045 is fixed.
+        CRASH();
+    }
 
     if (!m_accessedImage) {
         m_accessedImage = true;
diff --git a/Source/WebCore/css/CSSMediaRule.cpp b/Source/WebCore/css/CSSMediaRule.cpp
index 6348762..46dc780 100644
--- a/Source/WebCore/css/CSSMediaRule.cpp
+++ b/Source/WebCore/css/CSSMediaRule.cpp
@@ -88,8 +88,8 @@ unsigned CSSMediaRule::insertRule(const String& rule, unsigned index, ExceptionC
     newRule->setParent(this);
     unsigned returnedIndex = m_lstCSSRules->insertRule(newRule.get(), index);
 
-    // stylesheet() can only return 0 for computed style declarations.
-    stylesheet()->styleSheetChanged();
+    if (stylesheet())
+        stylesheet()->styleSheetChanged();
 
     return returnedIndex;
 }
@@ -105,8 +105,8 @@ void CSSMediaRule::deleteRule(unsigned index, ExceptionCode& ec)
 
     m_lstCSSRules->deleteRule(index);
 
-    // stylesheet() can only return 0 for computed style declarations.
-    stylesheet()->styleSheetChanged();
+    if (stylesheet())
+        stylesheet()->styleSheetChanged();
 }
 
 String CSSMediaRule::cssText() const
diff --git a/Source/WebCore/css/CSSPageRule.cpp b/Source/WebCore/css/CSSPageRule.cpp
index c85c1aa..c3dbcaa 100644
--- a/Source/WebCore/css/CSSPageRule.cpp
+++ b/Source/WebCore/css/CSSPageRule.cpp
@@ -27,12 +27,9 @@
 
 namespace WebCore {
 
-CSSPageRule::CSSPageRule(CSSStyleSheet* parent, CSSSelector* selector, int sourceLine)
+CSSPageRule::CSSPageRule(CSSStyleSheet* parent, int sourceLine)
     : CSSStyleRule(parent, sourceLine)
 {
-    Vector<CSSSelector*> selectors;
-    selectors.append(selector);
-    adoptSelectorVector(selectors);
 }
 
 CSSPageRule::~CSSPageRule()
diff --git a/Source/WebCore/css/CSSPageRule.h b/Source/WebCore/css/CSSPageRule.h
index bdfb751..9c1c41f 100644
--- a/Source/WebCore/css/CSSPageRule.h
+++ b/Source/WebCore/css/CSSPageRule.h
@@ -34,9 +34,9 @@ class CSSSelectorList;
 
 class CSSPageRule : public CSSStyleRule {
 public:
-    static PassRefPtr<CSSPageRule> create(CSSStyleSheet* parent, CSSSelector* selector, int sourceLine)
+    static PassRefPtr<CSSPageRule> create(CSSStyleSheet* parent, int sourceLine)
     {
-        return adoptRef(new CSSPageRule(parent, selector, sourceLine));
+        return adoptRef(new CSSPageRule(parent, sourceLine));
     }
 
     virtual ~CSSPageRule();
@@ -44,7 +44,7 @@ public:
     virtual String selectorText() const;
 
 private:
-    CSSPageRule(CSSStyleSheet* parent, CSSSelector* selector, int sourceLine);
+    CSSPageRule(CSSStyleSheet* parent, int sourceLine);
 
     virtual bool isPageRule() { return true; }
 
diff --git a/Source/WebCore/css/CSSParser.cpp b/Source/WebCore/css/CSSParser.cpp
index 9142e67..55175a2 100644
--- a/Source/WebCore/css/CSSParser.cpp
+++ b/Source/WebCore/css/CSSParser.cpp
@@ -62,8 +62,10 @@
 #include "HashTools.h"
 #include "MediaList.h"
 #include "MediaQueryExp.h"
+#include "Page.h"
 #include "Pair.h"
 #include "Rect.h"
+#include "RenderTheme.h"
 #include "ShadowValue.h"
 #include "WebKitCSSKeyframeRule.h"
 #include "WebKitCSSKeyframesRule.h"
@@ -129,13 +131,6 @@ static bool hasPrefix(const char* string, unsigned length, const char* prefix)
     return false;
 }
 
-static int clampToSignedInteger(double d)
-{
-    const double minIntAsDouble = std::numeric_limits<int>::min();
-    const double maxIntAsDouble = std::numeric_limits<int>::max();
-    return static_cast<int>(max(minIntAsDouble, min(d, maxIntAsDouble)));
-}
-
 CSSParser::CSSParser(bool strictParsing)
     : m_strict(strictParsing)
     , m_important(false)
@@ -183,7 +178,6 @@ CSSParser::~CSSParser()
     fastDeleteAllValues(m_floatingSelectors);
     deleteAllValues(m_floatingValueLists);
     deleteAllValues(m_floatingFunctions);
-    deleteAllValues(m_reusableSelectorVector);
 }
 
 void CSSParserString::lower()
@@ -330,11 +324,14 @@ bool CSSParser::parseColor(RGBA32& color, const String& string, bool strict)
         return false;
 
     CSSValue* value = parser.m_parsedProperties[0]->value();
-    if (value->cssValueType() == CSSValue::CSS_PRIMITIVE_VALUE) {
-        CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
-        color = primitiveValue->getRGBA32Value();
-    }
+    if (value->cssValueType() != CSSValue::CSS_PRIMITIVE_VALUE)
+        return false;
+
+    CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+    if (primitiveValue->primitiveType() != CSSPrimitiveValue::CSS_RGBCOLOR)
+        return false;
 
+    color = primitiveValue->getRGBA32Value();
     return true;
 }
 
@@ -356,6 +353,22 @@ bool CSSParser::parseColor(CSSMutableStyleDeclaration* declaration, const String
     return (m_numParsedProperties && m_parsedProperties[0]->m_id == CSSPropertyColor);
 }
 
+bool CSSParser::parseSystemColor(RGBA32& color, const String& string, Document* document)
+{
+    if (!document || !document->page())
+        return false;
+
+    CSSParserString cssColor;
+    cssColor.characters = const_cast<UChar*>(string.characters());
+    cssColor.length = string.length();
+    int id = cssValueKeywordID(cssColor);
+    if (id <= 0)
+        return false;
+
+    color = document->page()->theme()->systemColor(id).rgb();
+    return true;
+}
+
 void CSSParser::parseSelector(const String& string, Document* doc, CSSSelectorList& selectorList)
 {
 #ifdef ANDROID_INSTRUMENT
@@ -1675,14 +1688,14 @@ bool CSSParser::parseValue(int propId, bool important)
         // FIXME: Add CSSPropertyBackgroundSize to the shorthand.
         const int properties[] = { CSSPropertyBackgroundImage, CSSPropertyBackgroundRepeat,
                                    CSSPropertyBackgroundAttachment, CSSPropertyBackgroundPosition, CSSPropertyBackgroundOrigin,
-                                   CSSPropertyBackgroundColor };
-        return parseFillShorthand(propId, properties, 6, important);
+                                   CSSPropertyBackgroundClip, CSSPropertyBackgroundColor };
+        return parseFillShorthand(propId, properties, 7, important);
     }
     case CSSPropertyWebkitMask: {
         const int properties[] = { CSSPropertyWebkitMaskImage, CSSPropertyWebkitMaskRepeat,
                                    CSSPropertyWebkitMaskAttachment, CSSPropertyWebkitMaskPosition,
-                                   CSSPropertyWebkitMaskOrigin };
-        return parseFillShorthand(propId, properties, 5, important);
+                                   CSSPropertyWebkitMaskOrigin, CSSPropertyWebkitMaskClip };
+        return parseFillShorthand(propId, properties, 6, important);
     }
     case CSSPropertyBorder:
         // [ 'border-width' || 'border-style' || <color> ] | inherit
@@ -1988,6 +2001,7 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
     RefPtr<CSSValue> clipValue;
     RefPtr<CSSValue> positionYValue;
     RefPtr<CSSValue> repeatYValue;
+    bool foundClip = false;
     int i;
 
     while (m_valueList->current()) {
@@ -2010,7 +2024,7 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
                     if ((properties[i] == CSSPropertyBackgroundOrigin || properties[i] == CSSPropertyWebkitMaskOrigin) && !parsedProperty[i]) {
                         // If background-origin wasn't present, then reset background-clip also.
                         addFillValue(clipValue, CSSInitialValue::createImplicit());
-                    }
+                    }                    
                 }
                 parsedProperty[i] = false;
             }
@@ -2039,6 +2053,11 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
                         else
                             addFillValue(clipValue, CSSInitialValue::createImplicit()); // Some value was used for origin that is not supported by clip. Just reset clip instead.
                     }
+                    if (properties[i] == CSSPropertyBackgroundClip || properties[i] == CSSPropertyWebkitMaskClip) {
+                        // Update clipValue
+                        addFillValue(clipValue, val1.release());
+                        foundClip = true;
+                    }
                 }
             }
         }
@@ -2082,13 +2101,16 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
             addProperty(CSSPropertyWebkitMaskRepeatX, values[i].release(), important);
             // it's OK to call repeatYValue.release() since we only see CSSPropertyBackgroundPosition once
             addProperty(CSSPropertyWebkitMaskRepeatY, repeatYValue.release(), important);
-        } else
+        } else if ((properties[i] == CSSPropertyBackgroundClip || properties[i] == CSSPropertyWebkitMaskClip) && !foundClip)
+            // Value is already set while updating origin
+            continue;
+        else
             addProperty(properties[i], values[i].release(), important);
 
         // Add in clip values when we hit the corresponding origin property.
-        if (properties[i] == CSSPropertyBackgroundOrigin)
+        if (properties[i] == CSSPropertyBackgroundOrigin && !foundClip)
             addProperty(CSSPropertyBackgroundClip, clipValue.release(), important);
-        else  if (properties[i] == CSSPropertyWebkitMaskOrigin)
+        else if (properties[i] == CSSPropertyWebkitMaskOrigin && !foundClip)
             addProperty(CSSPropertyWebkitMaskClip, clipValue.release(), important);
     }
 
@@ -4722,7 +4744,7 @@ bool CSSParser::parseCounter(int propId, int defaultValue, bool important)
             case VAL: {
                 int i = defaultValue;
                 if (val && val->unit == CSSPrimitiveValue::CSS_NUMBER) {
-                    i = clampToSignedInteger(val->fValue);
+                    i = clampToInteger(val->fValue);
                     m_valueList->next();
                 }
 
@@ -5409,6 +5431,10 @@ PassRefPtr<CSSValueList> CSSParser::parseTransform()
                 // 1st param of translateZ() cannot be a percentage
                 if (!validUnit(a, FLength, true))
                     return 0;
+            } else if (info.type() == WebKitCSSTransformValue::PerspectiveTransformOperation && argNumber == 0) {
+                // 1st param of perspective() must be a non-negative number (deprecated) or length.
+                if (!validUnit(a, FNumber | FLength | FNonNeg, true))
+                    return 0;
             } else if (!validUnit(a, unit, true))
                 return 0;
 
@@ -5789,20 +5815,20 @@ void CSSParser::countLines()
     }
 }
 
-CSSSelector* CSSParser::createFloatingSelector()
+CSSParserSelector* CSSParser::createFloatingSelector()
 {
-    CSSSelector* selector = fastNew<CSSSelector>();
+    CSSParserSelector* selector = new CSSParserSelector;
     m_floatingSelectors.add(selector);
     return selector;
 }
 
-CSSSelector* CSSParser::sinkFloatingSelector(CSSSelector* selector)
+PassOwnPtr<CSSParserSelector> CSSParser::sinkFloatingSelector(CSSParserSelector* selector)
 {
     if (selector) {
         ASSERT(m_floatingSelectors.contains(selector));
         m_floatingSelectors.remove(selector);
     }
-    return selector;
+    return adoptPtr(selector);
 }
 
 CSSParserValueList* CSSParser::createFloatingValueList()
@@ -5944,7 +5970,7 @@ WebKitCSSKeyframesRule* CSSParser::createKeyframesRule()
     return rulePtr;
 }
 
-CSSRule* CSSParser::createStyleRule(Vector<CSSSelector*>* selectors)
+CSSRule* CSSParser::createStyleRule(Vector<OwnPtr<CSSParserSelector> >* selectors)
 {
     CSSStyleRule* result = 0;
     markRuleBodyEnd();
@@ -6006,21 +6032,21 @@ void CSSParser::addNamespace(const AtomicString& prefix, const AtomicString& uri
     m_styleSheet->addNamespace(this, prefix, uri);
 }
 
-void CSSParser::updateSpecifiersWithElementName(const AtomicString& namespacePrefix, const AtomicString& elementName, CSSSelector* specifiers)
+void CSSParser::updateSpecifiersWithElementName(const AtomicString& namespacePrefix, const AtomicString& elementName, CSSParserSelector* specifiers)
 {
     AtomicString determinedNamespace = namespacePrefix != nullAtom && m_styleSheet ? m_styleSheet->determineNamespace(namespacePrefix) : m_defaultNamespace;
     QualifiedName tag = QualifiedName(namespacePrefix, elementName, determinedNamespace);
     if (!specifiers->isUnknownPseudoElement()) {
-        specifiers->m_tag = tag;
+        specifiers->setTag(tag);
         return;
     }
 
     if (Document* doc = document())
         doc->setUsesDescendantRules(true);
 
-    specifiers->m_relation = CSSSelector::ShadowDescendant;
-    if (CSSSelector* history = specifiers->tagHistory()) {
-        history->m_tag = tag;
+    specifiers->setRelation(CSSSelector::ShadowDescendant);
+    if (CSSParserSelector* history = specifiers->tagHistory()) {
+        history->setTag(tag);
         return;
     }
 
@@ -6029,19 +6055,22 @@ void CSSParser::updateSpecifiersWithElementName(const AtomicString& namespacePre
     if (elementName == starAtom && m_defaultNamespace == starAtom)
         return;
 
-    CSSSelector* elementNameSelector = fastNew<CSSSelector>();
-    elementNameSelector->m_tag = tag;
+    CSSParserSelector* elementNameSelector = new CSSParserSelector;
+    elementNameSelector->setTag(tag);
     specifiers->setTagHistory(elementNameSelector);
 }
 
 
-CSSRule* CSSParser::createPageRule(CSSSelector* pageSelector)
+CSSRule* CSSParser::createPageRule(PassOwnPtr<CSSParserSelector> pageSelector)
 {
     // FIXME: Margin at-rules are ignored.
     m_allowImportRules = m_allowNamespaceDeclarations = false;
     CSSPageRule* pageRule = 0;
     if (pageSelector) {
-        RefPtr<CSSPageRule> rule = CSSPageRule::create(m_styleSheet, pageSelector, m_lastSelectorLineNumber);
+        RefPtr<CSSPageRule> rule = CSSPageRule::create(m_styleSheet, m_lastSelectorLineNumber);
+        Vector<OwnPtr<CSSParserSelector> > selectorVector;
+        selectorVector.append(pageSelector);
+        rule->adoptSelectorVector(selectorVector);
         rule->setDeclaration(CSSMutableStyleDeclaration::create(rule.get(), m_parsedProperties, m_numParsedProperties));
         pageRule = rule.get();
         m_parsedStyleObjects.append(rule.release());
diff --git a/Source/WebCore/css/CSSParser.h b/Source/WebCore/css/CSSParser.h
index d326812..6ccfbe2 100644
--- a/Source/WebCore/css/CSSParser.h
+++ b/Source/WebCore/css/CSSParser.h
@@ -64,6 +64,7 @@ namespace WebCore {
         PassRefPtr<CSSRule> parseKeyframeRule(CSSStyleSheet*, const String&);
         bool parseValue(CSSMutableStyleDeclaration*, int propId, const String&, bool important);
         static bool parseColor(RGBA32& color, const String&, bool strict = false);
+        static bool parseSystemColor(RGBA32& color, const String&, Document*);
         bool parseColor(CSSMutableStyleDeclaration*, const String&);
         bool parseDeclaration(CSSMutableStyleDeclaration*, const String&, RefPtr<CSSStyleSourceData>* styleSourceData = 0);
         bool parseMediaQuery(MediaList*, const String&);
@@ -170,8 +171,8 @@ namespace WebCore {
 
         int yyparse();
 
-        CSSSelector* createFloatingSelector();
-        CSSSelector* sinkFloatingSelector(CSSSelector*);
+        CSSParserSelector* createFloatingSelector();
+        PassOwnPtr<CSSParserSelector> sinkFloatingSelector(CSSParserSelector*);
 
         CSSParserValueList* createFloatingValueList();
         CSSParserValueList* sinkFloatingValueList(CSSParserValueList*);
@@ -188,9 +189,9 @@ namespace WebCore {
         WebKitCSSKeyframesRule* createKeyframesRule();
         CSSRule* createMediaRule(MediaList*, CSSRuleList*);
         CSSRuleList* createRuleList();
-        CSSRule* createStyleRule(Vector<CSSSelector*>* selectors);
+        CSSRule* createStyleRule(Vector<OwnPtr<CSSParserSelector> >* selectors);
         CSSRule* createFontFaceRule();
-        CSSRule* createPageRule(CSSSelector* pageSelector);
+        CSSRule* createPageRule(PassOwnPtr<CSSParserSelector> pageSelector);
         CSSRule* createMarginAtRule(CSSSelector::MarginBoxType marginBox);
         void startDeclarationsForMarginBox();
         void endDeclarationsForMarginBox();
@@ -204,11 +205,11 @@ namespace WebCore {
         PassOwnPtr<MediaQuery> sinkFloatingMediaQuery(MediaQuery*);
 
         void addNamespace(const AtomicString& prefix, const AtomicString& uri);
-        void updateSpecifiersWithElementName(const AtomicString& namespacePrefix, const AtomicString& elementName, CSSSelector*);
+        void updateSpecifiersWithElementName(const AtomicString& namespacePrefix, const AtomicString& elementName, CSSParserSelector*);
 
         void invalidBlockHit();
 
-        Vector<CSSSelector*>* reusableSelectorVector() { return &m_reusableSelectorVector; }
+        Vector<OwnPtr<CSSParserSelector> >* reusableSelectorVector() { return &m_reusableSelectorVector; }
 
         void updateLastSelectorLineAndPosition();
 
@@ -302,7 +303,7 @@ namespace WebCore {
 
         Vector<RefPtr<StyleBase> > m_parsedStyleObjects;
         Vector<RefPtr<CSSRuleList> > m_parsedRuleLists;
-        HashSet<CSSSelector*> m_floatingSelectors;
+        HashSet<CSSParserSelector*> m_floatingSelectors;
         HashSet<CSSParserValueList*> m_floatingValueLists;
         HashSet<CSSParserFunction*> m_floatingFunctions;
 
@@ -310,7 +311,7 @@ namespace WebCore {
         OwnPtr<MediaQueryExp> m_floatingMediaQueryExp;
         OwnPtr<Vector<OwnPtr<MediaQueryExp> > > m_floatingMediaQueryExpList;
 
-        Vector<CSSSelector*> m_reusableSelectorVector;
+        Vector<OwnPtr<CSSParserSelector> > m_reusableSelectorVector;
 
         // defines units allowed for a certain property, used in parseUnit
         enum Units {
diff --git a/Source/WebCore/css/CSSParserValues.cpp b/Source/WebCore/css/CSSParserValues.cpp
index 06651f1..dc0e82b 100644
--- a/Source/WebCore/css/CSSParserValues.cpp
+++ b/Source/WebCore/css/CSSParserValues.cpp
@@ -20,11 +20,15 @@
 
 #include "config.h"
 #include "CSSParserValues.h"
+
 #include "CSSPrimitiveValue.h"
 #include "CSSFunctionValue.h"
 #include "CSSQuirkPrimitiveValue.h"
+#include "CSSSelector.h"
 
 namespace WebCore {
+        
+using namespace WTF;
 
 CSSParserValueList::~CSSParserValueList()
 {
@@ -70,6 +74,27 @@ PassRefPtr<CSSValue> CSSParserValue::createCSSValue()
         parsedValue = CSSQuirkPrimitiveValue::create(fValue, CSSPrimitiveValue::CSS_EMS);
     return parsedValue;
 }
+    
+CSSParserSelector::CSSParserSelector()
+    : m_selector(adoptPtr(fastNew<CSSSelector>()))
+{
+}
+
+CSSParserSelector::~CSSParserSelector()
+{
+    if (!m_tagHistory)
+        return;
+    Vector<CSSParserSelector*, 16> toDelete;
+    CSSParserSelector* selector = m_tagHistory.leakPtr();
+    while (true) {
+        toDelete.append(selector);
+        CSSParserSelector* next = selector->m_tagHistory.leakPtr();
+        if (!next)
+            break;
+        selector = next;
+    }
+    deleteAllValues(toDelete);
+}
 
 }
 
diff --git a/Source/WebCore/css/CSSParserValues.h b/Source/WebCore/css/CSSParserValues.h
index 996e783..d084091 100644
--- a/Source/WebCore/css/CSSParserValues.h
+++ b/Source/WebCore/css/CSSParserValues.h
@@ -21,11 +21,13 @@
 #ifndef CSSParserValues_h
 #define CSSParserValues_h
 
+#include "CSSSelector.h"
 #include <wtf/text/AtomicString.h>
 
 namespace WebCore {
 
 class CSSValue;
+class QualifiedName;
 
 struct CSSParserString {
     UChar* characters;
@@ -91,6 +93,35 @@ public:
     OwnPtr<CSSParserValueList> args;
 };
 
+class CSSParserSelector {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    CSSParserSelector();
+    ~CSSParserSelector();
+
+    PassOwnPtr<CSSSelector> releaseSelector() { return m_selector.release(); }
+    
+    void setTag(const QualifiedName& value) { m_selector->setTag(value); }
+    void setValue(const AtomicString& value) { m_selector->setValue(value); }
+    void setAttribute(const QualifiedName& value) { m_selector->setAttribute(value); }
+    void setArgument(const AtomicString& value) { m_selector->setArgument(value); }
+    void setSimpleSelector(PassOwnPtr<CSSSelector> value) { m_selector->setSimpleSelector(value); }
+    void setMatch(CSSSelector::Match value) { m_selector->m_match = value; }
+    void setRelation(CSSSelector::Relation value) { m_selector->m_relation = value; }
+    void setForPage() { m_selector->setForPage(); }
+    
+    CSSSelector::PseudoType pseudoType() const { return m_selector->pseudoType(); }
+    bool isUnknownPseudoElement() const { return m_selector->isUnknownPseudoElement(); }
+    bool isSimple() const { return !m_tagHistory && m_selector->isSimple(); }
+
+    CSSParserSelector* tagHistory() const { return m_tagHistory.get(); }
+    void setTagHistory(PassOwnPtr<CSSParserSelector> selector) { m_tagHistory = selector; }
+
+private:
+    OwnPtr<CSSSelector> m_selector;
+    OwnPtr<CSSParserSelector> m_tagHistory;
+};
+
 }
 
 #endif
diff --git a/Source/WebCore/css/CSSPrimitiveValue.cpp b/Source/WebCore/css/CSSPrimitiveValue.cpp
index ce1b87b..6d930bd 100644
--- a/Source/WebCore/css/CSSPrimitiveValue.cpp
+++ b/Source/WebCore/css/CSSPrimitiveValue.cpp
@@ -127,10 +127,20 @@ PassRefPtr<CSSPrimitiveValue> CSSPrimitiveValue::createColor(unsigned rgbValue)
     // These are the empty and deleted values of the hash table.
     if (rgbValue == Color::transparent) {
         static CSSPrimitiveValue* colorTransparent = createUncachedColor(Color::transparent).releaseRef();
+#if CPU(ARM) && OS(LINUX)
+         // A workaround for gcc bug on ARM.
+        if (!colorTransparent)
+            return 0;
+#endif
         return colorTransparent;
     }
     if (rgbValue == Color::white) {
         static CSSPrimitiveValue* colorWhite = createUncachedColor(Color::white).releaseRef();
+#if CPU(ARM) && OS(LINUX)
+        // A workaround for gcc bug on ARM.
+        if (!colorWhite)
+            return 0;
+#endif
         return colorWhite;
     }
     RefPtr<CSSPrimitiveValue> primitiveValue = colorValueCache->get(rgbValue);
@@ -400,7 +410,7 @@ double CSSPrimitiveValue::computeLengthDouble(RenderStyle* style, RenderStyle* r
             // We really need to compute EX using fontMetrics for the original specifiedSize and not use
             // our actual constructed rendering font.
             applyZoomMultiplier = false;
-            factor = style->font().xHeight();
+            factor = style->fontMetrics().xHeight();
             break;
         case CSS_REMS:
             applyZoomMultiplier = false;
@@ -914,81 +924,6 @@ String CSSPrimitiveValue::cssText() const
     return text;
 }
 
-CSSParserValue CSSPrimitiveValue::parserValue() const
-{
-    // We only have to handle a subset of types.
-    CSSParserValue value;
-    value.id = 0;
-    value.isInt = false;
-    value.unit = CSSPrimitiveValue::CSS_IDENT;
-    switch (m_type) {
-        case CSS_NUMBER:
-        case CSS_PERCENTAGE:
-        case CSS_EMS:
-        case CSS_EXS:
-        case CSS_REMS:
-        case CSS_PX:
-        case CSS_CM:
-        case CSS_MM:
-        case CSS_IN:
-        case CSS_PT:
-        case CSS_PC:
-        case CSS_DEG:
-        case CSS_RAD:
-        case CSS_GRAD:
-        case CSS_MS:
-        case CSS_S:
-        case CSS_HZ:
-        case CSS_KHZ:
-        case CSS_DIMENSION:
-        case CSS_TURN:
-            value.fValue = m_value.num;
-            value.unit = m_type;
-            break;
-        case CSS_STRING:
-        case CSS_URI:
-        case CSS_PARSER_HEXCOLOR:
-            value.string.characters = const_cast<UChar*>(m_value.string->characters());
-            value.string.length = m_value.string->length();
-            value.unit = m_type;
-            break;
-        case CSS_IDENT: {
-            value.id = m_value.ident;
-            const AtomicString& name = valueOrPropertyName(m_value.ident);
-            value.string.characters = const_cast<UChar*>(name.characters());
-            value.string.length = name.length();
-            break;
-        }
-        case CSS_PARSER_OPERATOR:
-            value.iValue = m_value.ident;
-            value.unit = CSSParserValue::Operator;
-            break;
-        case CSS_PARSER_INTEGER:
-            value.fValue = m_value.num;
-            value.unit = CSSPrimitiveValue::CSS_NUMBER;
-            value.isInt = true;
-            break;
-        case CSS_PARSER_IDENTIFIER:
-            value.string.characters = const_cast<UChar*>(m_value.string->characters());
-            value.string.length = m_value.string->length();
-            value.unit = CSSPrimitiveValue::CSS_IDENT;
-            break;
-        case CSS_UNKNOWN:
-        case CSS_ATTR:
-        case CSS_COUNTER:
-        case CSS_RECT:
-        case CSS_RGBCOLOR:
-        case CSS_PAIR:
-#if ENABLE(DASHBOARD_SUPPORT)
-        case CSS_DASHBOARD_REGION:
-#endif
-            ASSERT_NOT_REACHED();
-            break;
-    }
-    
-    return value;
-}
-
 void CSSPrimitiveValue::addSubresourceStyleURLs(ListHashSet<KURL>& urls, const CSSStyleSheet* styleSheet)
 {
     if (m_type == CSS_URI)
diff --git a/Source/WebCore/css/CSSPrimitiveValue.h b/Source/WebCore/css/CSSPrimitiveValue.h
index e12cd4c..c9892e8 100644
--- a/Source/WebCore/css/CSSPrimitiveValue.h
+++ b/Source/WebCore/css/CSSPrimitiveValue.h
@@ -185,8 +185,6 @@ public:
 
     virtual bool isQuirkValue() { return false; }
 
-    virtual CSSParserValue parserValue() const;
-
     virtual void addSubresourceStyleURLs(ListHashSet<KURL>&, const CSSStyleSheet*);
 
 protected:
diff --git a/Source/WebCore/css/CSSRuleList.cpp b/Source/WebCore/css/CSSRuleList.cpp
index 0a312af..da65632 100644
--- a/Source/WebCore/css/CSSRuleList.cpp
+++ b/Source/WebCore/css/CSSRuleList.cpp
@@ -22,8 +22,10 @@
 #include "config.h"
 #include "CSSRuleList.h"
 
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSRule.h"
 #include "StyleList.h"
+#include "WebKitCSSKeyframeRule.h"
 
 namespace WebCore {
 
@@ -76,6 +78,11 @@ void CSSRuleList::deleteRule(unsigned index)
         return;
     }
 
+    if (m_lstCSSRules[index]->isKeyframeRule()) {
+        if (CSSMutableStyleDeclaration* style = static_cast<WebKitCSSKeyframeRule*>(m_lstCSSRules[index].get())->style())
+            style->setParent(0);
+    }
+
     m_lstCSSRules[index]->setParent(0);
     m_lstCSSRules.remove(index);
 }
diff --git a/Source/WebCore/css/CSSSelector.cpp b/Source/WebCore/css/CSSSelector.cpp
index ca3814a..c804697 100644
--- a/Source/WebCore/css/CSSSelector.cpp
+++ b/Source/WebCore/css/CSSSelector.cpp
@@ -36,38 +36,15 @@
 namespace WebCore {
 
 using namespace HTMLNames;
-
-class CSSSelectorBag {
-    WTF_MAKE_NONCOPYABLE(CSSSelectorBag);
-public:
-    CSSSelectorBag() { }
-    ~CSSSelectorBag()
-    {
-        ASSERT(isEmpty());
-    }
-
-    bool isEmpty() const
-    {
-        return m_stack.isEmpty();
-    }
-
-    void add(PassOwnPtr<CSSSelector> selector)
-    {
-        if (selector)
-            m_stack.append(selector.leakPtr());
-    }
-
-    PassOwnPtr<CSSSelector> takeAny()
-    {
-        ASSERT(!isEmpty());
-        OwnPtr<CSSSelector> selector = adoptPtr(m_stack.last());
-        m_stack.removeLast();
-        return selector.release();
-    }
-
-private:
-    Vector<CSSSelector*, 16> m_stack;
-};
+    
+void CSSSelector::createRareData()
+{
+    if (m_hasRareData) 
+        return;
+    // Move the value to the rare data stucture.
+    m_data.m_rareData = new RareData(adoptRef(m_data.m_value));
+    m_hasRareData = true;
+}
 
 unsigned CSSSelector::specificity() const
 {
@@ -161,40 +138,6 @@ PseudoId CSSSelector::pseudoId(PseudoType type)
         return SEARCH_RESULTS_DECORATION;
     case PseudoSearchResultsButton:
         return SEARCH_RESULTS_BUTTON;
-    case PseudoMediaControlsPanel:
-        return MEDIA_CONTROLS_PANEL;
-    case PseudoMediaControlsMuteButton:
-        return MEDIA_CONTROLS_MUTE_BUTTON;
-    case PseudoMediaControlsPlayButton:
-        return MEDIA_CONTROLS_PLAY_BUTTON;
-    case PseudoMediaControlsTimelineContainer:
-        return MEDIA_CONTROLS_TIMELINE_CONTAINER;
-    case PseudoMediaControlsVolumeSliderContainer:
-        return MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER;
-    case PseudoMediaControlsCurrentTimeDisplay:
-        return MEDIA_CONTROLS_CURRENT_TIME_DISPLAY;
-    case PseudoMediaControlsTimeRemainingDisplay:
-        return MEDIA_CONTROLS_TIME_REMAINING_DISPLAY;
-    case PseudoMediaControlsTimeline:
-        return MEDIA_CONTROLS_TIMELINE;
-    case PseudoMediaControlsVolumeSlider:
-        return MEDIA_CONTROLS_VOLUME_SLIDER;
-    case PseudoMediaControlsVolumeSliderMuteButton:
-        return MEDIA_CONTROLS_VOLUME_SLIDER_MUTE_BUTTON;
-    case PseudoMediaControlsSeekBackButton:
-        return MEDIA_CONTROLS_SEEK_BACK_BUTTON;
-    case PseudoMediaControlsSeekForwardButton:
-        return MEDIA_CONTROLS_SEEK_FORWARD_BUTTON;
-    case PseudoMediaControlsRewindButton:
-        return MEDIA_CONTROLS_REWIND_BUTTON;
-    case PseudoMediaControlsReturnToRealtimeButton:
-        return MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON;
-    case PseudoMediaControlsToggleClosedCaptions:
-        return MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON;
-    case PseudoMediaControlsStatusDisplay:
-        return MEDIA_CONTROLS_STATUS_DISPLAY;
-    case PseudoMediaControlsFullscreenButton:
-        return MEDIA_CONTROLS_FULLSCREEN_BUTTON;
     case PseudoScrollbar:
         return SCROLLBAR;
     case PseudoScrollbarButton:
@@ -213,14 +156,6 @@ PseudoId CSSSelector::pseudoId(PseudoType type)
         return INNER_SPIN_BUTTON;
     case PseudoOuterSpinButton:
         return OUTER_SPIN_BUTTON;
-    case PseudoProgressBarValue:
-#if ENABLE(PROGRESS_TAG)
-        return PROGRESS_BAR_VALUE;
-#else
-        ASSERT_NOT_REACHED();
-        return NOPSEUDO;
-#endif
-
 #if ENABLE(METER_TAG)
     case PseudoMeterHorizontalBar:
         return METER_HORIZONTAL_BAR;
@@ -369,32 +304,11 @@ static HashMap<AtomicStringImpl*, CSSSelector::PseudoType>* nameToPseudoTypeMap(
     DEFINE_STATIC_LOCAL(AtomicString, lastOfType, ("last-of-type"));
     DEFINE_STATIC_LOCAL(AtomicString, link, ("link"));
     DEFINE_STATIC_LOCAL(AtomicString, lang, ("lang("));
-    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsPanel, ("-webkit-media-controls-panel"));
-    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsMuteButton, ("-webkit-media-controls-mute-button"));
-    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsPlayButton, ("-webkit-media-controls-play-button"));
-    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimeline, ("-webkit-media-controls-timeline"));
-    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsVolumeSlider, ("-webkit-media-controls-volume-slider"));
-    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsVolumeSliderMuteButton, ("-webkit-media-controls-volume-slider-mute-button"));
-    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsSeekBackButton, ("-webkit-media-controls-seek-back-button"));
-    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsSeekForwardButton, ("-webkit-media-controls-seek-forward-button"));
-    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsRewindButton, ("-webkit-media-controls-rewind-button"));
-    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsReturnToRealtimeButton, ("-webkit-media-controls-return-to-realtime-button"));
-    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsToggleClosedCaptionsButton, ("-webkit-media-controls-toggle-closed-captions-button"));
-    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsStatusDisplay, ("-webkit-media-controls-status-display"));
-    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsFullscreenButton, ("-webkit-media-controls-fullscreen-button"));
-    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimelineContainer, ("-webkit-media-controls-timeline-container"));
-    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsVolumeSliderContainer, ("-webkit-media-controls-volume-slider-container"));
-    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsCurrentTimeDisplay, ("-webkit-media-controls-current-time-display"));
-    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimeRemainingDisplay, ("-webkit-media-controls-time-remaining-display"));
     DEFINE_STATIC_LOCAL(AtomicString, notStr, ("not("));
     DEFINE_STATIC_LOCAL(AtomicString, onlyChild, ("only-child"));
     DEFINE_STATIC_LOCAL(AtomicString, onlyOfType, ("only-of-type"));
     DEFINE_STATIC_LOCAL(AtomicString, optional, ("optional"));
     DEFINE_STATIC_LOCAL(AtomicString, outerSpinButton, ("-webkit-outer-spin-button"));
-#if ENABLE(PROGRESS_TAG)
-    DEFINE_STATIC_LOCAL(AtomicString, progressBarValue, ("-webkit-progress-bar-value"));
-#endif
-
 #if ENABLE(METER_TAG)
     DEFINE_STATIC_LOCAL(AtomicString, meterHorizontalBar, ("-webkit-meter-horizontal-bar"));
     DEFINE_STATIC_LOCAL(AtomicString, meterHorizontalOptimumValue, ("-webkit-meter-horizontal-optimum-value"));
@@ -486,32 +400,12 @@ static HashMap<AtomicStringImpl*, CSSSelector::PseudoType>* nameToPseudoTypeMap(
         nameToPseudoType->set(innerSpinButton.impl(), CSSSelector::PseudoInnerSpinButton);
         nameToPseudoType->set(link.impl(), CSSSelector::PseudoLink);
         nameToPseudoType->set(lang.impl(), CSSSelector::PseudoLang);
-        nameToPseudoType->set(mediaControlsPanel.impl(), CSSSelector::PseudoMediaControlsPanel);
-        nameToPseudoType->set(mediaControlsMuteButton.impl(), CSSSelector::PseudoMediaControlsMuteButton);
-        nameToPseudoType->set(mediaControlsPlayButton.impl(), CSSSelector::PseudoMediaControlsPlayButton);
-        nameToPseudoType->set(mediaControlsCurrentTimeDisplay.impl(), CSSSelector::PseudoMediaControlsCurrentTimeDisplay);
-        nameToPseudoType->set(mediaControlsTimeRemainingDisplay.impl(), CSSSelector::PseudoMediaControlsTimeRemainingDisplay);
-        nameToPseudoType->set(mediaControlsTimeline.impl(), CSSSelector::PseudoMediaControlsTimeline);
-        nameToPseudoType->set(mediaControlsVolumeSlider.impl(), CSSSelector::PseudoMediaControlsVolumeSlider);
-        nameToPseudoType->set(mediaControlsVolumeSliderMuteButton.impl(), CSSSelector::PseudoMediaControlsVolumeSliderMuteButton);
-        nameToPseudoType->set(mediaControlsSeekBackButton.impl(), CSSSelector::PseudoMediaControlsSeekBackButton);
-        nameToPseudoType->set(mediaControlsSeekForwardButton.impl(), CSSSelector::PseudoMediaControlsSeekForwardButton);
-        nameToPseudoType->set(mediaControlsRewindButton.impl(), CSSSelector::PseudoMediaControlsRewindButton);
-        nameToPseudoType->set(mediaControlsReturnToRealtimeButton.impl(), CSSSelector::PseudoMediaControlsReturnToRealtimeButton);
-        nameToPseudoType->set(mediaControlsToggleClosedCaptionsButton.impl(), CSSSelector::PseudoMediaControlsToggleClosedCaptions);
-        nameToPseudoType->set(mediaControlsStatusDisplay.impl(), CSSSelector::PseudoMediaControlsStatusDisplay);
-        nameToPseudoType->set(mediaControlsFullscreenButton.impl(), CSSSelector::PseudoMediaControlsFullscreenButton);
-        nameToPseudoType->set(mediaControlsTimelineContainer.impl(), CSSSelector::PseudoMediaControlsTimelineContainer);
-        nameToPseudoType->set(mediaControlsVolumeSliderContainer.impl(), CSSSelector::PseudoMediaControlsVolumeSliderContainer);
         nameToPseudoType->set(notStr.impl(), CSSSelector::PseudoNot);
         nameToPseudoType->set(nthChild.impl(), CSSSelector::PseudoNthChild);
         nameToPseudoType->set(nthOfType.impl(), CSSSelector::PseudoNthOfType);
         nameToPseudoType->set(nthLastChild.impl(), CSSSelector::PseudoNthLastChild);
         nameToPseudoType->set(nthLastOfType.impl(), CSSSelector::PseudoNthLastOfType);
         nameToPseudoType->set(outerSpinButton.impl(), CSSSelector::PseudoOuterSpinButton);
-#if ENABLE(PROGRESS_TAG)
-        nameToPseudoType->set(progressBarValue.impl(), CSSSelector::PseudoProgressBarValue);
-#endif
 #if ENABLE(METER_TAG)
         nameToPseudoType->set(meterHorizontalBar.impl(), CSSSelector::PseudoMeterHorizontalBar);
         nameToPseudoType->set(meterHorizontalOptimumValue.impl(), CSSSelector::PseudoMeterHorizontalOptimum);
@@ -577,7 +471,7 @@ void CSSSelector::extractPseudoType() const
     if (m_match != PseudoClass && m_match != PseudoElement && m_match != PagePseudoClass)
         return;
 
-    m_pseudoType = parsePseudoType(m_value);
+    m_pseudoType = parsePseudoType(value());
 
     bool element = false; // pseudo-element
     bool compat = false; // single colon compatbility mode
@@ -596,23 +490,6 @@ void CSSSelector::extractPseudoType() const
     case PseudoInputSpeechButton:
 #endif
     case PseudoInnerSpinButton:
-    case PseudoMediaControlsPanel:
-    case PseudoMediaControlsMuteButton:
-    case PseudoMediaControlsPlayButton:
-    case PseudoMediaControlsCurrentTimeDisplay:
-    case PseudoMediaControlsTimeRemainingDisplay:
-    case PseudoMediaControlsTimeline:
-    case PseudoMediaControlsVolumeSlider:
-    case PseudoMediaControlsVolumeSliderMuteButton:
-    case PseudoMediaControlsSeekBackButton:
-    case PseudoMediaControlsSeekForwardButton:
-    case PseudoMediaControlsRewindButton:
-    case PseudoMediaControlsReturnToRealtimeButton:
-    case PseudoMediaControlsToggleClosedCaptions:
-    case PseudoMediaControlsStatusDisplay:
-    case PseudoMediaControlsFullscreenButton:
-    case PseudoMediaControlsTimelineContainer:
-    case PseudoMediaControlsVolumeSliderContainer:
     case PseudoMeterHorizontalBar:
     case PseudoMeterHorizontalOptimum:
     case PseudoMeterHorizontalSuboptimal:
@@ -622,7 +499,6 @@ void CSSSelector::extractPseudoType() const
     case PseudoMeterVerticalSuboptimal:
     case PseudoMeterVerticalEvenLessGood:
     case PseudoOuterSpinButton:
-    case PseudoProgressBarValue:
     case PseudoResizer:
     case PseudoScrollbar:
     case PseudoScrollbarCorner:
@@ -721,7 +597,7 @@ bool CSSSelector::operator==(const CSSSelector& other)
     while (sel1 && sel2) {
         if (sel1->m_tag != sel2->m_tag || sel1->attribute() != sel2->attribute() ||
              sel1->relation() != sel2->relation() || sel1->m_match != sel2->m_match ||
-             sel1->m_value != sel2->m_value ||
+             sel1->value() != sel2->value() ||
              sel1->pseudoType() != sel2->pseudoType() ||
              sel1->argument() != sel2->argument())
             return false;
@@ -755,13 +631,13 @@ String CSSSelector::selectorText() const
     while (true) {
         if (cs->m_match == CSSSelector::Id) {
             str += "#";
-            serializeIdentifier(cs->m_value, str);
+            serializeIdentifier(cs->value(), str);
         } else if (cs->m_match == CSSSelector::Class) {
             str += ".";
-            serializeIdentifier(cs->m_value, str);
+            serializeIdentifier(cs->value(), str);
         } else if (cs->m_match == CSSSelector::PseudoClass || cs->m_match == CSSSelector::PagePseudoClass) {
             str += ":";
-            str += cs->m_value;
+            str += cs->value();
             if (cs->pseudoType() == PseudoNot) {
                 if (CSSSelector* subSel = cs->simpleSelector())
                     str += subSel->selectorText();
@@ -776,7 +652,7 @@ String CSSSelector::selectorText() const
             }
         } else if (cs->m_match == CSSSelector::PseudoElement) {
             str += "::";
-            str += cs->m_value;
+            str += cs->value();
         } else if (cs->hasAttribute()) {
             str += "[";
             const AtomicString& prefix = cs->attribute().prefix();
@@ -812,7 +688,7 @@ String CSSSelector::selectorText() const
                     break;
             }
             if (cs->m_match != CSSSelector::Set) {
-                serializeString(cs->m_value, str);
+                serializeString(cs->value(), str);
                 str += "]";
             }
         }
@@ -836,14 +712,6 @@ String CSSSelector::selectorText() const
 
     return str;
 }
-    
-void CSSSelector::setTagHistory(CSSSelector* tagHistory) 
-{ 
-    if (m_hasRareData) 
-        m_data.m_rareData->m_tagHistory.set(tagHistory); 
-    else 
-        m_data.m_tagHistory = tagHistory; 
-}
 
 const QualifiedName& CSSSelector::attribute() const
 { 
@@ -869,10 +737,10 @@ void CSSSelector::setArgument(const AtomicString& value)
     m_data.m_rareData->m_argument = value; 
 }
 
-void CSSSelector::setSimpleSelector(CSSSelector* value)
+void CSSSelector::setSimpleSelector(PassOwnPtr<CSSSelector> value)
 {
     createRareData(); 
-    m_data.m_rareData->m_simpleSelector.set(value); 
+    m_data.m_rareData->m_simpleSelector = value; 
 }
 
 bool CSSSelector::parseNth()
@@ -975,33 +843,4 @@ bool CSSSelector::RareData::matchNth(int count)
     }
 }
 
-inline void CSSSelector::releaseOwnedSelectorsToBag(CSSSelectorBag& bag)
-{
-    if (m_hasRareData) {
-        ASSERT(m_data.m_rareData);
-        bag.add(m_data.m_rareData->m_tagHistory.release());
-        bag.add(m_data.m_rareData->m_simpleSelector.release());
-        delete m_data.m_rareData;
-        // Clear the pointer so that a destructor of this selector will not
-        // traverse this chain.
-        m_data.m_rareData = 0;
-    } else {
-        bag.add(adoptPtr(m_data.m_tagHistory));
-        // Clear the pointer for the same reason.
-        m_data.m_tagHistory = 0;
-    }
-}
-
-void CSSSelector::deleteReachableSelectors()
-{
-    // Traverse the chain of selectors and delete each iteratively.
-    CSSSelectorBag selectorsToBeDeleted;
-    releaseOwnedSelectorsToBag(selectorsToBeDeleted);
-    while (!selectorsToBeDeleted.isEmpty()) {
-        OwnPtr<CSSSelector> selector(selectorsToBeDeleted.takeAny());
-        ASSERT(selector);
-        selector->releaseOwnedSelectorsToBag(selectorsToBeDeleted);
-    }
-}
-
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSSelector.h b/Source/WebCore/css/CSSSelector.h
index b930353..ea161c3 100644
--- a/Source/WebCore/css/CSSSelector.h
+++ b/Source/WebCore/css/CSSSelector.h
@@ -30,8 +30,6 @@
 
 namespace WebCore {
 
-    class CSSSelectorBag;
-
     // this class represents a selector for a StyleRule
     class CSSSelector {
         WTF_MAKE_NONCOPYABLE(CSSSelector); WTF_MAKE_FAST_ALLOCATED;
@@ -42,6 +40,7 @@ namespace WebCore {
             , m_pseudoType(PseudoNotParsed)
             , m_parsedNth(false)
             , m_isLastInSelectorList(false)
+            , m_isLastInTagHistory(true)
             , m_hasRareData(false)
             , m_isForPage(false)
             , m_tag(anyQName())
@@ -54,6 +53,7 @@ namespace WebCore {
             , m_pseudoType(PseudoNotParsed)
             , m_parsedNth(false)
             , m_isLastInSelectorList(false)
+            , m_isLastInTagHistory(true)
             , m_hasRareData(false)
             , m_isForPage(false)
             , m_tag(qName)
@@ -62,18 +62,10 @@ namespace WebCore {
 
         ~CSSSelector()
         {
-            // Exit if this selector does not own any objects to be deleted.
-            if (m_hasRareData) {
-                if (!m_data.m_rareData)
-                    return;
-            } else if (!m_data.m_tagHistory)
-                return;
-
-            // We can not delete the owned object(s) by simply calling delete
-            // directly on them. That would lead to recursive destructor calls
-            // which might cause stack overflow. We have to delete them
-            // iteratively.
-            deleteReachableSelectors();
+            if (m_hasRareData)
+                delete m_data.m_rareData;
+            else if (m_data.m_value)
+                m_data.m_value->deref();
         }
 
         /**
@@ -183,23 +175,6 @@ namespace WebCore {
             PseudoSearchDecoration,
             PseudoSearchResultsDecoration,
             PseudoSearchResultsButton,
-            PseudoMediaControlsPanel,
-            PseudoMediaControlsMuteButton,
-            PseudoMediaControlsPlayButton,
-            PseudoMediaControlsTimelineContainer,
-            PseudoMediaControlsVolumeSliderContainer,
-            PseudoMediaControlsVolumeSliderMuteButton,
-            PseudoMediaControlsCurrentTimeDisplay,
-            PseudoMediaControlsTimeRemainingDisplay,
-            PseudoMediaControlsToggleClosedCaptions,
-            PseudoMediaControlsTimeline,
-            PseudoMediaControlsVolumeSlider,
-            PseudoMediaControlsSeekBackButton,
-            PseudoMediaControlsSeekForwardButton,
-            PseudoMediaControlsRewindButton,
-            PseudoMediaControlsReturnToRealtimeButton,
-            PseudoMediaControlsStatusDisplay,
-            PseudoMediaControlsFullscreenButton,
             PseudoMeterHorizontalBar,
             PseudoMeterVerticalBar,
             PseudoMeterHorizontalOptimum,
@@ -214,7 +189,6 @@ namespace WebCore {
 #endif
             PseudoInnerSpinButton,
             PseudoOuterSpinButton,
-            PseudoProgressBarValue,
             PseudoLeftPage,
             PseudoRightPage,
             PseudoFirstPage,
@@ -255,29 +229,31 @@ namespace WebCore {
         static PseudoType parsePseudoType(const AtomicString&);
         static PseudoId pseudoId(PseudoType);
 
-        CSSSelector* tagHistory() const { return m_hasRareData ? m_data.m_rareData->m_tagHistory.get() : m_data.m_tagHistory; }
-        void setTagHistory(CSSSelector* tagHistory);
+        // Selectors are kept in an array by CSSSelectorList. The next component of the selector is 
+        // the next item in the array.
+        CSSSelector* tagHistory() const { return m_isLastInTagHistory ? 0 : const_cast<CSSSelector*>(this + 1); }
 
         bool hasTag() const { return m_tag != anyQName(); }
         bool hasAttribute() const { return m_match == Id || m_match == Class || (m_hasRareData && m_data.m_rareData->m_attribute != anyQName()); }
         
+        const QualifiedName& tag() const { return m_tag; }
+        // AtomicString is really just an AtomicStringImpl* so the cast below is safe.
+        // FIXME: Perhaps call sites could be changed to accept AtomicStringImpl?
+        const AtomicString& value() const { return *reinterpret_cast<const AtomicString*>(m_hasRareData ? &m_data.m_rareData->m_value : &m_data.m_value); }
         const QualifiedName& attribute() const;
         const AtomicString& argument() const { return m_hasRareData ? m_data.m_rareData->m_argument : nullAtom; }
         CSSSelector* simpleSelector() const { return m_hasRareData ? m_data.m_rareData->m_simpleSelector.get() : 0; }
         
-        void setAttribute(const QualifiedName& value);
-        void setArgument(const AtomicString& value);
-        void setSimpleSelector(CSSSelector* value);
+        void setTag(const QualifiedName& value) { m_tag = value; }
+        void setValue(const AtomicString&);
+        void setAttribute(const QualifiedName&);
+        void setArgument(const AtomicString&);
+        void setSimpleSelector(PassOwnPtr<CSSSelector>);
         
         bool parseNth();
         bool matchNth(int count);
 
-        bool matchesPseudoElement() const 
-        { 
-            if (m_pseudoType == PseudoUnknown)
-                extractPseudoType();
-            return m_match == PseudoElement;
-        }
+        bool matchesPseudoElement() const;
         bool isUnknownPseudoElement() const;
         bool isSiblingSelector() const;
 
@@ -285,6 +261,9 @@ namespace WebCore {
 
         bool isLastInSelectorList() const { return m_isLastInSelectorList; }
         void setLastInSelectorList() { m_isLastInSelectorList = true; }
+        bool isLastInTagHistory() const { return m_isLastInTagHistory; }
+        void setNotLastInTagHistory() { m_isLastInTagHistory = false; }
+
         bool isSimple() const;
 
         bool isForPage() const { return m_isForPage; }
@@ -297,12 +276,10 @@ namespace WebCore {
     private:
         bool m_parsedNth              : 1; // Used for :nth-* 
         bool m_isLastInSelectorList   : 1;
+        bool m_isLastInTagHistory     : 1;
         bool m_hasRareData            : 1;
         bool m_isForPage              : 1;
 
-        void releaseOwnedSelectorsToBag(CSSSelectorBag&);
-        void deleteReachableSelectors();
-
         unsigned specificityForOneSelector() const;
         unsigned specificityForPage() const;
         void extractPseudoType() const;
@@ -310,44 +287,47 @@ namespace WebCore {
         struct RareData {
             WTF_MAKE_NONCOPYABLE(RareData); WTF_MAKE_FAST_ALLOCATED;
         public:
-            RareData(PassOwnPtr<CSSSelector> tagHistory)
-                : m_a(0)
+            RareData(PassRefPtr<AtomicStringImpl> value)
+                : m_value(value.leakRef())
+                , m_a(0)
                 , m_b(0)
-                , m_tagHistory(tagHistory)
                 , m_attribute(anyQName())
                 , m_argument(nullAtom)
             {
             }
+            ~RareData()
+            {
+                if (m_value)
+                    m_value->deref();
+            }
 
             bool parseNth();
             bool matchNth(int count);
 
+            AtomicStringImpl* m_value; // Plain pointer to keep things uniform with the union.
             int m_a; // Used for :nth-*
             int m_b; // Used for :nth-*
-            OwnPtr<CSSSelector> m_tagHistory;
             OwnPtr<CSSSelector> m_simpleSelector; // Used for :not.
             QualifiedName m_attribute; // used for attribute selector
             AtomicString m_argument; // Used for :contains, :lang and :nth-*
         };
-
-        void createRareData()
-        {
-            if (m_hasRareData) 
-                return;
-            m_data.m_rareData = new RareData(adoptPtr(m_data.m_tagHistory));
-            m_hasRareData = true;
-        }
+        void createRareData();
         
         union DataUnion {
-            DataUnion() : m_tagHistory(0) { }
-            CSSSelector* m_tagHistory;
+            DataUnion() : m_value(0) { }
+            AtomicStringImpl* m_value;
             RareData* m_rareData;
         } m_data;
         
-    public:
-        mutable AtomicString m_value;
         QualifiedName m_tag;
     };
+    
+inline bool CSSSelector::matchesPseudoElement() const 
+{ 
+    if (m_pseudoType == PseudoUnknown)
+        extractPseudoType();
+    return m_match == PseudoElement;
+}
 
 inline bool CSSSelector::isUnknownPseudoElement() const
 {
@@ -371,6 +351,26 @@ inline bool CSSSelector::isSiblingSelector() const
         || type == PseudoNthLastChild
         || type == PseudoNthLastOfType;
 }
+    
+inline void CSSSelector::setValue(const AtomicString& value)
+{ 
+    // Need to do ref counting manually for the union.
+    if (m_hasRareData) {
+        m_data.m_rareData->m_value = value.impl();
+        m_data.m_rareData->m_value->ref();
+        return;
+    }
+    m_data.m_value = value.impl();
+    m_data.m_value->ref();
+}
+
+inline void move(PassOwnPtr<CSSSelector> from, CSSSelector* to) 
+{
+    memcpy(to, from.get(), sizeof(CSSSelector));
+    // We want to free the memory (which was allocated with fastNew), but we
+    // don't want the destructor to run since it will affect the copy we've just made.
+    fastDeleteSkippingDestructor(from.leakPtr());
+}
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/css/CSSSelectorList.cpp b/Source/WebCore/css/CSSSelectorList.cpp
index 7cb4df4..f4a8165 100644
--- a/Source/WebCore/css/CSSSelectorList.cpp
+++ b/Source/WebCore/css/CSSSelectorList.cpp
@@ -27,6 +27,8 @@
 #include "config.h"
 #include "CSSSelectorList.h"
 
+#include "CSSParserValues.h"
+
 namespace WebCore {
 
 CSSSelectorList::~CSSSelectorList() 
@@ -41,26 +43,40 @@ void CSSSelectorList::adopt(CSSSelectorList& list)
     list.m_selectorArray = 0;
 }
 
-void CSSSelectorList::adoptSelectorVector(Vector<CSSSelector*>& selectorVector)
+void CSSSelectorList::adoptSelectorVector(Vector<OwnPtr<CSSParserSelector> >& selectorVector)
 {
     deleteSelectors();
-    const size_t size = selectorVector.size();
-    ASSERT(size);
-    if (size == 1) {
-        m_selectorArray = selectorVector[0];
+    const size_t vectorSize = selectorVector.size();
+    size_t flattenedSize = 0;
+    for (size_t i = 0; i < vectorSize; ++i) {        
+        for (CSSParserSelector* selector = selectorVector[i].get(); selector; selector = selector->tagHistory())
+            ++flattenedSize;
+    }
+    ASSERT(flattenedSize);
+    if (flattenedSize == 1) {
+        m_selectorArray = selectorVector[0]->releaseSelector().leakPtr();
         m_selectorArray->setLastInSelectorList();
+        ASSERT(m_selectorArray->isLastInTagHistory());
         selectorVector.shrink(0);
         return;
     }
-    m_selectorArray = reinterpret_cast<CSSSelector*>(fastMalloc(sizeof(CSSSelector) * selectorVector.size()));
-    for (size_t i = 0; i < size; ++i) {
-        memcpy(&m_selectorArray[i], selectorVector[i], sizeof(CSSSelector));
-        // We want to free the memory (which was allocated with fastNew), but we
-        // don't want the destructor to run since it will affect the copy we've just made.
-        fastDeleteSkippingDestructor(selectorVector[i]);
-        ASSERT(!m_selectorArray[i].isLastInSelectorList());
+    m_selectorArray = reinterpret_cast<CSSSelector*>(fastMalloc(sizeof(CSSSelector) * flattenedSize));
+    size_t arrayIndex = 0;
+    for (size_t i = 0; i < vectorSize; ++i) {
+        CSSParserSelector* current = selectorVector[i].get();
+        while (current) {
+            OwnPtr<CSSSelector> selector = current->releaseSelector();
+            current = current->tagHistory();
+            move(selector.release(), &m_selectorArray[arrayIndex]);
+            ASSERT(!m_selectorArray[arrayIndex].isLastInSelectorList());
+            if (current)
+                m_selectorArray[arrayIndex].setNotLastInTagHistory();
+            ++arrayIndex;
+        }
+        ASSERT(m_selectorArray[arrayIndex - 1].isLastInTagHistory());
     }
-    m_selectorArray[size - 1].setLastInSelectorList();
+    ASSERT(flattenedSize == arrayIndex);
+    m_selectorArray[arrayIndex - 1].setLastInSelectorList();
     selectorVector.shrink(0);
 }
 
@@ -122,7 +138,7 @@ class SelectorNeedsNamespaceResolutionFunctor {
 public:
     bool operator()(CSSSelector* selector)
     {
-        if (selector->hasTag() && selector->m_tag.prefix() != nullAtom && selector->m_tag.prefix() != starAtom)
+        if (selector->hasTag() && selector->tag().prefix() != nullAtom && selector->tag().prefix() != starAtom)
             return true;
         if (selector->hasAttribute() && selector->attribute().prefix() != nullAtom && selector->attribute().prefix() != starAtom)
             return true;
diff --git a/Source/WebCore/css/CSSSelectorList.h b/Source/WebCore/css/CSSSelectorList.h
index abd9bc8..2b96d92 100644
--- a/Source/WebCore/css/CSSSelectorList.h
+++ b/Source/WebCore/css/CSSSelectorList.h
@@ -30,6 +30,8 @@
 
 namespace WebCore {
     
+class CSSParserSelector;
+    
 class CSSSelectorList {
     WTF_MAKE_NONCOPYABLE(CSSSelectorList); WTF_MAKE_FAST_ALLOCATED;
 public:
@@ -37,11 +39,11 @@ public:
     ~CSSSelectorList();
 
     void adopt(CSSSelectorList& list);
-    void adoptSelectorVector(Vector<CSSSelector*>& selectorVector);
+    void adoptSelectorVector(Vector<OwnPtr<CSSParserSelector> >& selectorVector);
     
     CSSSelector* first() const { return m_selectorArray ? m_selectorArray : 0; }
-    static CSSSelector* next(CSSSelector* previous) { return previous->isLastInSelectorList() ? 0 : previous + 1; }
-    bool hasOneSelector() const { return m_selectorArray ? m_selectorArray->isLastInSelectorList() : false; }
+    static CSSSelector* next(CSSSelector*);
+    bool hasOneSelector() const { return m_selectorArray && !next(m_selectorArray); }
 
     bool selectorsNeedNamespaceResolution();
     bool hasUnknownPseudoElements() const;
@@ -49,10 +51,19 @@ public:
 private:
     void deleteSelectors();
 
+    // End of a multipart selector is indicated by m_isLastInTagHistory bit in the last item.
     // End of the array is indicated by m_isLastInSelectorList bit in the last item.
     CSSSelector* m_selectorArray;
 };
 
+inline CSSSelector* CSSSelectorList::next(CSSSelector* current)
+{
+    // Skip subparts of compound selectors.
+    while (!current->isLastInTagHistory())
+        current++;
+    return current->isLastInSelectorList() ? 0 : current + 1;
+}
+
 } // namespace WebCore
 
 #endif // CSSSelectorList_h
diff --git a/Source/WebCore/css/CSSStyleRule.h b/Source/WebCore/css/CSSStyleRule.h
index 171b636..2d35043 100644
--- a/Source/WebCore/css/CSSStyleRule.h
+++ b/Source/WebCore/css/CSSStyleRule.h
@@ -50,7 +50,7 @@ public:
     // Not part of the CSSOM
     virtual bool parseString(const String&, bool = false);
 
-    void adoptSelectorVector(Vector<CSSSelector*>& selectors) { m_selectorList.adoptSelectorVector(selectors); }
+    void adoptSelectorVector(Vector<OwnPtr<CSSParserSelector> >& selectors) { m_selectorList.adoptSelectorVector(selectors); }
     void setDeclaration(PassRefPtr<CSSMutableStyleDeclaration>);
 
     const CSSSelectorList& selectorList() const { return m_selectorList; }
diff --git a/Source/WebCore/css/CSSStyleSelector.cpp b/Source/WebCore/css/CSSStyleSelector.cpp
index 5a21615..02cf8d3 100644
--- a/Source/WebCore/css/CSSStyleSelector.cpp
+++ b/Source/WebCore/css/CSSStyleSelector.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2004-2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2006, 2007 Nicholas Shanks (webkit@nickshanks.com)
- * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007, 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
@@ -352,73 +352,43 @@ if (id == propID) { \
     return; \
 }
 
-class CSSRuleData {
-    WTF_MAKE_NONCOPYABLE(CSSRuleData);
+class RuleData {
 public:
-    CSSRuleData(unsigned pos, CSSStyleRule* r, CSSSelector* sel, CSSRuleData* prev = 0)
-        : m_position(pos)
-        , m_rule(r)
-        , m_selector(sel)
-        , m_next(0)
-    {
-        if (prev)
-            prev->m_next = this;
-    }
-
-    ~CSSRuleData()
-    {
-    }
+    RuleData(CSSStyleRule*, CSSSelector*, unsigned position);
 
-    unsigned position() { return m_position; }
-    CSSStyleRule* rule() { return m_rule; }
-    CSSSelector* selector() { return m_selector; }
-    CSSRuleData* next() { return m_next; }
+    unsigned position() const { return m_position; }
+    CSSStyleRule* rule() const { return m_rule; }
+    CSSSelector* selector() const { return m_selector; }
+    
+    bool hasFastCheckableSelector() const { return m_hasFastCheckableSelector; }
+    bool hasMultipartSelector() const { return m_hasMultipartSelector; }
+    bool hasTopSelectorMatchingHTMLBasedOnRuleHash() const { return m_hasTopSelectorMatchingHTMLBasedOnRuleHash; }
+    
+    // Try to balance between memory usage (there can be lots of RuleData objects) and good filtering performance.
+    static const unsigned maximumIdentifierCount = 4;
+    const unsigned* descendantSelectorIdentifierHashes() const { return m_descendantSelectorIdentifierHashes; }
 
 private:
-    unsigned m_position;
+    void collectDescendantSelectorIdentifierHashes();
+    void collectIdentifierHashes(const CSSSelector*, unsigned& identifierCount);
+    
     CSSStyleRule* m_rule;
     CSSSelector* m_selector;
-    CSSRuleData* m_next;
+    unsigned m_position : 29;
+    bool m_hasFastCheckableSelector : 1;
+    bool m_hasMultipartSelector : 1;
+    bool m_hasTopSelectorMatchingHTMLBasedOnRuleHash : 1;
+    // Use plain array instead of a Vector to minimize memory overhead.
+    unsigned m_descendantSelectorIdentifierHashes[maximumIdentifierCount];
 };
 
-class CSSRuleDataList {
-    WTF_MAKE_NONCOPYABLE(CSSRuleDataList);
+class RuleSet {
+    WTF_MAKE_NONCOPYABLE(RuleSet);
 public:
-    CSSRuleDataList(unsigned pos, CSSStyleRule* rule, CSSSelector* sel)
-        : m_first(new CSSRuleData(pos, rule, sel))
-        , m_last(m_first)
-    {
-    }
-
-    ~CSSRuleDataList()
-    {
-        CSSRuleData* ptr;
-        CSSRuleData* next;
-        ptr = m_first;
-        while (ptr) {
-            next = ptr->next();
-            delete ptr;
-            ptr = next;
-        }
-    }
-
-    CSSRuleData* first() const { return m_first; }
-    CSSRuleData* last() const { return m_last; }
-
-    void append(unsigned pos, CSSStyleRule* rule, CSSSelector* sel) { m_last = new CSSRuleData(pos, rule, sel, m_last); }
-
-private:
-    CSSRuleData* m_first;
-    CSSRuleData* m_last;
-};
-
-class CSSRuleSet {
-    WTF_MAKE_NONCOPYABLE(CSSRuleSet);
-public:
-    CSSRuleSet();
-    ~CSSRuleSet();
+    RuleSet();
+    ~RuleSet();
     
-    typedef HashMap<AtomicStringImpl*, CSSRuleDataList*> AtomRuleMap;
+    typedef HashMap<AtomicStringImpl*, Vector<RuleData>*> AtomRuleMap;
     
     void addRulesFromSheet(CSSStyleSheet*, const MediaQueryEvaluator&, CSSStyleSelector* = 0);
 
@@ -427,34 +397,36 @@ public:
     void addPageRule(CSSStyleRule* rule, CSSSelector* sel);
     void addToRuleSet(AtomicStringImpl* key, AtomRuleMap& map,
                       CSSStyleRule* rule, CSSSelector* sel);
+    void shrinkToFit();
+    void disableAutoShrinkToFit() { m_autoShrinkToFitEnabled = false; }
     
-    void collectIdsAndSiblingRules(HashSet<AtomicStringImpl*>& ids, OwnPtr<CSSRuleSet>& siblingRules) const;
+    void collectIdsAndSiblingRules(HashSet<AtomicStringImpl*>& ids, OwnPtr<RuleSet>& siblingRules) const;
     
-    CSSRuleDataList* getIDRules(AtomicStringImpl* key) { return m_idRules.get(key); }
-    CSSRuleDataList* getClassRules(AtomicStringImpl* key) { return m_classRules.get(key); }
-    CSSRuleDataList* getTagRules(AtomicStringImpl* key) { return m_tagRules.get(key); }
-    CSSRuleDataList* getPseudoRules(AtomicStringImpl* key) { return m_pseudoRules.get(key); }
-    CSSRuleDataList* getUniversalRules() { return m_universalRules.get(); }
-    CSSRuleDataList* getPageRules() { return m_pageRules.get(); }
+    const Vector<RuleData>* getIDRules(AtomicStringImpl* key) const { return m_idRules.get(key); }
+    const Vector<RuleData>* getClassRules(AtomicStringImpl* key) const { return m_classRules.get(key); }
+    const Vector<RuleData>* getTagRules(AtomicStringImpl* key) const { return m_tagRules.get(key); }
+    const Vector<RuleData>* getPseudoRules(AtomicStringImpl* key) const { return m_pseudoRules.get(key); }
+    const Vector<RuleData>* getUniversalRules() const { return &m_universalRules; }
+    const Vector<RuleData>* getPageRules() const { return &m_pageRules; }
     
 public:
     AtomRuleMap m_idRules;
     AtomRuleMap m_classRules;
     AtomRuleMap m_tagRules;
     AtomRuleMap m_pseudoRules;
-    OwnPtr<CSSRuleDataList> m_universalRules;
-    OwnPtr<CSSRuleDataList> m_pageRules;
+    Vector<RuleData> m_universalRules;
+    Vector<RuleData> m_pageRules;
     unsigned m_ruleCount;
-    unsigned m_pageRuleCount;
+    bool m_autoShrinkToFitEnabled;
 };
 
-static CSSRuleSet* defaultStyle;
-static CSSRuleSet* defaultQuirksStyle;
-static CSSRuleSet* defaultPrintStyle;
-static CSSRuleSet* defaultViewSourceStyle;
+static RuleSet* defaultStyle;
+static RuleSet* defaultQuirksStyle;
+static RuleSet* defaultPrintStyle;
+static RuleSet* defaultViewSourceStyle;
 static CSSStyleSheet* simpleDefaultStyleSheet;
     
-static CSSRuleSet* siblingRulesInDefaultStyle;
+static RuleSet* siblingRulesInDefaultStyle;
 
 RenderStyle* CSSStyleSelector::s_styleNotYetAvailable;
 
@@ -473,7 +445,7 @@ static inline bool elementCanUseSimpleDefaultStyle(Element* e)
 
 static inline void collectSiblingRulesInDefaultStyle()
 {
-    OwnPtr<CSSRuleSet> siblingRules;
+    OwnPtr<RuleSet> siblingRules;
     HashSet<AtomicStringImpl*> ids;
     defaultStyle->collectIdsAndSiblingRules(ids, siblingRules);
     ASSERT(ids.isEmpty());
@@ -546,10 +518,12 @@ CSSStyleSelector::CSSStyleSelector(Document* document, StyleSheetList* styleShee
     if (m_rootDefaultStyle && view)
         m_medium = adoptPtr(new MediaQueryEvaluator(view->mediaType(), view->frame(), m_rootDefaultStyle.get()));
 
-    m_authorStyle = adoptPtr(new CSSRuleSet);
+    m_authorStyle = adoptPtr(new RuleSet);
+    // Adding rules from multiple sheets, shrink at the end.
+    m_authorStyle->disableAutoShrinkToFit();
 
     // FIXME: This sucks! The user sheet is reparsed every time!
-    OwnPtr<CSSRuleSet> tempUserStyle = adoptPtr(new CSSRuleSet);
+    OwnPtr<RuleSet> tempUserStyle = adoptPtr(new RuleSet);
     if (pageUserSheet)
         tempUserStyle->addRulesFromSheet(pageUserSheet, *m_medium, this);
     if (pageGroupUserSheets) {
@@ -562,7 +536,7 @@ CSSStyleSelector::CSSStyleSelector(Document* document, StyleSheetList* styleShee
         }
     }
 
-    if (tempUserStyle->m_ruleCount > 0 || tempUserStyle->m_pageRuleCount > 0)
+    if (tempUserStyle->m_ruleCount > 0 || tempUserStyle->m_pageRules.size() > 0)
         m_userStyle = tempUserStyle.release();
 
     // Add rules from elements like SVG's <font-face>
@@ -575,8 +549,7 @@ CSSStyleSelector::CSSStyleSelector(Document* document, StyleSheetList* styleShee
         StyleSheet* sheet = styleSheets->item(i);
         if (sheet->isCSSStyleSheet() && !sheet->disabled())
             m_authorStyle->addRulesFromSheet(static_cast<CSSStyleSheet*>(sheet), *m_medium, this);
-    }
-    
+    }    
     // Collect all ids and rules using sibling selectors (:first-child and similar)
     // in the current set of stylesheets. Style sharing code uses this information to reject
     // sharing candidates.
@@ -587,6 +560,10 @@ CSSStyleSelector::CSSStyleSelector(Document* document, StyleSheetList* styleShee
     if (m_userStyle)
         m_userStyle->collectIdsAndSiblingRules(m_idsInRules, m_siblingRules);
 
+    m_authorStyle->shrinkToFit();
+    if (m_siblingRules)
+        m_siblingRules->shrinkToFit();
+
     if (document->renderer() && document->renderer()->style())
         document->renderer()->style()->font().update(fontSelector());
 }
@@ -622,13 +599,13 @@ static void loadFullDefaultStyle()
         ASSERT(defaultStyle);
         delete defaultStyle;
         simpleDefaultStyleSheet->deref();
-        defaultStyle = new CSSRuleSet;
+        defaultStyle = new RuleSet;
         simpleDefaultStyleSheet = 0;
     } else {
         ASSERT(!defaultStyle);
-        defaultStyle = new CSSRuleSet;
-        defaultPrintStyle = new CSSRuleSet;
-        defaultQuirksStyle = new CSSRuleSet;
+        defaultStyle = new RuleSet;
+        defaultPrintStyle = new RuleSet;
+        defaultQuirksStyle = new RuleSet;
     }
 
     // Strict-mode rules.
@@ -661,9 +638,9 @@ static void loadSimpleDefaultStyle()
     ASSERT(!defaultStyle);
     ASSERT(!simpleDefaultStyleSheet);
     
-    defaultStyle = new CSSRuleSet;
-    defaultPrintStyle = new CSSRuleSet;
-    defaultQuirksStyle = new CSSRuleSet;
+    defaultStyle = new RuleSet;
+    defaultPrintStyle = new RuleSet;
+    defaultQuirksStyle = new RuleSet;
 
     simpleDefaultStyleSheet = parseUASheet(simpleUserAgentStyleSheet, strlen(simpleUserAgentStyleSheet));
     defaultStyle->addRulesFromSheet(simpleDefaultStyleSheet, screenEval());
@@ -674,16 +651,98 @@ static void loadSimpleDefaultStyle()
 static void loadViewSourceStyle()
 {
     ASSERT(!defaultViewSourceStyle);
-    defaultViewSourceStyle = new CSSRuleSet;
+    defaultViewSourceStyle = new RuleSet;
     defaultViewSourceStyle->addRulesFromSheet(parseUASheet(sourceUserAgentStyleSheet, sizeof(sourceUserAgentStyleSheet)), screenEval());
 }
+    
+static inline void collectElementIdentifierHashes(const Element* element, Vector<unsigned, 4>& identifierHashes)
+{
+    identifierHashes.append(element->localName().impl()->existingHash());
+    if (element->hasID())
+        identifierHashes.append(element->idForStyleResolution().impl()->existingHash());
+    const StyledElement* styledElement = element->isStyledElement() ? static_cast<const StyledElement*>(element) : 0;
+    if (styledElement && styledElement->hasClass()) {
+        const SpaceSplitString& classNames = styledElement->classNames();
+        size_t count = classNames.size();
+        for (size_t i = 0; i < count; ++i)
+            identifierHashes.append(classNames[i].impl()->existingHash());
+    }
+}
+
+void CSSStyleSelector::pushParentStackFrame(Element* parent)
+{
+    ASSERT(m_ancestorIdentifierFilter);
+    ASSERT(m_parentStack.isEmpty() || m_parentStack.last().element == parent->parentElement());
+    ASSERT(!m_parentStack.isEmpty() || !parent->parentElement());
+    m_parentStack.append(ParentStackFrame(parent));
+    ParentStackFrame& parentFrame = m_parentStack.last();
+    // Mix tags, class names and ids into some sort of weird bouillabaisse.
+    // The filter is used for fast rejection of child and descendant selectors.
+    collectElementIdentifierHashes(parent, parentFrame.identifierHashes);
+    size_t count = parentFrame.identifierHashes.size();
+    for (size_t i = 0; i < count; ++i)
+        m_ancestorIdentifierFilter->add(parentFrame.identifierHashes[i]);
+}
+
+void CSSStyleSelector::popParentStackFrame()
+{
+    ASSERT(!m_parentStack.isEmpty());
+    ASSERT(m_ancestorIdentifierFilter);
+    const ParentStackFrame& parentFrame = m_parentStack.last();
+    size_t count = parentFrame.identifierHashes.size();
+    for (size_t i = 0; i < count; ++i)
+        m_ancestorIdentifierFilter->remove(parentFrame.identifierHashes[i]);
+    m_parentStack.removeLast();
+    if (m_parentStack.isEmpty()) {
+        ASSERT(m_ancestorIdentifierFilter->likelyEmpty());
+        m_ancestorIdentifierFilter.clear();
+    }
+}
+
+void CSSStyleSelector::pushParent(Element* parent)
+{
+    if (m_parentStack.isEmpty()) {
+        ASSERT(!m_ancestorIdentifierFilter);
+        m_ancestorIdentifierFilter = adoptPtr(new BloomFilter<bloomFilterKeyBits>);
+        // If the element is not the root itself, build the stack starting from the root.
+        if (parent->parentElement()) {
+            Vector<Element*, 30> ancestors;
+            for (Element* ancestor = parent; ancestor; ancestor = ancestor->parentElement())
+                ancestors.append(ancestor);
+            int count = ancestors.size();
+            for (int n = count - 1; n >= 0; --n)
+                pushParentStackFrame(ancestors[n]);
+            return;
+        }
+    } else if (!parent->parentElement()) {
+        // We are not always invoked consistently. For example, script execution can cause us to enter
+        // style recalc in the middle of tree building. Reset the stack if we see a new root element.
+        ASSERT(m_ancestorIdentifierFilter);
+        m_ancestorIdentifierFilter->clear();
+        m_parentStack.resize(0);
+    } else {
+        ASSERT(m_ancestorIdentifierFilter);
+        // We may get invoked for some random elements in some wacky cases during style resolve.
+        // Pause maintaining the stack in this case.
+        if (m_parentStack.last().element != parent->parentElement())
+            return;
+    }
+    pushParentStackFrame(parent);
+}
+
+void CSSStyleSelector::popParent(Element* parent)
+{
+    if (m_parentStack.isEmpty() || m_parentStack.last().element != parent)
+        return;
+    popParentStackFrame();
+}
 
 void CSSStyleSelector::addMatchedDeclaration(CSSMutableStyleDeclaration* decl)
 {
     m_matchedDecls.append(decl);
 }
 
-void CSSStyleSelector::matchRules(CSSRuleSet* rules, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules)
+void CSSStyleSelector::matchRules(RuleSet* rules, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules)
 {
     m_matchedRules.clear();
 
@@ -728,21 +787,38 @@ void CSSStyleSelector::matchRules(CSSRuleSet* rules, int& firstRuleIndex, int& l
     }
 }
 
-void CSSStyleSelector::matchRulesForList(CSSRuleDataList* rules, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules)
+inline bool CSSStyleSelector::fastRejectSelector(const RuleData& ruleData) const
+{
+    ASSERT(m_ancestorIdentifierFilter);
+    const unsigned* descendantSelectorIdentifierHashes = ruleData.descendantSelectorIdentifierHashes();
+    for (unsigned n = 0; n < RuleData::maximumIdentifierCount && descendantSelectorIdentifierHashes[n]; ++n) {
+        if (!m_ancestorIdentifierFilter->mayContain(descendantSelectorIdentifierHashes[n]))
+            return true;
+    }
+    return false;
+}
+
+void CSSStyleSelector::matchRulesForList(const Vector<RuleData>* rules, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules)
 {
     if (!rules)
         return;
+    // In some cases we may end up looking up style for random elements in the middle of a recursive tree resolve.
+    // Ancestor identifier filter won't be up-to-date in that case and we can't use the fast path.
+    bool canUseFastReject = !m_parentStack.isEmpty() && m_parentStack.last().element == m_parentNode;
 
-    for (CSSRuleData* d = rules->first(); d; d = d->next()) {
-        CSSStyleRule* rule = d->rule();
-        if (m_checker.m_sameOriginOnly && !m_checker.m_document->securityOrigin()->canRequest(rule->baseURL()))
-            continue; 
-        if (checkSelector(d->selector())) {
+    unsigned size = rules->size();
+    for (unsigned i = 0; i < size; ++i) {
+        const RuleData& ruleData = rules->at(i);
+        if (canUseFastReject && fastRejectSelector(ruleData))
+            continue;
+        if (checkSelector(ruleData)) {
             // If the rule has no properties to apply, then ignore it in the non-debug mode.
+            CSSStyleRule* rule = ruleData.rule();
             CSSMutableStyleDeclaration* decl = rule->declaration();
             if (!decl || (!decl->length() && !includeEmptyRules))
                 continue;
-            
+            if (m_checker.m_sameOriginOnly && !m_checker.m_document->securityOrigin()->canRequest(rule->baseURL()))
+                continue; 
             // If we're matching normal rules, set a pseudo bit if 
             // we really just matched a pseudo-element.
             if (m_dynamicPseudo != NOPSEUDO && m_checker.m_pseudoStyle == NOPSEUDO) {
@@ -757,20 +833,20 @@ void CSSStyleSelector::matchRulesForList(CSSRuleDataList* rules, int& firstRuleI
                     firstRuleIndex = lastRuleIndex;
 
                 // Add this rule to our list of matched rules.
-                addMatchedRule(d);
+                addMatchedRule(&ruleData);
             }
         }
     }
 }
 
-static bool operator >(CSSRuleData& r1, CSSRuleData& r2)
+static bool operator >(const RuleData& r1, const RuleData& r2)
 {
     int spec1 = r1.selector()->specificity();
     int spec2 = r2.selector()->specificity();
     return (spec1 == spec2) ? r1.position() > r2.position() : spec1 > spec2; 
 }
     
-static bool operator <=(CSSRuleData& r1, CSSRuleData& r2)
+static bool operator <=(const RuleData& r1, const RuleData& r2)
 {
     return !(r1 > r2);
 }
@@ -785,8 +861,8 @@ void CSSStyleSelector::sortMatchedRules(unsigned start, unsigned end)
         for (unsigned i = end - 1; i > start; i--) {
             bool sorted = true;
             for (unsigned j = start; j < i; j++) {
-                CSSRuleData* elt = m_matchedRules[j];
-                CSSRuleData* elt2 = m_matchedRules[j + 1];
+                const RuleData* elt = m_matchedRules[j];
+                const RuleData* elt2 = m_matchedRules[j + 1];
                 if (*elt > *elt2) {
                     sorted = false;
                     m_matchedRules[j] = elt2;
@@ -804,8 +880,8 @@ void CSSStyleSelector::sortMatchedRules(unsigned start, unsigned end)
     sortMatchedRules(start, mid);
     sortMatchedRules(mid, end);
     
-    CSSRuleData* elt = m_matchedRules[mid - 1];
-    CSSRuleData* elt2 = m_matchedRules[mid];
+    const RuleData* elt = m_matchedRules[mid - 1];
+    const RuleData* elt2 = m_matchedRules[mid];
     
     // Handle the fast common case (of equal specificity).  The list may already
     // be completely sorted.
@@ -814,7 +890,7 @@ void CSSStyleSelector::sortMatchedRules(unsigned start, unsigned end)
     
     // We have to merge sort.  Ensure our merge buffer is big enough to hold
     // all the items.
-    Vector<CSSRuleData*> rulesMergeBuffer;
+    Vector<const RuleData*> rulesMergeBuffer;
     rulesMergeBuffer.reserveInitialCapacity(end - start); 
 
     unsigned i1 = start;
@@ -1129,6 +1205,14 @@ inline Node* CSSStyleSelector::findSiblingForStyleSharing(Node* node, unsigned&
     return node;
 }
 
+static inline bool parentStylePreventsSharing(const RenderStyle* parentStyle)
+{
+    return parentStyle->childrenAffectedByPositionalRules() 
+        || parentStyle->childrenAffectedByFirstChildRules()
+        || parentStyle->childrenAffectedByLastChildRules() 
+        || parentStyle->childrenAffectedByDirectAdjacentRules();
+}
+
 ALWAYS_INLINE RenderStyle* CSSStyleSelector::locateSharedStyle()
 {
     if (!m_styledElement || !m_parentStyle)
@@ -1139,6 +1223,8 @@ ALWAYS_INLINE RenderStyle* CSSStyleSelector::locateSharedStyle()
     // Ids stop style sharing if they show up in the stylesheets.
     if (m_styledElement->hasID() && m_idsInRules.contains(m_styledElement->idForStyleResolution().impl()))
         return 0;
+    if (parentStylePreventsSharing(m_parentStyle))
+        return 0;
     // Check previous siblings.
     unsigned count = 0;
     Node* shareNode = findSiblingForStyleSharing(m_styledElement->previousSibling(), count);
@@ -1152,7 +1238,7 @@ ALWAYS_INLINE RenderStyle* CSSStyleSelector::locateSharedStyle()
     if (matchesSiblingRules())
         return 0;
     // Tracking child index requires unique style for each node. This may get set by the sibling rule match above.
-    if (m_parentStyle->childrenAffectedByPositionalRules())
+    if (parentStylePreventsSharing(m_parentStyle))
         return 0;
     return shareNode->renderStyle();
 }
@@ -1160,7 +1246,7 @@ ALWAYS_INLINE RenderStyle* CSSStyleSelector::locateSharedStyle()
 void CSSStyleSelector::matchUARules(int& firstUARule, int& lastUARule)
 {
     // First we match rules from the user agent sheet.
-    CSSRuleSet* userAgentStyleSheet = m_medium->mediaTypeMatchSpecific("print")
+    RuleSet* userAgentStyleSheet = m_medium->mediaTypeMatchSpecific("print")
         ? defaultPrintStyle : defaultStyle;
     matchRules(userAgentStyleSheet, firstUARule, lastUARule, false);
 
@@ -2010,21 +2096,103 @@ PassRefPtr<CSSRuleList> CSSStyleSelector::pseudoStyleRulesForElement(Element* e,
     return m_ruleList.release();
 }
 
-bool CSSStyleSelector::checkSelector(CSSSelector* sel)
+inline bool CSSStyleSelector::checkSelector(const RuleData& ruleData)
 {
     m_dynamicPseudo = NOPSEUDO;
 
-    // Check the selector
-    SelectorMatch match = m_checker.checkSelector(sel, m_element, &m_selectorAttrs, m_dynamicPseudo, false, false, style(), m_parentNode ? m_parentNode->renderStyle() : 0);
+    if (ruleData.hasFastCheckableSelector()) {
+        // We know this selector does not include any pseudo selectors.
+        if (m_checker.m_pseudoStyle != NOPSEUDO)
+            return false;
+        // We know a sufficiently simple single part selector matches simply because we found it from the rule hash.
+        // This is limited to HTML only so we don't need to check the namespace.
+        if (ruleData.hasTopSelectorMatchingHTMLBasedOnRuleHash() && !ruleData.hasMultipartSelector() && m_element->isHTMLElement())
+            return true;
+        return SelectorChecker::fastCheckSelector(ruleData.selector(), m_element);
+    }
+
+    // Slow path.
+    SelectorMatch match = m_checker.checkSelector(ruleData.selector(), m_element, &m_selectorAttrs, m_dynamicPseudo, false, false, style(), m_parentNode ? m_parentNode->renderStyle() : 0);
     if (match != SelectorMatches)
         return false;
-
     if (m_checker.m_pseudoStyle != NOPSEUDO && m_checker.m_pseudoStyle != m_dynamicPseudo)
         return false;
+    return true;
+}
+
+static inline bool selectorTagMatches(const Element* element, const CSSSelector* selector)
+{
+    if (!selector->hasTag())
+        return true;
+    const AtomicString& localName = selector->tag().localName();
+    if (localName != starAtom && localName != element->localName())
+        return false;
+    const AtomicString& namespaceURI = selector->tag().namespaceURI();
+    return namespaceURI == starAtom || namespaceURI == element->namespaceURI();
+}
 
+static inline bool isFastCheckableSelector(const CSSSelector* selector)
+{
+    for (; selector; selector = selector->tagHistory()) {
+        if (selector->relation() != CSSSelector::Descendant)
+            return false;
+        if (selector->m_match != CSSSelector::None && selector->m_match != CSSSelector::Id && selector->m_match != CSSSelector::Class)
+            return false;
+    }
     return true;
 }
 
+bool CSSStyleSelector::SelectorChecker::fastCheckSelector(const CSSSelector* selector, const Element* element)
+{
+    ASSERT(isFastCheckableSelector(selector));
+
+    // The top selector requires tag check only as rule hashes have already handled id and class matches.
+    if (!selectorTagMatches(element, selector))
+        return false;
+
+    selector = selector->tagHistory();
+    if (!selector)
+        return true;
+    const Element* ancestor = element;
+    // We know this compound selector has descendant combinators only and all components are simple.
+    for (; selector; selector = selector->tagHistory()) {
+        AtomicStringImpl* value;
+        switch (selector->m_match) {
+        case CSSSelector::Class:
+            value = selector->value().impl();
+            while (true) {
+                if (!(ancestor = ancestor->parentElement()))
+                    return false;
+                const StyledElement* styledElement = static_cast<const StyledElement*>(ancestor);
+                if (ancestor->hasClass() && styledElement->classNames().contains(value) && selectorTagMatches(ancestor, selector))
+                    break;
+            }
+            break;
+        case CSSSelector::Id:
+            value = selector->value().impl();
+            while (true) {
+                if (!(ancestor = ancestor->parentElement()))
+                    return false;
+                if (ancestor->hasID() && ancestor->idForStyleResolution().impl() == value && selectorTagMatches(ancestor, selector))
+                    break;
+            }
+            break;
+        case CSSSelector::None:
+            while (true) {
+                if (!(ancestor = ancestor->parentElement()))
+                    return false;
+                if (selectorTagMatches(ancestor, selector))
+                    break;
+            }
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+    return true;
+}
+    
+
 // Recursive check of selectors and combinators
 // It can return 3 different values:
 // * SelectorMatches         - the selector matches the element e
@@ -2216,21 +2384,15 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
     if (!e)
         return false;
 
-    if (sel->hasTag()) {
-        const AtomicString& selLocalName = sel->m_tag.localName();
-        if (selLocalName != starAtom && selLocalName != e->localName())
-            return false;
-        const AtomicString& selNS = sel->m_tag.namespaceURI();
-        if (selNS != starAtom && selNS != e->namespaceURI())
-            return false;
-    }
+    if (!selectorTagMatches(e, sel))
+        return false;
 
     if (sel->hasAttribute()) {
         if (sel->m_match == CSSSelector::Class)
-            return e->hasClass() && static_cast<StyledElement*>(e)->classNames().contains(sel->m_value);
+            return e->hasClass() && static_cast<StyledElement*>(e)->classNames().contains(sel->value());
 
         if (sel->m_match == CSSSelector::Id)
-            return e->hasID() && e->idForStyleResolution() == sel->m_value;
+            return e->hasID() && e->idForStyleResolution() == sel->value();
         
         const QualifiedName& attr = sel->attribute();
 
@@ -2249,22 +2411,22 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
 
         switch (sel->m_match) {
         case CSSSelector::Exact:
-            if (caseSensitive ? sel->m_value != value : !equalIgnoringCase(sel->m_value, value))
+            if (caseSensitive ? sel->value() != value : !equalIgnoringCase(sel->value(), value))
                 return false;
             break;
         case CSSSelector::List:
         {
             // Ignore empty selectors or selectors containing spaces
-            if (sel->m_value.contains(' ') || sel->m_value.isEmpty())
+            if (sel->value().contains(' ') || sel->value().isEmpty())
                 return false;
 
             unsigned startSearchAt = 0;
             while (true) {
-                size_t foundPos = value.find(sel->m_value, startSearchAt, caseSensitive);
+                size_t foundPos = value.find(sel->value(), startSearchAt, caseSensitive);
                 if (foundPos == notFound)
                     return false;
                 if (foundPos == 0 || value[foundPos - 1] == ' ') {
-                    unsigned endStr = foundPos + sel->m_value.length();
+                    unsigned endStr = foundPos + sel->value().length();
                     if (endStr == value.length() || value[endStr] == ' ')
                         break; // We found a match.
                 }
@@ -2275,24 +2437,24 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             break;
         }
         case CSSSelector::Contain:
-            if (!value.contains(sel->m_value, caseSensitive) || sel->m_value.isEmpty())
+            if (!value.contains(sel->value(), caseSensitive) || sel->value().isEmpty())
                 return false;
             break;
         case CSSSelector::Begin:
-            if (!value.startsWith(sel->m_value, caseSensitive) || sel->m_value.isEmpty())
+            if (!value.startsWith(sel->value(), caseSensitive) || sel->value().isEmpty())
                 return false;
             break;
         case CSSSelector::End:
-            if (!value.endsWith(sel->m_value, caseSensitive) || sel->m_value.isEmpty())
+            if (!value.endsWith(sel->value(), caseSensitive) || sel->value().isEmpty())
                 return false;
             break;
         case CSSSelector::Hyphen:
-            if (value.length() < sel->m_value.length())
+            if (value.length() < sel->value().length())
                 return false;
-            if (!value.startsWith(sel->m_value, caseSensitive))
+            if (!value.startsWith(sel->value(), caseSensitive))
                 return false;
             // It they start the same, check for exact match or following '-':
-            if (value.length() != sel->m_value.length() && value[sel->m_value.length()] != '-')
+            if (value.length() != sel->value().length() && value[sel->value().length()] != '-')
                 return false;
             break;
         case CSSSelector::PseudoClass:
@@ -2875,70 +3037,130 @@ bool CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass(CSSSelector* s
 
 // -----------------------------------------------------------------
 
-CSSRuleSet::CSSRuleSet()
+static inline bool isSelectorMatchingHTMLBasedOnRuleHash(const CSSSelector* selector)
+{
+    const AtomicString& selectorNamespace = selector->tag().namespaceURI();
+    if (selectorNamespace != starAtom && selectorNamespace != xhtmlNamespaceURI)
+        return false;
+    if (selector->m_match == CSSSelector::None)
+        return true;
+    if (selector->m_match != CSSSelector::Id && selector->m_match != CSSSelector::Class)
+        return false;
+    return selector->tag() == starAtom;
+}
+
+RuleData::RuleData(CSSStyleRule* rule, CSSSelector* selector, unsigned position)
+    : m_rule(rule)
+    , m_selector(selector)
+    , m_position(position)
+    , m_hasFastCheckableSelector(isFastCheckableSelector(selector))
+    , m_hasMultipartSelector(selector->tagHistory())
+    , m_hasTopSelectorMatchingHTMLBasedOnRuleHash(isSelectorMatchingHTMLBasedOnRuleHash(selector))
+{
+    collectDescendantSelectorIdentifierHashes();
+}
+
+inline void RuleData::collectIdentifierHashes(const CSSSelector* selector, unsigned& identifierCount)
+{
+    if ((selector->m_match == CSSSelector::Id || selector->m_match == CSSSelector::Class) && !selector->value().isEmpty())
+        m_descendantSelectorIdentifierHashes[identifierCount++] = selector->value().impl()->existingHash();
+    if (identifierCount == maximumIdentifierCount)
+        return;
+    const AtomicString& localName = selector->tag().localName();
+    if (localName != starAtom)
+        m_descendantSelectorIdentifierHashes[identifierCount++] = localName.impl()->existingHash();
+}
+
+inline void RuleData::collectDescendantSelectorIdentifierHashes()
+{
+    unsigned identifierCount = 0;
+    CSSSelector::Relation relation = m_selector->relation();
+    
+    // Skip the topmost selector. It is handled quickly by the rule hashes.    
+    bool skipOverSubselectors = true;
+    for (const CSSSelector* selector = m_selector->tagHistory(); selector; selector = selector->tagHistory()) {
+        // Only collect identifiers that match ancestors.
+        switch (relation) {
+        case CSSSelector::SubSelector:
+            if (!skipOverSubselectors)
+                collectIdentifierHashes(selector, identifierCount);
+            break;
+        case CSSSelector::DirectAdjacent:
+        case CSSSelector::IndirectAdjacent:
+        case CSSSelector::ShadowDescendant:
+            skipOverSubselectors = true;
+            break;
+        case CSSSelector::Descendant:
+        case CSSSelector::Child:
+            skipOverSubselectors = false;
+            collectIdentifierHashes(selector, identifierCount);
+            break;
+        }
+        if (identifierCount == maximumIdentifierCount)
+            return;
+        relation = selector->relation();
+    }
+    m_descendantSelectorIdentifierHashes[identifierCount] = 0;
+}
+
+RuleSet::RuleSet()
     : m_ruleCount(0)
-    , m_pageRuleCount(0)
+    , m_autoShrinkToFitEnabled(true)
 {
 }
 
-CSSRuleSet::~CSSRuleSet()
+RuleSet::~RuleSet()
 { 
     deleteAllValues(m_idRules);
     deleteAllValues(m_classRules);
+    deleteAllValues(m_pseudoRules);
     deleteAllValues(m_tagRules);
 }
 
 
-void CSSRuleSet::addToRuleSet(AtomicStringImpl* key, AtomRuleMap& map,
+void RuleSet::addToRuleSet(AtomicStringImpl* key, AtomRuleMap& map,
                               CSSStyleRule* rule, CSSSelector* sel)
 {
     if (!key) return;
-    CSSRuleDataList* rules = map.get(key);
+    Vector<RuleData>* rules = map.get(key);
     if (!rules) {
-        rules = new CSSRuleDataList(m_ruleCount++, rule, sel);
+        rules = new Vector<RuleData>;
         map.set(key, rules);
-    } else
-        rules->append(m_ruleCount++, rule, sel);
+    }
+    rules->append(RuleData(rule, sel, m_ruleCount++));
 }
 
-void CSSRuleSet::addRule(CSSStyleRule* rule, CSSSelector* sel)
+void RuleSet::addRule(CSSStyleRule* rule, CSSSelector* sel)
 {
     if (sel->m_match == CSSSelector::Id) {
-        addToRuleSet(sel->m_value.impl(), m_idRules, rule, sel);
+        addToRuleSet(sel->value().impl(), m_idRules, rule, sel);
         return;
     }
     if (sel->m_match == CSSSelector::Class) {
-        addToRuleSet(sel->m_value.impl(), m_classRules, rule, sel);
+        addToRuleSet(sel->value().impl(), m_classRules, rule, sel);
         return;
     }
      
     if (sel->isUnknownPseudoElement()) {
-        addToRuleSet(sel->m_value.impl(), m_pseudoRules, rule, sel);
+        addToRuleSet(sel->value().impl(), m_pseudoRules, rule, sel);
         return;
     }
 
-    const AtomicString& localName = sel->m_tag.localName();
+    const AtomicString& localName = sel->tag().localName();
     if (localName != starAtom) {
         addToRuleSet(localName.impl(), m_tagRules, rule, sel);
         return;
     }
 
-    // Just put it in the universal rule set.
-    if (!m_universalRules)
-        m_universalRules = adoptPtr(new CSSRuleDataList(m_ruleCount++, rule, sel));
-    else
-        m_universalRules->append(m_ruleCount++, rule, sel);
+    m_universalRules.append(RuleData(rule, sel, m_ruleCount++));
 }
 
-void CSSRuleSet::addPageRule(CSSStyleRule* rule, CSSSelector* sel)
+void RuleSet::addPageRule(CSSStyleRule* rule, CSSSelector* sel)
 {
-    if (!m_pageRules)
-        m_pageRules = adoptPtr(new CSSRuleDataList(m_pageRuleCount++, rule, sel));
-    else
-        m_pageRules->append(m_pageRuleCount++, rule, sel);
+    m_pageRules.append(RuleData(rule, sel, m_pageRules.size()));
 }
 
-void CSSRuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluator& medium, CSSStyleSelector* styleSelector)
+void RuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluator& medium, CSSStyleSelector* styleSelector)
 {
     if (!sheet)
         return;
@@ -2987,9 +3209,11 @@ void CSSRuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluat
         } else if (item->isKeyframesRule())
             styleSelector->addKeyframeStyle(static_cast<WebKitCSSKeyframesRule*>(item));
     }
+    if (m_autoShrinkToFitEnabled)
+        shrinkToFit();
 }
 
-void CSSRuleSet::addStyleRule(CSSStyleRule* rule)
+void RuleSet::addStyleRule(CSSStyleRule* rule)
 {
     if (rule->isPageRule()) {
         CSSPageRule* pageRule = static_cast<CSSPageRule*>(rule);
@@ -3000,45 +3224,63 @@ void CSSRuleSet::addStyleRule(CSSStyleRule* rule)
     }
 }
 
-static void collectIdsAndSiblingRulesFromList(HashSet<AtomicStringImpl*>& ids, OwnPtr<CSSRuleSet>& siblingRules, const CSSRuleDataList* rules)
+static void collectIdsAndSiblingRulesFromList(HashSet<AtomicStringImpl*>& ids, OwnPtr<RuleSet>& siblingRules, const Vector<RuleData>& rules)
 {
-    for (CSSRuleData* data = rules->first(); data; data = data->next()) {
+    unsigned size = rules.size();
+    for (unsigned i = 0; i < size; ++i) {
+        const RuleData& ruleData = rules[i];
         bool foundSiblingSelector = false;
-        for (CSSSelector* selector = data->selector(); selector; selector = selector->tagHistory()) {
-            if (selector->m_match == CSSSelector::Id && !selector->m_value.isEmpty())
-                ids.add(selector->m_value.impl());
+        for (CSSSelector* selector = ruleData.selector(); selector; selector = selector->tagHistory()) {
+            if (selector->m_match == CSSSelector::Id && !selector->value().isEmpty())
+                ids.add(selector->value().impl());
             if (CSSSelector* simpleSelector = selector->simpleSelector()) {
                 ASSERT(!simpleSelector->simpleSelector());
-                if (simpleSelector->m_match == CSSSelector::Id && !simpleSelector->m_value.isEmpty())
-                    ids.add(simpleSelector->m_value.impl());
+                if (simpleSelector->m_match == CSSSelector::Id && !simpleSelector->value().isEmpty())
+                    ids.add(simpleSelector->value().impl());
             }
             if (selector->isSiblingSelector())
                 foundSiblingSelector = true;
         }
         if (foundSiblingSelector) {
             if (!siblingRules)
-                siblingRules = adoptPtr(new CSSRuleSet);
-            siblingRules->addRule(data->rule(), data->selector());   
+                siblingRules = adoptPtr(new RuleSet);
+            siblingRules->addRule(ruleData.rule(), ruleData.selector());   
         }
     }
 }
 
-void CSSRuleSet::collectIdsAndSiblingRules(HashSet<AtomicStringImpl*>& ids, OwnPtr<CSSRuleSet>& siblingRules) const
+void RuleSet::collectIdsAndSiblingRules(HashSet<AtomicStringImpl*>& ids, OwnPtr<RuleSet>& siblingRules) const
 {
     AtomRuleMap::const_iterator end = m_idRules.end();
     for (AtomRuleMap::const_iterator it = m_idRules.begin(); it != end; ++it)
-        collectIdsAndSiblingRulesFromList(ids, siblingRules, it->second);
+        collectIdsAndSiblingRulesFromList(ids, siblingRules, *it->second);
     end = m_classRules.end();
     for (AtomRuleMap::const_iterator it = m_classRules.begin(); it != end; ++it)
-        collectIdsAndSiblingRulesFromList(ids, siblingRules, it->second);
+        collectIdsAndSiblingRulesFromList(ids, siblingRules, *it->second);
     end = m_tagRules.end();
     for (AtomRuleMap::const_iterator it = m_tagRules.begin(); it != end; ++it)
-        collectIdsAndSiblingRulesFromList(ids, siblingRules, it->second);
+        collectIdsAndSiblingRulesFromList(ids, siblingRules, *it->second);
     end = m_pseudoRules.end();
     for (AtomRuleMap::const_iterator it = m_pseudoRules.begin(); it != end; ++it)
-        collectIdsAndSiblingRulesFromList(ids, siblingRules, it->second);
-    if (m_universalRules)
-        collectIdsAndSiblingRulesFromList(ids, siblingRules, m_universalRules.get());
+        collectIdsAndSiblingRulesFromList(ids, siblingRules, *it->second);
+    collectIdsAndSiblingRulesFromList(ids, siblingRules, m_universalRules);
+}
+    
+static inline void shrinkMapVectorsToFit(RuleSet::AtomRuleMap& map)
+{
+    RuleSet::AtomRuleMap::iterator end = map.end();
+    for (RuleSet::AtomRuleMap::iterator it = map.begin(); it != end; ++it)
+        it->second->shrinkToFit();
+}
+    
+void RuleSet::shrinkToFit()
+{
+    shrinkMapVectorsToFit(m_idRules);
+    shrinkMapVectorsToFit(m_classRules);
+    shrinkMapVectorsToFit(m_tagRules);
+    shrinkMapVectorsToFit(m_pseudoRules);
+    m_universalRules.shrinkToFit();
+    m_pageRules.shrinkToFit();
 }
 
 // -------------------------------------------------------------------------------------
@@ -3107,7 +3349,7 @@ void CSSStyleSelector::applyDeclarations(bool isImportant, int startIndex, int e
     }
 }
 
-void CSSStyleSelector::matchPageRules(CSSRuleSet* rules, bool isLeftPage, bool isFirstPage, const String& pageName)
+void CSSStyleSelector::matchPageRules(RuleSet* rules, bool isLeftPage, bool isFirstPage, const String& pageName)
 {
     m_matchedRules.clear();
 
@@ -3128,17 +3370,19 @@ void CSSStyleSelector::matchPageRules(CSSRuleSet* rules, bool isLeftPage, bool i
         addMatchedDeclaration(m_matchedRules[i]->rule()->declaration());
 }
 
-void CSSStyleSelector::matchPageRulesForList(CSSRuleDataList* rules, bool isLeftPage, bool isFirstPage, const String& pageName)
+void CSSStyleSelector::matchPageRulesForList(const Vector<RuleData>* rules, bool isLeftPage, bool isFirstPage, const String& pageName)
 {
     if (!rules)
         return;
 
-    for (CSSRuleData* d = rules->first(); d; d = d->next()) {
-        CSSStyleRule* rule = d->rule();
-        const AtomicString& selectorLocalName = d->selector()->m_tag.localName();
+    unsigned size = rules->size();
+    for (unsigned i = 0; i < size; ++i) {
+        const RuleData& ruleData = rules->at(i);
+        CSSStyleRule* rule = ruleData.rule();
+        const AtomicString& selectorLocalName = ruleData.selector()->tag().localName();
         if (selectorLocalName != starAtom && selectorLocalName != pageName)
             continue;
-        CSSSelector::PseudoType pseudoType = d->selector()->pseudoType();
+        CSSSelector::PseudoType pseudoType = ruleData.selector()->pseudoType();
         if ((pseudoType == CSSSelector::PseudoLeftPage && !isLeftPage)
             || (pseudoType == CSSSelector::PseudoRightPage && isLeftPage)
             || (pseudoType == CSSSelector::PseudoFirstPage && !isFirstPage))
@@ -3150,7 +3394,7 @@ void CSSStyleSelector::matchPageRulesForList(CSSRuleDataList* rules, bool isLeft
             continue;
 
         // Add this rule to our list of matched rules.
-        addMatchedRule(d);
+        addMatchedRule(&ruleData);
     }
 }
 
@@ -4295,9 +4539,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         }
         
         // FIXME: Should clamp all sorts of other integer properties too.
-        const double minIntAsDouble = INT_MIN;
-        const double maxIntAsDouble = INT_MAX;
-        m_style->setZIndex(static_cast<int>(max(minIntAsDouble, min(primitiveValue->getDoubleValue(), maxIntAsDouble))));
+        m_style->setZIndex(clampToInteger(primitiveValue->getDoubleValue()));
         return;
     }
     case CSSPropertyWidows:
@@ -5763,6 +6005,8 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 
     case CSSPropertyWebkitTextCombine:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(textCombine, TextCombine)
+        if (m_style->hasTextCombine())
+            m_style->setUnique(); // The style could be modified in RenderCombineText depending on text metrics.
         return;
 
     case CSSPropertyWebkitTextEmphasisPosition:
@@ -7196,9 +7440,21 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
                 break;
             }   
             case WebKitCSSTransformValue::PerspectiveTransformOperation: {
-                double p = firstValue->getDoubleValue();
-                if (p < 0.0)
+                bool ok = true;
+                Length p = Length(0, Fixed);
+                if (CSSPrimitiveValue::isUnitTypeLength(firstValue->primitiveType()))
+                    p = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                else {
+                    // This is a quirk that should go away when 3d transforms are finalized.
+                    double val = firstValue->getDoubleValue();
+                    ok = val >= 0;
+                    val = clampToPositiveInteger(val);
+                    p = Length(static_cast<int>(val), Fixed);
+                }
+                
+                if (!ok)
                     return false;
+
                 operations.operations().append(PerspectiveTransformOperation::create(p));
                 break;
             }
diff --git a/Source/WebCore/css/CSSStyleSelector.h b/Source/WebCore/css/CSSStyleSelector.h
index e035af2..6065c2c 100644
--- a/Source/WebCore/css/CSSStyleSelector.h
+++ b/Source/WebCore/css/CSSStyleSelector.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -27,6 +27,7 @@
 #include "LinkHash.h"
 #include "MediaQueryExp.h"
 #include "RenderStyle.h"
+#include <wtf/BloomFilter.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/RefPtr.h>
@@ -42,10 +43,7 @@ class CSSProperty;
 class CSSFontFace;
 class CSSFontFaceRule;
 class CSSImageValue;
-class CSSRuleData;
-class CSSRuleDataList;
 class CSSRuleList;
-class CSSRuleSet;
 class CSSSelector;
 class CSSStyleRule;
 class CSSStyleSheet;
@@ -61,6 +59,8 @@ class KeyframeList;
 class KeyframeValue;
 class MediaQueryEvaluator;
 class Node;
+class RuleData;
+class RuleSet;
 class Settings;
 class StyleImage;
 class StyleSheet;
@@ -90,6 +90,10 @@ public:
                          CSSStyleSheet* pageUserSheet, const Vector<RefPtr<CSSStyleSheet> >* pageGroupUserSheets,
                          bool strictParsing, bool matchAuthorAndUserStyles);
         ~CSSStyleSelector();
+        
+        // Using these during tree walk will allow style selector to optimize child and descendant selector lookups.
+        void pushParent(Element* parent);
+        void popParent(Element* parent);
 
         PassRefPtr<RenderStyle> styleForElement(Element* e, RenderStyle* parentStyle = 0, bool allowSharing = true, bool resolveForRootDefault = false, bool matchVisitedPseudoClass = false);
         
@@ -115,6 +119,9 @@ public:
         Node* locateCousinList(Element* parent, unsigned depth = 1) const;
         Node* findSiblingForStyleSharing(Node*, unsigned& count) const;
         bool canShareStyleWithElement(Node*) const;
+        
+        void pushParentStackFrame(Element* parent);
+        void popParentStackFrame();
 
         RenderStyle* style() const { return m_style.get(); }
 
@@ -157,9 +164,6 @@ public:
  
         CSSFontSelector* fontSelector() const { return m_fontSelector.get(); }
 
-        // Checks if a compound selector (which can consist of multiple simple selectors) matches the current element.
-        bool checkSelector(CSSSelector*);
-
         void addViewportDependentMediaQueryResult(const MediaQueryExp*, bool result);
 
         bool affectedByViewportChange() const;
@@ -182,28 +186,43 @@ public:
 
         void adjustRenderStyle(RenderStyle* styleToAdjust, RenderStyle* parentStyle, Element*);
 
-        void addMatchedRule(CSSRuleData* rule) { m_matchedRules.append(rule); }
+        void addMatchedRule(const RuleData* rule) { m_matchedRules.append(rule); }
         void addMatchedDeclaration(CSSMutableStyleDeclaration* decl);
 
-        void matchRules(CSSRuleSet*, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules);
-        void matchRulesForList(CSSRuleDataList*, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules);
+        void matchRules(RuleSet*, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules);
+        void matchRulesForList(const Vector<RuleData>*, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules);
+        bool fastRejectSelector(const RuleData&) const;
         void sortMatchedRules(unsigned start, unsigned end);
+        
+        bool checkSelector(const RuleData&);
 
         template <bool firstPass>
         void applyDeclarations(bool important, int startIndex, int endIndex);
 
-        void matchPageRules(CSSRuleSet*, bool isLeftPage, bool isFirstPage, const String& pageName);
-        void matchPageRulesForList(CSSRuleDataList*, bool isLeftPage, bool isFirstPage, const String& pageName);
+        void matchPageRules(RuleSet*, bool isLeftPage, bool isFirstPage, const String& pageName);
+        void matchPageRulesForList(const Vector<RuleData>*, bool isLeftPage, bool isFirstPage, const String& pageName);
         bool isLeftPage(int pageIndex) const;
         bool isRightPage(int pageIndex) const { return !isLeftPage(pageIndex); }
         bool isFirstPage(int pageIndex) const;
         String pageName(int pageIndex) const;
         
-        OwnPtr<CSSRuleSet> m_authorStyle;
-        OwnPtr<CSSRuleSet> m_userStyle;
+        OwnPtr<RuleSet> m_authorStyle;
+        OwnPtr<RuleSet> m_userStyle;
         
-        OwnPtr<CSSRuleSet> m_siblingRules;
+        OwnPtr<RuleSet> m_siblingRules;
         HashSet<AtomicStringImpl*> m_idsInRules;
+        
+        struct ParentStackFrame {
+            ParentStackFrame() {}
+            ParentStackFrame(Element* element) : element(element) {}
+            Element* element;
+            Vector<unsigned, 4> identifierHashes;
+        };
+        Vector<ParentStackFrame> m_parentStack;
+        
+        // With 100 unique strings in the filter, 2^12 slot table has false positive rate of ~0.2%.
+        static const unsigned bloomFilterKeyBits = 12;
+        OwnPtr<BloomFilter<bloomFilterKeyBits> > m_ancestorIdentifierFilter;
 
         bool m_hasUAAppearance;
         BorderData m_borderData;
@@ -225,6 +244,7 @@ public:
             SelectorMatch checkSelector(CSSSelector*, Element*, HashSet<AtomicStringImpl*>* selectorAttrs, PseudoId& dynamicPseudo, bool isSubSelector, bool encounteredLink, RenderStyle* = 0, RenderStyle* elementParentStyle = 0) const;
             bool checkOneSelector(CSSSelector*, Element*, HashSet<AtomicStringImpl*>* selectorAttrs, PseudoId& dynamicPseudo, bool isSubSelector, RenderStyle*, RenderStyle* elementParentStyle) const;
             bool checkScrollbarPseudoClass(CSSSelector*, PseudoId& dynamicPseudo) const;
+            static bool fastCheckSelector(const CSSSelector*, const Element*);
 
             EInsideLink determineLinkState(Element* element) const;
             EInsideLink determineLinkStateSlowCase(Element* element) const;
@@ -293,7 +313,7 @@ public:
 
         // A buffer used to hold the set of matched rules for an element, and a temporary buffer used for
         // merge sorting.
-        Vector<CSSRuleData*, 32> m_matchedRules;
+        Vector<const RuleData*, 32> m_matchedRules;
 
         RefPtr<CSSRuleList> m_ruleList;
         
diff --git a/Source/WebCore/css/CSSStyleSheet.cpp b/Source/WebCore/css/CSSStyleSheet.cpp
index d5487a1..16c2ba8 100644
--- a/Source/WebCore/css/CSSStyleSheet.cpp
+++ b/Source/WebCore/css/CSSStyleSheet.cpp
@@ -53,7 +53,6 @@ static bool isAcceptableCSSStyleSheetParent(Node* parentNode)
 
 CSSStyleSheet::CSSStyleSheet(CSSStyleSheet* parentSheet, const String& href, const KURL& baseURL, const String& charset)
     : StyleSheet(parentSheet, href, baseURL)
-    , m_document(parentSheet ? parentSheet->document() : 0)
     , m_charset(charset)
     , m_loadCompleted(false)
     , m_strictParsing(!parentSheet || parentSheet->useStrictParsing())
@@ -64,7 +63,6 @@ CSSStyleSheet::CSSStyleSheet(CSSStyleSheet* parentSheet, const String& href, con
 
 CSSStyleSheet::CSSStyleSheet(Node* parentNode, const String& href, const KURL& baseURL, const String& charset)
     : StyleSheet(parentNode, href, baseURL)
-    , m_document(parentNode->document())
     , m_charset(charset)
     , m_loadCompleted(false)
     , m_strictParsing(false)
@@ -82,7 +80,6 @@ CSSStyleSheet::CSSStyleSheet(CSSRule* ownerRule, const String& href, const KURL&
     , m_hasSyntacticallyValidCSSHeader(true)
 {
     CSSStyleSheet* parentSheet = ownerRule ? ownerRule->parentStyleSheet() : 0;
-    m_document = parentSheet ? parentSheet->document() : 0;
     m_isUserStyleSheet = parentSheet ? parentSheet->isUserStyleSheet() : false;
 }
 
@@ -233,6 +230,24 @@ void CSSStyleSheet::checkLoaded()
     m_loadCompleted = ownerNode() ? ownerNode()->sheetLoaded() : true;
 }
 
+Document* CSSStyleSheet::document()
+{
+    StyleBase* styleObject = this;
+    while (styleObject) {
+        if (styleObject->isCSSStyleSheet()) {
+            Node* ownerNode = static_cast<CSSStyleSheet*>(styleObject)->ownerNode();
+            if (ownerNode)
+                return ownerNode->document();
+        }
+        if (styleObject->isRule())
+            styleObject = static_cast<CSSRule*>(styleObject)->parentStyleSheet();
+        else
+            styleObject = styleObject->parent();
+    }
+
+    return 0;
+}
+
 void CSSStyleSheet::styleSheetChanged()
 {
     StyleBase* root = this;
diff --git a/Source/WebCore/css/CSSStyleSheet.h b/Source/WebCore/css/CSSStyleSheet.h
index 725518f..062886a 100644
--- a/Source/WebCore/css/CSSStyleSheet.h
+++ b/Source/WebCore/css/CSSStyleSheet.h
@@ -87,7 +87,7 @@ public:
 
     virtual void checkLoaded();
 
-    Document* document() { return m_document; }
+    Document* document();
 
     const String& charset() const { return m_charset; }
 
@@ -112,7 +112,6 @@ private:
     virtual bool isCSSStyleSheet() const { return true; }
     virtual String type() const { return "text/css"; }
 
-    Document* m_document;
     OwnPtr<CSSNamespace> m_namespaces;
     String m_charset;
     bool m_loadCompleted : 1;
diff --git a/Source/WebCore/css/CSSValue.h b/Source/WebCore/css/CSSValue.h
index d1464ca..e8053fe 100644
--- a/Source/WebCore/css/CSSValue.h
+++ b/Source/WebCore/css/CSSValue.h
@@ -21,7 +21,6 @@
 #ifndef CSSValue_h
 #define CSSValue_h
 
-#include "CSSParserValues.h"
 #include "KURLHash.h"
 #include <wtf/ListHashSet.h>
 #include <wtf/RefPtr.h>
@@ -70,8 +69,6 @@ public:
     virtual bool isSVGPaint() const { return false; }
 #endif
 
-    virtual CSSParserValue parserValue() const { ASSERT_NOT_REACHED(); return CSSParserValue(); }
-
     virtual void addSubresourceStyleURLs(ListHashSet<KURL>&, const CSSStyleSheet*) { }
 };
 
diff --git a/Source/WebCore/css/CSSValueList.cpp b/Source/WebCore/css/CSSValueList.cpp
index f8d8457..e107fb4 100644
--- a/Source/WebCore/css/CSSValueList.cpp
+++ b/Source/WebCore/css/CSSValueList.cpp
@@ -120,17 +120,6 @@ String CSSValueList::cssText() const
     return result;
 }
 
-PassOwnPtr<CSSParserValueList> CSSValueList::createParserValueList() const
-{
-    size_t size = m_values.size();
-    if (!size)
-        return 0;
-    OwnPtr<CSSParserValueList> result = adoptPtr(new CSSParserValueList);
-    for (size_t i = 0; i < size; ++i)
-        result->addValue(m_values[i]->parserValue());
-    return result.release();
-}
-
 void CSSValueList::addSubresourceStyleURLs(ListHashSet<KURL>& urls, const CSSStyleSheet* styleSheet)
 {
     size_t size = m_values.size();
diff --git a/Source/WebCore/css/CSSValueList.h b/Source/WebCore/css/CSSValueList.h
index 0d5c882..b2e6063 100644
--- a/Source/WebCore/css/CSSValueList.h
+++ b/Source/WebCore/css/CSSValueList.h
@@ -58,8 +58,6 @@ public:
 
     virtual String cssText() const;
 
-    PassOwnPtr<CSSParserValueList> createParserValueList() const;
-
     virtual void addSubresourceStyleURLs(ListHashSet<KURL>&, const CSSStyleSheet*);
 
 protected:
diff --git a/Source/WebCore/css/WebKitCSSKeyframesRule.cpp b/Source/WebCore/css/WebKitCSSKeyframesRule.cpp
index 23f9f34..bf0c463 100644
--- a/Source/WebCore/css/WebKitCSSKeyframesRule.cpp
+++ b/Source/WebCore/css/WebKitCSSKeyframesRule.cpp
@@ -24,12 +24,13 @@
  */
 
 #include "config.h"
+#include "WebKitCSSKeyframesRule.h"
 
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSParser.h"
-#include "WebKitCSSKeyframesRule.h"
-#include "WebKitCSSKeyframeRule.h"
 #include "CSSRuleList.h"
 #include "StyleSheet.h"
+#include "WebKitCSSKeyframeRule.h"
 
 namespace WebCore {
 
@@ -45,8 +46,13 @@ WebKitCSSKeyframesRule::~WebKitCSSKeyframesRule()
     if (length == 0)
         return;
         
-    for (int i = 0; i < length; i++)
+    for (int i = 0; i < length; i++) {
+        if (m_lstCSSRules->item(i)->isKeyframeRule()) {
+            if (CSSMutableStyleDeclaration* style = static_cast<WebKitCSSKeyframeRule*>(m_lstCSSRules->item(i))->style())
+                style->setParent(0);
+        }
         m_lstCSSRules->item(i)->setParent(0);
+    }
 }
 
 String WebKitCSSKeyframesRule::name() const
diff --git a/Source/WebCore/css/WebKitCSSMatrix.cpp b/Source/WebCore/css/WebKitCSSMatrix.cpp
index 14f6b4e..163eac8 100644
--- a/Source/WebCore/css/WebKitCSSMatrix.cpp
+++ b/Source/WebCore/css/WebKitCSSMatrix.cpp
@@ -91,9 +91,7 @@ PassRefPtr<WebKitCSSMatrix> WebKitCSSMatrix::multiply(WebKitCSSMatrix* secondMat
     if (!secondMatrix)
         return 0;
 
-    TransformationMatrix tmp(secondMatrix->m_matrix);
-    tmp.multiply(m_matrix);
-    return WebKitCSSMatrix::create(tmp);
+    return WebKitCSSMatrix::create(TransformationMatrix(m_matrix).multiply(secondMatrix->m_matrix));
 }
 
 PassRefPtr<WebKitCSSMatrix> WebKitCSSMatrix::inverse(ExceptionCode& ec) const
diff --git a/Source/WebCore/css/html.css b/Source/WebCore/css/html.css
index 3c75559..0f13fcb 100644
--- a/Source/WebCore/css/html.css
+++ b/Source/WebCore/css/html.css
@@ -61,7 +61,10 @@ body {
 
 p {
     display: block;
-    margin: 1.0__qem 0px
+    -webkit-margin-before: 1__qem;
+    -webkit-margin-after: 1__qem;
+    -webkit-margin-start: 0;
+    -webkit-margin-end: 0;
 }
 
 div {
@@ -87,7 +90,10 @@ address {
 
 blockquote {
     display: block;
-    margin: 1__qem 40px 1em 40px
+    -webkit-margin-before: 1__qem;
+    -webkit-margin-after: 1em;
+    -webkit-margin-start: 40px;
+    -webkit-margin-end: 40px;
 }
 
 figcaption {
@@ -96,7 +102,10 @@ figcaption {
 
 figure {
     display: block;
-    margin: 1em 40px 1em 40px
+    -webkit-margin-before: 1em;
+    -webkit-margin-after: 1em;
+    -webkit-margin-start: 40px;
+    -webkit-margin-end: 40px;
 }
 
 q {
@@ -121,7 +130,10 @@ center {
 
 hr {
     display: block;
-    margin: 0.5em auto;
+    -webkit-margin-before: 0.5em;
+    -webkit-margin-after: 0.5em;
+    -webkit-margin-start: auto;
+    -webkit-margin-end: auto;
     border-style: inset;
     border-width: 1px
 }
@@ -135,41 +147,59 @@ map {
 h1 {
     display: block;
     font-size: 2em;
-    margin: .67__qem 0 .67em 0;
+    -webkit-margin-before: 0.67__qem;
+    -webkit-margin-after: 0.67em;
+    -webkit-margin-start: 0;
+    -webkit-margin-end: 0;
     font-weight: bold
 }
 
 h2 {
     display: block;
     font-size: 1.5em;
-    margin: .83__qem 0 .83em 0;
+    -webkit-margin-before: 0.83__qem;
+    -webkit-margin-after: 0.83em;
+    -webkit-margin-start: 0;
+    -webkit-margin-end: 0;
     font-weight: bold
 }
 
 h3 {
     display: block;
     font-size: 1.17em;
-    margin: 1__qem 0 1em 0;
+    -webkit-margin-before: 1__qem;
+    -webkit-margin-after: 1em;
+    -webkit-margin-start: 0;
+    -webkit-margin-end: 0;
     font-weight: bold
 }
 
 h4 {
     display: block;
-    margin: 1.33__qem 0 1.33em 0;
+    -webkit-margin-before: 1.33__qem;
+    -webkit-margin-after: 1.33em;
+    -webkit-margin-start: 0;
+    -webkit-margin-end: 0;
     font-weight: bold
 }
 
 h5 {
     display: block;
     font-size: .83em;
-    margin: 1.67__qem 0 1.67em 0;
+    -webkit-margin-before: 1.67__qem;
+    -webkit-margin-after: 1.67em;
+    -webkit-margin-start: 0;
+    -webkit-margin-end: 0;
     font-weight: bold
 }
 
 h6 {
     display: block;
     font-size: .67em;
-    margin: 2.33__qem 0 2.33em 0;
+    -webkit-margin-before: 2.33__qem;
+    -webkit-margin-after: 2.33em;
+    -webkit-margin-start: 0;
+    -webkit-margin-end: 0;
     font-weight: bold
 }
 
@@ -293,7 +323,7 @@ ol ul, ul ol, ul ul, ol ol {
 
 form {
     display: block;
-    margin-top: 0__qem
+    margin-top: 0__qem;
 }
 
 label {
@@ -403,6 +433,14 @@ input::-webkit-input-speech-button {
     display: inline-block;
 }
 
+keygen, select {
+    -webkit-border-radius: 5px;
+}
+
+keygen::-webkit-keygen-select {
+    margin: 0px;
+}
+
 textarea {
     -webkit-appearance: textarea;
     background-color: white;
@@ -505,12 +543,11 @@ input[type="radio"] {
     -webkit-box-sizing: border-box;
 }
 
-keygen, select {
+select {
     -webkit-appearance: menulist;
     -webkit-box-sizing: border-box;
     -webkit-box-align: center;
     border: 1px solid;
-    -webkit-border-radius: 5px;
     white-space: pre;
     -webkit-rtl-ordering: logical;
     color: black;
@@ -557,6 +594,7 @@ output {
     position: absolute;
     opacity: 0.9;
     line-height: 0;
+    -webkit-text-security: none;
     -webkit-transition: opacity 05.5s ease;
 }
 
@@ -793,7 +831,7 @@ rt {
 
 ruby > rt {
     display: block;
-    font-size: 60%; /* make slightly larger than 50% for better readability */
+    font-size: 50%;
     text-align: center;
 }
 
diff --git a/Source/WebCore/css/mediaControls.css b/Source/WebCore/css/mediaControls.css
index 6a0f14b..88144b4 100644
--- a/Source/WebCore/css/mediaControls.css
+++ b/Source/WebCore/css/mediaControls.css
@@ -52,6 +52,9 @@ audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-bu
     display: -webkit-box;
     width: 16px;
     height: 16px;
+    background-color: initial;
+    border: initial;
+    color: inherit;
 }
 
 audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
@@ -59,6 +62,9 @@ audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-bu
     display: -webkit-box;
     width: 16px;
     height: 16px;
+    background-color: initial;
+    border: initial;
+    color: inherit;
 }
 
 audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
@@ -86,6 +92,10 @@ audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
     -webkit-box-flex: 1;
     height: 16px;
     padding: 0px 2px;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+    margin: initial;
 }
 
 audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container {
@@ -94,6 +104,10 @@ audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-cont
 
 audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider {
     display: none;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+    margin: initial;
 }
 
 audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
@@ -101,6 +115,9 @@ audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-se
     display: -webkit-box;
     width: 16px;
     height: 16px;
+    background-color: initial;
+    border: initial;
+    color: inherit;
 }
 
 audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button {
@@ -108,6 +125,9 @@ audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls
     display: -webkit-box;
     width: 16px;
     height: 16px;
+    background-color: initial;
+    border: initial;
+    color: inherit;
 }
 
 audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button {
@@ -115,14 +135,23 @@ audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-f
     display: -webkit-box;
     width: 16px;
     height: 16px;
+    background-color: initial;
+    border: initial;
+    color: inherit;
 }
 
 audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewind-button {
     display: none;
+    background-color: initial;
+    border: initial;
+    color: inherit;
 }
 
 audio::-webkit-media-controls-return-to-realtime-button, video::-webkit-media-controls-return-to-realtime-button {
     display: none;
+    background-color: initial;
+    border: initial;
+    color: inherit;
 }
 
 audio::-webkit-media-controls-toggle-closed-captions-button, video::-webkit-media-controls-toggle-closed-captions-button {
@@ -130,9 +159,15 @@ audio::-webkit-media-controls-toggle-closed-captions-button, video::-webkit-medi
     display: -webkit-box;
     width: 16px;
     height: 16px;
+    background-color: initial;
+    border: initial;
+    color: inherit;
 }
 
 audio::-webkit-media-controls-volume-slider-mute-button, video::-webkit-media-controls-volume-slider-mute-button {
     -webkit-appearance: media-volume-slider-mute-button;
     display: none;
+    background-color: initial;
+    border: initial;
+    color: inherit;
 }
diff --git a/Source/WebCore/css/mediaControlsChromium.css b/Source/WebCore/css/mediaControlsChromium.css
index 61cbb0d..b8adc2c 100644
--- a/Source/WebCore/css/mediaControlsChromium.css
+++ b/Source/WebCore/css/mediaControlsChromium.css
@@ -153,11 +153,12 @@ audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-contr
 audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
     -webkit-appearance: media-slider;
     display: -webkit-box;
+    box-sizing: border-box;
     -webkit-box-flex: 1;
 
     padding: 0px;
     margin: 0px 6px;
-    height: 16px;
+    height: 18px;
 
     border-color: rgba(255, 255, 255, 0.2);
     border-style: solid;
diff --git a/Source/WebCore/css/mediaControlsQt.css b/Source/WebCore/css/mediaControlsQt.css
index 871a5b8..9ca3313 100644
--- a/Source/WebCore/css/mediaControlsQt.css
+++ b/Source/WebCore/css/mediaControlsQt.css
@@ -213,7 +213,12 @@ audio::-webkit-media-controls-fullscreen-button {
 }
 
 video::-webkit-media-controls-fullscreen-button {
-    display: none;
+    top: 0px;
+    right: 0px;
+    width: 12px;
+    height: 12px;
+    padding: 6px;
+    margin: 5px 5px 5px 3px;
 }
 
 audio::-webkit-media-controls-rewind-button {
@@ -240,3 +245,11 @@ video::-webkit-media-controls-toggle-closed-captions-button {
     display: none;
 }
 
+::-webkit-media-controls-mute-button,
+::-webkit-media-controls-play-button,
+::-webkit-media-controls-timeline,
+::-webkit-media-controls-volume-slider,
+::-webkit-media-controls-fullscreen-button
+{
+    box-sizing: content-box !important;
+}
diff --git a/Source/WebCore/css/themeChromiumLinux.css b/Source/WebCore/css/themeChromiumLinux.css
index f8210c3..bd7f961 100644
--- a/Source/WebCore/css/themeChromiumLinux.css
+++ b/Source/WebCore/css/themeChromiumLinux.css
@@ -34,3 +34,8 @@ select {
     background-color: #dddddd;
     border: 0px;
 }
+
+select[size="0"] option,
+select[size="1"] option {
+    background-color: #f7f7f7;
+}
diff --git a/Source/WebCore/css/themeWin.css b/Source/WebCore/css/themeWin.css
index f2ad669..0838b11 100644
--- a/Source/WebCore/css/themeWin.css
+++ b/Source/WebCore/css/themeWin.css
@@ -33,8 +33,19 @@
    making our form elements match Firefox's. */
 
 input:not([type]), 
+input[type="color"],
+input[type="date"],
+input[type="datetime"],
+input[type="datetime-local"],
+input[type="email"],
+input[type="month"],
+input[type="number"],
+input[type="password"],
+input[type="tel"],
 input[type="text"],
-input[type="password"] {
+input[type="time"],
+input[type="url"],
+input[type="week"] {
     padding:1px 0;
 }
 
@@ -59,14 +70,25 @@ input[type="radio"] {
 */
 textarea:disabled,
 input:not([type]):disabled, 
-input[type="text"]:disabled,
+input[type="color"]:disabled,
+input[type="date"]:disabled,
+input[type="datetime"]:disabled,
+input[type="datetime-local"]:disabled,
+input[type="email"]:disabled,
+input[type="month"]:disabled,
 input[type="password"]:disabled,
-input[type="search"]:disabled {
+input[type="number"]:disabled,
+input[type="search"]:disabled,
+input[type="tel"]:disabled,
+input[type="text"]:disabled,
+input[type="time"]:disabled,
+input[type="url"]:disabled,
+input[type="week"]:disabled {
     background-color: #EBEBE4; 
 }
 
 input[type="search"]::-webkit-search-cancel-button {
-   margin-right: 3px; 
+    margin-right: 3px;
 }
 
 input[type="search"]::-webkit-search-results-decoration {
@@ -77,6 +99,10 @@ input[type="search"]::-webkit-search-results-button {
     margin: 0 3px 0 2px;
 }
 
+input::-webkit-outer-spin-button {
+    margin: 0;
+}
+
 input[type="button"], input[type="submit"], input[type="reset"], input[type="file"]::-webkit-file-upload-button, button {
     padding: 1px 6px;
 }
diff --git a/Source/WebCore/dom/ClientRect.h b/Source/WebCore/dom/ClientRect.h
index f9acef0..f739497 100644
--- a/Source/WebCore/dom/ClientRect.h
+++ b/Source/WebCore/dom/ClientRect.h
@@ -42,8 +42,8 @@ namespace WebCore {
         static PassRefPtr<ClientRect> create(const FloatRect& rect) { return adoptRef(new ClientRect(rect)); }
 
         float top() const { return m_rect.y(); }
-        float right() const { return m_rect.right(); }
-        float bottom() const { return m_rect.bottom(); }
+        float right() const { return m_rect.maxX(); }
+        float bottom() const { return m_rect.maxY(); }
         float left() const { return m_rect.x(); }
         float width() const { return m_rect.width(); }
         float height() const { return m_rect.height(); }
diff --git a/Source/WebCore/dom/DOMAllInOne.cpp b/Source/WebCore/dom/DOMAllInOne.cpp
index aa85bfb..c88aecf 100644
--- a/Source/WebCore/dom/DOMAllInOne.cpp
+++ b/Source/WebCore/dom/DOMAllInOne.cpp
@@ -60,6 +60,7 @@
 #include "Document.cpp"
 #include "DocumentFragment.cpp"
 #include "DocumentMarkerController.cpp"
+#include "DocumentOrderedMap.cpp"
 #include "DocumentParser.cpp"
 #include "DocumentType.cpp"
 #include "DynamicNodeList.cpp"
diff --git a/Source/WebCore/dom/DeviceMotionController.cpp b/Source/WebCore/dom/DeviceMotionController.cpp
index 3385167..28e201e 100644
--- a/Source/WebCore/dom/DeviceMotionController.cpp
+++ b/Source/WebCore/dom/DeviceMotionController.cpp
@@ -54,7 +54,7 @@ void DeviceMotionController::timerFired(Timer<DeviceMotionController>* timer)
     RefPtr<DeviceMotionData> deviceMotionData = m_client ? m_client->currentDeviceMotion() : DeviceMotionData::create();
     RefPtr<DeviceMotionEvent> event = DeviceMotionEvent::create(eventNames().devicemotionEvent, deviceMotionData.get());
  
-    Vector<DOMWindow*> listenersVector;
+    Vector<RefPtr<DOMWindow> > listenersVector;
     copyToVector(m_newListeners, listenersVector);
     m_newListeners.clear();
     for (size_t i = 0; i < listenersVector.size(); ++i)
@@ -100,7 +100,7 @@ void DeviceMotionController::removeAllListeners(DOMWindow* window)
 void DeviceMotionController::didChangeDeviceMotion(DeviceMotionData* deviceMotionData)
 {
     RefPtr<DeviceMotionEvent> event = DeviceMotionEvent::create(eventNames().devicemotionEvent, deviceMotionData);
-    Vector<DOMWindow*> listenersVector;
+    Vector<RefPtr<DOMWindow> > listenersVector;
     copyToVector(m_listeners, listenersVector);
     for (size_t i = 0; i < listenersVector.size(); ++i)
         listenersVector[i]->dispatchEvent(event);
diff --git a/Source/WebCore/dom/DeviceMotionController.h b/Source/WebCore/dom/DeviceMotionController.h
index 70c948e..80c9d94 100644
--- a/Source/WebCore/dom/DeviceMotionController.h
+++ b/Source/WebCore/dom/DeviceMotionController.h
@@ -52,9 +52,9 @@ private:
     void timerFired(Timer<DeviceMotionController>*);
     
     DeviceMotionClient* m_client;
-    typedef HashCountedSet<DOMWindow*> ListenersCountedSet;
+    typedef HashCountedSet<RefPtr<DOMWindow> > ListenersCountedSet;
     ListenersCountedSet m_listeners;
-    typedef HashSet<DOMWindow*> ListenersSet;
+    typedef HashSet<RefPtr<DOMWindow> > ListenersSet;
     ListenersSet m_newListeners;
     Timer<DeviceMotionController> m_timer;
 };
diff --git a/Source/WebCore/dom/DeviceOrientationController.cpp b/Source/WebCore/dom/DeviceOrientationController.cpp
index 60fcf13..da42bec 100644
--- a/Source/WebCore/dom/DeviceOrientationController.cpp
+++ b/Source/WebCore/dom/DeviceOrientationController.cpp
@@ -54,7 +54,7 @@ void DeviceOrientationController::timerFired(Timer<DeviceOrientationController>*
     RefPtr<DeviceOrientation> orientation = m_client->lastOrientation();
     RefPtr<DeviceOrientationEvent> event = DeviceOrientationEvent::create(eventNames().deviceorientationEvent, orientation.get());
 
-    Vector<DOMWindow*> listenersVector;
+    Vector<RefPtr<DOMWindow> > listenersVector;
     copyToVector(m_newListeners, listenersVector);
     m_newListeners.clear();
     for (size_t i = 0; i < listenersVector.size(); ++i)
@@ -102,7 +102,7 @@ void DeviceOrientationController::removeAllListeners(DOMWindow* window)
 void DeviceOrientationController::didChangeDeviceOrientation(DeviceOrientation* orientation)
 {
     RefPtr<DeviceOrientationEvent> event = DeviceOrientationEvent::create(eventNames().deviceorientationEvent, orientation);
-    Vector<DOMWindow*> listenersVector;
+    Vector<RefPtr<DOMWindow> > listenersVector;
     copyToVector(m_listeners, listenersVector);
     for (size_t i = 0; i < listenersVector.size(); ++i)
         listenersVector[i]->dispatchEvent(event);
diff --git a/Source/WebCore/dom/DeviceOrientationController.h b/Source/WebCore/dom/DeviceOrientationController.h
index 4fa9006..5e06771 100644
--- a/Source/WebCore/dom/DeviceOrientationController.h
+++ b/Source/WebCore/dom/DeviceOrientationController.h
@@ -55,9 +55,9 @@ private:
 
     Page* m_page;
     DeviceOrientationClient* m_client;
-    typedef HashCountedSet<DOMWindow*> ListenersCountedSet;
+    typedef HashCountedSet<RefPtr<DOMWindow> > ListenersCountedSet;
     ListenersCountedSet m_listeners;
-    typedef HashSet<DOMWindow*> ListenersSet;
+    typedef HashSet<RefPtr<DOMWindow> > ListenersSet;
     ListenersSet m_newListeners;
     Timer<DeviceOrientationController> m_timer;
 };
diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index 0bdd603..6b1b90d 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -55,6 +55,7 @@
 #include "DocumentType.h"
 #include "EditingText.h"
 #include "Editor.h"
+#include "Element.h"
 #include "EntityReference.h"
 #include "Event.h"
 #include "EventHandler.h"
@@ -102,6 +103,7 @@
 #include "MouseEventWithHitTestResults.h"
 #include "MutationEvent.h"
 #include "NameNodeList.h"
+#include "NestingLevelIncrementer.h"
 #include "NodeFilter.h"
 #include "NodeIterator.h"
 #include "NodeWithIndex.h"
@@ -143,7 +145,6 @@
 #include "XMLHttpRequest.h"
 #include "XMLNSNames.h"
 #include "XMLNames.h"
-#include "XSSAuditor.h"
 #include "htmlediting.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/HashFunctions.h>
@@ -235,16 +236,13 @@ using namespace HTMLNames;
 
 // #define INSTRUMENT_LAYOUT_SCHEDULING 1
 
+static const unsigned cMaxWriteRecursionDepth = 21;
+
 // This amount of time must have elapsed before we will even consider scheduling a layout without a delay.
 // FIXME: For faster machines this value can really be lowered to 200.  250 is adequate, but a little high
 // for dual G5s. :)
 static const int cLayoutScheduleThreshold = 250;
 
-// These functions can't have internal linkage because they are used as template arguments.
-bool keyMatchesId(AtomicStringImpl*, Element*);
-bool keyMatchesMapName(AtomicStringImpl*, Element*);
-bool keyMatchesLowercasedMapName(AtomicStringImpl*, Element*);
-
 // DOM Level 2 says (letters added):
 //
 // a) Name start characters must have one of the categories Ll, Lu, Lo, Lt, Nl.
@@ -383,7 +381,7 @@ private:
     Document* m_document;
 };
 
-Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML, const KURL& baseURL)
+Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     : ContainerNode(0)
     , m_compatibilityMode(NoQuirksMode)
     , m_compatibilityModeLocked(false)
@@ -430,7 +428,7 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML, con
     , m_normalWorldWrapperCache(0)
 #endif
     , m_usingGeolocation(false)
-    , m_eventQueue(adoptPtr(new EventQueue))
+    , m_eventQueue(EventQueue::create(this))
 #if ENABLE(WML)
     , m_containsWMLContent(false)
 #endif
@@ -446,6 +444,8 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML, con
     , m_loadEventDelayTimer(this, &Document::loadEventDelayTimerFired)
     , m_directionSetOnDocumentElement(false)
     , m_writingModeSetOnDocumentElement(false)
+    , m_writeRecursionIsTooDeep(false)
+    , m_writeRecursionDepth(0)
 #if ENABLE(REQUEST_ANIMATION_FRAME)
     , m_nextRequestAnimationFrameCallbackId(0)
 #endif
@@ -460,16 +460,25 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML, con
     m_ignoreAutofocus = false;
 
     m_frame = frame;
-
-    if (frame || !url.isEmpty())
+    m_documentLoader = frame ? frame->loader()->activeDocumentLoader() : 0;
+
+    // We depend on the url getting immediately set in subframes, but we
+    // also depend on the url NOT getting immediately set in opened windows.
+    // See fast/dom/early-frame-url.html
+    // and fast/dom/location-new-window-no-crash.html, respectively.
+    // FIXME: Can/should we unify this behavior?
+    if ((frame && frame->ownerElement()) || !url.isEmpty())
         setURL(url);
 
+<<<<<<< HEAD
     // Setting of m_baseURL needs to happen after the setURL call, since that
     // calls updateBaseURL, which would clobber the passed in value.
     if (!baseURL.isNull())
         m_baseURL = baseURL;
 
 #if !PLATFORM(ANDROID)
+=======
+>>>>>>> webkit.org at r78450
     m_axObjectCache = 0;
 #endif
 
@@ -521,12 +530,6 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML, con
 #endif
 }
 
-inline void Document::DocumentOrderedMap::clear()
-{
-    m_map.clear();
-    m_duplicateCounts.clear();
-}
-
 void Document::removedLastRef()
 {
     ASSERT(!m_deletionHasBegun);
@@ -736,10 +739,7 @@ void Document::childrenChanged(bool changedByParser, Node* beforeChange, Node* a
 void Document::cacheDocumentElement() const
 {
     ASSERT(!m_documentElement);
-    Node* n = firstChild();
-    while (n && !n->isElementNode())
-        n = n->nextSibling();
-    m_documentElement = static_cast<Element*>(n);
+    m_documentElement = firstElementChild(this);
 }
 
 PassRefPtr<Element> Document::createElement(const AtomicString& name, ExceptionCode& ec)
@@ -1019,87 +1019,11 @@ PassRefPtr<Element> Document::createElementNS(const String& namespaceURI, const
     return createElement(qName, false);
 }
 
-inline void Document::DocumentOrderedMap::add(AtomicStringImpl* key, Element* element)
-{
-    ASSERT(key);
-    ASSERT(element);
-
-    if (!m_duplicateCounts.contains(key)) {
-        // Fast path. The key is not already in m_duplicateCounts, so we assume that it's
-        // also not already in m_map and try to add it. If that add succeeds, we're done.
-        pair<Map::iterator, bool> addResult = m_map.add(key, element);
-        if (addResult.second)
-            return;
-
-        // The add failed, so this key was already cached in m_map.
-        // There are multiple elements with this key. Remove the m_map
-        // cache for this key so get searches for it next time it is called.
-        m_map.remove(addResult.first);
-        m_duplicateCounts.add(key);
-    } else {
-        // There are multiple elements with this key. Remove the m_map
-        // cache for this key so get will search for it next time it is called.
-        Map::iterator cachedItem = m_map.find(key);
-        if (cachedItem != m_map.end()) {
-            m_map.remove(cachedItem);
-            m_duplicateCounts.add(key);
-        }
-    }
-
-    m_duplicateCounts.add(key);
-}
-
-inline void Document::DocumentOrderedMap::remove(AtomicStringImpl* key, Element* element)
-{
-    ASSERT(key);
-    ASSERT(element);
-
-    m_map.checkConsistency();
-    Map::iterator cachedItem = m_map.find(key);
-    if (cachedItem != m_map.end() && cachedItem->second == element)
-        m_map.remove(cachedItem);
-    else
-        m_duplicateCounts.remove(key);
-}
-
-template<bool keyMatches(AtomicStringImpl*, Element*)> inline Element* Document::DocumentOrderedMap::get(AtomicStringImpl* key, const Document* document) const
-{
-    ASSERT(key);
-
-    m_map.checkConsistency();
-
-    Element* element = m_map.get(key);
-    if (element)
-        return element;
-
-    if (m_duplicateCounts.contains(key)) {
-        // We know there's at least one node that matches; iterate to find the first one.
-        for (Node* node = document->firstChild(); node; node = node->traverseNextNode()) {
-            if (!node->isElementNode())
-                continue;
-            element = static_cast<Element*>(node);
-            if (!keyMatches(key, element))
-                continue;
-            m_duplicateCounts.remove(key);
-            m_map.set(key, element);
-            return element;
-        }
-        ASSERT_NOT_REACHED();
-    }
-
-    return 0;
-}
-
-inline bool keyMatchesId(AtomicStringImpl* key, Element* element)
-{
-    return element->hasID() && element->getIdAttribute().impl() == key;
-}
-
 Element* Document::getElementById(const AtomicString& elementId) const
 {
     if (elementId.isEmpty())
         return 0;
-    return m_elementsById.get<keyMatchesId>(elementId.impl(), this);
+    return m_elementsById.getElementById(elementId.impl(), this);
 }
 
 String Document::readyState() const
@@ -1209,7 +1133,7 @@ void Document::setContent(const String& content)
     open();
     m_parser->append(content);
     m_parser->finish();
-    close();
+    explicitClose();
 }
 
 // FIXME: We need to discuss the DOM API here at some point. Ideas:
@@ -2038,6 +1962,8 @@ void Document::open(Document* ownerDocument)
 
     removeAllEventListeners();
     implicitOpen();
+    if (ScriptableDocumentParser* parser = scriptableDocumentParser())
+        parser->setWasCreatedByScript(true);
 
     if (DOMWindow* domWindow = this->domWindow())
         domWindow->removeAllEventListeners();
@@ -2056,14 +1982,15 @@ void Document::detachParser()
 
 void Document::cancelParsing()
 {
-    if (m_parser) {
-        // We have to clear the parser to avoid possibly triggering
-        // the onload handler when closing as a side effect of a cancel-style
-        // change, such as opening a new document or closing the window while
-        // still parsing
-        detachParser();
-        close();
-    }
+    if (!m_parser)
+        return;
+
+    // We have to clear the parser to avoid possibly triggering
+    // the onload handler when closing as a side effect of a cancel-style
+    // change, such as opening a new document or closing the window while
+    // still parsing
+    detachParser();
+    explicitClose();
 }
 
 void Document::implicitOpen()
@@ -2078,10 +2005,6 @@ void Document::implicitOpen()
     setParsing(true);
     setReadyState(Loading);
 
-    ScriptableDocumentParser* parser = scriptableDocumentParser();
-    if (m_frame && parser)
-        parser->setXSSAuditor(m_frame->script()->xssAuditor());
-
     // If we reload, the animation controller sticks around and has
     // a stale animation time. We need to update it here.
     if (m_frame && m_frame->animation())
@@ -2098,12 +2021,12 @@ HTMLElement* Document::body() const
     Node* body = 0;
     for (Node* i = de->firstChild(); i; i = i->nextSibling()) {
         if (i->hasTagName(framesetTag))
-            return static_cast<HTMLElement*>(i);
+            return toHTMLElement(i);
         
         if (i->hasTagName(bodyTag) && !body)
             body = i;
     }
-    return static_cast<HTMLElement*>(body);
+    return toHTMLElement(body);
 }
 
 void Document::setBody(PassRefPtr<HTMLElement> newBody, ExceptionCode& ec)
@@ -2135,18 +2058,28 @@ HTMLHeadElement* Document::head()
 
 void Document::close()
 {
-    Frame* frame = this->frame();
-    if (frame) {
-        // This code calls implicitClose() if all loading has completed.
-        FrameLoader* frameLoader = frame->loader();
-        frameLoader->writer()->endIfNotLoadingMainResource();
-        frameLoader->checkCompleted();
-    } else {
+    // FIXME: We should follow the specification more closely:
+    //        http://www.whatwg.org/specs/web-apps/current-work/#dom-document-close
+
+    if (!scriptableDocumentParser() || !scriptableDocumentParser()->wasCreatedByScript())
+        return;
+
+    explicitClose();
+}
+
+void Document::explicitClose()
+{
+    if (!m_frame) {
         // Because we have no frame, we don't know if all loading has completed,
         // so we just call implicitClose() immediately. FIXME: This might fire
         // the load event prematurely <http://bugs.webkit.org/show_bug.cgi?id=14568>.
         implicitClose();
+        return;
     }
+
+    // This code calls implicitClose() if all loading has completed.
+    loader()->writer()->endIfNotLoadingMainResource();
+    m_frame->loader()->checkCompleted();
 }
 
 void Document::implicitClose()
@@ -2297,6 +2230,14 @@ int Document::elapsedTime() const
 
 void Document::write(const SegmentedString& text, Document* ownerDocument)
 {
+    NestingLevelIncrementer nestingLevelIncrementer(m_writeRecursionDepth);
+
+    m_writeRecursionIsTooDeep = (m_writeRecursionDepth > 1) && m_writeRecursionIsTooDeep;
+    m_writeRecursionIsTooDeep = (m_writeRecursionDepth > cMaxWriteRecursionDepth) || m_writeRecursionIsTooDeep;
+
+    if (m_writeRecursionIsTooDeep)
+       return;
+
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
     if (!ownerElement())
         printf("Beginning a document.write at %d\n", elapsedTime());
@@ -2421,7 +2362,7 @@ void Document::processBaseElement()
     KURL baseElementURL;
     if (href) {
         String strippedHref = stripLeadingAndTrailingHTMLSpaces(*href);
-        if (!strippedHref.isEmpty() && (!frame() || frame()->script()->xssAuditor()->canSetBaseElementURL(*href)))
+        if (!strippedHref.isEmpty())
             baseElementURL = KURL(url(), strippedHref);
     }
     if (m_baseElementURL != baseElementURL) {
@@ -2698,7 +2639,7 @@ void Document::processHttpEquiv(const String& equiv, const String& content)
         String url;
         if (frame && parseHTTPRefresh(content, true, delay, url)) {
             if (url.isEmpty())
-                url = frame->loader()->url().string();
+                url = m_url.string();
             else
                 url = completeURL(url).string();
             frame->navigationScheduler()->scheduleRedirect(delay, url);
@@ -2979,12 +2920,11 @@ void Document::removePendingSheet()
 
     styleSelectorChanged(RecalcStyleImmediately);
 
-    ScriptableDocumentParser* parser = scriptableDocumentParser();
-    if (parser)
+    if (ScriptableDocumentParser* parser = scriptableDocumentParser())
         parser->executeScriptsWaitingForStylesheets();
 
     if (m_gotoAnchorNeededAfterStylesheetsLoad && view())
-        view()->scrollToFragment(m_frame->loader()->url());
+        view()->scrollToFragment(m_url);
 }
 
 void Document::styleSelectorChanged(StyleSelectorUpdateFlag updateFlag)
@@ -3037,6 +2977,9 @@ void Document::styleSelectorChanged(StyleSelectorUpdateFlag updateFlag)
 
 void Document::addStyleSheetCandidateNode(Node* node, bool createdByParser)
 {
+    if (!node->inDocument())
+        return;
+    
     // Until the <body> exists, we have no choice but to compare document positions,
     // since styles outside of the body and head continue to be shunted into the head
     // (and thus can shift to end up before dynamically added DOM content that is also
@@ -3825,7 +3768,7 @@ String Document::lastModified() const
     DateComponents date;
     bool foundDate = false;
     if (m_frame) {
-        String httpLastModified = m_frame->loader()->documentLoader()->response().httpHeaderField("Last-Modified");
+        String httpLastModified = m_documentLoader->response().httpHeaderField("Last-Modified");
         if (!httpLastModified.isEmpty()) {
             date.setMillisecondsSinceEpochForDateTime(parseDate(httpLastModified));
             foundDate = true;
@@ -3957,16 +3900,6 @@ void Document::removeImageMap(HTMLMapElement* imageMap)
     m_imageMapsByName.remove(name, imageMap);
 }
 
-inline bool keyMatchesMapName(AtomicStringImpl* key, Element* element)
-{
-    return element->hasTagName(mapTag) && static_cast<HTMLMapElement*>(element)->getName().impl() == key;
-}
-
-inline bool keyMatchesLowercasedMapName(AtomicStringImpl* key, Element* element)
-{
-    return element->hasTagName(mapTag) && static_cast<HTMLMapElement*>(element)->getName().lower().impl() == key;
-}
-
 HTMLMapElement* Document::getImageMap(const String& url) const
 {
     if (url.isNull())
@@ -3974,8 +3907,8 @@ HTMLMapElement* Document::getImageMap(const String& url) const
     size_t hashPos = url.find('#');
     String name = (hashPos == notFound ? url : url.substring(hashPos + 1)).impl();
     if (isHTMLDocument())
-        return static_cast<HTMLMapElement*>(m_imageMapsByName.get<keyMatchesLowercasedMapName>(AtomicString(name.lower()).impl(), this));
-    return static_cast<HTMLMapElement*>(m_imageMapsByName.get<keyMatchesMapName>(AtomicString(name).impl(), this));
+        return static_cast<HTMLMapElement*>(m_imageMapsByName.getElementByLowercasedMapName(AtomicString(name.lower()).impl(), this));
+    return static_cast<HTMLMapElement*>(m_imageMapsByName.getElementByMapName(AtomicString(name).impl(), this));
 }
 
 void Document::setDecoder(PassRefPtr<TextResourceDecoder> decoder)
@@ -4338,7 +4271,7 @@ void Document::finishedParsing()
 
         f->loader()->finishedParsing();
 
-        InspectorInstrumentation::mainResourceFiredDOMContentEvent(f, url());
+        InspectorInstrumentation::domContentLoadedEventFired(f, url());
     }
 }
 
@@ -4551,8 +4484,7 @@ void Document::initSecurityContext()
         // load local resources.  See https://bugs.webkit.org/show_bug.cgi?id=16756
         // and https://bugs.webkit.org/show_bug.cgi?id=19760 for further
         // discussion.
-        DocumentLoader* documentLoader = m_frame->loader()->documentLoader();
-        if (documentLoader && documentLoader->substituteData().isValid())
+        if (m_documentLoader->substituteData().isValid())
             securityOrigin()->grantLoadLocalResources();
     }
 
@@ -4629,10 +4561,9 @@ void Document::updateURLForPushOrReplaceState(const KURL& url)
     if (!f)
         return;
 
-    // FIXME: Eliminate this redundancy.
     setURL(url);
-    f->loader()->setURL(url);
-    f->loader()->documentLoader()->replaceRequestURLForSameDocumentNavigation(url);
+    f->loader()->setOutgoingReferrer(url);
+    m_documentLoader->replaceRequestURLForSameDocumentNavigation(url);
 }
 
 void Document::statePopped(SerializedScriptValue* stateObject)
@@ -5048,7 +4979,7 @@ void Document::webkitCancelRequestAnimationFrame(int id)
     }
 }
 
-void Document::serviceScriptedAnimations()
+void Document::serviceScriptedAnimations(DOMTimeStamp time)
 {
     if (!m_requestAnimationFrameCallbacks)
         return;
@@ -5076,7 +5007,7 @@ void Document::serviceScriptedAnimations()
             RequestAnimationFrameCallback* callback = callbacks[i].get();
             if (!callback->m_firedOrCancelled && (!callback->m_element || callback->m_element->renderer())) {
                 callback->m_firedOrCancelled = true;
-                callback->handleEvent();
+                callback->handleEvent(time);
                 firedCallback = true;
                 callbacks.remove(i);
                 break;
diff --git a/Source/WebCore/dom/Document.h b/Source/WebCore/dom/Document.h
index c9c8d38..9ace93d 100644
--- a/Source/WebCore/dom/Document.h
+++ b/Source/WebCore/dom/Document.h
@@ -32,15 +32,19 @@
 #include "CollectionType.h"
 #include "Color.h"
 #include "ContainerNode.h"
+#include "ContentSecurityPolicy.h"
+#include "DOMTimeStamp.h"
+#include "DocumentLoader.h"
+#include "DocumentOrderedMap.h"
 #include "DocumentTiming.h"
 #include "QualifiedName.h"
 #include "ScriptExecutionContext.h"
 #include "Timer.h"
 #include "ViewportArguments.h"
 #include <wtf/FixedArray.h>
-#include <wtf/HashCountedSet.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
 
 #if USE(JSC)
 #include <runtime/WeakGCMap.h>
@@ -347,7 +351,6 @@ public:
 
     String defaultCharset() const;
     
-    // Synonyms backing similar DOM attributes. Use Document::encoding() to avoid virtual dispatch.
     String inputEncoding() const { return Document::encoding(); }
     String charset() const { return Document::encoding(); }
     String characterSet() const { return Document::encoding(); }
@@ -429,6 +432,7 @@ public:
 #endif
     virtual bool isFrameSet() const { return false; }
     
+    CSSStyleSelector* styleSelectorIfExists() const { return m_styleSelector.get(); }
     CSSStyleSelector* styleSelector()
     { 
         if (!m_styleSelector)
@@ -554,11 +558,22 @@ public:
     // to get visually ordered hebrew and arabic pages right
     void setVisuallyOrdered();
     bool visuallyOrdered() const { return m_visuallyOrdered; }
+    
+    void setDocumentLoader(DocumentLoader* documentLoader) { m_documentLoader = documentLoader; }
+    DocumentLoader* loader() const { return m_documentLoader; }
 
     void open(Document* ownerDocument = 0);
     void implicitOpen();
+
+    // close() is the DOM API document.close()
     void close();
+    // In some situations (see the code), we ignore document.close().
+    // explicitClose() bypass these checks and actually tries to close the
+    // input stream.
+    void explicitClose();
+    // implicitClose() actually does the work of closing the input stream.
     void implicitClose();
+
     void cancelParsing();
 
     void write(const SegmentedString& text, Document* ownerDocument = 0);
@@ -952,7 +967,7 @@ public:
     virtual void postTask(PassOwnPtr<Task>); // Executes the task on context's thread asynchronously.
 
 #if USE(JSC)
-    typedef JSC::WeakGCMap<WebCore::Node*, JSNode*> JSWrapperCache;
+    typedef JSC::WeakGCMap<WebCore::Node*, JSNode> JSWrapperCache;
     typedef HashMap<DOMWrapperWorld*, JSWrapperCache*> JSWrapperCacheMap;
     JSWrapperCacheMap& wrapperCacheMap() { return m_wrapperCacheMap; }
     JSWrapperCache* getWrapperCache(DOMWrapperWorld* world);
@@ -1091,7 +1106,7 @@ public:
 #if ENABLE(REQUEST_ANIMATION_FRAME)
     int webkitRequestAnimationFrame(PassRefPtr<RequestAnimationFrameCallback>, Element*);
     void webkitCancelRequestAnimationFrame(int id);
-    void serviceScriptedAnimations();
+    void serviceScriptedAnimations(DOMTimeStamp);
 #endif
 
     bool mayCauseFlashOfUnstyledContent() const;
@@ -1101,35 +1116,15 @@ public:
 
     void initDNSPrefetch();
 
+    ContentSecurityPolicy* contentSecurityPolicy() { return &m_contentSecurityPolicy; }
+
 protected:
-    Document(Frame*, const KURL& url, bool isXHTML, bool isHTML, const KURL& baseURL = KURL());
+    Document(Frame*, const KURL&, bool isXHTML, bool isHTML);
 
     void clearXMLVersion() { m_xmlVersion = String(); }
 
 
 private:
-    class DocumentOrderedMap {
-    public:
-        void add(AtomicStringImpl*, Element*);
-        void remove(AtomicStringImpl*, Element*);
-        void clear();
-
-        bool contains(AtomicStringImpl*) const;
-        bool containsMultiple(AtomicStringImpl*) const;
-        template<bool keyMatches(AtomicStringImpl*, Element*)> Element* get(AtomicStringImpl*, const Document*) const;
-
-        void checkConsistency() const;
-
-    private:
-        typedef HashMap<AtomicStringImpl*, Element*> Map;
-
-        // We maintain the invariant that m_duplicateCounts is the count of all elements with a given key
-        // excluding the one referenced in m_map, if any. This means it one less than the total count
-        // when the first node with a given key is cached, otherwise the same as the total count.
-        mutable Map m_map;
-        mutable HashCountedSet<AtomicStringImpl*> m_duplicateCounts;
-    };
-
     friend class IgnoreDestructiveWriteCountIncrementer;
 
     void detachParser();
@@ -1172,6 +1167,7 @@ private:
     bool m_didCalculateStyleSelector;
 
     Frame* m_frame;
+    DocumentLoader* m_documentLoader;
     OwnPtr<CachedResourceLoader> m_cachedResourceLoader;
     RefPtr<DocumentParser> m_parser;
     bool m_wellFormed;
@@ -1422,23 +1418,17 @@ private:
 
     DocumentTiming m_documentTiming;
     RefPtr<MediaQueryMatcher> m_mediaQueryMatcher;
+    bool m_writeRecursionIsTooDeep;
+    unsigned m_writeRecursionDepth;
 
 #if ENABLE(REQUEST_ANIMATION_FRAME)
     typedef Vector<RefPtr<RequestAnimationFrameCallback> > RequestAnimationFrameCallbackList;
     OwnPtr<RequestAnimationFrameCallbackList> m_requestAnimationFrameCallbacks;
     int m_nextRequestAnimationFrameCallbackId;
 #endif
-};
 
-inline bool Document::DocumentOrderedMap::contains(AtomicStringImpl* id) const
-{
-    return m_map.contains(id) || m_duplicateCounts.contains(id);
-}
-
-inline bool Document::DocumentOrderedMap::containsMultiple(AtomicStringImpl* id) const
-{
-    return m_duplicateCounts.contains(id);
-}
+    ContentSecurityPolicy m_contentSecurityPolicy;
+};
 
 inline bool Document::hasElementWithId(AtomicStringImpl* id) const
 {
diff --git a/Source/WebCore/dom/DocumentMarker.h b/Source/WebCore/dom/DocumentMarker.h
index 2be60f8..76b85bb 100644
--- a/Source/WebCore/dom/DocumentMarker.h
+++ b/Source/WebCore/dom/DocumentMarker.h
@@ -37,10 +37,20 @@ struct DocumentMarker {
         Spelling = 1 << 0,
         Grammar = 1 << 1,
         TextMatch = 1 << 2,
+        // Text has been modified by spell correction. On some platforms, this prevents the text
+        // to be autocorrected again.
         Replacement = 1 << 3,
+        // Renderer needs to add underline indicating that the text has been modified by spell
+        // correction. Text with Replacement marker doesn't necessarily has CorrectionIndicator
+        // marker. For instance, after some text has been corrected, it will have both Replacement
+        // and CorrectionIndicator. However, if user further modifies such text, we would remove
+        // CorrectionIndicator marker, but retain Replacement marker.
         CorrectionIndicator = 1 << 4,
+        // Correction suggestion has been offered, but got rejected by user.
         RejectedCorrection = 1 << 5,
-        AllMarkers = Spelling | Grammar | TextMatch | Replacement | CorrectionIndicator | RejectedCorrection
+        // On some platforms, this prevents the text to be spellchecked again.
+        SpellCheckingExemption = 1 << 6,
+        AllMarkers = Spelling | Grammar | TextMatch | Replacement | CorrectionIndicator | RejectedCorrection | SpellCheckingExemption
     };
     MarkerType type;
     typedef unsigned MarkerTypes;
diff --git a/Source/WebCore/dom/DocumentMarkerController.cpp b/Source/WebCore/dom/DocumentMarkerController.cpp
index 5f88631..1bc7cb4 100644
--- a/Source/WebCore/dom/DocumentMarkerController.cpp
+++ b/Source/WebCore/dom/DocumentMarkerController.cpp
@@ -57,21 +57,16 @@ void DocumentMarkerController::addMarker(Range* range, DocumentMarker::MarkerTyp
     }
 }
 
-void DocumentMarkerController::removeMarkers(Range* range, DocumentMarker::MarkerType markerType)
+void DocumentMarkerController::removeMarkers(Range* range, DocumentMarker::MarkerTypes markerTypes, RemovePartiallyOverlappingMarkerOrNot shouldRemovePartiallyOverlappingMarker)
 {
     if (m_markers.isEmpty())
         return;
 
-    ExceptionCode ec = 0;
-    Node* startContainer = range->startContainer(ec);
-    Node* endContainer = range->endContainer(ec);
-
-    Node* pastLastNode = range->pastLastNode();
-    for (Node* node = range->firstNode(); node != pastLastNode; node = node->traverseNextNode()) {
-        int startOffset = node == startContainer ? range->startOffset(ec) : 0;
-        int endOffset = node == endContainer ? range->endOffset(ec) : INT_MAX;
-        int length = endOffset - startOffset;
-        removeMarkers(node, startOffset, length, markerType);
+    for (TextIterator markedText(range); !markedText.atEnd(); markedText.advance()) {
+        RefPtr<Range> textPiece = markedText.range();
+        int startOffset = textPiece->startOffset();
+        int endOffset = textPiece->endOffset();
+        removeMarkers(textPiece->startContainer(), startOffset, endOffset - startOffset, markerTypes, shouldRemovePartiallyOverlappingMarker);
     }
 }
 
@@ -185,7 +180,7 @@ void DocumentMarkerController::copyMarkers(Node* srcNode, unsigned startOffset,
         dstNode->renderer()->repaint();
 }
 
-void DocumentMarkerController::removeMarkers(Node* node, unsigned startOffset, int length, DocumentMarker::MarkerType markerType)
+void DocumentMarkerController::removeMarkers(Node* node, unsigned startOffset, int length, DocumentMarker::MarkerTypes markerTypes, RemovePartiallyOverlappingMarkerOrNot shouldRemovePartiallyOverlappingMarker)
 {
     if (length <= 0)
         return;
@@ -207,7 +202,7 @@ void DocumentMarkerController::removeMarkers(Node* node, unsigned startOffset, i
             break;
 
         // skip marker that is wrong type or before target
-        if (marker.endOffset < startOffset || (marker.type != markerType && markerType != DocumentMarker::AllMarkers)) {
+        if (marker.endOffset <= startOffset || !(marker.type & markerTypes)) {
             i++;
             continue;
         }
@@ -219,6 +214,10 @@ void DocumentMarkerController::removeMarkers(Node* node, unsigned startOffset, i
         markers.remove(i);
         rects.remove(i);
 
+        if (shouldRemovePartiallyOverlappingMarker)
+            // Stop here. Don't add resulting slices back.
+            continue;
+
         // add either of the resulting slices that are left after removing target
         if (startOffset > marker.startOffset) {
             DocumentMarker newLeft = marker;
@@ -321,14 +320,14 @@ Vector<IntRect> DocumentMarkerController::renderedRectsForMarkers(DocumentMarker
     return result;
 }
 
-void DocumentMarkerController::removeMarkers(Node* node, DocumentMarker::MarkerType markerType)
+void DocumentMarkerController::removeMarkers(Node* node, DocumentMarker::MarkerTypes markerTypes)
 {
     MarkerMap::iterator iterator = m_markers.find(node);
     if (iterator != m_markers.end())
-        removeMarkersFromMarkerMapVectorPair(node, iterator->second, markerType);
+        removeMarkersFromMarkerMapVectorPair(node, iterator->second, markerTypes);
 }
 
-void DocumentMarkerController::removeMarkers(DocumentMarker::MarkerType markerType)
+void DocumentMarkerController::removeMarkers(DocumentMarker::MarkerTypes markerTypes)
 {
     // outer loop: process each markered node in the document
     MarkerMap markerMapCopy = m_markers;
@@ -336,14 +335,14 @@ void DocumentMarkerController::removeMarkers(DocumentMarker::MarkerType markerTy
     for (MarkerMap::iterator i = markerMapCopy.begin(); i != end; ++i) {
         Node* node = i->first.get();
         MarkerMapVectorPair* vectorPair = i->second;
-        removeMarkersFromMarkerMapVectorPair(node, vectorPair, markerType);
+        removeMarkersFromMarkerMapVectorPair(node, vectorPair, markerTypes);
     }
 }
 
 // This function may release node and vectorPair.
-void DocumentMarkerController::removeMarkersFromMarkerMapVectorPair(Node* node, MarkerMapVectorPair* vectorPair, DocumentMarker::MarkerType markerType)
+void DocumentMarkerController::removeMarkersFromMarkerMapVectorPair(Node* node, MarkerMapVectorPair* vectorPair, DocumentMarker::MarkerTypes markerTypes)
 {
-    if (markerType == DocumentMarker::AllMarkers) {
+    if (!~(markerTypes & DocumentMarker::AllMarkers)) {
         delete vectorPair;
         m_markers.remove(node);
         if (RenderObject* renderer = node->renderer())
@@ -357,7 +356,7 @@ void DocumentMarkerController::removeMarkersFromMarkerMapVectorPair(Node* node,
             DocumentMarker marker = markers[i];
 
             // skip nodes that are not of the specified type
-            if (marker.type != markerType) {
+            if (!(marker.type & markerTypes)) {
                 ++i;
                 continue;
             }
@@ -566,7 +565,6 @@ bool DocumentMarkerController::hasMarkers(Range* range, DocumentMarker::MarkerTy
     }
     return false;
 }
-
 #ifndef NDEBUG
 void DocumentMarkerController::showMarkers() const
 {
diff --git a/Source/WebCore/dom/DocumentMarkerController.h b/Source/WebCore/dom/DocumentMarkerController.h
index 2dc2b9e..21b351b 100644
--- a/Source/WebCore/dom/DocumentMarkerController.h
+++ b/Source/WebCore/dom/DocumentMarkerController.h
@@ -49,10 +49,16 @@ public:
     void addMarker(Node*, DocumentMarker);
     void copyMarkers(Node* srcNode, unsigned startOffset, int length, Node* dstNode, int delta, DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
     bool hasMarkers(Range*, DocumentMarker::MarkerTypes = DocumentMarker::AllMarkers);
-    void removeMarkers(Range*, DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
-    void removeMarkers(Node*, unsigned startOffset, int length, DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
-    void removeMarkers(DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
-    void removeMarkers(Node*, DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
+
+    // When a marker partially overlaps with range, if removePartiallyOverlappingMarkers is true, we completely
+    // remove the marker. If the argument is false, we will adjust the span of the marker so that it retains
+    // the portion that is outside of the range.
+    enum RemovePartiallyOverlappingMarkerOrNot { DoNotRemovePartiallyOverlappingMarker, RemovePartiallyOverlappingMarker };
+    void removeMarkers(Range*, DocumentMarker::MarkerTypes = DocumentMarker::AllMarkers, RemovePartiallyOverlappingMarkerOrNot = DoNotRemovePartiallyOverlappingMarker);
+    void removeMarkers(Node*, unsigned startOffset, int length, DocumentMarker::MarkerTypes = DocumentMarker::AllMarkers,  RemovePartiallyOverlappingMarkerOrNot = DoNotRemovePartiallyOverlappingMarker);
+
+    void removeMarkers(DocumentMarker::MarkerTypes = DocumentMarker::AllMarkers);
+    void removeMarkers(Node*, DocumentMarker::MarkerTypes = DocumentMarker::AllMarkers);
     void repaintMarkers(DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
     void setRenderedRectForMarker(Node*, const DocumentMarker&, const IntRect&);
     void invalidateRenderedRectsForMarkersInRect(const IntRect&);
@@ -72,7 +78,7 @@ private:
     typedef std::pair<Vector<DocumentMarker>, Vector<IntRect> > MarkerMapVectorPair;
     typedef HashMap<RefPtr<Node>, MarkerMapVectorPair*> MarkerMap;
     MarkerMap m_markers;
-    void removeMarkersFromMarkerMapVectorPair(Node*, MarkerMapVectorPair*, DocumentMarker::MarkerType);
+    void removeMarkersFromMarkerMapVectorPair(Node*, MarkerMapVectorPair*, DocumentMarker::MarkerTypes);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/DocumentOrderedMap.cpp b/Source/WebCore/dom/DocumentOrderedMap.cpp
new file mode 100644
index 0000000..787fcf4
--- /dev/null
+++ b/Source/WebCore/dom/DocumentOrderedMap.cpp
@@ -0,0 +1,151 @@
+/*
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DocumentOrderedMap.h"
+
+#include "Element.h"
+#include "HTMLMapElement.h"
+#include "HTMLNames.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+inline bool keyMatchesId(AtomicStringImpl* key, Element* element)
+{
+    return element->hasID() && element->getIdAttribute().impl() == key;
+}
+
+inline bool keyMatchesMapName(AtomicStringImpl* key, Element* element)
+{
+    return element->hasTagName(mapTag) && static_cast<HTMLMapElement*>(element)->getName().impl() == key;
+}
+
+inline bool keyMatchesLowercasedMapName(AtomicStringImpl* key, Element* element)
+{
+    return element->hasTagName(mapTag) && static_cast<HTMLMapElement*>(element)->getName().lower().impl() == key;
+}
+
+void DocumentOrderedMap::clear()
+{
+    m_map.clear();
+    m_duplicateCounts.clear();
+}
+
+void DocumentOrderedMap::add(AtomicStringImpl* key, Element* element)
+{
+    ASSERT(key);
+    ASSERT(element);
+
+    if (!m_duplicateCounts.contains(key)) {
+        // Fast path. The key is not already in m_duplicateCounts, so we assume that it's
+        // also not already in m_map and try to add it. If that add succeeds, we're done.
+        pair<Map::iterator, bool> addResult = m_map.add(key, element);
+        if (addResult.second)
+            return;
+
+        // The add failed, so this key was already cached in m_map.
+        // There are multiple elements with this key. Remove the m_map
+        // cache for this key so get searches for it next time it is called.
+        m_map.remove(addResult.first);
+        m_duplicateCounts.add(key);
+    } else {
+        // There are multiple elements with this key. Remove the m_map
+        // cache for this key so get will search for it next time it is called.
+        Map::iterator cachedItem = m_map.find(key);
+        if (cachedItem != m_map.end()) {
+            m_map.remove(cachedItem);
+            m_duplicateCounts.add(key);
+        }
+    }
+
+    m_duplicateCounts.add(key);
+}
+
+void DocumentOrderedMap::remove(AtomicStringImpl* key, Element* element)
+{
+    ASSERT(key);
+    ASSERT(element);
+
+    m_map.checkConsistency();
+    Map::iterator cachedItem = m_map.find(key);
+    if (cachedItem != m_map.end() && cachedItem->second == element)
+        m_map.remove(cachedItem);
+    else
+        m_duplicateCounts.remove(key);
+}
+
+template<bool keyMatches(AtomicStringImpl*, Element*)>
+inline Element* DocumentOrderedMap::get(AtomicStringImpl* key, const Document* document) const
+{
+    ASSERT(key);
+
+    m_map.checkConsistency();
+
+    Element* element = m_map.get(key);
+    if (element)
+        return element;
+
+    if (m_duplicateCounts.contains(key)) {
+        // We know there's at least one node that matches; iterate to find the first one.
+        for (Node* node = document->firstChild(); node; node = node->traverseNextNode()) {
+            if (!node->isElementNode())
+                continue;
+            element = static_cast<Element*>(node);
+            if (!keyMatches(key, element))
+                continue;
+            m_duplicateCounts.remove(key);
+            m_map.set(key, element);
+            return element;
+        }
+        ASSERT_NOT_REACHED();
+    }
+
+    return 0;
+}
+
+Element* DocumentOrderedMap::getElementById(AtomicStringImpl* key, const Document* document) const
+{
+    return get<keyMatchesId>(key, document);
+}
+
+Element* DocumentOrderedMap::getElementByMapName(AtomicStringImpl* key, const Document* document) const
+{
+    return get<keyMatchesMapName>(key, document);
+}
+
+Element* DocumentOrderedMap::getElementByLowercasedMapName(AtomicStringImpl* key, const Document* document) const
+{
+    return get<keyMatchesLowercasedMapName>(key, document);
+}
+
+} // namespace WebCore
+
diff --git a/Source/WebCore/dom/DocumentOrderedMap.h b/Source/WebCore/dom/DocumentOrderedMap.h
new file mode 100644
index 0000000..58767c6
--- /dev/null
+++ b/Source/WebCore/dom/DocumentOrderedMap.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DocumentOrderedMap_h
+#define DocumentOrderedMap_h
+
+#include <wtf/HashCountedSet.h>
+#include <wtf/HashMap.h>
+#include <wtf/text/AtomicStringImpl.h>
+
+namespace WebCore {
+
+class Document;
+class Element;
+
+class DocumentOrderedMap {
+public:
+    void add(AtomicStringImpl*, Element*);
+    void remove(AtomicStringImpl*, Element*);
+    void clear();
+
+    bool contains(AtomicStringImpl*) const;
+    bool containsMultiple(AtomicStringImpl*) const;
+    // concrete instantiations of the get<>() method template
+    Element* getElementById(AtomicStringImpl*, const Document*) const;
+    Element* getElementByMapName(AtomicStringImpl*, const Document*) const;
+    Element* getElementByLowercasedMapName(AtomicStringImpl*, const Document*) const;
+
+    void checkConsistency() const;
+
+private:
+    template<bool keyMatches(AtomicStringImpl*, Element*)> Element* get(AtomicStringImpl*, const Document*) const;
+
+    typedef HashMap<AtomicStringImpl*, Element*> Map;
+
+    // We maintain the invariant that m_duplicateCounts is the count of all elements with a given key
+    // excluding the one referenced in m_map, if any. This means it one less than the total count
+    // when the first node with a given key is cached, otherwise the same as the total count.
+    mutable Map m_map;
+    mutable HashCountedSet<AtomicStringImpl*> m_duplicateCounts;
+};
+
+inline bool DocumentOrderedMap::contains(AtomicStringImpl* id) const
+{
+    return m_map.contains(id) || m_duplicateCounts.contains(id);
+}
+
+inline bool DocumentOrderedMap::containsMultiple(AtomicStringImpl* id) const
+{
+    return m_duplicateCounts.contains(id);
+}
+
+} // namespace WebCore
+
+#endif // DocumentOrderedMap_h
+
diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
index 276a409..142febd 100644
--- a/Source/WebCore/dom/Element.cpp
+++ b/Source/WebCore/dom/Element.cpp
@@ -68,6 +68,34 @@ namespace WebCore {
 using namespace HTMLNames;
 using namespace XMLNames;
     
+class StyleSelectorParentPusher {
+public:
+    StyleSelectorParentPusher(Element* parent)
+        : m_parent(parent)
+        , m_pushedStyleSelector(0)
+    {
+    }
+    void push()
+    {
+        if (m_pushedStyleSelector)
+            return;
+        m_pushedStyleSelector = m_parent->document()->styleSelector();
+        m_pushedStyleSelector->pushParent(m_parent);
+    }
+    ~StyleSelectorParentPusher() 
+    {
+
+        if (!m_pushedStyleSelector)
+            return;
+        ASSERT(m_pushedStyleSelector == m_parent->document()->styleSelector());
+        m_pushedStyleSelector->popParent(m_parent); 
+    }
+
+private:
+    Element* m_parent;
+    CSSStyleSelector* m_pushedStyleSelector;
+};
+
 PassRefPtr<Element> Element::create(const QualifiedName& tagName, Document* document)
 {
     return adoptRef(new Element(tagName, document, CreateElement));
@@ -124,7 +152,7 @@ PassRefPtr<DocumentFragment> Element::deprecatedCreateContextualFragment(const S
     for (RefPtr<Node> node = fragment->firstChild(); node; node = nextNode) {
         nextNode = node->nextSibling();
         if (node->hasTagName(htmlTag) || node->hasTagName(bodyTag)) {
-            HTMLElement* element = static_cast<HTMLElement*>(node.get());
+            HTMLElement* element = toHTMLElement(node.get());
             Node* firstChild = element->firstChild();
             if (firstChild)
                 nextNode = firstChild;
@@ -917,9 +945,15 @@ void Element::attach()
     RenderWidget::suspendWidgetHierarchyUpdates();
 
     createRendererIfNeeded();
+    
+    StyleSelectorParentPusher parentPusher(this);
+    if (firstChild())
+        parentPusher.push();
     ContainerNode::attach();
-    if (Node* shadow = shadowRoot())
+    if (Node* shadow = shadowRoot()) {
+        parentPusher.push();
         shadow->attach();
+    }
     if (hasRareData()) {   
         ElementRareData* data = rareData();
         if (data->needsFocusAppearanceUpdateSoonAfterAttach()) {
@@ -1075,7 +1109,7 @@ void Element::recalcStyle(StyleChange change)
                 change = ch;
         }
     }
-
+    StyleSelectorParentPusher parentPusher(this);
     // FIXME: This check is good enough for :hover + foo, but it is not good enough for :hover + foo + bar.
     // For now we will just worry about the common case, since it's a lot trickier to get the second case right
     // without doing way too much re-resolution.
@@ -1084,15 +1118,19 @@ void Element::recalcStyle(StyleChange change)
         bool childRulesChanged = n->needsStyleRecalc() && n->styleChangeType() == FullStyleChange;
         if (forceCheckOfNextElementSibling && n->isElementNode())
             n->setNeedsStyleRecalc();
-        if (change >= Inherit || n->isTextNode() || n->childNeedsStyleRecalc() || n->needsStyleRecalc())
+        if (change >= Inherit || n->isTextNode() || n->childNeedsStyleRecalc() || n->needsStyleRecalc()) {
+            parentPusher.push();
             n->recalcStyle(change);
+        }
         if (n->isElementNode())
             forceCheckOfNextElementSibling = childRulesChanged && hasDirectAdjacentRules;
     }
     // FIXME: This does not care about sibling combinators. Will be necessary in XBL2 world.
     if (Node* shadow = shadowRoot()) {
-        if (change >= Inherit || shadow->isTextNode() || shadow->childNeedsStyleRecalc() || shadow->needsStyleRecalc())
+        if (change >= Inherit || shadow->isTextNode() || shadow->childNeedsStyleRecalc() || shadow->needsStyleRecalc()) {
+            parentPusher.push();
             shadow->recalcStyle(change);
+        }
     }
 
     clearNeedsStyleRecalc();
@@ -1238,12 +1276,22 @@ void Element::childrenChanged(bool changedByParser, Node* beforeChange, Node* af
     if (!changedByParser)
         checkForSiblingStyleChanges(this, renderStyle(), false, beforeChange, afterChange, childCountDelta);
 }
+    
+void Element::beginParsingChildren()
+{
+    clearIsParsingChildrenFinished();
+    CSSStyleSelector* styleSelector = document()->styleSelectorIfExists();
+    if (styleSelector && attached())
+        styleSelector->pushParent(this);
+}
 
 void Element::finishParsingChildren()
 {
     ContainerNode::finishParsingChildren();
     setIsParsingChildrenFinished();
     checkForSiblingStyleChanges(this, renderStyle(), true, lastChild(), 0, 0);
+    if (CSSStyleSelector* styleSelector = document()->styleSelectorIfExists())
+        styleSelector->popParent(this);
 }
 
 void Element::dispatchAttrRemovalEvent(Attribute*)
@@ -1632,10 +1680,7 @@ void Element::normalizeAttributes()
 // ElementTraversal API
 Element* Element::firstElementChild() const
 {
-    Node* n = firstChild();
-    while (n && !n->isElementNode())
-        n = n->nextSibling();
-    return static_cast<Element*>(n);
+    return WebCore::firstElementChild(this);
 }
 
 Element* Element::lastElementChild() const
diff --git a/Source/WebCore/dom/Element.h b/Source/WebCore/dom/Element.h
index 4510478..a85f8cd 100644
--- a/Source/WebCore/dom/Element.h
+++ b/Source/WebCore/dom/Element.h
@@ -232,7 +232,7 @@ public:
 
     Node* shadowRoot();
     void setShadowRoot(PassRefPtr<Node>);
-    virtual AtomicString shadowPseudoId() const;
+    virtual const AtomicString& shadowPseudoId() const;
 
     RenderStyle* computedStyle(PseudoId = NOPSEUDO);
 
@@ -276,7 +276,7 @@ public:
 
     bool isFinishedParsingChildren() const { return isParsingChildrenFinished(); }
     virtual void finishParsingChildren();
-    virtual void beginParsingChildren() { clearIsParsingChildrenFinished(); }
+    virtual void beginParsingChildren();
 
     // ElementTraversal API
     Element* firstElementChild() const;
@@ -510,9 +510,18 @@ inline void Element::setIdAttribute(const AtomicString& value)
     setAttribute(document()->idAttributeName(), value);
 }
 
-inline AtomicString Element::shadowPseudoId() const
+inline const AtomicString& Element::shadowPseudoId() const
 {
-    return AtomicString();
+    return nullAtom;
+}
+    
+inline Element* firstElementChild(const ContainerNode* container)
+{
+    ASSERT_ARG(container, container);
+    Node* child = container->firstChild();
+    while (child && !child->isElementNode())
+        child = child->nextSibling();
+    return static_cast<Element*>(child);
 }
 
 } // namespace
diff --git a/Source/WebCore/dom/Event.cpp b/Source/WebCore/dom/Event.cpp
index 0e11c69..bdc1c58 100644
--- a/Source/WebCore/dom/Event.cpp
+++ b/Source/WebCore/dom/Event.cpp
@@ -193,6 +193,16 @@ bool Event::isStorageEvent() const
 #endif
 
 #if ENABLE(INDEXED_DATABASE)
+bool Event::isIDBAbortEvent() const
+{
+    return false;
+}
+
+bool Event::isIDBCompleteEvent() const
+{
+    return false;
+}
+
 bool Event::isIDBErrorEvent() const
 {
     return false;
diff --git a/Source/WebCore/dom/Event.h b/Source/WebCore/dom/Event.h
index 45b879d..81f9e6b 100644
--- a/Source/WebCore/dom/Event.h
+++ b/Source/WebCore/dom/Event.h
@@ -126,6 +126,8 @@ namespace WebCore {
         virtual bool isStorageEvent() const;
 #endif
 #if ENABLE(INDEXED_DATABASE)
+        virtual bool isIDBAbortEvent() const;
+        virtual bool isIDBCompleteEvent() const;
         virtual bool isIDBErrorEvent() const;
         virtual bool isIDBSuccessEvent() const;
 #endif
diff --git a/Source/WebCore/dom/EventQueue.cpp b/Source/WebCore/dom/EventQueue.cpp
index a43929e..5a1abe8 100644
--- a/Source/WebCore/dom/EventQueue.cpp
+++ b/Source/WebCore/dom/EventQueue.cpp
@@ -28,24 +28,41 @@
 #include "EventQueue.h"
 
 #include "DOMWindow.h"
-#include "Document.h"
 #include "Event.h"
 #include "EventNames.h"
+#include "ScriptExecutionContext.h"
+#include "SuspendableTimer.h"
 
 namespace WebCore {
 
-EventQueue::EventQueue()
-    : m_pendingEventTimer(this, &EventQueue::pendingEventTimerFired)
+class EventQueueTimer : public SuspendableTimer {
+    WTF_MAKE_NONCOPYABLE(EventQueueTimer);
+public:
+    EventQueueTimer(EventQueue* eventQueue, ScriptExecutionContext* context)
+        : SuspendableTimer(context)
+        , m_eventQueue(eventQueue) { }
+
+private:
+    virtual void fired() { m_eventQueue->pendingEventTimerFired(); }
+    EventQueue* m_eventQueue;    
+};
+
+EventQueue::EventQueue(ScriptExecutionContext* context)
+    : m_pendingEventTimer(adoptPtr(new EventQueueTimer(this, context)))
+{
+}
+
+EventQueue::~EventQueue()
 {
 }
 
 void EventQueue::enqueueEvent(PassRefPtr<Event> event)
 {
-    ASSERT(event->target()->toNode() || event->target()->toDOMWindow());
+    ASSERT(event->target());
     m_queuedEvents.append(event);
     
-    if (!m_pendingEventTimer.isActive())
-        m_pendingEventTimer.startOneShot(0);
+    if (!m_pendingEventTimer->isActive())
+        m_pendingEventTimer->startOneShot(0);
 }
 
 void EventQueue::enqueueScrollEvent(PassRefPtr<Node> target, ScrollEventTargetType targetType)
@@ -60,9 +77,9 @@ void EventQueue::enqueueScrollEvent(PassRefPtr<Node> target, ScrollEventTargetTy
     enqueueEvent(scrollEvent.release());
 }
 
-void EventQueue::pendingEventTimerFired(Timer<EventQueue>*)
+void EventQueue::pendingEventTimerFired()
 {
-    ASSERT(!m_pendingEventTimer.isActive());
+    ASSERT(!m_pendingEventTimer->isActive());
 
     Vector<RefPtr<Event> > queuedEvents;
     queuedEvents.swap(m_queuedEvents);
@@ -81,7 +98,7 @@ void EventQueue::dispatchEvent(PassRefPtr<Event> event)
     else if (eventTarget->toDOMWindow())
         eventTarget->toDOMWindow()->dispatchEvent(event, 0);
     else
-        ASSERT_NOT_REACHED();
+        eventTarget->dispatchEvent(event);
 }
 
 }
diff --git a/Source/WebCore/dom/EventQueue.h b/Source/WebCore/dom/EventQueue.h
index 7f8d5fb..a589ed8 100644
--- a/Source/WebCore/dom/EventQueue.h
+++ b/Source/WebCore/dom/EventQueue.h
@@ -27,38 +27,51 @@
 #ifndef EventQueue_h
 #define EventQueue_h
 
-#include "Timer.h"
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
 
 class Event;
+class EventQueueTimer;
 class Node;
+class ScriptExecutionContext;
 
 class EventQueue {
     WTF_MAKE_NONCOPYABLE(EventQueue);
 
+    
 public:
     enum ScrollEventTargetType {
         ScrollEventDocumentTarget,
         ScrollEventElementTarget
     };
 
-    EventQueue();
+    static PassOwnPtr<EventQueue> create(ScriptExecutionContext* context)
+    {
+        return adoptPtr(new EventQueue(context));
+    }
+
+    ~EventQueue();
 
     void enqueueEvent(PassRefPtr<Event>);
     void enqueueScrollEvent(PassRefPtr<Node>, ScrollEventTargetType);
 
 private:
-    void pendingEventTimerFired(Timer<EventQueue>*);
+    explicit EventQueue(ScriptExecutionContext*);
+
+    void pendingEventTimerFired();
     void dispatchEvent(PassRefPtr<Event>);
 
-    Timer<EventQueue> m_pendingEventTimer;
+    OwnPtr<EventQueueTimer> m_pendingEventTimer;
     Vector<RefPtr<Event> > m_queuedEvents;
     HashSet<Node*> m_nodesWithQueuedScrollEvents;
+    
+    friend class EventQueueTimer;    
 };
 
 }
diff --git a/Source/WebCore/dom/EventTarget.cpp b/Source/WebCore/dom/EventTarget.cpp
index 5f2f8a7..ed5995c 100644
--- a/Source/WebCore/dom/EventTarget.cpp
+++ b/Source/WebCore/dom/EventTarget.cpp
@@ -181,6 +181,10 @@ FileWriter* EventTarget::toFileWriter()
 #endif
 
 #if ENABLE(INDEXED_DATABASE)
+IDBDatabase* EventTarget::toIDBDatabase()
+{
+    return 0;
+}
 IDBRequest* EventTarget::toIDBRequest()
 {
     return 0;
diff --git a/Source/WebCore/dom/EventTarget.h b/Source/WebCore/dom/EventTarget.h
index 81eeb7f..a03801b 100644
--- a/Source/WebCore/dom/EventTarget.h
+++ b/Source/WebCore/dom/EventTarget.h
@@ -49,6 +49,7 @@ namespace WebCore {
     class EventSource;
     class FileReader;
     class FileWriter;
+    class IDBDatabase;
     class IDBRequest;
     class IDBTransaction;
     class JavaScriptAudioNode;
@@ -138,6 +139,7 @@ namespace WebCore {
 #endif
 
 #if ENABLE(INDEXED_DATABASE)
+        virtual IDBDatabase* toIDBDatabase();
         virtual IDBRequest* toIDBRequest();
         virtual IDBTransaction* toIDBTransaction();
 #endif
diff --git a/Source/WebCore/dom/InputElement.h b/Source/WebCore/dom/InputElement.h
index 2d5606d..02ac5cf 100644
--- a/Source/WebCore/dom/InputElement.h
+++ b/Source/WebCore/dom/InputElement.h
@@ -59,6 +59,8 @@ public:
     virtual String value() const = 0;
     virtual void setValue(const String&, bool sendChangeEvent = false) = 0;
     virtual void setValueForUser(const String&) = 0;
+    // The value which is drawn by a renderer.
+    virtual String visibleValue() const = 0;
 
     // Returns true if the specified string can be set as the value of InputElement.
     virtual bool isAcceptableValue(const String&) const = 0;
diff --git a/Source/WebCore/dom/NamedNodeMap.cpp b/Source/WebCore/dom/NamedNodeMap.cpp
index 0e2861e..2861226 100644
--- a/Source/WebCore/dom/NamedNodeMap.cpp
+++ b/Source/WebCore/dom/NamedNodeMap.cpp
@@ -357,7 +357,7 @@ bool NamedNodeMap::mappedMapsEquivalent(const NamedNodeMap* otherMap) const
             ASSERT(attr->isMappedAttribute());
 
             Attribute* otherAttr = otherMap->getAttributeItem(attr->name());
-            if (!otherAttr || attr->value() != otherAttr->value())
+            if (!otherAttr || !otherAttr->decl() || attr->value() != otherAttr->value())
                 return false;
             if (!attr->decl()->propertiesEqual(otherAttr->decl()))
                 return false;
diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
index 275e370..72592ae 100644
--- a/Source/WebCore/dom/Node.cpp
+++ b/Source/WebCore/dom/Node.cpp
@@ -1641,7 +1641,7 @@ PassRefPtr<Element> Node::querySelector(const String& selectors, ExceptionCode&
 
     // FIXME: we could also optimize for the the [id="foo"] case
     if (strictParsing && inDocument() && querySelectorList.hasOneSelector() && querySelectorList.first()->m_match == CSSSelector::Id) {
-        Element* element = document()->getElementById(querySelectorList.first()->m_value);
+        Element* element = document()->getElementById(querySelectorList.first()->value());
         if (element && (isDocumentNode() || element->isDescendantOf(this)) && selectorChecker.checkSelector(querySelectorList.first(), element))
             return element;
         return 0;
@@ -2913,6 +2913,18 @@ void Node::dispatchSimulatedClick(PassRefPtr<Event> event, bool sendMouseEvents,
     gNodesDispatchingSimulatedClicks->remove(this);
 }
 
+// FIXME: Once https://bugs.webkit.org/show_bug.cgi?id=52963 lands, this should
+// be greatly improved. See https://bugs.webkit.org/show_bug.cgi?id=54025.
+static Node* pullOutOfShadow(Node* node)
+{
+    Node* outermostShadowBoundary = node;
+    for (Node* n = node; n; n = n->parentOrHostNode()) {
+        if (n->isShadowRoot())
+            outermostShadowBoundary = n->parentOrHostNode();
+    }
+    return outermostShadowBoundary;
+}
+
 bool Node::dispatchMouseEvent(const AtomicString& eventType, int button, int detail,
     int pageX, int pageY, int screenX, int screenY,
     bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, 
@@ -2935,7 +2947,7 @@ bool Node::dispatchMouseEvent(const AtomicString& eventType, int button, int det
     bool swallowEvent = false;
     
     // Attempting to dispatch with a non-EventTarget relatedTarget causes the relatedTarget to be silently ignored.
-    RefPtr<Node> relatedTarget = relatedTargetArg;
+    RefPtr<Node> relatedTarget = pullOutOfShadow(relatedTargetArg);
 
     int adjustedPageX = pageX;
     int adjustedPageY = pageY;
diff --git a/Source/WebCore/dom/Position.cpp b/Source/WebCore/dom/Position.cpp
index 6749ca9..cbad302 100644
--- a/Source/WebCore/dom/Position.cpp
+++ b/Source/WebCore/dom/Position.cpp
@@ -27,7 +27,6 @@
 #include "Position.h"
 
 #include "CSSComputedStyleDeclaration.h"
-#include "CharacterNames.h"
 #include "Logging.h"
 #include "PositionIterator.h"
 #include "RenderBlock.h"
@@ -38,6 +37,7 @@
 #include "visible_units.h"
 #include <stdio.h>
 #include <wtf/text/CString.h>
+#include <wtf/unicode/CharacterNames.h>
   
 namespace WebCore {
 
diff --git a/Source/WebCore/dom/ProcessingInstruction.cpp b/Source/WebCore/dom/ProcessingInstruction.cpp
index e7dea48..ed329bc 100644
--- a/Source/WebCore/dom/ProcessingInstruction.cpp
+++ b/Source/WebCore/dom/ProcessingInstruction.cpp
@@ -168,7 +168,7 @@ void ProcessingInstruction::checkStyleSheet()
             {
                 String charset = attrs.get("charset");
                 if (charset.isEmpty())
-                    charset = document()->frame()->loader()->writer()->encoding();
+                    charset = document()->charset();
 
                 m_cachedSheet = document()->cachedResourceLoader()->requestCSSStyleSheet(url, charset);
             }
diff --git a/Source/WebCore/dom/Range.cpp b/Source/WebCore/dom/Range.cpp
index a41fc49..e224843 100644
--- a/Source/WebCore/dom/Range.cpp
+++ b/Source/WebCore/dom/Range.cpp
@@ -594,6 +594,21 @@ bool Range::intersectsNode(Node* refNode, ExceptionCode& ec)
     return true; // all other cases
 }
 
+static inline Node* highestAncestorUnderCommonRoot(Node* node, Node* commonRoot)
+{
+    if (node == commonRoot)
+        return 0;
+
+    ASSERT(commonRoot->contains(node));
+
+    while (node->parentNode() != commonRoot)
+        node = node->parentNode();
+
+    return node;
+}
+
+static inline unsigned lengthOfContentsInNode() { return numeric_limits<unsigned>::max(); }
+
 PassRefPtr<DocumentFragment> Range::processContents(ActionType action, ExceptionCode& ec)
 {
     typedef Vector<RefPtr<Node> > NodeVector;
@@ -601,7 +616,7 @@ PassRefPtr<DocumentFragment> Range::processContents(ActionType action, Exception
     RefPtr<DocumentFragment> fragment;
     if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS)
         fragment = DocumentFragment::create(m_ownerDocument.get());
-    
+
     ec = 0;
     if (collapsed(ec))
         return fragment.release();
@@ -613,68 +628,16 @@ PassRefPtr<DocumentFragment> Range::processContents(ActionType action, Exception
         return 0;
     ASSERT(commonRoot);
 
-    // what is the highest node that partially selects the start of the range?
-    Node* partialStart = 0;
-    if (m_start.container() != commonRoot) {
-        partialStart = m_start.container();
-        while (partialStart->parentNode() != commonRoot)
-            partialStart = partialStart->parentNode();
-    }
-
-    // what is the highest node that partially selects the end of the range?
-    Node* partialEnd = 0;
-    if (m_end.container() != commonRoot) {
-        partialEnd = m_end.container();
-        while (partialEnd->parentNode() != commonRoot)
-            partialEnd = partialEnd->parentNode();
-    }
-
-    // Simple case: the start and end containers are the same. We just grab
-    // everything >= start offset and < end offset
     if (m_start.container() == m_end.container()) {
-        Node::NodeType startNodeType = m_start.container()->nodeType();
-        if (startNodeType == Node::TEXT_NODE || startNodeType == Node::CDATA_SECTION_NODE || startNodeType == Node::COMMENT_NODE) {
-            if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS) {
-                RefPtr<CharacterData> c = static_pointer_cast<CharacterData>(m_start.container()->cloneNode(true));
-                c->deleteData(m_end.offset(), c->length() - m_end.offset(), ec);
-                c->deleteData(0, m_start.offset(), ec);
-                fragment->appendChild(c.release(), ec);
-            }
-            if (action == EXTRACT_CONTENTS || action == DELETE_CONTENTS)
-                static_cast<CharacterData*>(m_start.container())->deleteData(m_start.offset(), m_end.offset() - m_start.offset(), ec);
-        } else if (startNodeType == Node::PROCESSING_INSTRUCTION_NODE) {
-            if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS) {
-                RefPtr<ProcessingInstruction> c = static_pointer_cast<ProcessingInstruction>(m_start.container()->cloneNode(true));
-                c->setData(c->data().substring(m_start.offset(), m_end.offset() - m_start.offset()), ec);
-                fragment->appendChild(c.release(), ec);
-            }
-            if (action == EXTRACT_CONTENTS || action == DELETE_CONTENTS) {
-                ProcessingInstruction* pi = static_cast<ProcessingInstruction*>(m_start.container());
-                String data(pi->data());
-                data.remove(m_start.offset(), m_end.offset() - m_start.offset());
-                pi->setData(data, ec);
-            }
-        } else {
-            RefPtr<Node> n = m_start.container()->firstChild();
-            int i;
-            for (i = 0; n && i < m_start.offset(); i++) // skip until start offset
-                n = n->nextSibling();
-            int endOffset = m_end.offset();
-            RefPtr<Node> next;
-            for (; n && i < endOffset; n = next, i++) { // delete until end offset
-                next = n->nextSibling();
-                if (action == EXTRACT_CONTENTS)
-                    fragment->appendChild(n, ec); // will remove n from its parent
-                else if (action == CLONE_CONTENTS)
-                    fragment->appendChild(n->cloneNode(true), ec);
-                else
-                    toContainerNode(m_start.container())->removeChild(n.get(), ec);
-            }
-        }
-        return fragment.release();
+        processContentsBetweenOffsets(action, fragment, m_start.container(), m_start.offset(), m_end.offset(), ec);
+        return fragment;
     }
 
-    // Complex case: Start and end containers are different.
+    // what is the highest node that partially selects the start / end of the range?
+    Node* partialStart = highestAncestorUnderCommonRoot(m_start.container(), commonRoot);
+    Node* partialEnd = highestAncestorUnderCommonRoot(m_end.container(), commonRoot);
+
+    // Start and end containers are different.
     // There are three possibilities here:
     // 1. Start container == commonRoot (End container must be a descendant)
     // 2. End container == commonRoot (Start container must be a descendant)
@@ -693,49 +656,7 @@ PassRefPtr<DocumentFragment> Range::processContents(ActionType action, Exception
 
     RefPtr<Node> leftContents;
     if (m_start.container() != commonRoot) {
-        // process the left-hand side of the range, up until the last ancestor of
-        // start container before commonRoot
-        Node::NodeType startNodeType = m_start.container()->nodeType();
-        if (startNodeType == Node::TEXT_NODE || startNodeType == Node::CDATA_SECTION_NODE || startNodeType == Node::COMMENT_NODE) {
-            if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS) {
-                RefPtr<CharacterData> c = static_pointer_cast<CharacterData>(m_start.container()->cloneNode(true));
-                c->deleteData(0, m_start.offset(), ec);
-                leftContents = c.release();
-            }
-            if (action == EXTRACT_CONTENTS || action == DELETE_CONTENTS)
-                static_cast<CharacterData*>(m_start.container())->deleteData(
-                    m_start.offset(), static_cast<CharacterData*>(m_start.container())->length() - m_start.offset(), ec);
-        } else if (startNodeType == Node::PROCESSING_INSTRUCTION_NODE) {
-            if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS) {
-                RefPtr<ProcessingInstruction> c = static_pointer_cast<ProcessingInstruction>(m_start.container()->cloneNode(true));
-                c->setData(c->data().substring(m_start.offset()), ec);
-                leftContents = c.release();
-            }
-            if (action == EXTRACT_CONTENTS || action == DELETE_CONTENTS) {
-                ProcessingInstruction* pi = static_cast<ProcessingInstruction*>(m_start.container());
-                String data(pi->data());
-                pi->setData(data.left(m_start.offset()), ec);
-            }
-        } else {
-            if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS)
-                leftContents = m_start.container()->cloneNode(false);
-            NodeVector nodes;
-            Node* n = m_start.container()->firstChild();
-            for (int i = 0; n; n = n->nextSibling(), i++) {
-                if (i < m_start.offset())
-                    continue; // Skip until start offset.
-                nodes.append(n);
-            }
-            for (NodeVector::const_iterator it = nodes.begin(); it != nodes.end(); it++) {
-                Node* n = it->get();
-                if (action == EXTRACT_CONTENTS)
-                    leftContents->appendChild(n, ec); // Will remove n from start container.
-                else if (action == CLONE_CONTENTS)
-                    leftContents->appendChild(n->cloneNode(true), ec);
-                else
-                    toContainerNode(m_start.container())->removeChild(n, ec);
-            }
-        }
+        leftContents = processContentsBetweenOffsets(action, 0, m_start.container(), m_start.offset(), lengthOfContentsInNode(), ec);
 
         NodeVector ancestorNodes;
         for (ContainerNode* n = m_start.container()->parentNode(); n && n != commonRoot; n = n->parentNode())
@@ -767,46 +688,7 @@ PassRefPtr<DocumentFragment> Range::processContents(ActionType action, Exception
 
     RefPtr<Node> rightContents;
     if (m_end.container() != commonRoot) {
-        // delete the right-hand side of the range, up until the last ancestor of
-        // end container before commonRoot
-        Node::NodeType endNodeType = m_end.container()->nodeType();
-        if (endNodeType == Node::TEXT_NODE || endNodeType == Node::CDATA_SECTION_NODE || endNodeType == Node::COMMENT_NODE) {
-            if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS) {
-                RefPtr<CharacterData> c = static_pointer_cast<CharacterData>(m_end.container()->cloneNode(true));
-                c->deleteData(m_end.offset(), static_cast<CharacterData*>(m_end.container())->length() - m_end.offset(), ec);
-                rightContents = c;
-            }
-            if (action == EXTRACT_CONTENTS || action == DELETE_CONTENTS)
-                static_cast<CharacterData*>(m_end.container())->deleteData(0, m_end.offset(), ec);
-        } else if (endNodeType == Node::PROCESSING_INSTRUCTION_NODE) {
-            if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS) {
-                RefPtr<ProcessingInstruction> c = static_pointer_cast<ProcessingInstruction>(m_end.container()->cloneNode(true));
-                c->setData(c->data().left(m_end.offset()), ec);
-                rightContents = c.release();
-            }
-            if (action == EXTRACT_CONTENTS || action == DELETE_CONTENTS) {
-                ProcessingInstruction* pi = static_cast<ProcessingInstruction*>(m_end.container());
-                pi->setData(pi->data().substring(m_end.offset()), ec);
-            }
-        } else {
-            if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS)
-                rightContents = m_end.container()->cloneNode(false);
-            Node* n = m_end.container()->firstChild();
-            if (n && m_end.offset()) {
-                NodeVector nodes;
-                for (int i = 0; i < m_end.offset() && n; i++, n = n->nextSibling())
-                    nodes.append(n);
-                for (int i = nodes.size() - 1; i >= 0; i--) {
-                    n = nodes[i].get();
-                    if (action == EXTRACT_CONTENTS)
-                        rightContents->insertBefore(n, rightContents->firstChild(), ec); // will remove n from its parent
-                    else if (action == CLONE_CONTENTS)
-                        rightContents->insertBefore(n->cloneNode(true), rightContents->firstChild(), ec);
-                    else
-                        toContainerNode(m_end.container())->removeChild(n, ec);
-                }
-            }
-        }
+        rightContents = processContentsBetweenOffsets(action, 0, m_end.container(), 0, m_end.offset(), ec);
 
         ContainerNode* rightParent = m_end.container()->parentNode();
         Node* n = m_end.container()->previousSibling();
@@ -892,6 +774,98 @@ PassRefPtr<DocumentFragment> Range::processContents(ActionType action, Exception
     return fragment.release();
 }
 
+PassRefPtr<Node> Range::processContentsBetweenOffsets(ActionType action, PassRefPtr<DocumentFragment> fragment,
+    Node* container, unsigned startOffset, unsigned endOffset, ExceptionCode& ec)
+{
+    ASSERT(container);
+    ASSERT(startOffset <= endOffset);
+    
+    RefPtr<Node> result;
+    switch (container->nodeType()) {
+    case Node::TEXT_NODE:
+    case Node::CDATA_SECTION_NODE:
+    case Node::COMMENT_NODE:
+        ASSERT(endOffset <= static_cast<CharacterData*>(container)->length() || endOffset == lengthOfContentsInNode());
+        if (endOffset == lengthOfContentsInNode())
+            endOffset = static_cast<CharacterData*>(container)->length();
+        if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS) {
+            RefPtr<CharacterData> c = static_pointer_cast<CharacterData>(container->cloneNode(true));
+            if (c->length() - endOffset)
+                c->deleteData(endOffset, c->length() - endOffset, ec);
+            if (startOffset)
+                c->deleteData(0, startOffset, ec);
+            if (fragment) {
+                result = fragment;
+                result->appendChild(c.release(), ec);
+            } else
+                result = c.release();
+        }
+        if (action == EXTRACT_CONTENTS || action == DELETE_CONTENTS)
+            static_cast<CharacterData*>(container)->deleteData(startOffset, endOffset - startOffset, ec);
+        break;
+    case Node::PROCESSING_INSTRUCTION_NODE:
+        ASSERT(endOffset <= static_cast<ProcessingInstruction*>(container)->data().length() || endOffset == lengthOfContentsInNode());
+        if (endOffset == lengthOfContentsInNode())
+            endOffset = static_cast<ProcessingInstruction*>(container)->data().length();
+        if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS) {
+            RefPtr<ProcessingInstruction> c = static_pointer_cast<ProcessingInstruction>(container->cloneNode(true));
+            c->setData(c->data().substring(startOffset, endOffset - startOffset), ec);
+            if (fragment) {
+                result = fragment;
+                result->appendChild(c.release(), ec);
+            } else
+                result = c.release();
+        }
+        if (action == EXTRACT_CONTENTS || action == DELETE_CONTENTS) {
+            ProcessingInstruction* pi = static_cast<ProcessingInstruction*>(container);
+            String data(pi->data());
+            data.remove(startOffset, endOffset - startOffset);
+            pi->setData(data, ec);
+        }
+        break;
+    case Node::ELEMENT_NODE:
+    case Node::ATTRIBUTE_NODE:
+    case Node::ENTITY_REFERENCE_NODE:
+    case Node::ENTITY_NODE:
+    case Node::DOCUMENT_NODE:
+    case Node::DOCUMENT_TYPE_NODE:
+    case Node::DOCUMENT_FRAGMENT_NODE:
+    case Node::NOTATION_NODE:
+    case Node::XPATH_NAMESPACE_NODE:
+        // FIXME: Should we assert that some nodes never appear here?
+        if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS) {
+            if (fragment)
+                result = fragment;
+            else
+                result = container->cloneNode(false);
+        }
+
+        Node* n = container->firstChild();
+        Vector<RefPtr<Node> > nodes;
+        for (unsigned i = startOffset; n && i; i--)
+            n = n->nextSibling();
+        for (unsigned i = startOffset; n && i < endOffset; i++, n = n->nextSibling())
+            nodes.append(n);
+
+        for (unsigned i = 0; i < nodes.size(); i++) {
+            switch (action) {
+            case DELETE_CONTENTS:
+                container->removeChild(nodes[i].get(), ec);
+                break;
+            case EXTRACT_CONTENTS:
+                result->appendChild(nodes[i].release(), ec); // will remove n from its parent
+                break;
+            case CLONE_CONTENTS:
+                result->appendChild(nodes[i]->cloneNode(true), ec);
+                break;
+            }
+        }
+        break;
+    }
+
+    return result;
+}
+
 PassRefPtr<DocumentFragment> Range::extractContents(ExceptionCode& ec)
 {
     checkDeleteExtract(ec);
@@ -1079,7 +1053,7 @@ PassRefPtr<DocumentFragment> Range::createContextualFragment(const String& marku
     // Logic from deprecatedCreateContextualFragment should just be moved into
     // this function.  Range::createContextualFragment semantics do not make
     // sense for the rest of the DOM implementation to use.
-    RefPtr<DocumentFragment> fragment = static_cast<HTMLElement*>(element)->deprecatedCreateContextualFragment(markup);
+    RefPtr<DocumentFragment> fragment = toHTMLElement(element)->deprecatedCreateContextualFragment(markup);
     if (!fragment) {
         ec = NOT_SUPPORTED_ERR;
         return 0;
diff --git a/Source/WebCore/dom/Range.h b/Source/WebCore/dom/Range.h
index aea76e1..86c1354 100644
--- a/Source/WebCore/dom/Range.h
+++ b/Source/WebCore/dom/Range.h
@@ -147,6 +147,7 @@ private:
 
     enum ActionType { DELETE_CONTENTS, EXTRACT_CONTENTS, CLONE_CONTENTS };
     PassRefPtr<DocumentFragment> processContents(ActionType, ExceptionCode&);
+    PassRefPtr<Node> processContentsBetweenOffsets(ActionType, PassRefPtr<DocumentFragment>, Node*, unsigned startOffset, unsigned endOffset, ExceptionCode&);
 
     RefPtr<Document> m_ownerDocument;
     RangeBoundaryPoint m_start;
diff --git a/Source/WebCore/dom/RequestAnimationFrameCallback.h b/Source/WebCore/dom/RequestAnimationFrameCallback.h
index 819e495..3edeb9e 100644
--- a/Source/WebCore/dom/RequestAnimationFrameCallback.h
+++ b/Source/WebCore/dom/RequestAnimationFrameCallback.h
@@ -40,7 +40,7 @@ namespace WebCore {
 class RequestAnimationFrameCallback : public RefCounted<RequestAnimationFrameCallback> {
 public:
     virtual ~RequestAnimationFrameCallback() { }
-    virtual bool handleEvent() = 0;
+    virtual bool handleEvent(DOMTimeStamp) = 0;
 
     RefPtr<Element> m_element;
     int m_id;
diff --git a/Source/WebCore/dom/RequestAnimationFrameCallback.idl b/Source/WebCore/dom/RequestAnimationFrameCallback.idl
index 8d232e5..1905193 100644
--- a/Source/WebCore/dom/RequestAnimationFrameCallback.idl
+++ b/Source/WebCore/dom/RequestAnimationFrameCallback.idl
@@ -32,6 +32,6 @@ module core {
     interface [
         Callback=FunctionOnly,Conditional=REQUEST_ANIMATION_FRAME
     ] RequestAnimationFrameCallback{
-        boolean handleEvent();
+        boolean handleEvent(in DOMTimeStamp time);
     };
 }
diff --git a/Source/WebCore/dom/ScriptElement.cpp b/Source/WebCore/dom/ScriptElement.cpp
index 747f7a1..1939a08 100644
--- a/Source/WebCore/dom/ScriptElement.cpp
+++ b/Source/WebCore/dom/ScriptElement.cpp
@@ -292,10 +292,8 @@ String ScriptElement::scriptCharset() const
     String charset = charsetAttributeValue().stripWhiteSpace();
 
     // If charset has not been declared in script tag, fall back to frame encoding.
-    if (charset.isEmpty()) {
-        if (Frame* frame = m_element->document()->frame())
-            charset = frame->loader()->writer()->encoding();
-    }
+    if (charset.isEmpty())
+        charset = m_element->document()->charset();
 
     return charset;
 }
diff --git a/Source/WebCore/dom/ScriptExecutionContext.cpp b/Source/WebCore/dom/ScriptExecutionContext.cpp
index 9fdf85e..19267c6 100644
--- a/Source/WebCore/dom/ScriptExecutionContext.cpp
+++ b/Source/WebCore/dom/ScriptExecutionContext.cpp
@@ -30,6 +30,7 @@
 #include "ActiveDOMObject.h"
 #include "Blob.h"
 #include "BlobURL.h"
+#include "DOMURL.h"
 #include "Database.h"
 #include "DatabaseTask.h"
 #include "DatabaseThread.h"
@@ -83,7 +84,9 @@ public:
 };
 
 ScriptExecutionContext::ScriptExecutionContext()
-    : m_inDispatchErrorEvent(false)
+    : m_iteratingActiveDOMObjects(false)
+    , m_inDestructor(false)
+    , m_inDispatchErrorEvent(false)
 #if ENABLE(DATABASE)
     , m_hasOpenDatabases(false)
 #endif
@@ -92,10 +95,12 @@ ScriptExecutionContext::ScriptExecutionContext()
 
 ScriptExecutionContext::~ScriptExecutionContext()
 {
-    HashMap<ActiveDOMObject*, void*>::iterator activeObjectsEnd = m_activeDOMObjects.end();
-    for (HashMap<ActiveDOMObject*, void*>::iterator iter = m_activeDOMObjects.begin(); iter != activeObjectsEnd; ++iter) {
-        ASSERT(iter->first->scriptExecutionContext() == this);
-        iter->first->contextDestroyed();
+    m_inDestructor = true;
+    for (HashMap<ActiveDOMObject*, void*>::iterator iter = m_activeDOMObjects.begin(); iter != m_activeDOMObjects.end(); iter = m_activeDOMObjects.begin()) {
+        ActiveDOMObject* object = iter->first;
+        m_activeDOMObjects.remove(iter);
+        ASSERT(object->scriptExecutionContext() == this);
+        object->contextDestroyed();
     }
 
     HashSet<MessagePort*>::iterator messagePortsEnd = m_messagePorts.end();
@@ -120,6 +125,12 @@ ScriptExecutionContext::~ScriptExecutionContext()
     HashSet<String>::iterator publicBlobURLsEnd = m_publicBlobURLs.end();
     for (HashSet<String>::iterator iter = m_publicBlobURLs.begin(); iter != publicBlobURLsEnd; ++iter)
         ThreadableBlobRegistry::unregisterBlobURL(KURL(ParsedURLString, *iter));
+
+    HashSet<DOMURL*>::iterator domUrlsEnd = m_domUrls.end();
+    for (HashSet<DOMURL*>::iterator iter = m_domUrls.begin(); iter != domUrlsEnd; ++iter) {
+        ASSERT((*iter)->scriptExecutionContext() == this);
+        (*iter)->contextDestroyed();
+    }
 #endif
 }
 
@@ -194,46 +205,70 @@ void ScriptExecutionContext::destroyedMessagePort(MessagePort* port)
     m_messagePorts.remove(port);
 }
 
+#if ENABLE(BLOB)
+void ScriptExecutionContext::createdDomUrl(DOMURL* url)
+{
+    ASSERT(url);
+    m_domUrls.add(url);
+}
+
+void ScriptExecutionContext::destroyedDomUrl(DOMURL* url)
+{
+    ASSERT(url);
+    m_domUrls.remove(url);
+}
+#endif
+
 bool ScriptExecutionContext::canSuspendActiveDOMObjects()
 {
     // No protection against m_activeDOMObjects changing during iteration: canSuspend() shouldn't execute arbitrary JS.
+    m_iteratingActiveDOMObjects = true;
     HashMap<ActiveDOMObject*, void*>::iterator activeObjectsEnd = m_activeDOMObjects.end();
     for (HashMap<ActiveDOMObject*, void*>::iterator iter = m_activeDOMObjects.begin(); iter != activeObjectsEnd; ++iter) {
         ASSERT(iter->first->scriptExecutionContext() == this);
-        if (!iter->first->canSuspend())
+        if (!iter->first->canSuspend()) {
+            m_iteratingActiveDOMObjects = false;
             return false;
-    }
+        }
+    }    
+    m_iteratingActiveDOMObjects = false;
     return true;
 }
 
 void ScriptExecutionContext::suspendActiveDOMObjects(ActiveDOMObject::ReasonForSuspension why)
 {
     // No protection against m_activeDOMObjects changing during iteration: suspend() shouldn't execute arbitrary JS.
+    m_iteratingActiveDOMObjects = true;
     HashMap<ActiveDOMObject*, void*>::iterator activeObjectsEnd = m_activeDOMObjects.end();
     for (HashMap<ActiveDOMObject*, void*>::iterator iter = m_activeDOMObjects.begin(); iter != activeObjectsEnd; ++iter) {
         ASSERT(iter->first->scriptExecutionContext() == this);
         iter->first->suspend(why);
     }
+    m_iteratingActiveDOMObjects = false;
 }
 
 void ScriptExecutionContext::resumeActiveDOMObjects()
 {
     // No protection against m_activeDOMObjects changing during iteration: resume() shouldn't execute arbitrary JS.
+    m_iteratingActiveDOMObjects = true;
     HashMap<ActiveDOMObject*, void*>::iterator activeObjectsEnd = m_activeDOMObjects.end();
     for (HashMap<ActiveDOMObject*, void*>::iterator iter = m_activeDOMObjects.begin(); iter != activeObjectsEnd; ++iter) {
         ASSERT(iter->first->scriptExecutionContext() == this);
         iter->first->resume();
     }
+    m_iteratingActiveDOMObjects = false;
 }
 
 void ScriptExecutionContext::stopActiveDOMObjects()
 {
     // No protection against m_activeDOMObjects changing during iteration: stop() shouldn't execute arbitrary JS.
+    m_iteratingActiveDOMObjects = true;
     HashMap<ActiveDOMObject*, void*>::iterator activeObjectsEnd = m_activeDOMObjects.end();
     for (HashMap<ActiveDOMObject*, void*>::iterator iter = m_activeDOMObjects.begin(); iter != activeObjectsEnd; ++iter) {
         ASSERT(iter->first->scriptExecutionContext() == this);
         iter->first->stop();
     }
+    m_iteratingActiveDOMObjects = false;
 
     // Also close MessagePorts. If they were ActiveDOMObjects (they could be) then they could be stopped instead.
     closeMessagePorts();
@@ -243,12 +278,17 @@ void ScriptExecutionContext::createdActiveDOMObject(ActiveDOMObject* object, voi
 {
     ASSERT(object);
     ASSERT(upcastPointer);
+    ASSERT(!m_inDestructor);
+    if (m_iteratingActiveDOMObjects)
+        CRASH();
     m_activeDOMObjects.add(object, upcastPointer);
 }
 
 void ScriptExecutionContext::destroyedActiveDOMObject(ActiveDOMObject* object)
 {
     ASSERT(object);
+    if (m_iteratingActiveDOMObjects)
+        CRASH();
     m_activeDOMObjects.remove(object);
 }
 
@@ -265,6 +305,17 @@ void ScriptExecutionContext::setSecurityOrigin(PassRefPtr<SecurityOrigin> securi
     m_securityOrigin = securityOrigin;
 }
 
+bool ScriptExecutionContext::sanitizeScriptError(String& errorMessage, int& lineNumber, String& sourceURL)
+{
+    KURL targetURL = completeURL(sourceURL);
+    if (securityOrigin()->canRequest(targetURL))
+        return false;
+    errorMessage = "Script error.";
+    sourceURL = String();
+    lineNumber = 0;
+    return true;
+}
+
 void ScriptExecutionContext::reportException(const String& errorMessage, int lineNumber, const String& sourceURL, PassRefPtr<ScriptCallStack> callStack)
 {
     if (m_inDispatchErrorEvent) {
@@ -294,9 +345,14 @@ bool ScriptExecutionContext::dispatchErrorEvent(const String& errorMessage, int
     if (!target)
         return false;
 
+    String message = errorMessage;
+    int line = lineNumber;
+    String sourceName = sourceURL;
+    sanitizeScriptError(message, line, sourceName);
+
     ASSERT(!m_inDispatchErrorEvent);
     m_inDispatchErrorEvent = true;
-    RefPtr<ErrorEvent> errorEvent = ErrorEvent::create(errorMessage, sourceURL, lineNumber);
+    RefPtr<ErrorEvent> errorEvent = ErrorEvent::create(message, sourceName, line);
     target->dispatchEvent(errorEvent);
     m_inDispatchErrorEvent = false;
     return errorEvent->defaultPrevented();
diff --git a/Source/WebCore/dom/ScriptExecutionContext.h b/Source/WebCore/dom/ScriptExecutionContext.h
index b57b75a..642906c 100644
--- a/Source/WebCore/dom/ScriptExecutionContext.h
+++ b/Source/WebCore/dom/ScriptExecutionContext.h
@@ -60,6 +60,7 @@ namespace WebCore {
     class FileThread;
 #endif
     class MessagePort;
+    class DOMURL;
     class SecurityOrigin;
     class ScriptCallStack;
 
@@ -90,6 +91,7 @@ namespace WebCore {
 
         SecurityOrigin* securityOrigin() const { return m_securityOrigin.get(); }
 
+        bool sanitizeScriptError(String& errorMessage, int& lineNumber, String& sourceURL);
         void reportException(const String& errorMessage, int lineNumber, const String& sourceURL, PassRefPtr<ScriptCallStack>);
         virtual void addMessage(MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL, PassRefPtr<ScriptCallStack>) = 0;
 
@@ -112,6 +114,11 @@ namespace WebCore {
         void destroyedMessagePort(MessagePort*);
         const HashSet<MessagePort*>& messagePorts() const { return m_messagePorts; }
 
+#if ENABLE(BLOB)
+        void createdDomUrl(DOMURL*);
+        void destroyedDomUrl(DOMURL*);
+        const HashSet<DOMURL*>& domUrls() const { return m_domUrls; }
+#endif
         void ref() { refScriptExecutionContext(); }
         void deref() { derefScriptExecutionContext(); }
 
@@ -166,11 +173,14 @@ namespace WebCore {
         HashSet<MessagePort*> m_messagePorts;
 
         HashMap<ActiveDOMObject*, void*> m_activeDOMObjects;
+        bool m_iteratingActiveDOMObjects;
+        bool m_inDestructor;
 
         HashMap<int, DOMTimer*> m_timeouts;
 
 #if ENABLE(BLOB)
         HashSet<String> m_publicBlobURLs;
+        HashSet<DOMURL*> m_domUrls;
 #endif
 
         virtual void refScriptExecutionContext() = 0;
diff --git a/Source/WebCore/dom/ScriptableDocumentParser.cpp b/Source/WebCore/dom/ScriptableDocumentParser.cpp
index 0712a15..708dc1d 100644
--- a/Source/WebCore/dom/ScriptableDocumentParser.cpp
+++ b/Source/WebCore/dom/ScriptableDocumentParser.cpp
@@ -30,7 +30,7 @@ namespace WebCore {
 
 ScriptableDocumentParser::ScriptableDocumentParser(Document* document)
     : DecodedDataDocumentParser(document)
-    , m_xssAuditor(0)
+    , m_wasCreatedByScript(false)
 {
 }
 
diff --git a/Source/WebCore/dom/ScriptableDocumentParser.h b/Source/WebCore/dom/ScriptableDocumentParser.h
index d9bf85c..35c2767 100644
--- a/Source/WebCore/dom/ScriptableDocumentParser.h
+++ b/Source/WebCore/dom/ScriptableDocumentParser.h
@@ -31,8 +31,6 @@
 
 namespace WebCore {
 
-class XSSAuditor;
-
 class ScriptableDocumentParser : public DecodedDataDocumentParser {
 public:
     // Only used by Document::open for deciding if its safe to act on a
@@ -49,8 +47,8 @@ public:
     virtual int lineNumber() const = 0;
     virtual TextPosition0 textPosition() const = 0;
 
-    XSSAuditor* xssAuditor() const { return m_xssAuditor; }
-    void setXSSAuditor(XSSAuditor* auditor) { m_xssAuditor = auditor; }
+    void setWasCreatedByScript(bool wasCreatedByScript) { m_wasCreatedByScript = wasCreatedByScript; }
+    bool wasCreatedByScript() const { return m_wasCreatedByScript; }
 
 protected:
     explicit ScriptableDocumentParser(Document*);
@@ -58,8 +56,8 @@ protected:
 private:
     virtual ScriptableDocumentParser* asScriptableDocumentParser() { return this; }
 
-    // The XSSAuditor associated with this document parser.
-    XSSAuditor* m_xssAuditor;
+    // http://www.whatwg.org/specs/web-apps/current-work/#script-created-parser
+    bool m_wasCreatedByScript;
 };
 
 }
diff --git a/Source/WebCore/dom/SelectElement.cpp b/Source/WebCore/dom/SelectElement.cpp
index 661ba88..a4da0ae 100644
--- a/Source/WebCore/dom/SelectElement.cpp
+++ b/Source/WebCore/dom/SelectElement.cpp
@@ -22,7 +22,6 @@
 #include "SelectElement.h"
 
 #include "Attribute.h"
-#include "CharacterNames.h"
 #include "Chrome.h"
 #include "ChromeClient.h"
 #include "Element.h"
@@ -31,7 +30,6 @@
 #include "FormDataList.h"
 #include "Frame.h"
 #include "HTMLFormElement.h"
-#include "HTMLKeygenElement.h"
 #include "HTMLNames.h"
 #include "HTMLSelectElement.h"
 #include "KeyboardEvent.h"
@@ -43,6 +41,7 @@
 #include "RenderMenuList.h"
 #include "SpatialNavigation.h"
 #include <wtf/Assertions.h>
+#include <wtf/unicode/CharacterNames.h>
 
 #if ENABLE(WML)
 #include "WMLNames.h"
@@ -315,11 +314,14 @@ int SelectElement::selectedIndex(const SelectElementData& data, const Element* e
 
 void SelectElement::setSelectedIndex(SelectElementData& data, Element* element, int optionIndex, bool deselect, bool fireOnChangeNow, bool userDrivenChange)
 {
-    const Vector<Element*>& items = data.listItems(element);
-    int listIndex = optionToListIndex(data, element, optionIndex);
+    if (optionIndex == -1 && !deselect && !data.multiple())
+        optionIndex = nextSelectableListIndex(data, element, -1);
     if (!data.multiple())
         deselect = true;
 
+    const Vector<Element*>& items = data.listItems(element);
+    int listIndex = optionToListIndex(data, element, optionIndex);
+
     Element* excludeElement = 0;
     if (OptionElement* optionElement = (listIndex >= 0 ? toOptionElement(items[listIndex]) : 0)) {
         excludeElement = items[listIndex];
@@ -1024,12 +1026,8 @@ const Vector<Element*>& SelectElementData::listItems(const Element* element) con
 
 SelectElement* toSelectElement(Element* element)
 {
-    if (element->isHTMLElement()) {
-        if (element->hasTagName(HTMLNames::selectTag))
-            return static_cast<HTMLSelectElement*>(element);
-        if (element->hasTagName(HTMLNames::keygenTag))
-            return static_cast<HTMLKeygenElement*>(element);
-    }
+    if (element->isHTMLElement() && element->hasTagName(HTMLNames::selectTag))
+        return static_cast<HTMLSelectElement*>(element);
 
 #if ENABLE(WML)
     if (element->isWMLElement() && element->hasTagName(WMLNames::selectTag))
diff --git a/Source/WebCore/dom/SelectorNodeList.cpp b/Source/WebCore/dom/SelectorNodeList.cpp
index 039a29f..7611488 100644
--- a/Source/WebCore/dom/SelectorNodeList.cpp
+++ b/Source/WebCore/dom/SelectorNodeList.cpp
@@ -50,8 +50,8 @@ PassRefPtr<StaticNodeList> createSelectorNodeList(Node* rootNode, const CSSSelec
 
     CSSStyleSelector::SelectorChecker selectorChecker(document, strictParsing);
 
-    if (strictParsing && rootNode->inDocument() && onlySelector && onlySelector->m_match == CSSSelector::Id && !document->containsMultipleElementsWithId(onlySelector->m_value)) {
-        Element* element = document->getElementById(onlySelector->m_value);
+    if (strictParsing && rootNode->inDocument() && onlySelector && onlySelector->m_match == CSSSelector::Id && !document->containsMultipleElementsWithId(onlySelector->value())) {
+        Element* element = document->getElementById(onlySelector->value());
         if (element && (rootNode->isDocumentNode() || element->isDescendantOf(rootNode)) && selectorChecker.checkSelector(onlySelector, element))
             nodes.append(element);
     } else {
diff --git a/Source/WebCore/dom/Text.cpp b/Source/WebCore/dom/Text.cpp
index 47c532e..34266f1 100644
--- a/Source/WebCore/dom/Text.cpp
+++ b/Source/WebCore/dom/Text.cpp
@@ -23,6 +23,7 @@
 #include "Text.h"
 
 #include "ExceptionCode.h"
+#include "RenderCombineText.h"
 #include "RenderText.h"
 #include "TextBreakIterator.h"
 #include <wtf/text/CString.h>
@@ -237,7 +238,7 @@ bool Text::rendererIsNeeded(RenderStyle *style)
     return true;
 }
 
-RenderObject* Text::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* Text::createRenderer(RenderArena* arena, RenderStyle* style)
 {
 #if ENABLE(SVG)
     Node* parentOrHost = parentOrHostNode();
@@ -248,7 +249,10 @@ RenderObject* Text::createRenderer(RenderArena* arena, RenderStyle*)
     )
         return new (arena) RenderSVGInlineText(this, dataImpl());
 #endif
-    
+
+    if (style->hasTextCombine())
+        return new (arena) RenderCombineText(this, dataImpl());
+
     return new (arena) RenderText(this, dataImpl());
 }
 
diff --git a/Source/WebCore/dom/TextEvent.h b/Source/WebCore/dom/TextEvent.h
index d770d38..26c8b93 100644
--- a/Source/WebCore/dom/TextEvent.h
+++ b/Source/WebCore/dom/TextEvent.h
@@ -51,6 +51,7 @@ namespace WebCore {
         virtual bool isTextEvent() const;
 
         bool isLineBreak() const { return m_inputType == TextEventInputLineBreak; }
+        bool isComposition() const { return m_inputType == TextEventInputComposition; }
         bool isBackTab() const { return m_inputType == TextEventInputBackTab; }
         bool isPaste() const { return m_inputType == TextEventInputPaste; }
         bool isDrop() const { return m_inputType == TextEventInputDrop; }
diff --git a/Source/WebCore/dom/TextEventInputType.h b/Source/WebCore/dom/TextEventInputType.h
index 2522ec4..f5a05eb 100644
--- a/Source/WebCore/dom/TextEventInputType.h
+++ b/Source/WebCore/dom/TextEventInputType.h
@@ -31,6 +31,7 @@ namespace WebCore {
 enum TextEventInputType {
     TextEventInputKeyboard, // any newline characters in the text are line breaks only, not paragraph separators.
     TextEventInputLineBreak, // any tab characters in the text are backtabs.
+    TextEventInputComposition,
     TextEventInputBackTab,
     TextEventInputPaste,
     TextEventInputDrop,
diff --git a/Source/WebCore/dom/ViewportArguments.cpp b/Source/WebCore/dom/ViewportArguments.cpp
index d3026e7..6dd1b8a 100644
--- a/Source/WebCore/dom/ViewportArguments.cpp
+++ b/Source/WebCore/dom/ViewportArguments.cpp
@@ -50,30 +50,6 @@ ViewportAttributes computeViewportAttributes(ViewportArguments args, int desktop
 
     ASSERT(availableWidth > 0 && availableHeight > 0);
 
-    switch (int(args.width)) {
-    case ViewportArguments::ValueDesktopWidth:
-        args.width = desktopWidth;
-        break;
-    case ViewportArguments::ValueDeviceWidth:
-        args.width = deviceWidth;
-        break;
-    case ViewportArguments::ValueDeviceHeight:
-        args.width = deviceHeight;
-        break;
-    }
-
-    switch (int(args.height)) {
-    case ViewportArguments::ValueDesktopWidth:
-        args.height = desktopWidth;
-        break;
-    case ViewportArguments::ValueDeviceWidth:
-        args.height = deviceWidth;
-        break;
-    case ViewportArguments::ValueDeviceHeight:
-        args.height = deviceHeight;
-        break;
-    }
-
     switch (int(args.targetDensityDpi)) {
     case ViewportArguments::ValueDeviceDPI:
         args.targetDensityDpi = deviceDPI;
@@ -98,11 +74,30 @@ ViewportAttributes computeViewportAttributes(ViewportArguments args, int desktop
         availableHeight /= result.devicePixelRatio;
         deviceWidth /= result.devicePixelRatio;
         deviceHeight /= result.devicePixelRatio;
+    }
 
-        if (args.width != ViewportArguments::ValueAuto)
-            args.width /= result.devicePixelRatio;
-        if (args.height != ViewportArguments::ValueAuto)
-            args.height /= result.devicePixelRatio;
+    switch (int(args.width)) {
+    case ViewportArguments::ValueDesktopWidth:
+        args.width = desktopWidth;
+        break;
+    case ViewportArguments::ValueDeviceWidth:
+        args.width = deviceWidth;
+        break;
+    case ViewportArguments::ValueDeviceHeight:
+        args.width = deviceHeight;
+        break;
+    }
+
+    switch (int(args.height)) {
+    case ViewportArguments::ValueDesktopWidth:
+        args.height = desktopWidth;
+        break;
+    case ViewportArguments::ValueDeviceWidth:
+        args.height = deviceWidth;
+        break;
+    case ViewportArguments::ValueDeviceHeight:
+        args.height = deviceHeight;
+        break;
     }
 
     // Clamp values to range defined by spec and resolve minimum-scale and maximum-scale values
diff --git a/Source/WebCore/editing/ApplyStyleCommand.cpp b/Source/WebCore/editing/ApplyStyleCommand.cpp
index 39350b9..ccade74 100644
--- a/Source/WebCore/editing/ApplyStyleCommand.cpp
+++ b/Source/WebCore/editing/ApplyStyleCommand.cpp
@@ -113,7 +113,7 @@ public:
 private:
     void init(PassRefPtr<CSSStyleDeclaration>, const Position&);
     void reconcileTextDecorationProperties(CSSMutableStyleDeclaration*);
-    void extractTextStyles(Document*, CSSMutableStyleDeclaration*, bool shouldUseFixedFontDefautlSize);
+    void extractTextStyles(Document*, CSSMutableStyleDeclaration*, bool shouldUseFixedFontDefaultSize);
 
     String m_cssStyle;
     bool m_applyBold;
@@ -205,7 +205,31 @@ static void setTextDecorationProperty(CSSMutableStyleDeclaration* style, const C
     }
 }
 
-void StyleChange::extractTextStyles(Document* document, CSSMutableStyleDeclaration* style, bool shouldUseFixedFontDefautlSize)
+static bool isCSSValueLength(CSSPrimitiveValue* value)
+{
+    return value->primitiveType() >= CSSPrimitiveValue::CSS_PX && value->primitiveType() <= CSSPrimitiveValue::CSS_PC;
+}
+
+int legacyFontSizeFromCSSValue(Document* document, CSSPrimitiveValue* value, bool shouldUseFixedFontDefaultSize, LegacyFontSizeMode mode)
+{
+    if (isCSSValueLength(value)) {
+        int pixelFontSize = value->getIntValue(CSSPrimitiveValue::CSS_PX);
+        int legacyFontSize = CSSStyleSelector::legacyFontSize(document, pixelFontSize, shouldUseFixedFontDefaultSize);
+        // Use legacy font size only if pixel value matches exactly to that of legacy font size.
+        int cssPrimitiveEquivalent = legacyFontSize - 1 + CSSValueXSmall;
+        if (mode == AlwaysUseLegacyFontSize || CSSStyleSelector::fontSizeForKeyword(document, cssPrimitiveEquivalent, shouldUseFixedFontDefaultSize) == pixelFontSize)
+            return legacyFontSize;
+
+        return 0;
+    }
+
+    if (CSSValueXSmall <= value->getIdent() && value->getIdent() <= CSSValueWebkitXxxLarge)
+        return value->getIdent() - CSSValueXSmall + 1;
+
+    return 0;
+}
+
+void StyleChange::extractTextStyles(Document* document, CSSMutableStyleDeclaration* style, bool shouldUseFixedFontDefaultSize)
 {
     ASSERT(style);
 
@@ -260,20 +284,10 @@ void StyleChange::extractTextStyles(Document* document, CSSMutableStyleDeclarati
     if (RefPtr<CSSValue> fontSize = style->getPropertyCSSValue(CSSPropertyFontSize)) {
         if (!fontSize->isPrimitiveValue())
             style->removeProperty(CSSPropertyFontSize); // Can't make sense of the number. Put no font size.
-        else {
-            CSSPrimitiveValue* value = static_cast<CSSPrimitiveValue*>(fontSize.get());
-            if (value->primitiveType() >= CSSPrimitiveValue::CSS_PX && value->primitiveType() <= CSSPrimitiveValue::CSS_PC) {
-                int pixelFontSize = value->getFloatValue(CSSPrimitiveValue::CSS_PX);
-                int legacyFontSize = CSSStyleSelector::legacyFontSize(document, pixelFontSize, shouldUseFixedFontDefautlSize);
-                // Use legacy font size only if pixel value matches exactly to that of legacy font size.
-                if (CSSStyleSelector::fontSizeForKeyword(document, legacyFontSize - 1 + CSSValueXSmall, shouldUseFixedFontDefautlSize) == pixelFontSize) {
-                    m_applyFontSize = String::number(legacyFontSize);
-                    style->removeProperty(CSSPropertyFontSize);
-                }
-            } else if (CSSValueXSmall <= value->getIdent() && value->getIdent() <= CSSValueWebkitXxxLarge) {
-                m_applyFontSize = String::number(value->getIdent() - CSSValueXSmall + 1);
-                style->removeProperty(CSSPropertyFontSize);
-            }
+        else if (int legacyFontSize = legacyFontSizeFromCSSValue(document, static_cast<CSSPrimitiveValue*>(fontSize.get()),
+                shouldUseFixedFontDefaultSize, UseLegacyFontSizeOnlyIfPixelValuesMatch)) {
+            m_applyFontSize = String::number(legacyFontSize);
+            style->removeProperty(CSSPropertyFontSize);
         }
     }
 }
@@ -522,18 +536,17 @@ void ApplyStyleCommand::doApply()
         // Apply the block-centric properties of the style.
         RefPtr<EditingStyle> blockStyle = m_style->extractAndRemoveBlockProperties();
         if (!blockStyle->isEmpty())
-            applyBlockStyle(blockStyle->style());
+            applyBlockStyle(blockStyle.get());
         // Apply any remaining styles to the inline elements.
         if (!m_style->isEmpty() || m_styledInlineElement || m_isInlineElementToRemoveFunction) {
-            RefPtr<CSSMutableStyleDeclaration> style = m_style->style() ? m_style->style() : CSSMutableStyleDeclaration::create();
             applyRelativeFontStyleChange(m_style.get());
-            applyInlineStyle(style.get());
+            applyInlineStyle(m_style.get());
         }
         break;
     }
     case ForceBlockProperties:
         // Force all properties to be applied as block styles.
-        applyBlockStyle(m_style->style());
+        applyBlockStyle(m_style.get());
         break;
     }
 }
@@ -543,7 +556,7 @@ EditAction ApplyStyleCommand::editingAction() const
     return m_editingAction;
 }
 
-void ApplyStyleCommand::applyBlockStyle(CSSMutableStyleDeclaration *style)
+void ApplyStyleCommand::applyBlockStyle(EditingStyle *style)
 {
     // update document layout once before removing styles
     // so that we avoid the expense of updating before each and every call
@@ -578,7 +591,7 @@ void ApplyStyleCommand::applyBlockStyle(CSSMutableStyleDeclaration *style)
     VisiblePosition nextParagraphStart(endOfParagraph(paragraphStart).next());
     VisiblePosition beyondEnd(endOfParagraph(visibleEnd).next());
     while (paragraphStart.isNotNull() && paragraphStart != beyondEnd) {
-        StyleChange styleChange(style, paragraphStart.deepEquivalent());
+        StyleChange styleChange(style->style(), paragraphStart.deepEquivalent());
         if (styleChange.cssStyle().length() || m_removeOnly) {
             RefPtr<Node> block = enclosingBlock(paragraphStart.deepEquivalent().node());
             if (!m_removeOnly) {
@@ -588,9 +601,9 @@ void ApplyStyleCommand::applyBlockStyle(CSSMutableStyleDeclaration *style)
             }
             ASSERT(block->isHTMLElement());
             if (block->isHTMLElement()) {
-                removeCSSStyle(style, static_cast<HTMLElement*>(block.get()));
+                removeCSSStyle(style->style(), toHTMLElement(block.get()));
                 if (!m_removeOnly)
-                    addBlockStyle(styleChange, static_cast<HTMLElement*>(block.get()));
+                    addBlockStyle(styleChange, toHTMLElement(block.get()));
             }
 
             if (nextParagraphStart.isOrphan())
@@ -677,7 +690,7 @@ void ApplyStyleCommand::applyRelativeFontStyleChange(EditingStyle* style)
             // Only work on fully selected nodes.
             if (!nodeFullySelected(node, start, end))
                 continue;
-            element = static_cast<HTMLElement*>(node);
+            element = toHTMLElement(node);
         } else if (node->isTextNode() && node->renderer() && node->parentNode() != lastStyledNode) {
             // Last styled node was not parent node of this text node, but we wish to style this
             // text node. To make this possible, add a style span to surround this text node.
@@ -741,7 +754,7 @@ void ApplyStyleCommand::cleanupUnstyledAppleStyleSpans(Node* dummySpanAncestor)
     }
 }
 
-HTMLElement* ApplyStyleCommand::splitAncestorsWithUnicodeBidi(Node* node, bool before, int allowedDirection)
+HTMLElement* ApplyStyleCommand::splitAncestorsWithUnicodeBidi(Node* node, bool before, WritingDirection allowedDirection)
 {
     // We are allowed to leave the highest ancestor with unicode-bidi unsplit if it is unicode-bidi: embed and direction: allowedDirection.
     // In that case, we return the unsplit ancestor. Otherwise, we return 0.
@@ -766,13 +779,16 @@ HTMLElement* ApplyStyleCommand::splitAncestorsWithUnicodeBidi(Node* node, bool b
 
     HTMLElement* unsplitAncestor = 0;
 
-    if (allowedDirection && highestAncestorUnicodeBidi != CSSValueBidiOverride
-        && getIdentifierValue(computedStyle(highestAncestorWithUnicodeBidi).get(), CSSPropertyDirection) == allowedDirection
-        && highestAncestorWithUnicodeBidi->isHTMLElement()) {
+    WritingDirection highestAncestorDirection;
+    if (allowedDirection != NaturalWritingDirection
+        && highestAncestorUnicodeBidi != CSSValueBidiOverride
+        && highestAncestorWithUnicodeBidi->isHTMLElement()
+        && EditingStyle::create(highestAncestorWithUnicodeBidi, EditingStyle::AllProperties)->textDirection(highestAncestorDirection)
+        && highestAncestorDirection == allowedDirection) {
         if (!nextHighestAncestorWithUnicodeBidi)
-            return static_cast<HTMLElement*>(highestAncestorWithUnicodeBidi);
+            return toHTMLElement(highestAncestorWithUnicodeBidi);
 
-        unsplitAncestor = static_cast<HTMLElement*>(highestAncestorWithUnicodeBidi);
+        unsplitAncestor = toHTMLElement(highestAncestorWithUnicodeBidi);
         highestAncestorWithUnicodeBidi = nextHighestAncestorWithUnicodeBidi;
     }
 
@@ -836,7 +852,7 @@ static Node* highestEmbeddingAncestor(Node* startNode, Node* enclosingNode)
     return 0;
 }
 
-void ApplyStyleCommand::applyInlineStyle(CSSMutableStyleDeclaration *style)
+void ApplyStyleCommand::applyInlineStyle(EditingStyle* style)
 {
     Node* startDummySpanAncestor = 0;
     Node* endDummySpanAncestor = 0;
@@ -858,7 +874,7 @@ void ApplyStyleCommand::applyInlineStyle(CSSMutableStyleDeclaration *style)
     // split the start node and containing element if the selection starts inside of it
     bool splitStart = isValidCaretPositionInTextNode(start);
     if (splitStart) {
-        if (shouldSplitTextElement(start.node()->parentElement(), style))
+        if (shouldSplitTextElement(start.node()->parentElement(), style->style()))
             splitTextElementAtStart(start, end);
         else
             splitTextAtStart(start, end);
@@ -870,7 +886,7 @@ void ApplyStyleCommand::applyInlineStyle(CSSMutableStyleDeclaration *style)
     // split the end node and containing element if the selection ends inside of it
     bool splitEnd = isValidCaretPositionInTextNode(end);
     if (splitEnd) {
-        if (shouldSplitTextElement(end.node()->parentElement(), style))
+        if (shouldSplitTextElement(end.node()->parentElement(), style->style()))
             splitTextElementAtEnd(start, end);
         else
             splitTextAtEnd(start, end);
@@ -885,15 +901,16 @@ void ApplyStyleCommand::applyInlineStyle(CSSMutableStyleDeclaration *style)
     // and prevent us from adding redundant ones, as described in:
     // <rdar://problem/3724344> Bolding and unbolding creates extraneous tags
     Position removeStart = start.upstream();
-    int unicodeBidi = getIdentifierValue(style, CSSPropertyUnicodeBidi);
-    int direction = 0;
-    RefPtr<CSSMutableStyleDeclaration> styleWithoutEmbedding;
+    int unicodeBidi = getIdentifierValue(style->style(), CSSPropertyUnicodeBidi);
+    RefPtr<EditingStyle> styleWithoutEmbedding;
+    RefPtr<EditingStyle> embeddingStyle;
     if (unicodeBidi) {
+        WritingDirection textDirection = NaturalWritingDirection;
+        style->textDirection(textDirection);
+
         // Leave alone an ancestor that provides the desired single level embedding, if there is one.
-        if (unicodeBidi == CSSValueEmbed)
-            direction = getIdentifierValue(style, CSSPropertyDirection);
-        HTMLElement* startUnsplitAncestor = splitAncestorsWithUnicodeBidi(start.node(), true, direction);
-        HTMLElement* endUnsplitAncestor = splitAncestorsWithUnicodeBidi(end.node(), false, direction);
+        HTMLElement* startUnsplitAncestor = splitAncestorsWithUnicodeBidi(start.node(), true, textDirection);
+        HTMLElement* endUnsplitAncestor = splitAncestorsWithUnicodeBidi(end.node(), false, textDirection);
         removeEmbeddingUpToEnclosingBlock(start.node(), startUnsplitAncestor);
         removeEmbeddingUpToEnclosingBlock(end.node(), endUnsplitAncestor);
 
@@ -907,18 +924,15 @@ void ApplyStyleCommand::applyInlineStyle(CSSMutableStyleDeclaration *style)
             embeddingRemoveEnd = positionInParentBeforeNode(endUnsplitAncestor).downstream();
 
         if (embeddingRemoveEnd != removeStart || embeddingRemoveEnd != end) {
-            RefPtr<CSSMutableStyleDeclaration> embeddingStyle = CSSMutableStyleDeclaration::create();
-            embeddingStyle->setProperty(CSSPropertyUnicodeBidi, CSSValueEmbed);
-            embeddingStyle->setProperty(CSSPropertyDirection, direction);
-            if (comparePositions(embeddingRemoveStart, embeddingRemoveEnd) <= 0)
-                removeInlineStyle(embeddingStyle, embeddingRemoveStart, embeddingRemoveEnd);
             styleWithoutEmbedding = style->copy();
-            styleWithoutEmbedding->removeProperty(CSSPropertyUnicodeBidi);
-            styleWithoutEmbedding->removeProperty(CSSPropertyDirection);
+            embeddingStyle = styleWithoutEmbedding->extractAndRemoveTextDirection();
+
+            if (comparePositions(embeddingRemoveStart, embeddingRemoveEnd) <= 0)
+                removeInlineStyle(embeddingStyle->style(), embeddingRemoveStart, embeddingRemoveEnd);
         }
     }
 
-    removeInlineStyle(styleWithoutEmbedding ? styleWithoutEmbedding.get() : style, removeStart, end);
+    removeInlineStyle(styleWithoutEmbedding ? styleWithoutEmbedding->style() : style->style(), removeStart, end);
     start = startPosition();
     end = endPosition();
     if (start.isNull() || start.isOrphan() || end.isNull() || end.isOrphan())
@@ -942,7 +956,7 @@ void ApplyStyleCommand::applyInlineStyle(CSSMutableStyleDeclaration *style)
     // to check a computed style
     updateLayout();
 
-    RefPtr<CSSMutableStyleDeclaration> styleToApply = style;
+    RefPtr<CSSMutableStyleDeclaration> styleToApply = style->isEmpty() ? CSSMutableStyleDeclaration::create() : style->style();
     if (unicodeBidi) {
         // Avoid applying the unicode-bidi and direction properties beneath ancestors that already have them.
         Node* embeddingStartNode = highestEmbeddingAncestor(start.node(), enclosingBlock(start.node()));
@@ -953,18 +967,13 @@ void ApplyStyleCommand::applyInlineStyle(CSSMutableStyleDeclaration *style)
             Position embeddingApplyEnd = embeddingEndNode ? positionInParentBeforeNode(embeddingEndNode) : end;
             ASSERT(embeddingApplyStart.isNotNull() && embeddingApplyEnd.isNotNull());
 
-            RefPtr<CSSMutableStyleDeclaration> embeddingStyle = CSSMutableStyleDeclaration::create();
-            embeddingStyle->setProperty(CSSPropertyUnicodeBidi, CSSValueEmbed);
-            embeddingStyle->setProperty(CSSPropertyDirection, direction);
-            fixRangeAndApplyInlineStyle(embeddingStyle.get(), embeddingApplyStart, embeddingApplyEnd);
-
-            if (styleWithoutEmbedding)
-                styleToApply = styleWithoutEmbedding;
-            else {
-                styleToApply = style->copy();
-                styleToApply->removeProperty(CSSPropertyUnicodeBidi);
-                styleToApply->removeProperty(CSSPropertyDirection);
+            if (!embeddingStyle) {
+                styleWithoutEmbedding = style->copy();
+                embeddingStyle = styleWithoutEmbedding->extractAndRemoveTextDirection();
             }
+            fixRangeAndApplyInlineStyle(embeddingStyle->style(), embeddingApplyStart, embeddingApplyEnd);
+
+            styleToApply = styleWithoutEmbedding->style();
         }
     }
 
@@ -1040,7 +1049,7 @@ void ApplyStyleCommand::applyInlineStyleToNodeRange(CSSMutableStyleDeclaration*
             if (pastEndNode && pastEndNode->isDescendantOf(node))
                 break;
             // Add to this element's inline style and skip over its contents.
-            HTMLElement* element = static_cast<HTMLElement*>(node);
+            HTMLElement* element = toHTMLElement(node);
             RefPtr<CSSMutableStyleDeclaration> inlineStyle = element->getInlineStyleDecl()->copy();
             inlineStyle->merge(style);
             setNodeAttribute(element, styleAttr, inlineStyle->cssText());
@@ -1110,7 +1119,7 @@ bool ApplyStyleCommand::removeStyleFromRunBeforeApplyingStyle(CSSMutableStyleDec
         RefPtr<Node> previousSibling = node->previousSibling();
         RefPtr<Node> nextSibling = node->nextSibling();
         RefPtr<ContainerNode> parent = node->parentNode();
-        removeInlineStyleFromElement(style, static_cast<HTMLElement*>(node.get()), RemoveAlways);
+        removeInlineStyleFromElement(style, toHTMLElement(node.get()), RemoveAlways);
         if (!node->inDocument()) {
             // FIXME: We might need to update the start and the end of current selection here but need a test.
             if (runStart == node)
@@ -1125,7 +1134,6 @@ bool ApplyStyleCommand::removeStyleFromRunBeforeApplyingStyle(CSSMutableStyleDec
 
 bool ApplyStyleCommand::removeInlineStyleFromElement(CSSMutableStyleDeclaration* style, PassRefPtr<HTMLElement> element, InlineStyleRemovalMode mode, CSSMutableStyleDeclaration* extractedStyle)
 {
-    ASSERT(style);
     ASSERT(element);
 
     if (!element->parentNode() || !element->parentNode()->isContentEditable())
@@ -1141,6 +1149,9 @@ bool ApplyStyleCommand::removeInlineStyleFromElement(CSSMutableStyleDeclaration*
         return true;
     }
 
+    if (!style)
+        return false;
+
     bool removed = false;
     if (removeImplicitlyStyledElement(style, element.get(), mode, extractedStyle))
         removed = true;
@@ -1214,6 +1225,7 @@ static const HTMLEquivalent HTMLEquivalents[] = {
 bool ApplyStyleCommand::removeImplicitlyStyledElement(CSSMutableStyleDeclaration* style, HTMLElement* element, InlineStyleRemovalMode mode, CSSMutableStyleDeclaration* extractedStyle)
 {
     // Current implementation does not support stylePushedDown when mode == RemoveNone because of early exit.
+    ASSERT(style);
     ASSERT(!extractedStyle || mode != RemoveNone);
     bool removed = false;
     for (size_t i = 0; i < WTF_ARRAY_LENGTH(HTMLEquivalents); ++i) {
@@ -1336,8 +1348,8 @@ HTMLElement* ApplyStyleCommand::highestAncestorWithConflictingInlineStyle(CSSMut
     Node* unsplittableElement = unsplittableElementForPosition(firstPositionInOrBeforeNode(node));
 
     for (Node *n = node; n; n = n->parentNode()) {
-        if (n->isHTMLElement() && shouldRemoveInlineStyleFromElement(style, static_cast<HTMLElement*>(n)))
-            result = static_cast<HTMLElement*>(n);
+        if (n->isHTMLElement() && shouldRemoveInlineStyleFromElement(style, toHTMLElement(n)))
+            result = toHTMLElement(n);
         // Should stop at the editable root (cannot cross editing boundary) and
         // also stop at the unsplittable element to be consistent with other UAs
         if (n == unsplittableElement)
@@ -1356,7 +1368,7 @@ void ApplyStyleCommand::applyInlineStyleToPushDown(Node* node, CSSMutableStyleDe
 
     RefPtr<CSSMutableStyleDeclaration> newInlineStyle = style;
     if (node->isHTMLElement()) {
-        HTMLElement* element = static_cast<HTMLElement*>(node);
+        HTMLElement* element = toHTMLElement(node);
         CSSMutableStyleDeclaration* existingInlineStyle = element->inlineStyleDecl();
 
         // Avoid overriding existing styles of node
@@ -1392,7 +1404,7 @@ void ApplyStyleCommand::applyInlineStyleToPushDown(Node* node, CSSMutableStyleDe
     // Since addInlineStyleIfNeeded can't add styles to block-flow render objects, add style attribute instead.
     // FIXME: applyInlineStyleToRange should be used here instead.
     if ((node->renderer()->isBlockFlow() || node->childNodeCount()) && node->isHTMLElement()) {
-        setNodeAttribute(static_cast<HTMLElement*>(node), styleAttr, newInlineStyle->cssText());
+        setNodeAttribute(toHTMLElement(node), styleAttr, newInlineStyle->cssText());
         return;
     }
 
@@ -1428,7 +1440,7 @@ void ApplyStyleCommand::pushDownInlineStyleAroundNode(CSSMutableStyleDeclaration
             elementsToPushDown.append(styledElement);
         }
         RefPtr<CSSMutableStyleDeclaration> styleToPushDown = CSSMutableStyleDeclaration::create();
-        removeInlineStyleFromElement(style, static_cast<HTMLElement*>(current), RemoveIfNeeded, styleToPushDown.get());
+        removeInlineStyleFromElement(style, toHTMLElement(current), RemoveIfNeeded, styleToPushDown.get());
 
         // The inner loop will go through children on each level
         // FIXME: we should aggregate inline child elements together so that we don't wrap each child separately.
@@ -1469,8 +1481,8 @@ void ApplyStyleCommand::removeInlineStyle(PassRefPtr<CSSMutableStyleDeclaration>
     ASSERT(start.node()->inDocument());
     ASSERT(end.node()->inDocument());
     ASSERT(comparePositions(start, end) <= 0);
-    
-    RefPtr<CSSValue> textDecorationSpecialProperty = style->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
+
+    RefPtr<CSSValue> textDecorationSpecialProperty = style ? style->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect) : 0;
     if (textDecorationSpecialProperty) {
         style = style->copy();
         style->setProperty(CSSPropertyTextDecoration, textDecorationSpecialProperty->cssText(), style->getPropertyPriority(CSSPropertyWebkitTextDecorationsInEffect));
@@ -1500,7 +1512,7 @@ void ApplyStyleCommand::removeInlineStyle(PassRefPtr<CSSMutableStyleDeclaration>
     while (node) {
         RefPtr<Node> next = node->traverseNextNode();
         if (node->isHTMLElement() && nodeFullySelected(node, start, end)) {
-            RefPtr<HTMLElement> elem = static_cast<HTMLElement*>(node);
+            RefPtr<HTMLElement> elem = toHTMLElement(node);
             RefPtr<Node> prev = elem->traversePreviousNodePostOrder();
             RefPtr<Node> next = elem->traverseNextNode();
             RefPtr<CSSMutableStyleDeclaration> styleToPushDown;
@@ -1624,7 +1636,7 @@ bool ApplyStyleCommand::shouldSplitTextElement(Element* element, CSSMutableStyle
     if (!element || !element->isHTMLElement())
         return false;
 
-    return shouldRemoveInlineStyleFromElement(style, static_cast<HTMLElement*>(element));
+    return shouldRemoveInlineStyleFromElement(style, toHTMLElement(element));
 }
 
 bool ApplyStyleCommand::isValidCaretPositionInTextNode(const Position& position)
@@ -1827,10 +1839,10 @@ void ApplyStyleCommand::addInlineStyleIfNeeded(CSSMutableStyleDeclaration *style
     HTMLElement* styleContainer = 0;
     for (Node* container = startNode.get(); container && startNode == endNode; container = container->firstChild()) {
         if (container->isHTMLElement() && container->hasTagName(fontTag))
-            fontContainer = static_cast<HTMLElement*>(container);
+            fontContainer = toHTMLElement(container);
         bool styleContainerIsNotSpan = !styleContainer || !styleContainer->hasTagName(spanTag);
         if (container->isHTMLElement() && (container->hasTagName(spanTag) || (styleContainerIsNotSpan && container->childNodeCount())))
-            styleContainer = static_cast<HTMLElement*>(container);
+            styleContainer = toHTMLElement(container);
         if (!container->firstChild())
             break;
         startNode = container->firstChild();
@@ -1860,7 +1872,7 @@ void ApplyStyleCommand::addInlineStyleIfNeeded(CSSMutableStyleDeclaration *style
 
     if (styleChange.cssStyle().length()) {
         if (styleContainer) {
-            CSSMutableStyleDeclaration* existingStyle = static_cast<HTMLElement*>(styleContainer)->inlineStyleDecl();
+            CSSMutableStyleDeclaration* existingStyle = toHTMLElement(styleContainer)->inlineStyleDecl();
             if (existingStyle)
                 setNodeAttribute(styleContainer, styleAttr, existingStyle->cssText() + styleChange.cssStyle());
             else
diff --git a/Source/WebCore/editing/ApplyStyleCommand.h b/Source/WebCore/editing/ApplyStyleCommand.h
index 05af85c..1b2c2ef 100644
--- a/Source/WebCore/editing/ApplyStyleCommand.h
+++ b/Source/WebCore/editing/ApplyStyleCommand.h
@@ -28,6 +28,7 @@
 
 #include "CompositeEditCommand.h"
 #include "HTMLElement.h"
+#include "WritingDirection.h"
 
 namespace WebCore {
 
@@ -90,9 +91,9 @@ private:
     bool nodeFullyUnselected(Node*, const Position& start, const Position& end) const;
 
     // style-application helpers
-    void applyBlockStyle(CSSMutableStyleDeclaration*);
+    void applyBlockStyle(EditingStyle*);
     void applyRelativeFontStyleChange(EditingStyle*);
-    void applyInlineStyle(CSSMutableStyleDeclaration*);
+    void applyInlineStyle(EditingStyle*);
     void fixRangeAndApplyInlineStyle(CSSMutableStyleDeclaration*, const Position& start, const Position& end);
     void applyInlineStyleToNodeRange(CSSMutableStyleDeclaration*, Node* startNode, Node* pastEndNode);
     void addBlockStyle(const StyleChange&, HTMLElement*);
@@ -111,7 +112,7 @@ private:
     float computedFontSize(Node*);
     void joinChildTextNodes(Node*, const Position& start, const Position& end);
 
-    HTMLElement* splitAncestorsWithUnicodeBidi(Node*, bool before, int allowedDirection);
+    HTMLElement* splitAncestorsWithUnicodeBidi(Node*, bool before, WritingDirection allowedDirection);
     void removeEmbeddingUpToEnclosingBlock(Node* node, Node* unsplitAncestor);
 
     void updateStartEnd(const Position& newStart, const Position& newEnd);
@@ -129,6 +130,8 @@ private:
     IsInlineElementToRemoveFunction m_isInlineElementToRemoveFunction;
 };
 
+enum LegacyFontSizeMode { AlwaysUseLegacyFontSize, UseLegacyFontSizeOnlyIfPixelValuesMatch };
+int legacyFontSizeFromCSSValue(Document*, CSSPrimitiveValue*, bool shouldUseFixedFontDefaultSize, LegacyFontSizeMode);
 bool isStyleSpan(const Node*);
 PassRefPtr<HTMLElement> createStyleSpanElement(Document*);
 RefPtr<CSSMutableStyleDeclaration> getPropertiesNotIn(CSSStyleDeclaration* styleWithRedundantProperties, CSSStyleDeclaration* baseStyle);
diff --git a/Source/WebCore/editing/CompositeEditCommand.cpp b/Source/WebCore/editing/CompositeEditCommand.cpp
index 552ed79..ac3d761 100644
--- a/Source/WebCore/editing/CompositeEditCommand.cpp
+++ b/Source/WebCore/editing/CompositeEditCommand.cpp
@@ -28,7 +28,6 @@
 
 #include "AppendNodeCommand.h"
 #include "ApplyStyleCommand.h"
-#include "CharacterNames.h"
 #include "DeleteFromTextNodeCommand.h"
 #include "DeleteSelectionCommand.h"
 #include "Document.h"
@@ -63,6 +62,7 @@
 #include "htmlediting.h"
 #include "markup.h"
 #include "visible_units.h"
+#include <wtf/unicode/CharacterNames.h>
 
 using namespace std;
 
@@ -390,57 +390,84 @@ void CompositeEditCommand::setNodeAttribute(PassRefPtr<Element> element, const Q
     applyCommandToComposite(SetNodeAttributeCommand::create(element, attribute, value));
 }
 
-static inline bool isWhitespace(UChar c)
+static inline bool containsOnlyWhitespace(const String& text)
 {
-    return c == noBreakSpace || c == ' ' || c == '\n' || c == '\t';
+    for (unsigned i = 0; i < text.length(); ++i) {
+        if (!isWhitespace(text.characters()[i]))
+            return false;
+    }
+    
+    return true;
 }
 
-// FIXME: Doesn't go into text nodes that contribute adjacent text (siblings, cousins, etc).
-void CompositeEditCommand::rebalanceWhitespaceAt(const Position& position)
+bool CompositeEditCommand::shouldRebalanceLeadingWhitespaceFor(const String& text) const
+{
+    return containsOnlyWhitespace(text);
+}
+
+bool CompositeEditCommand::canRebalance(const Position& position) const
 {
     Node* node = position.containerNode();
     if (position.anchorType() != Position::PositionIsOffsetInAnchor || !node || !node->isTextNode())
-        return;
-    Text* textNode = static_cast<Text*>(node);
+        return false;
 
+    Text* textNode = static_cast<Text*>(node);
     if (textNode->length() == 0)
-        return;
+        return false;
+
     RenderObject* renderer = textNode->renderer();
     if (renderer && !renderer->style()->collapseWhiteSpace())
-        return;
+        return false;
 
-    String text = textNode->data();
-    ASSERT(!text.isEmpty());
+    return true;
+}
+
+// FIXME: Doesn't go into text nodes that contribute adjacent text (siblings, cousins, etc).
+void CompositeEditCommand::rebalanceWhitespaceAt(const Position& position)
+{
+    Node* node = position.containerNode();
+    if (!canRebalance(position))
+        return;
 
+    // If the rebalance is for the single offset, and neither text[offset] nor text[offset - 1] are some form of whitespace, do nothing.
     int offset = position.deprecatedEditingOffset();
-    // If neither text[offset] nor text[offset - 1] are some form of whitespace, do nothing.
+    String text = static_cast<Text*>(node)->data();
     if (!isWhitespace(text[offset])) {
         offset--;
         if (offset < 0 || !isWhitespace(text[offset]))
             return;
     }
-    
+
+    rebalanceWhitespaceOnTextSubstring(static_cast<Text*>(node), position.offsetInContainerNode(), position.offsetInContainerNode());
+}
+
+void CompositeEditCommand::rebalanceWhitespaceOnTextSubstring(RefPtr<Text> textNode, int startOffset, int endOffset)
+{
+    String text = textNode->data();
+    ASSERT(!text.isEmpty());
+
     // Set upstream and downstream to define the extent of the whitespace surrounding text[offset].
-    int upstream = offset;
+    int upstream = startOffset;
     while (upstream > 0 && isWhitespace(text[upstream - 1]))
         upstream--;
     
-    int downstream = offset;
-    while ((unsigned)downstream + 1 < text.length() && isWhitespace(text[downstream + 1]))
+    int downstream = endOffset;
+    while ((unsigned)downstream < text.length() && isWhitespace(text[downstream]))
         downstream++;
     
-    int length = downstream - upstream + 1;
-    ASSERT(length > 0);
-    
-    VisiblePosition visibleUpstreamPos(Position(position.containerNode(), upstream, Position::PositionIsOffsetInAnchor));
-    VisiblePosition visibleDownstreamPos(Position(position.containerNode(), downstream + 1, Position::PositionIsOffsetInAnchor));
+    int length = downstream - upstream;
+    if (!length)
+        return;
+
+    VisiblePosition visibleUpstreamPos(Position(textNode, upstream, Position::PositionIsOffsetInAnchor));
+    VisiblePosition visibleDownstreamPos(Position(textNode, downstream, Position::PositionIsOffsetInAnchor));
     
     String string = text.substring(upstream, length);
     String rebalancedString = stringWithRebalancedWhitespace(string,
     // FIXME: Because of the problem mentioned at the top of this function, we must also use nbsps at the start/end of the string because
     // this function doesn't get all surrounding whitespace, just the whitespace in the current text node.
                                                              isStartOfParagraph(visibleUpstreamPos) || upstream == 0, 
-                                                             isEndOfParagraph(visibleDownstreamPos) || (unsigned)downstream == text.length() - 1);
+                                                             isEndOfParagraph(visibleDownstreamPos) || (unsigned)downstream == text.length());
     
     if (string != rebalancedString)
         replaceTextInNode(textNode, upstream, length, rebalancedString);
diff --git a/Source/WebCore/editing/CompositeEditCommand.h b/Source/WebCore/editing/CompositeEditCommand.h
index 6db4eb1..9066b65 100644
--- a/Source/WebCore/editing/CompositeEditCommand.h
+++ b/Source/WebCore/editing/CompositeEditCommand.h
@@ -71,7 +71,10 @@ protected:
     void mergeIdenticalElements(PassRefPtr<Element>, PassRefPtr<Element>);
     void rebalanceWhitespace();
     void rebalanceWhitespaceAt(const Position&);
+    void rebalanceWhitespaceOnTextSubstring(RefPtr<Text>, int startOffset, int endOffset);
     void prepareWhitespaceAtPositionForSplit(Position&);
+    bool canRebalance(const Position&) const;
+    bool shouldRebalanceLeadingWhitespaceFor(const String&) const;
     void removeCSSProperty(PassRefPtr<StyledElement>, CSSPropertyID);
     void removeNodeAttribute(PassRefPtr<Element>, const QualifiedName& attribute);
     void removeChildrenInRange(PassRefPtr<Node>, unsigned from, unsigned to);
diff --git a/Source/WebCore/editing/DeleteButtonController.cpp b/Source/WebCore/editing/DeleteButtonController.cpp
index 61e3190..75b9a96 100644
--- a/Source/WebCore/editing/DeleteButtonController.cpp
+++ b/Source/WebCore/editing/DeleteButtonController.cpp
@@ -164,7 +164,7 @@ static HTMLElement* enclosingDeletableElement(const VisibleSelection& selection)
         return 0;
 
     ASSERT(element->isHTMLElement());
-    return static_cast<HTMLElement*>(element);
+    return toHTMLElement(element);
 }
 
 void DeleteButtonController::respondToChangedSelection(const VisibleSelection& oldSelection)
@@ -263,7 +263,7 @@ void DeleteButtonController::show(HTMLElement* element)
     if (!enabled() || !element || !element->inDocument() || !isDeletableElement(element))
         return;
 
-    if (!m_frame->editor()->shouldShowDeleteInterface(static_cast<HTMLElement*>(element)))
+    if (!m_frame->editor()->shouldShowDeleteInterface(toHTMLElement(element)))
         return;
 
     // we rely on the renderer having current information, so we should update the layout if needed
diff --git a/Source/WebCore/editing/EditingStyle.cpp b/Source/WebCore/editing/EditingStyle.cpp
index 8caf4b6..a3f66be 100644
--- a/Source/WebCore/editing/EditingStyle.cpp
+++ b/Source/WebCore/editing/EditingStyle.cpp
@@ -90,18 +90,18 @@ EditingStyle::EditingStyle()
 {
 }
 
-EditingStyle::EditingStyle(Node* node)
+EditingStyle::EditingStyle(Node* node, PropertiesToInclude propertiesToInclude)
     : m_shouldUseFixedDefaultFontSize(false)
     , m_fontSizeDelta(NoFontDelta)
 {
-    init(node);
+    init(node, propertiesToInclude);
 }
 
 EditingStyle::EditingStyle(const Position& position)
     : m_shouldUseFixedDefaultFontSize(false)
     , m_fontSizeDelta(NoFontDelta)
 {
-    init(position.node());
+    init(position.node(), OnlyInheritableProperties);
 }
 
 EditingStyle::EditingStyle(const CSSStyleDeclaration* style)
@@ -116,10 +116,10 @@ EditingStyle::~EditingStyle()
 {
 }
 
-void EditingStyle::init(Node* node)
+void EditingStyle::init(Node* node, PropertiesToInclude propertiesToInclude)
 {
     RefPtr<CSSComputedStyleDeclaration> computedStyleAtPosition = computedStyle(node);
-    m_mutableStyle = editingStyleFromComputedStyle(computedStyleAtPosition);
+    m_mutableStyle = propertiesToInclude == AllProperties && computedStyleAtPosition ? computedStyleAtPosition->copy() : editingStyleFromComputedStyle(computedStyleAtPosition);
 
     if (node && node->computedStyle()) {
         RenderStyle* renderStyle = node->computedStyle();
@@ -255,6 +255,20 @@ PassRefPtr<EditingStyle> EditingStyle::extractAndRemoveBlockProperties()
     return blockProperties;
 }
 
+PassRefPtr<EditingStyle> EditingStyle::extractAndRemoveTextDirection()
+{
+    RefPtr<EditingStyle> textDirection = EditingStyle::create();
+    textDirection->m_mutableStyle = CSSMutableStyleDeclaration::create();
+    textDirection->m_mutableStyle->setProperty(CSSPropertyUnicodeBidi, CSSValueEmbed, m_mutableStyle->getPropertyPriority(CSSPropertyUnicodeBidi));
+    textDirection->m_mutableStyle->setProperty(CSSPropertyDirection, m_mutableStyle->getPropertyValue(CSSPropertyDirection),
+        m_mutableStyle->getPropertyPriority(CSSPropertyDirection));
+
+    m_mutableStyle->removeProperty(CSSPropertyUnicodeBidi);
+    m_mutableStyle->removeProperty(CSSPropertyDirection);
+
+    return textDirection;
+}
+
 void EditingStyle::removeBlockProperties()
 {
     if (!m_mutableStyle)
diff --git a/Source/WebCore/editing/EditingStyle.h b/Source/WebCore/editing/EditingStyle.h
index a71b4ad..129ade5 100644
--- a/Source/WebCore/editing/EditingStyle.h
+++ b/Source/WebCore/editing/EditingStyle.h
@@ -47,6 +47,7 @@ class RenderStyle;
 class EditingStyle : public RefCounted<EditingStyle> {
 public:
 
+    enum PropertiesToInclude { AllProperties, OnlyInheritableProperties };
     enum ShouldPreserveWritingDirection { PreserveWritingDirection, DoNotPreserveWritingDirection };
     static float NoFontDelta;
 
@@ -55,9 +56,9 @@ public:
         return adoptRef(new EditingStyle());
     }
 
-    static PassRefPtr<EditingStyle> create(Node* node)
+    static PassRefPtr<EditingStyle> create(Node* node, PropertiesToInclude propertiesToInclude = OnlyInheritableProperties)
     {
-        return adoptRef(new EditingStyle(node));
+        return adoptRef(new EditingStyle(node, propertiesToInclude));
     }
 
     static PassRefPtr<EditingStyle> create(const Position& position)
@@ -80,6 +81,7 @@ public:
     void clear();
     PassRefPtr<EditingStyle> copy() const;
     PassRefPtr<EditingStyle> extractAndRemoveBlockProperties();
+    PassRefPtr<EditingStyle> extractAndRemoveTextDirection();
     void removeBlockProperties();
     void removeStyleAddedByNode(Node*);
     void removeStyleConflictingWithStyleOfNode(Node*);
@@ -91,10 +93,10 @@ public:
 
 private:
     EditingStyle();
-    EditingStyle(Node*);
+    EditingStyle(Node*, PropertiesToInclude);
     EditingStyle(const Position&);
     EditingStyle(const CSSStyleDeclaration*);
-    void init(Node*);
+    void init(Node*, PropertiesToInclude);
     void removeTextFillAndStrokeColorsIfNeeded(RenderStyle*);
     void replaceFontSizeByKeywordIfPossible(RenderStyle*, CSSComputedStyleDeclaration*);
     void extractFontSizeDelta();
diff --git a/Source/WebCore/editing/Editor.cpp b/Source/WebCore/editing/Editor.cpp
index 23b41ce..99624b3 100644
--- a/Source/WebCore/editing/Editor.cpp
+++ b/Source/WebCore/editing/Editor.cpp
@@ -36,7 +36,6 @@
 #include "CSSStyleSelector.h"
 #include "CSSValueKeywords.h"
 #include "CachedResourceLoader.h"
-#include "CharacterNames.h"
 #include "ClipboardEvent.h"
 #include "CompositionEvent.h"
 #include "CreateLinkCommand.h"
@@ -83,6 +82,7 @@
 #include "markup.h"
 #include "visible_units.h"
 #include <wtf/UnusedParam.h>
+#include <wtf/unicode/CharacterNames.h>
 
 namespace WebCore {
 
@@ -116,6 +116,7 @@ static const Vector<DocumentMarker::MarkerType>& markerTypesForAutocorrection()
     if (markerTypesForAutoCorrection.isEmpty()) {
         markerTypesForAutoCorrection.append(DocumentMarker::Replacement);
         markerTypesForAutoCorrection.append(DocumentMarker::CorrectionIndicator);
+        markerTypesForAutoCorrection.append(DocumentMarker::SpellCheckingExemption);
     }
     return markerTypesForAutoCorrection;
 }
@@ -123,8 +124,10 @@ static const Vector<DocumentMarker::MarkerType>& markerTypesForAutocorrection()
 static const Vector<DocumentMarker::MarkerType>& markerTypesForReplacement()
 {
     DEFINE_STATIC_LOCAL(Vector<DocumentMarker::MarkerType>, markerTypesForReplacement, ());
-    if (markerTypesForReplacement.isEmpty())
+    if (markerTypesForReplacement.isEmpty()) {
         markerTypesForReplacement.append(DocumentMarker::Replacement);
+        markerTypesForReplacement.append(DocumentMarker::SpellCheckingExemption);
+    }
     return markerTypesForReplacement;
 }
 
@@ -505,19 +508,12 @@ bool Editor::shouldShowDeleteInterface(HTMLElement* element) const
 
 void Editor::respondToChangedSelection(const VisibleSelection& oldSelection)
 {
-#if SUPPORT_AUTOCORRECTION_PANEL
-    VisibleSelection currentSelection(frame()->selection()->selection());
-    if (currentSelection != oldSelection) {
-        stopCorrectionPanelTimer();
-        dismissCorrectionPanel(ReasonForDismissingCorrectionPanelIgnored);
-    }
-#endif // SUPPORT_AUTOCORRECTION_PANEL
-
     if (client())
         client()->respondToChangedSelection();
     m_deleteButtonController->respondToChangedSelection(oldSelection);
 
 #if SUPPORT_AUTOCORRECTION_PANEL
+    VisibleSelection currentSelection(frame()->selection()->selection());
     // When user moves caret to the end of autocorrected word and pauses, we show the panel
     // containing the original pre-correction word so that user can quickly revert the
     // undesired autocorrection. Here, we start correction panel timer once we confirm that
@@ -1051,10 +1047,10 @@ String Editor::selectionStartCSSPropertyValue(int propertyID)
 
     if (propertyID == CSSPropertyFontSize) {
         RefPtr<CSSValue> cssValue = selectionStyle->getPropertyCSSValue(CSSPropertyFontSize);
-        ASSERT(cssValue->isPrimitiveValue());
-        int fontPixelSize = static_cast<CSSPrimitiveValue*>(cssValue.get())->getIntValue(CSSPrimitiveValue::CSS_PX);
-        int size = CSSStyleSelector::legacyFontSize(m_frame->document(), fontPixelSize, shouldUseFixedFontDefaultSize);
-        value = String::number(size);
+        if (cssValue->isPrimitiveValue()) {
+            value = String::number(legacyFontSizeFromCSSValue(m_frame->document(), static_cast<CSSPrimitiveValue*>(cssValue.get()),
+                shouldUseFixedFontDefaultSize, AlwaysUseLegacyFontSize));
+        }
     }
 
     return value;
@@ -1089,14 +1085,20 @@ void Editor::appliedEditing(PassRefPtr<EditCommand> cmd)
     m_frame->document()->updateLayout();
 
     dispatchEditableContentChangedEvents(*cmd);
-
     VisibleSelection newSelection(cmd->endingSelection());
+
+#if SUPPORT_AUTOCORRECTION_PANEL
+    // Check to see if the command introduced paragraph separator. If it did, we remove existing autocorrection underlines. This is in consistency with the behavior in AppKit.
+    if (cmd->isTopLevelCommand() && !inSameParagraph(cmd->startingSelection().start(), newSelection.end()))
+        m_frame->document()->markers()->removeMarkers(DocumentMarker::CorrectionIndicator);
+#endif
+
     // Don't clear the typing style with this selection change.  We do those things elsewhere if necessary.
     changeSelectionAfterCommand(newSelection, false, false);
-        
+
     if (!cmd->preservesTypingStyle())
         m_frame->selection()->clearTypingStyle();
-    
+
     // Command will be equal to last edit command only in the case of typing
     if (m_lastEditCommand.get() == cmd)
         ASSERT(cmd->isTypingCommand());
@@ -1173,7 +1175,12 @@ bool Editor::insertText(const String& text, Event* triggeringEvent)
     return m_frame->eventHandler()->handleTextInputEvent(text, triggeringEvent);
 }
 
-bool Editor::insertTextWithoutSendingTextEvent(const String& text, bool selectInsertedText, Event* triggeringEvent)
+bool Editor::insertTextForConfirmedComposition(const String& text)
+{
+    return m_frame->eventHandler()->handleTextInputEvent(text, 0, TextEventInputComposition);
+}
+
+bool Editor::insertTextWithoutSendingTextEvent(const String& text, bool selectInsertedText, TextEvent* triggeringEvent)
 {
     if (text.isEmpty())
         return false;
@@ -1186,6 +1193,9 @@ bool Editor::insertTextWithoutSendingTextEvent(const String& text, bool selectIn
     if (!shouldInsertText(text, range.get(), EditorInsertActionTyped))
         return true;
 
+    if (text == " " || text == "\t")
+        applyAutocorrectionBeforeTypingIfAppropriate();
+
     // Get the selection to use for the event that triggered this insertText.
     // If the event handler changed the selection, we may want to use a different selection
     // that is contained in the event target.
@@ -1195,7 +1205,8 @@ bool Editor::insertTextWithoutSendingTextEvent(const String& text, bool selectIn
             RefPtr<Document> document = selectionStart->document();
             
             // Insert the text
-            TypingCommand::insertText(document.get(), text, selection, selectInsertedText);
+            TypingCommand::insertText(document.get(), text, selection, selectInsertedText, 
+                                      triggeringEvent && triggeringEvent->isComposition() ? TypingCommand::TextCompositionConfirm : TypingCommand::TextCompositionNone);
 
             // Reveal the current selection 
             if (Frame* editedFrame = document->frame())
@@ -1215,6 +1226,8 @@ bool Editor::insertLineBreak()
     if (!shouldInsertText("\n", m_frame->selection()->toNormalizedRange().get(), EditorInsertActionTyped))
         return true;
 
+    applyAutocorrectionBeforeTypingIfAppropriate();
+
     TypingCommand::insertLineBreak(m_frame->document());
     revealSelectionAfterEditingOperation();
     return true;
@@ -1231,6 +1244,8 @@ bool Editor::insertParagraphSeparator()
     if (!shouldInsertText("\n", m_frame->selection()->toNormalizedRange().get(), EditorInsertActionTyped))
         return true;
 
+    applyAutocorrectionBeforeTypingIfAppropriate();
+
     TypingCommand::insertParagraphSeparator(m_frame->document());
     revealSelectionAfterEditingOperation();
     return true;
@@ -1543,7 +1558,7 @@ void Editor::setBaseWritingDirection(WritingDirection direction)
     if (focusedNode && (focusedNode->hasTagName(textareaTag) || (focusedNode->hasTagName(inputTag) && static_cast<HTMLInputElement*>(focusedNode)->isTextField()))) {
         if (direction == NaturalWritingDirection)
             return;
-        static_cast<HTMLElement*>(focusedNode)->setAttribute(dirAttr, direction == LeftToRightWritingDirection ? "ltr" : "rtl");
+        toHTMLElement(focusedNode)->setAttribute(dirAttr, direction == LeftToRightWritingDirection ? "ltr" : "rtl");
         frame()->document()->updateStyleIfNeeded();
         return;
     }
@@ -1618,7 +1633,7 @@ void Editor::confirmComposition(const String& text, bool preserveSelection)
     m_compositionNode = 0;
     m_customCompositionUnderlines.clear();
 
-    insertText(text, 0);
+    insertTextForConfirmedComposition(text);
 
     if (preserveSelection) {
         m_frame->selection()->setSelection(oldSelection, false, false);
@@ -1687,7 +1702,7 @@ void Editor::setComposition(const String& text, const Vector<CompositionUnderlin
     m_customCompositionUnderlines.clear();
 
     if (!text.isEmpty()) {
-        TypingCommand::insertText(m_frame->document(), text, true, true);
+        TypingCommand::insertText(m_frame->document(), text, true, TypingCommand::TextCompositionUpdate);
 
         // Find out what node has the composition now.
         Position base = m_frame->selection()->base().downstream();
@@ -2210,6 +2225,9 @@ void Editor::markBadGrammar(const VisibleSelection& selection)
 #if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
 void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCheckingOptions, Range* spellingRange, Range* grammarRange)
 {
+    // There shouldn't be pending autocorrection at this moment.
+    ASSERT(!m_correctionPanelInfo.rangeToBeReplaced);
+
     bool shouldMarkSpelling = textCheckingOptions & MarkSpelling;
     bool shouldMarkGrammar = textCheckingOptions & MarkGrammar;
     bool shouldPerformReplacement = textCheckingOptions & PerformReplacement;
@@ -2303,6 +2321,10 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
         if (shouldMarkSpelling && result->type == TextCheckingTypeSpelling && resultLocation >= spellingParagraph.checkingStart() && resultLocation + resultLength <= spellingRangeEndOffset && !resultEndsAtAmbiguousBoundary) {
             ASSERT(resultLength > 0 && resultLocation >= 0);
             RefPtr<Range> misspellingRange = spellingParagraph.subrange(resultLocation, resultLength);
+#if SUPPORT_AUTOCORRECTION_PANEL
+            if (m_frame->document()->markers()->hasMarkers(misspellingRange.get(), DocumentMarker::SpellCheckingExemption))
+                continue;
+#endif // SUPPORT_AUTOCORRECTION_PANEL
             misspellingRange->startContainer(ec)->document()->markers()->addMarker(misspellingRange.get(), DocumentMarker::Spelling);
         } else if (shouldMarkGrammar && result->type == TextCheckingTypeGrammar && grammarParagraph.checkingRangeCovers(resultLocation, resultLength)) {
             ASSERT(resultLength > 0 && resultLocation >= 0);
@@ -2406,6 +2428,7 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
                             RefPtr<Range> replacedRange = paragraph.subrange(resultLocation, replacementLength);
                             replacedRange->startContainer()->document()->markers()->addMarker(replacedRange.get(), DocumentMarker::Replacement, replacedString);
                             replacedRange->startContainer()->document()->markers()->addMarker(replacedRange.get(), DocumentMarker::CorrectionIndicator, replacedString);
+                            replacedRange->startContainer()->document()->markers()->addMarker(replacedRange.get(), DocumentMarker::SpellCheckingExemption);
                         }
                     }
                 }
@@ -2488,8 +2511,10 @@ void Editor::correctionPanelTimerFired(Timer<Editor>*)
         String paragraphText = plainText(TextCheckingParagraph(m_correctionPanelInfo.rangeToBeReplaced).paragraphRange().get());
         Vector<String> suggestions;
         client()->getGuessesForWord(m_correctionPanelInfo.replacedString, paragraphText, suggestions);
-        if (suggestions.isEmpty())
+        if (suggestions.isEmpty()) {
+            m_correctionPanelInfo.rangeToBeReplaced.clear();
             break;
+        }
         String topSuggestion = suggestions.first();
         suggestions.remove(0);
         m_correctionPanelInfo.isActive = true;
@@ -2649,44 +2674,8 @@ void Editor::removeSpellAndCorrectionMarkersFromWordsToBeEdited(bool doNotRemove
     // of marker that contains the word in question, and remove marker on that whole range.
     Document* document = m_frame->document();
     RefPtr<Range> wordRange = Range::create(document, startOfFirstWord.deepEquivalent(), endOfLastWord.deepEquivalent());
-    RefPtr<Range> rangeOfFirstWord = Range::create(document, startOfFirstWord.deepEquivalent(), endOfFirstWord.deepEquivalent());
-    RefPtr<Range> rangeOfLastWord = Range::create(document, startOfLastWord.deepEquivalent(), endOfLastWord.deepEquivalent());
-
-    typedef pair<RefPtr<Range>, DocumentMarker::MarkerType> RangeMarkerPair;
-    // It's probably unsafe to remove marker while iterating a vector of markers. So we store the markers and ranges that we want to remove temporarily. Then remove them at the end of function.
-    // To avoid allocation on the heap, Give markersToRemove a small inline capacity
-    Vector<RangeMarkerPair, 16> markersToRemove;
-    for (TextIterator textIterator(wordRange.get()); !textIterator.atEnd(); textIterator.advance()) {
-        Node* node = textIterator.node();
-        if (!node)
-            continue;
-        if (node == startOfFirstWord.deepEquivalent().containerNode() || node == endOfLastWord.deepEquivalent().containerNode()) {
-            // First word and last word can belong to the same node
-            bool processFirstWord = node == startOfFirstWord.deepEquivalent().containerNode() && document->markers()->hasMarkers(rangeOfFirstWord.get(), DocumentMarker::Spelling | DocumentMarker::CorrectionIndicator);
-            bool processLastWord = node == endOfLastWord.deepEquivalent().containerNode() && document->markers()->hasMarkers(rangeOfLastWord.get(), DocumentMarker::Spelling | DocumentMarker::CorrectionIndicator);
-            // Take note on the markers whose range overlaps with the range of the first word or the last word.
-            Vector<DocumentMarker> markers = document->markers()->markersForNode(node);
-            for (size_t i = 0; i < markers.size(); ++i) {
-                DocumentMarker marker = markers[i];
-                if (processFirstWord && static_cast<int>(marker.endOffset) > startOfFirstWord.deepEquivalent().offsetInContainerNode() && (marker.type == DocumentMarker::Spelling || marker.type == DocumentMarker::CorrectionIndicator)) {
-                    RefPtr<Range> markerRange = Range::create(document, node, marker.startOffset, node, marker.endOffset);
-                    markersToRemove.append(std::make_pair(markerRange, marker.type));
-                }
-                if (processLastWord && static_cast<int>(marker.startOffset) <= endOfLastWord.deepEquivalent().offsetInContainerNode() && (marker.type == DocumentMarker::Spelling || marker.type == DocumentMarker::CorrectionIndicator)) {
-                    RefPtr<Range> markerRange = Range::create(document, node, marker.startOffset, node, marker.endOffset);
-                    markersToRemove.append(std::make_pair(markerRange, marker.type));
-                }
-            }
-        } else {
-            document->markers()->removeMarkers(node, DocumentMarker::Spelling);
-            document->markers()->removeMarkers(node, DocumentMarker::CorrectionIndicator);
-        }
-    }
 
-    // Actually remove the markers.
-    Vector<RangeMarkerPair>::const_iterator pairEnd = markersToRemove.end();
-    for (Vector<RangeMarkerPair>::const_iterator pairIterator = markersToRemove.begin(); pairIterator != pairEnd; ++pairIterator)
-        document->markers()->removeMarkers(pairIterator->first.get(), pairIterator->second);
+    document->markers()->removeMarkers(wordRange.get(), DocumentMarker::Spelling | DocumentMarker::CorrectionIndicator | DocumentMarker::SpellCheckingExemption, DocumentMarkerController::RemovePartiallyOverlappingMarker);
 }
 
 void Editor::applyCorrectionPanelInfo(const Vector<DocumentMarker::MarkerType>& markerTypesToAdd)
@@ -2719,7 +2708,6 @@ void Editor::applyCorrectionPanelInfo(const Vector<DocumentMarker::MarkerType>&
 
     // Take note of the location of autocorrection so that we can add marker after the replacement took place.
     int correctionStartOffsetInParagraph = TextIterator::rangeLength(correctionStartOffsetInParagraphAsRange.get());
-    Position caretPosition = m_frame->selection()->selection().end();
 
     // Clone the range, since the caller of this method may want to keep the original range around.
     RefPtr<Range> rangeToBeReplaced = m_correctionPanelInfo.rangeToBeReplaced->cloneRange(ec);
@@ -2727,17 +2715,34 @@ void Editor::applyCorrectionPanelInfo(const Vector<DocumentMarker::MarkerType>&
     if (m_frame->selection()->shouldChangeSelection(selectionToReplace)) {
         m_frame->selection()->setSelection(selectionToReplace);
         replaceSelectionWithText(m_correctionPanelInfo.replacementString, false, false);
-        caretPosition.moveToOffset(caretPosition.offsetInContainerNode() + m_correctionPanelInfo.replacementString.length() - m_correctionPanelInfo.replacedString.length());
-        setEnd(paragraphRangeContainingCorrection.get(), endOfParagraph(caretPosition));
+        setEnd(paragraphRangeContainingCorrection.get(), m_frame->selection()->selection().start());
         RefPtr<Range> replacementRange = TextIterator::subrange(paragraphRangeContainingCorrection.get(), correctionStartOffsetInParagraph, m_correctionPanelInfo.replacementString.length());
         DocumentMarkerController* markers = replacementRange->startContainer()->document()->markers();
         size_t size = markerTypesToAdd.size();
-        for (size_t i = 0; i < size; ++i)
-            markers->addMarker(replacementRange.get(), markerTypesToAdd[i], m_correctionPanelInfo.replacementString);
-        m_frame->selection()->moveTo(caretPosition, false);
+        for (size_t i = 0; i < size; ++i) {
+            if (m_correctionPanelInfo.panelType == CorrectionPanelInfo::PanelTypeReversion)
+                markers->addMarker(replacementRange.get(), markerTypesToAdd[i]);
+            else
+                markers->addMarker(replacementRange.get(), markerTypesToAdd[i], m_correctionPanelInfo.replacedString);
+        }
     }
 }
 
+void Editor::applyAutocorrectionBeforeTypingIfAppropriate()
+{
+    if (!m_correctionPanelInfo.rangeToBeReplaced || !m_correctionPanelInfo.isActive)
+        return;
+
+    if (m_correctionPanelInfo.panelType != CorrectionPanelInfo::PanelTypeCorrection)
+        return;
+
+    Position caretPosition = m_frame->selection()->selection().start();
+
+    // Pending correction should always be where caret is. But in case this is not always true, we still want to dismiss the panel without accepting the correction.
+    ASSERT(m_correctionPanelInfo.rangeToBeReplaced->endPosition() == caretPosition);
+    dismissCorrectionPanel(m_correctionPanelInfo.rangeToBeReplaced->endPosition() == caretPosition ? ReasonForDismissingCorrectionPanelAccepted : ReasonForDismissingCorrectionPanelIgnored);
+}
+
 PassRefPtr<Range> Editor::rangeForPoint(const IntPoint& windowPoint)
 {
     Document* document = m_frame->documentAtPoint(windowPoint);
@@ -3004,13 +3009,6 @@ void Editor::changeSelectionAfterCommand(const VisibleSelection& newSelection, b
     if (newSelection.start().isOrphan() || newSelection.end().isOrphan())
         return;
 
-#if SUPPORT_AUTOCORRECTION_PANEL
-    // Check to see if the command introduced paragraph separator. If it did, we remove existing autocorrection underlines.
-    // This is in consistency with the behavior in AppKit
-    if (!inSameParagraph(m_frame->selection()->selection().visibleStart(), newSelection.visibleEnd()))
-        m_frame->document()->markers()->removeMarkers(DocumentMarker::CorrectionIndicator);
-#endif
-
     // If there is no selection change, don't bother sending shouldChangeSelection, but still call setSelection,
     // because there is work that it must do in this situation.
     // The old selection can be invalid here and calling shouldChangeSelection can produce some strange calls.
@@ -3018,13 +3016,13 @@ void Editor::changeSelectionAfterCommand(const VisibleSelection& newSelection, b
     bool selectionDidNotChangeDOMPosition = newSelection == m_frame->selection()->selection();
     if (selectionDidNotChangeDOMPosition || m_frame->selection()->shouldChangeSelection(newSelection))
         m_frame->selection()->setSelection(newSelection, closeTyping, clearTypingStyle);
-        
+
     // Some editing operations change the selection visually without affecting its position within the DOM.
-    // For example when you press return in the following (the caret is marked by ^): 
+    // For example when you press return in the following (the caret is marked by ^):
     // <div contentEditable="true"><div>^Hello</div></div>
     // WebCore inserts <div><br></div> *before* the current block, which correctly moves the paragraph down but which doesn't
     // change the caret's DOM position (["hello", 0]).  In these situations the above SelectionController::setSelection call
-    // does not call EditorClient::respondToChangedSelection(), which, on the Mac, sends selection change notifications and 
+    // does not call EditorClient::respondToChangedSelection(), which, on the Mac, sends selection change notifications and
     // starts a new kill ring sequence, but we want to do these things (matches AppKit).
     if (selectionDidNotChangeDOMPosition)
         client()->respondToChangedSelection();
@@ -3142,8 +3140,7 @@ PassRefPtr<CSSMutableStyleDeclaration> Editor::selectionComputedStyle(bool& shou
     if (!m_frame->selection()->typingStyle())
         return mutableStyle;
 
-    RefPtr<EditingStyle> typingStyle = m_frame->selection()->typingStyle();
-    typingStyle->removeNonEditingProperties();
+    RefPtr<EditingStyle> typingStyle = m_frame->selection()->typingStyle()->copy();
     typingStyle->prepareToApplyAt(position);
     mutableStyle->merge(typingStyle->style());
 
@@ -3421,7 +3418,11 @@ unsigned Editor::countMatchesForText(const String& target, Range* range, FindOpt
             if (!visibleRect.isEmpty()) {
                 GraphicsContext context((PlatformGraphicsContext*)0);
                 context.setPaintingDisabled(true);
+
+                PaintBehavior oldBehavior = m_frame->view()->paintBehavior();
+                m_frame->view()->setPaintBehavior(oldBehavior | PaintBehaviorFlattenCompositingLayers);
                 m_frame->view()->paintContents(&context, visibleRect);
+                m_frame->view()->setPaintBehavior(oldBehavior);
             }
         }
     }
@@ -3440,6 +3441,15 @@ void Editor::setMarkedTextMatchesAreHighlighted(bool flag)
 
 void Editor::respondToChangedSelection(const VisibleSelection& oldSelection, bool closeTyping)
 {
+#if SUPPORT_AUTOCORRECTION_PANEL
+    // Make sure there's no pending autocorrection before we call markMisspellingsAndBadGrammar() below.
+    VisibleSelection currentSelection(frame()->selection()->selection());
+    if (currentSelection != oldSelection) {
+        stopCorrectionPanelTimer();
+        dismissCorrectionPanel(ReasonForDismissingCorrectionPanelIgnored);
+    }
+#endif // SUPPORT_AUTOCORRECTION_PANEL
+
     bool isContinuousSpellCheckingEnabled = this->isContinuousSpellCheckingEnabled();
     bool isContinuousGrammarCheckingEnabled = isContinuousSpellCheckingEnabled && isGrammarCheckingEnabled();
     if (isContinuousSpellCheckingEnabled) {
diff --git a/Source/WebCore/editing/Editor.h b/Source/WebCore/editing/Editor.h
index 2e61ce6..0a06a4a 100644
--- a/Source/WebCore/editing/Editor.h
+++ b/Source/WebCore/editing/Editor.h
@@ -198,7 +198,8 @@ public:
     static bool commandIsSupportedFromMenuOrKeyBinding(const String& commandName); // Works without a frame.
 
     bool insertText(const String&, Event* triggeringEvent);
-    bool insertTextWithoutSendingTextEvent(const String&, bool selectInsertedText, Event* triggeringEvent);
+    bool insertTextForConfirmedComposition(const String& text);
+    bool insertTextWithoutSendingTextEvent(const String&, bool selectInsertedText, TextEvent* triggeringEvent);
     bool insertLineBreak();
     bool insertParagraphSeparator();
     
@@ -423,6 +424,7 @@ private:
     void stopCorrectionPanelTimer();
     void dismissCorrectionPanel(ReasonForDismissingCorrectionPanel);
     void applyCorrectionPanelInfo(const Vector<DocumentMarker::MarkerType>& markerTypesToAdd);
+    void applyAutocorrectionBeforeTypingIfAppropriate();
 };
 
 inline void Editor::setStartNewKillRingSequence(bool flag)
diff --git a/Source/WebCore/editing/EditorCommand.cpp b/Source/WebCore/editing/EditorCommand.cpp
index 9e5bf9f..451d855 100644
--- a/Source/WebCore/editing/EditorCommand.cpp
+++ b/Source/WebCore/editing/EditorCommand.cpp
@@ -930,6 +930,26 @@ static bool executeRemoveFormat(Frame* frame, Event*, EditorCommandSource, const
     return true;
 }
 
+static bool executeScrollPageBackward(Frame* frame, Event*, EditorCommandSource, const String&)
+{
+    return frame->eventHandler()->logicalScrollRecursively(ScrollBlockDirectionBackward, ScrollByPage);
+}
+
+static bool executeScrollPageForward(Frame* frame, Event*, EditorCommandSource, const String&)
+{
+    return frame->eventHandler()->logicalScrollRecursively(ScrollBlockDirectionForward, ScrollByPage);
+}
+
+static bool executeScrollToBeginningOfDocument(Frame* frame, Event*, EditorCommandSource, const String&)
+{
+    return frame->eventHandler()->logicalScrollRecursively(ScrollBlockDirectionBackward, ScrollByDocument);
+}
+
+static bool executeScrollToEndOfDocument(Frame* frame, Event*, EditorCommandSource, const String&)
+{
+    return frame->eventHandler()->logicalScrollRecursively(ScrollBlockDirectionForward, ScrollByDocument);
+}
+
 static bool executeSelectAll(Frame* frame, Event*, EditorCommandSource, const String&)
 {
     frame->selection()->selectAll();
@@ -1477,6 +1497,10 @@ static const CommandMap& createCommandMap()
         { "Print", { executePrint, supported, enabled, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "Redo", { executeRedo, supported, enabledRedo, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "RemoveFormat", { executeRemoveFormat, supported, enabledRangeInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "ScrollPageBackward", { executeScrollPageBackward, supportedFromMenuOrKeyBinding, enabled, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "ScrollPageForward", { executeScrollPageForward, supportedFromMenuOrKeyBinding, enabled, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "ScrollToBeginningOfDocument", { executeScrollToBeginningOfDocument, supportedFromMenuOrKeyBinding, enabled, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "ScrollToEndOfDocument", { executeScrollToEndOfDocument, supportedFromMenuOrKeyBinding, enabled, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "SelectAll", { executeSelectAll, supported, enabled, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "SelectLine", { executeSelectLine, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "SelectParagraph", { executeSelectParagraph, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
diff --git a/Source/WebCore/editing/FormatBlockCommand.cpp b/Source/WebCore/editing/FormatBlockCommand.cpp
index e43f330..58157af 100644
--- a/Source/WebCore/editing/FormatBlockCommand.cpp
+++ b/Source/WebCore/editing/FormatBlockCommand.cpp
@@ -67,6 +67,9 @@ void FormatBlockCommand::formatRange(const Position& start, const Position& end,
     RefPtr<Range> range = Range::create(document(), start, endOfSelection);
     Element* refNode = enclosingBlockFlowElement(end);
     Element* root = editableRootForPosition(start);
+    // Root is null for elements with contenteditable=false.
+    if (!root)
+        return;
     if (isElementForFormatBlock(refNode->tagQName()) && start == startOfBlock(start)
         && (end == endOfBlock(end) || isNodeVisiblyContainedWithin(refNode, range.get()))
         && refNode != root && !root->isDescendantOf(refNode)) {
diff --git a/Source/WebCore/editing/HTMLInterchange.cpp b/Source/WebCore/editing/HTMLInterchange.cpp
index 16b330d..1ce06ab 100644
--- a/Source/WebCore/editing/HTMLInterchange.cpp
+++ b/Source/WebCore/editing/HTMLInterchange.cpp
@@ -26,10 +26,10 @@
 #include "config.h"
 #include "HTMLInterchange.h"
 
-#include "CharacterNames.h"
 #include "Text.h"
 #include "TextIterator.h"
 #include <wtf/StdLibExtras.h>
+#include <wtf/unicode/CharacterNames.h>
 
 namespace WebCore {
 
diff --git a/Source/WebCore/editing/InsertListCommand.cpp b/Source/WebCore/editing/InsertListCommand.cpp
index 9348786..c24c683 100644
--- a/Source/WebCore/editing/InsertListCommand.cpp
+++ b/Source/WebCore/editing/InsertListCommand.cpp
@@ -72,7 +72,7 @@ PassRefPtr<HTMLElement> InsertListCommand::mergeWithNeighboringLists(PassRefPtr<
     if (!list || !list->nextElementSibling() || !list->nextElementSibling()->isHTMLElement())
         return list.release();
 
-    RefPtr<HTMLElement> nextList = static_cast<HTMLElement*>(list->nextElementSibling());
+    RefPtr<HTMLElement> nextList = toHTMLElement(list->nextElementSibling());
     if (canMergeLists(list.get(), nextList.get())) {
         mergeIdenticalElements(list, nextList);
         return nextList.release();
diff --git a/Source/WebCore/editing/InsertTextCommand.cpp b/Source/WebCore/editing/InsertTextCommand.cpp
index fc18e91..1ec11ad 100644
--- a/Source/WebCore/editing/InsertTextCommand.cpp
+++ b/Source/WebCore/editing/InsertTextCommand.cpp
@@ -26,7 +26,6 @@
 #include "config.h"
 #include "InsertTextCommand.h"
 
-#include "CharacterNames.h"
 #include "CSSComputedStyleDeclaration.h"
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSPropertyNames.h"
@@ -41,6 +40,7 @@
 #include "TextIterator.h"
 #include "TypingCommand.h"
 #include "visible_units.h"
+#include <wtf/unicode/CharacterNames.h>
 
 namespace WebCore {
 
@@ -61,13 +61,13 @@ Position InsertTextCommand::prepareForTextInsertion(const Position& p)
     if (!pos.node()->isTextNode()) {
         RefPtr<Node> textNode = document()->createEditingTextNode("");
         insertNodeAt(textNode.get(), pos);
-        return Position(textNode.get(), 0);
+        return firstPositionInNode(textNode.get());
     }
 
     if (isTabSpanTextNode(pos.node())) {
         RefPtr<Node> textNode = document()->createEditingTextNode("");
         insertNodeAtTabSpanPosition(textNode.get(), pos);
-        return Position(textNode.get(), 0);
+        return firstPositionInNode(textNode.get());
     }
 
     return pos;
@@ -83,30 +83,32 @@ bool InsertTextCommand::performTrivialReplace(const String& text, bool selectIns
     if (text.contains('\t') || text.contains(' ') || text.contains('\n'))
         return false;
     
-    Position start = endingSelection().start();
-    Position end = endingSelection().end();
-    
-    if (start.node() != end.node() || !start.node()->isTextNode() || isTabSpanTextNode(start.node()))
+    Position start = endingSelection().start().parentAnchoredEquivalent();
+    Position end = endingSelection().end().parentAnchoredEquivalent();
+    ASSERT(start.anchorType() == Position::PositionIsOffsetInAnchor);
+    ASSERT(end.anchorType() == Position::PositionIsOffsetInAnchor);
+
+    if (start.containerNode() != end.containerNode() || !start.containerNode()->isTextNode() || isTabSpanTextNode(start.containerNode()))
         return false;
-        
-    replaceTextInNode(static_cast<Text*>(start.node()), start.deprecatedEditingOffset(), end.deprecatedEditingOffset() - start.deprecatedEditingOffset(), text);
-    
-    Position endPosition(start.node(), start.deprecatedEditingOffset() + text.length());
-    
+
+    replaceTextInNode(static_cast<Text*>(start.containerNode()), start.offsetInContainerNode(), end.offsetInContainerNode() - start.offsetInContainerNode(), text);
+
+    Position endPosition(start.containerNode(), start.offsetInContainerNode() + text.length());
+
     // We could have inserted a part of composed character sequence,
     // so we are basically treating ending selection as a range to avoid validation.
     // <http://bugs.webkit.org/show_bug.cgi?id=15781>
     VisibleSelection forcedEndingSelection;
     forcedEndingSelection.setWithoutValidation(start, endPosition);
     setEndingSelection(forcedEndingSelection);
-    
+
     if (!selectInsertedText)
         setEndingSelection(VisibleSelection(endingSelection().visibleEnd()));
     
     return true;
 }
 
-void InsertTextCommand::input(const String& text, bool selectInsertedText)
+void InsertTextCommand::input(const String& text, bool selectInsertedText, RebalanceType whitespaceRebalance)
 {
     
     ASSERT(text.find('\n') == notFound);
@@ -170,13 +172,19 @@ void InsertTextCommand::input(const String& text, bool selectInsertedText)
         int offset = startPosition.deprecatedEditingOffset();
 
         insertTextIntoNode(textNode, offset, text);
-        endPosition = Position(textNode, offset + text.length());
-
-        // The insertion may require adjusting adjacent whitespace, if it is present.
-        rebalanceWhitespaceAt(endPosition);
-        // Rebalancing on both sides isn't necessary if we've inserted a space.
-        if (text != " ") 
-            rebalanceWhitespaceAt(startPosition);
+        endPosition = Position(textNode, offset + text.length(), Position::PositionIsOffsetInAnchor);
+
+        if (whitespaceRebalance == RebalanceLeadingAndTrailingWhitespaces) {
+            // The insertion may require adjusting adjacent whitespace, if it is present.
+            rebalanceWhitespaceAt(endPosition);
+            // Rebalancing on both sides isn't necessary if we've inserted only spaces.
+            if (!shouldRebalanceLeadingWhitespaceFor(text))
+                rebalanceWhitespaceAt(startPosition);
+        } else {
+            ASSERT(whitespaceRebalance == RebalanceAllWhitespaces);
+            if (canRebalance(startPosition) && canRebalance(endPosition))
+                rebalanceWhitespaceOnTextSubstring(textNode, startPosition.deprecatedEditingOffset(), endPosition.deprecatedEditingOffset());
+        }
     }
 
     // We could have inserted a part of composed character sequence,
@@ -207,7 +215,7 @@ Position InsertTextCommand::insertTab(const Position& pos)
     // keep tabs coalesced in tab span
     if (isTabSpanTextNode(node)) {
         insertTextIntoNode(static_cast<Text *>(node), offset, "\t");
-        return Position(node, offset + 1);
+        return Position(node, offset + 1, Position::PositionIsOffsetInAnchor);
     }
     
     // create new tab span
@@ -230,9 +238,9 @@ Position InsertTextCommand::insertTab(const Position& pos)
             insertNodeBefore(spanNode, textNode);
         }
     }
-    
+
     // return the position following the new tab
-    return Position(spanNode->lastChild(), caretMaxOffset(spanNode->lastChild()));
+    return lastPositionInNode(spanNode.get());
 }
 
 bool InsertTextCommand::isInsertTextCommand() const
diff --git a/Source/WebCore/editing/InsertTextCommand.h b/Source/WebCore/editing/InsertTextCommand.h
index 77ae016..672e576 100644
--- a/Source/WebCore/editing/InsertTextCommand.h
+++ b/Source/WebCore/editing/InsertTextCommand.h
@@ -32,14 +32,20 @@ namespace WebCore {
 
 class InsertTextCommand : public CompositeEditCommand {
 public:
+    enum RebalanceType {
+        RebalanceLeadingAndTrailingWhitespaces,
+        RebalanceAllWhitespaces
+    };
+
     static PassRefPtr<InsertTextCommand> create(Document* document)
     {
         return adoptRef(new InsertTextCommand(document));
     }
 
-    void input(const String& text, bool selectInsertedText = false);
+    void input(const String& text, bool selectInsertedText = false, RebalanceType = RebalanceLeadingAndTrailingWhitespaces);
 
 private:
+
     InsertTextCommand(Document*);
 
     void deleteCharacter();
diff --git a/Source/WebCore/editing/MarkupAccumulator.cpp b/Source/WebCore/editing/MarkupAccumulator.cpp
index f6dbd8b..f4489c5 100644
--- a/Source/WebCore/editing/MarkupAccumulator.cpp
+++ b/Source/WebCore/editing/MarkupAccumulator.cpp
@@ -28,7 +28,6 @@
 #include "MarkupAccumulator.h"
 
 #include "CDATASection.h"
-#include "CharacterNames.h"
 #include "Comment.h"
 #include "DocumentFragment.h"
 #include "DocumentType.h"
@@ -38,6 +37,7 @@
 #include "KURL.h"
 #include "ProcessingInstruction.h"
 #include "XMLNSNames.h"
+#include <wtf/unicode/CharacterNames.h>
 
 namespace WebCore {
 
diff --git a/Source/WebCore/editing/MarkupAccumulator.h b/Source/WebCore/editing/MarkupAccumulator.h
index 5a9c884..0bfc6e6 100644
--- a/Source/WebCore/editing/MarkupAccumulator.h
+++ b/Source/WebCore/editing/MarkupAccumulator.h
@@ -72,7 +72,7 @@ public:
     String serializeNodes(Node* node, Node* nodeToSkip, EChildrenOnly childrenOnly);
 
 protected:
-    void appendString(const String&);
+    virtual void appendString(const String&);
     void appendStartTag(Node*, Namespaces* = 0);
     void appendEndTag(Node*);
     static size_t totalLength(const Vector<String>&);
diff --git a/Source/WebCore/editing/MoveSelectionCommand.cpp b/Source/WebCore/editing/MoveSelectionCommand.cpp
index 3a1cae0..0f23b29 100644
--- a/Source/WebCore/editing/MoveSelectionCommand.cpp
+++ b/Source/WebCore/editing/MoveSelectionCommand.cpp
@@ -39,25 +39,21 @@ MoveSelectionCommand::MoveSelectionCommand(PassRefPtr<DocumentFragment> fragment
 
 void MoveSelectionCommand::doApply()
 {
-    VisibleSelection selection = endingSelection();
-    ASSERT(selection.isNonOrphanedRange());
+    ASSERT(endingSelection().isNonOrphanedRange());
 
     Position pos = m_position;
     if (pos.isNull())
         return;
-        
+
     // Update the position otherwise it may become invalid after the selection is deleted.
-    Node *positionNode = m_position.node();
-    int positionOffset = m_position.deprecatedEditingOffset();
-    Position selectionEnd = selection.end();
-    int selectionEndOffset = selectionEnd.deprecatedEditingOffset();
-    if (selectionEnd.node() == positionNode && selectionEndOffset < positionOffset) {
-        positionOffset -= selectionEndOffset;
-        Position selectionStart = selection.start();
-        if (selectionStart.node() == positionNode) {
-            positionOffset += selectionStart.deprecatedEditingOffset();
-        }
-        pos = Position(positionNode, positionOffset);
+    Position selectionEnd = endingSelection().end();
+    if (pos.anchorType() == Position::PositionIsOffsetInAnchor && selectionEnd.anchorType() == Position::PositionIsOffsetInAnchor
+        && selectionEnd.containerNode() == pos.containerNode() && selectionEnd.offsetInContainerNode() < pos.offsetInContainerNode()) {
+        pos.moveToOffset(pos.offsetInContainerNode() - selectionEnd.offsetInContainerNode());
+
+        Position selectionStart = endingSelection().start();
+        if (selectionStart.anchorType() == Position::PositionIsOffsetInAnchor && selectionStart.containerNode() == pos.containerNode())
+            pos.moveToOffset(pos.offsetInContainerNode() + selectionStart.offsetInContainerNode());
     }
 
     deleteSelection(m_smartDelete);
@@ -70,11 +66,11 @@ void MoveSelectionCommand::doApply()
         pos = endingSelection().start();
 
     setEndingSelection(VisibleSelection(pos, endingSelection().affinity()));
-    if (!positionNode->inDocument()) {
+    if (!pos.anchorNode()->inDocument()) {
         // Document was modified out from under us.
         return;
     }
-    applyCommandToComposite(ReplaceSelectionCommand::create(positionNode->document(), m_fragment, true, m_smartInsert));
+    applyCommandToComposite(ReplaceSelectionCommand::create(document(), m_fragment, true, m_smartInsert));
 }
 
 EditAction MoveSelectionCommand::editingAction() const
diff --git a/Source/WebCore/editing/ReplaceSelectionCommand.cpp b/Source/WebCore/editing/ReplaceSelectionCommand.cpp
index f47cb4e..846b932 100644
--- a/Source/WebCore/editing/ReplaceSelectionCommand.cpp
+++ b/Source/WebCore/editing/ReplaceSelectionCommand.cpp
@@ -476,7 +476,7 @@ void ReplaceSelectionCommand::negateStyleRulesThatAffectAppearance()
     for (RefPtr<Node> node = m_firstNodeInserted.get(); node; node = node->traverseNextNode()) {
         // FIXME: <rdar://problem/5371536> Style rules that match pasted content can change it's appearance
         if (isStyleSpan(node.get())) {
-            HTMLElement* e = static_cast<HTMLElement*>(node.get());
+            HTMLElement* e = toHTMLElement(node.get());
             // There are other styles that style rules can give to style spans,
             // but these are the two important ones because they'll prevent
             // inserted content from appearing in the right paragraph.
@@ -496,10 +496,10 @@ void ReplaceSelectionCommand::negateStyleRulesThatAffectAppearance()
 void ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds()
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    if (!m_lastLeafInserted->renderer() && 
-        m_lastLeafInserted->isTextNode() && 
-        !enclosingNodeWithTag(Position(m_lastLeafInserted.get(), 0), selectTag) && 
-        !enclosingNodeWithTag(Position(m_lastLeafInserted.get(), 0), scriptTag)) {
+    if (!m_lastLeafInserted->renderer()
+        && m_lastLeafInserted->isTextNode()
+        && !enclosingNodeWithTag(firstPositionInOrBeforeNode(m_lastLeafInserted.get()), selectTag)
+        && !enclosingNodeWithTag(firstPositionInOrBeforeNode(m_lastLeafInserted.get()), scriptTag)) {
         if (m_firstNodeInserted == m_lastLeafInserted) {
             removeNode(m_lastLeafInserted.get());
             m_lastLeafInserted = 0;
@@ -620,7 +620,7 @@ void ReplaceSelectionCommand::handleStyleSpans()
     if (!sourceDocumentStyleSpan)
         return;
 
-    RefPtr<EditingStyle> sourceDocumentStyle = EditingStyle::create(static_cast<HTMLElement*>(sourceDocumentStyleSpan)->getInlineStyleDecl());
+    RefPtr<EditingStyle> sourceDocumentStyle = EditingStyle::create(toHTMLElement(sourceDocumentStyleSpan)->getInlineStyleDecl());
     ContainerNode* context = sourceDocumentStyleSpan->parentNode();
 
     // If Mail wraps the fragment with a Paste as Quotation blockquote, or if you're pasting into a quoted region,
@@ -657,7 +657,7 @@ void ReplaceSelectionCommand::handleStyleSpans()
         return;
     }
     
-    RefPtr<EditingStyle> copiedRangeStyle = EditingStyle::create(static_cast<HTMLElement*>(copiedRangeStyleSpan)->getInlineStyleDecl());
+    RefPtr<EditingStyle> copiedRangeStyle = EditingStyle::create(toHTMLElement(copiedRangeStyleSpan)->getInlineStyleDecl());
 
     // We're going to put sourceDocumentStyleSpan's non-redundant styles onto copiedRangeStyleSpan,
     // as long as they aren't overridden by ones on copiedRangeStyleSpan.
@@ -696,7 +696,7 @@ void ReplaceSelectionCommand::copyStyleToChildren(Node* parentNode, const CSSMut
             // In this case, put a span tag around the child node.
             RefPtr<Node> newNode = parentNode->cloneNode(false);
             ASSERT(newNode->hasTagName(spanTag));
-            HTMLElement* newSpan = static_cast<HTMLElement*>(newNode.get());
+            HTMLElement* newSpan = toHTMLElement(newNode.get());
             setNodeAttribute(newSpan, styleAttr, parentStyle->cssText());
             insertNodeAfter(newSpan, childNode);
             ExceptionCode ec = 0;
@@ -707,7 +707,7 @@ void ReplaceSelectionCommand::copyStyleToChildren(Node* parentNode, const CSSMut
             // Copy the style attribute and merge them into the child node.  We don't want to override
             // existing styles, so don't clobber on merge.
             RefPtr<CSSMutableStyleDeclaration> newStyle = parentStyle->copy();
-            HTMLElement* childElement = static_cast<HTMLElement*>(childNode);
+            HTMLElement* childElement = toHTMLElement(childNode);
             RefPtr<CSSMutableStyleDeclaration> existingStyles = childElement->getInlineStyleDecl()->copy();
             existingStyles->merge(newStyle.get(), false);
             setNodeAttribute(childElement, styleAttr, existingStyles->cssText());
@@ -743,7 +743,7 @@ void ReplaceSelectionCommand::mergeEndIfNeeded()
     if (endOfParagraph(startOfParagraphToMove) == destination) {
         RefPtr<Node> placeholder = createBreakElement(document());
         insertNodeBefore(placeholder, startOfParagraphToMove.deepEquivalent().node());
-        destination = VisiblePosition(Position(placeholder.get(), 0));
+        destination = VisiblePosition(positionBeforeNode(placeholder.get()));
     }
 
     moveParagraph(startOfParagraphToMove, endOfParagraph(startOfParagraphToMove), destination);
@@ -1045,7 +1045,7 @@ void ReplaceSelectionCommand::doApply()
                 if (isListItem(enclosingNode)) {
                     RefPtr<Node> newListItem = createListItemElement(document());
                     insertNodeAfter(newListItem, enclosingNode);
-                    setEndingSelection(VisiblePosition(Position(newListItem, 0)));
+                    setEndingSelection(VisiblePosition(firstPositionInNode(newListItem.get())));
                 } else
                     // Use a default paragraph element (a plain div) for the empty paragraph, using the last paragraph
                     // block's style seems to annoy users.
@@ -1124,7 +1124,7 @@ bool ReplaceSelectionCommand::shouldRemoveEndBR(Node* endBR, const VisiblePositi
     if (!endBR || !endBR->inDocument())
         return false;
         
-    VisiblePosition visiblePos(Position(endBR, 0));
+    VisiblePosition visiblePos(positionBeforeNode(endBR));
     
     // Don't remove the br if nothing was inserted.
     if (visiblePos.previous() == originalVisPosBeforeEndBR)
@@ -1261,7 +1261,7 @@ bool ReplaceSelectionCommand::performTrivialReplace(const ReplacementFragment& f
 {
     if (!fragment.firstChild() || fragment.firstChild() != fragment.lastChild() || !fragment.firstChild()->isTextNode())
         return false;
-        
+
     // FIXME: Would be nice to handle smart replace in the fast path.
     if (m_smartReplace || fragment.hasInterchangeNewlineAtStart() || fragment.hasInterchangeNewlineAtEnd())
         return false;
@@ -1270,20 +1270,22 @@ bool ReplaceSelectionCommand::performTrivialReplace(const ReplacementFragment& f
     // Our fragment creation code handles tabs, spaces, and newlines, so we don't have to worry about those here.
     String text(textNode->data());
     
-    Position start = endingSelection().start();
-    Position end = endingSelection().end();
-    
-    if (start.anchorNode() != end.anchorNode() || !start.anchorNode()->isTextNode())
+    Position start = endingSelection().start().parentAnchoredEquivalent();
+    Position end = endingSelection().end().parentAnchoredEquivalent();
+    ASSERT(start.anchorType() == Position::PositionIsOffsetInAnchor);
+    ASSERT(end.anchorType() == Position::PositionIsOffsetInAnchor);
+
+    if (start.containerNode() != end.containerNode() || !start.containerNode()->isTextNode())
         return false;
-        
-    replaceTextInNode(static_cast<Text*>(start.anchorNode()), start.offsetInContainerNode(), end.offsetInContainerNode() - start.offsetInContainerNode(), text);
-    
-    end = Position(start.anchorNode(), start.offsetInContainerNode() + text.length());
-    
+
+    replaceTextInNode(static_cast<Text*>(start.containerNode()), start.offsetInContainerNode(), end.offsetInContainerNode() - start.offsetInContainerNode(), text);
+
+    end = Position(start.containerNode(), start.offsetInContainerNode() + text.length(), Position::PositionIsOffsetInAnchor);
+
     VisibleSelection selectionAfterReplace(m_selectReplacement ? start : end, end);
-    
+
     setEndingSelection(selectionAfterReplace);
-    
+
     return true;
 }
 
diff --git a/Source/WebCore/editing/SelectionController.cpp b/Source/WebCore/editing/SelectionController.cpp
index fa0c32d..a574b5a 100644
--- a/Source/WebCore/editing/SelectionController.cpp
+++ b/Source/WebCore/editing/SelectionController.cpp
@@ -1707,7 +1707,7 @@ static HTMLFormElement* scanForForm(Node* start)
     for (Node* node = start; node; node = node->traverseNextNode()) {
         if (node->hasTagName(formTag))
             return static_cast<HTMLFormElement*>(node);
-        if (node->isHTMLElement() && static_cast<HTMLElement*>(node)->isFormControlElement())
+        if (node->isHTMLElement() && toHTMLElement(node)->isFormControlElement())
             return static_cast<HTMLFormControlElement*>(node)->form();
         if (node->hasTagName(frameTag) || node->hasTagName(iframeTag)) {
             Node* childDocument = static_cast<HTMLFrameElementBase*>(node)->contentDocument();
@@ -1731,7 +1731,7 @@ HTMLFormElement* SelectionController::currentForm() const
     for (node = start; node; node = node->parentNode()) {
         if (node->hasTagName(formTag))
             return static_cast<HTMLFormElement*>(node);
-        if (node->isHTMLElement() && static_cast<HTMLElement*>(node)->isFormControlElement())
+        if (node->isHTMLElement() && toHTMLElement(node)->isFormControlElement())
             return static_cast<HTMLFormControlElement*>(node)->form();
     }
 
@@ -1781,7 +1781,7 @@ void SelectionController::setSelectionFromNone()
     while (node && !node->hasTagName(bodyTag))
         node = node->traverseNextNode();
     if (node)
-        setSelection(VisibleSelection(Position(node, 0), DOWNSTREAM));
+        setSelection(VisibleSelection(firstPositionInOrBeforeNode(node), DOWNSTREAM));
 }
 
 bool SelectionController::shouldChangeSelection(const VisibleSelection& newSelection) const
diff --git a/Source/WebCore/editing/SpellChecker.cpp b/Source/WebCore/editing/SpellChecker.cpp
index 1807474..f14a74d 100644
--- a/Source/WebCore/editing/SpellChecker.cpp
+++ b/Source/WebCore/editing/SpellChecker.cpp
@@ -141,7 +141,7 @@ void SpellChecker::didCheck(int sequence, const Vector<SpellCheckingResult>& res
     }
 
     int startOffset = 0;
-    PositionIterator start = Position(m_requestNode, 0);
+    PositionIterator start = firstPositionInOrBeforeNode(m_requestNode.get());
     for (size_t i = 0; i < results.size(); ++i) {
         if (results[i].type() != DocumentMarker::Spelling && results[i].type() != DocumentMarker::Grammar)
             continue;
diff --git a/Source/WebCore/editing/TextIterator.cpp b/Source/WebCore/editing/TextIterator.cpp
index 1fc7606..b621dc2 100644
--- a/Source/WebCore/editing/TextIterator.cpp
+++ b/Source/WebCore/editing/TextIterator.cpp
@@ -27,7 +27,6 @@
 #include "config.h"
 #include "TextIterator.h"
 
-#include "CharacterNames.h"
 #include "Document.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
@@ -42,6 +41,7 @@
 #include "TextBreakIterator.h"
 #include "VisiblePosition.h"
 #include "visible_units.h"
+#include <wtf/unicode/CharacterNames.h>
 
 #if USE(ICU_UNICODE) && !UCONFIG_NO_COLLATION
 #include "TextBreakIteratorInternalICU.h"
@@ -543,7 +543,7 @@ void TextIterator::handleTextBox()
         unsigned runStart = max(textBoxStart, start);
 
         // Check for collapsed space at the start of this run.
-        InlineTextBox* firstTextBox = renderer->containsReversedText() ? m_sortedTextBoxes[0] : renderer->firstTextBox();
+        InlineTextBox* firstTextBox = renderer->containsReversedText() ? (m_sortedTextBoxes.isEmpty() ? 0 : m_sortedTextBoxes[0]) : renderer->firstTextBox();
         bool needSpace = m_lastTextNodeEndedWithCollapsedSpace
             || (m_textBox == firstTextBox && textBoxStart == runStart && runStart > 0);
         if (needSpace && !isCollapsibleWhitespace(m_lastCharacter) && m_lastCharacter) {
@@ -551,7 +551,7 @@ void TextIterator::handleTextBox()
                 unsigned spaceRunStart = runStart - 1;
                 while (spaceRunStart > 0 && str[spaceRunStart - 1] == ' ')
                     --spaceRunStart;
-                emitText(m_node, spaceRunStart, spaceRunStart + 1);
+                emitText(m_node, renderer, spaceRunStart, spaceRunStart + 1);
             } else
                 emitCharacter(' ', m_node, 0, runStart, runStart);
             return;
@@ -1922,6 +1922,11 @@ inline SearchBuffer::SearchBuffer(const String& target, FindOptions options)
 
 inline SearchBuffer::~SearchBuffer()
 {
+    // Leave the static object pointing to a valid string.
+    UErrorCode status = U_ZERO_ERROR;
+    usearch_setPattern(WebCore::searcher(), &newlineCharacter, 1, &status);
+    ASSERT(status == U_ZERO_ERROR);
+
     unlockSearcher();
 }
 
diff --git a/Source/WebCore/editing/TypingCommand.cpp b/Source/WebCore/editing/TypingCommand.cpp
index d54b388..9723c2d 100644
--- a/Source/WebCore/editing/TypingCommand.cpp
+++ b/Source/WebCore/editing/TypingCommand.cpp
@@ -47,7 +47,8 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-TypingCommand::TypingCommand(Document *document, ETypingCommand commandType, const String &textToInsert, bool selectInsertedText, TextGranularity granularity, bool killRing)
+TypingCommand::TypingCommand(Document *document, ETypingCommand commandType, const String &textToInsert, bool selectInsertedText, TextGranularity granularity, TextCompositionType compositionType,
+                             bool killRing)
     : CompositeEditCommand(document), 
       m_commandType(commandType), 
       m_textToInsert(textToInsert), 
@@ -55,6 +56,7 @@ TypingCommand::TypingCommand(Document *document, ETypingCommand commandType, con
       m_selectInsertedText(selectInsertedText),
       m_smartDelete(false),
       m_granularity(granularity),
+      m_compositionType(compositionType),
       m_killRing(killRing),
       m_openedByBackwardDelete(false)
 {
@@ -133,18 +135,18 @@ void TypingCommand::updateSelectionIfDifferentFromCurrentSelection(TypingCommand
 }
     
 
-void TypingCommand::insertText(Document* document, const String& text, bool selectInsertedText, bool insertedTextIsComposition)
+void TypingCommand::insertText(Document* document, const String& text, bool selectInsertedText, TextCompositionType composition)
 {
     ASSERT(document);
     
     Frame* frame = document->frame();
     ASSERT(frame);
 
-    insertText(document, text, frame->selection()->selection(), selectInsertedText, insertedTextIsComposition);
+    insertText(document, text, frame->selection()->selection(), selectInsertedText, composition);
 }
 
 // FIXME: We shouldn't need to take selectionForInsertion. It should be identical to SelectionController's current selection.
-void TypingCommand::insertText(Document* document, const String& text, const VisibleSelection& selectionForInsertion, bool selectInsertedText, bool insertedTextIsComposition)
+void TypingCommand::insertText(Document* document, const String& text, const VisibleSelection& selectionForInsertion, bool selectInsertedText, TextCompositionType compositionType)
 {
 #if REMOVE_MARKERS_UPON_EDITING
     if (!text.isEmpty())
@@ -161,7 +163,7 @@ void TypingCommand::insertText(Document* document, const String& text, const Vis
     String newText = text;
     Node* startNode = selectionForInsertion.start().node();
     
-    if (startNode && startNode->rootEditableElement() && !insertedTextIsComposition) {        
+    if (startNode && startNode->rootEditableElement() && compositionType != TextCompositionUpdate) {
         // Send BeforeTextInsertedEvent. The event handler will update text if necessary.
         ExceptionCode ec = 0;
         RefPtr<BeforeTextInsertedEvent> evt = BeforeTextInsertedEvent::create(text);
@@ -182,11 +184,13 @@ void TypingCommand::insertText(Document* document, const String& text, const Vis
             lastTypingCommand->setStartingSelection(selectionForInsertion);
             lastTypingCommand->setEndingSelection(selectionForInsertion);
         }
+        
+        lastTypingCommand->setCompositionType(compositionType);
         lastTypingCommand->insertText(newText, selectInsertedText);
         return;
     }
 
-    RefPtr<TypingCommand> cmd = TypingCommand::create(document, InsertText, newText, selectInsertedText);
+    RefPtr<TypingCommand> cmd = TypingCommand::create(document, InsertText, newText, selectInsertedText, compositionType);
     if (changeSelection)  {
         cmd->setStartingSelection(selectionForInsertion);
         cmd->setEndingSelection(selectionForInsertion);
@@ -386,7 +390,8 @@ void TypingCommand::insertTextRunWithoutNewlines(const String &text, bool select
         command->setStartingSelection(endingSelection());
         command->setEndingSelection(endingSelection());
     }
-    command->input(text, selectInsertedText);
+    command->input(text, selectInsertedText, 
+                   m_compositionType == TextCompositionNone ? InsertTextCommand::RebalanceLeadingAndTrailingWhitespaces : InsertTextCommand::RebalanceAllWhitespaces);
     typingAddedToOpenCommand(InsertText);
 }
 
@@ -431,7 +436,7 @@ bool TypingCommand::makeEditableRootEmpty()
         removeNode(child);
 
     addBlockPlaceholderIfNeeded(root);
-    setEndingSelection(VisibleSelection(Position(root, 0), DOWNSTREAM));
+    setEndingSelection(VisibleSelection(firstPositionInNode(root), DOWNSTREAM));
 
     return true;
 }
@@ -490,7 +495,7 @@ void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
             selection.modify(SelectionController::AlterationExtend, DirectionBackward, granularity);
         // If the caret is just after a table, select the table and don't delete anything.
         } else if (Node* table = isFirstPositionAfterTable(visibleStart)) {
-            setEndingSelection(VisibleSelection(Position(table, 0), endingSelection().start(), DOWNSTREAM));
+            setEndingSelection(VisibleSelection(positionAfterNode(table), endingSelection().start(), DOWNSTREAM));
             typingAddedToOpenCommand(DeleteKey);
             return;
         }
@@ -591,7 +596,7 @@ void TypingCommand::forwardDeleteKeyPressed(TextGranularity granularity, bool ki
                     extraCharacters = selectionToDelete.end().deprecatedEditingOffset() - selectionToDelete.start().deprecatedEditingOffset();
                 else
                     extraCharacters = selectionToDelete.end().deprecatedEditingOffset();
-                extent = Position(extent.node(), extent.deprecatedEditingOffset() + extraCharacters);
+                extent = Position(extent.node(), extent.deprecatedEditingOffset() + extraCharacters, Position::PositionIsOffsetInAnchor);
             }
             selectionAfterUndo.setWithoutValidation(startingSelection().start(), extent);
         }
diff --git a/Source/WebCore/editing/TypingCommand.h b/Source/WebCore/editing/TypingCommand.h
index 284ebc0..b34bdc1 100644
--- a/Source/WebCore/editing/TypingCommand.h
+++ b/Source/WebCore/editing/TypingCommand.h
@@ -42,11 +42,17 @@ public:
         InsertParagraphSeparatorInQuotedContent
     };
 
+    enum TextCompositionType {
+        TextCompositionNone,
+        TextCompositionUpdate,
+        TextCompositionConfirm
+    };
+
     static void deleteSelection(Document*, bool smartDelete = false);
     static void deleteKeyPressed(Document*, bool smartDelete = false, TextGranularity = CharacterGranularity, bool killRing = false);
     static void forwardDeleteKeyPressed(Document*, bool smartDelete = false, TextGranularity = CharacterGranularity, bool killRing = false);
-    static void insertText(Document*, const String&, bool selectInsertedText = false, bool insertedTextIsComposition = false);
-    static void insertText(Document*, const String&, const VisibleSelection&, bool selectInsertedText = false, bool insertedTextIsComposition = false);
+    static void insertText(Document*, const String&, bool selectInsertedText = false, TextCompositionType = TextCompositionNone);
+    static void insertText(Document*, const String&, const VisibleSelection&, bool selectInsertedText = false, TextCompositionType = TextCompositionNone);
     static void insertLineBreak(Document*);
     static void insertParagraphSeparator(Document*);
     static void insertParagraphSeparatorInQuotedContent(Document*);
@@ -64,14 +70,20 @@ public:
     void deleteKeyPressed(TextGranularity, bool killRing);
     void forwardDeleteKeyPressed(TextGranularity, bool killRing);
     void deleteSelection(bool smartDelete);
+    void setCompositionType(TextCompositionType type) { m_compositionType = type; }
 
 private:
     static PassRefPtr<TypingCommand> create(Document* document, ETypingCommand command, const String& text = "", bool selectInsertedText = false, TextGranularity granularity = CharacterGranularity, bool killRing = false)
     {
-        return adoptRef(new TypingCommand(document, command, text, selectInsertedText, granularity, killRing));
+        return adoptRef(new TypingCommand(document, command, text, selectInsertedText, granularity, TextCompositionNone, killRing));
+    }
+
+    static PassRefPtr<TypingCommand> create(Document* document, ETypingCommand command, const String& text, bool selectInsertedText, TextCompositionType compositionType)
+    {
+        return adoptRef(new TypingCommand(document, command, text, selectInsertedText, CharacterGranularity, compositionType, false));
     }
 
-    TypingCommand(Document*, ETypingCommand, const String& text, bool selectInsertedText, TextGranularity, bool killRing);
+    TypingCommand(Document*, ETypingCommand, const String& text, bool selectInsertedText, TextGranularity, TextCompositionType, bool killRing);
 
     bool smartDelete() const { return m_smartDelete; }
     void setSmartDelete(bool smartDelete) { m_smartDelete = smartDelete; }
@@ -94,6 +106,7 @@ private:
     bool m_selectInsertedText;
     bool m_smartDelete;
     TextGranularity m_granularity;
+    TextCompositionType m_compositionType;
     bool m_killRing;
     bool m_preservesTypingStyle;
     
diff --git a/Source/WebCore/editing/VisibleSelection.cpp b/Source/WebCore/editing/VisibleSelection.cpp
index 035afb8..9096dc5 100644
--- a/Source/WebCore/editing/VisibleSelection.cpp
+++ b/Source/WebCore/editing/VisibleSelection.cpp
@@ -26,7 +26,6 @@
 #include "config.h"
 #include "VisibleSelection.h"
 
-#include "CharacterNames.h"
 #include "Document.h"
 #include "Element.h"
 #include "htmlediting.h"
@@ -34,10 +33,10 @@
 #include "VisiblePosition.h"
 #include "visible_units.h"
 #include "Range.h"
-
+#include <stdio.h>
 #include <wtf/Assertions.h>
 #include <wtf/text/CString.h>
-#include <stdio.h>
+#include <wtf/unicode/CharacterNames.h>
 
 namespace WebCore {
 
@@ -173,6 +172,9 @@ PassRefPtr<Range> VisibleSelection::toNormalizedRange() const
         s = s.parentAnchoredEquivalent();
         e = e.parentAnchoredEquivalent();
     }
+    
+    if (s.isNull() || e.isNull())
+        return 0;
 
     // VisibleSelections are supposed to always be valid.  This constructor will ASSERT
     // if a valid range could not be created, which is fine for this callsite.
@@ -432,7 +434,6 @@ void VisibleSelection::setWithoutValidation(const Position& base, const Position
 {
     ASSERT(!base.isNull());
     ASSERT(!extent.isNull());
-    ASSERT(base != extent);
     ASSERT(m_affinity == DOWNSTREAM);
     m_base = base;
     m_extent = extent;
@@ -444,7 +445,7 @@ void VisibleSelection::setWithoutValidation(const Position& base, const Position
         m_start = extent;
         m_end = base;
     }
-    m_selectionType = RangeSelection;
+    m_selectionType = base == extent ? CaretSelection : RangeSelection;
 }
 
 void VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries()
@@ -526,13 +527,13 @@ void VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries()
             Position p = nextVisuallyDistinctCandidate(m_start);
             Node* shadowAncestor = startRoot ? startRoot->shadowAncestorNode() : 0;
             if (p.isNull() && startRoot && (shadowAncestor != startRoot))
-                p = Position(shadowAncestor, 0);
+                p = positionBeforeNode(shadowAncestor);
             while (p.isNotNull() && !(lowestEditableAncestor(p.node()) == baseEditableAncestor && !isEditablePosition(p))) {
                 Node* root = editableRootForPosition(p);
                 shadowAncestor = root ? root->shadowAncestorNode() : 0;
                 p = isAtomicNode(p.node()) ? positionInParentAfterNode(p.node()) : nextVisuallyDistinctCandidate(p);
                 if (p.isNull() && (shadowAncestor != root))
-                    p = Position(shadowAncestor, 0);
+                    p = positionBeforeNode(shadowAncestor);
             }
             VisiblePosition next(p);
             
diff --git a/Source/WebCore/editing/htmlediting.cpp b/Source/WebCore/editing/htmlediting.cpp
index 90db3ef..cb157d2 100644
--- a/Source/WebCore/editing/htmlediting.cpp
+++ b/Source/WebCore/editing/htmlediting.cpp
@@ -26,7 +26,6 @@
 #include "config.h"
 #include "htmlediting.h"
 
-#include "CharacterNames.h"
 #include "Document.h"
 #include "EditingText.h"
 #include "HTMLBRElement.h"
@@ -46,6 +45,7 @@
 #include "VisiblePosition.h"
 #include "visible_units.h"
 #include <wtf/StdLibExtras.h>
+#include <wtf/unicode/CharacterNames.h>
 
 #if ENABLE(WML)
 #include "WMLNames.h"
@@ -356,25 +356,27 @@ int lastOffsetForEditing(const Node* node)
 
 String stringWithRebalancedWhitespace(const String& string, bool startIsStartOfParagraph, bool endIsEndOfParagraph)
 {
-    DEFINE_STATIC_LOCAL(String, twoSpaces, ("  "));
-    DEFINE_STATIC_LOCAL(String, nbsp, ("\xa0"));
-    DEFINE_STATIC_LOCAL(String, pattern, (" \xa0"));
+    Vector<UChar> rebalancedString;
+    append(rebalancedString, string);
 
-    String rebalancedString = string;
+    bool previousCharacterWasSpace = false;
+    for (size_t i = 0; i < rebalancedString.size(); i++) {
+        if (!isWhitespace(rebalancedString[i])) {
+            previousCharacterWasSpace = false;
+            continue;
+        }
 
-    rebalancedString.replace(noBreakSpace, ' ');
-    rebalancedString.replace('\n', ' ');
-    rebalancedString.replace('\t', ' ');
-    
-    rebalancedString.replace(twoSpaces, pattern);
-    
-    if (startIsStartOfParagraph && rebalancedString[0] == ' ')
-        rebalancedString.replace(0, 1, nbsp);
-    int end = rebalancedString.length() - 1;
-    if (endIsEndOfParagraph && rebalancedString[end] == ' ')
-        rebalancedString.replace(end, 1, nbsp);    
+        if (previousCharacterWasSpace || (!i && startIsStartOfParagraph) || (i + 1 == rebalancedString.size() && endIsEndOfParagraph)) {
+            rebalancedString[i] = noBreakSpace;
+            previousCharacterWasSpace = false;
+        } else {
+            rebalancedString[i] = ' ';
+            previousCharacterWasSpace = true;
+        }
+            
+    }
 
-    return rebalancedString;
+    return String::adopt(rebalancedString);
 }
 
 bool isTableStructureNode(const Node *node)
@@ -660,7 +662,7 @@ HTMLElement* enclosingList(Node* node)
     
     for (ContainerNode* n = node->parentNode(); n; n = n->parentNode()) {
         if (n->hasTagName(ulTag) || n->hasTagName(olTag))
-            return static_cast<HTMLElement*>(n);
+            return toHTMLElement(n);
         if (n == root)
             return 0;
     }
@@ -668,7 +670,7 @@ HTMLElement* enclosingList(Node* node)
     return 0;
 }
 
-HTMLElement* enclosingListChild(Node *node)
+Node* enclosingListChild(Node *node)
 {
     if (!node)
         return 0;
@@ -679,7 +681,7 @@ HTMLElement* enclosingListChild(Node *node)
     // FIXME: This function is inappropriately named if it starts with node instead of node->parentNode()
     for (Node* n = node; n && n->parentNode(); n = n->parentNode()) {
         if (n->hasTagName(liTag) || isListElement(n->parentNode()))
-            return static_cast<HTMLElement*>(n);
+            return n;
         if (n == root || isTableCell(n))
             return 0;
     }
@@ -692,7 +694,7 @@ static HTMLElement* embeddedSublist(Node* listItem)
     // Check the DOM so that we'll find collapsed sublists without renderers.
     for (Node* n = listItem->firstChild(); n; n = n->nextSibling()) {
         if (isListElement(n))
-            return static_cast<HTMLElement*>(n);
+            return toHTMLElement(n);
     }
     
     return 0;
@@ -703,7 +705,7 @@ static Node* appendedSublist(Node* listItem)
     // Check the DOM so that we'll find collapsed sublists without renderers.
     for (Node* n = listItem->nextSibling(); n; n = n->nextSibling()) {
         if (isListElement(n))
-            return static_cast<HTMLElement*>(n);
+            return toHTMLElement(n);
         if (isListItem(listItem))
             return 0;
     }
diff --git a/Source/WebCore/editing/htmlediting.h b/Source/WebCore/editing/htmlediting.h
index 0208dfb..b71e879 100644
--- a/Source/WebCore/editing/htmlediting.h
+++ b/Source/WebCore/editing/htmlediting.h
@@ -26,10 +26,11 @@
 #ifndef htmlediting_h
 #define htmlediting_h
 
-#include <wtf/Forward.h>
-#include "HTMLNames.h"
 #include "ExceptionCode.h"
+#include "HTMLNames.h"
 #include "Position.h"
+#include <wtf/Forward.h>
+#include <wtf/unicode/CharacterNames.h>
 
 namespace WebCore {
 
@@ -202,7 +203,7 @@ PassRefPtr<HTMLElement> createHTMLElement(Document*, const AtomicString&);
 
 HTMLElement* enclosingList(Node*);
 HTMLElement* outermostEnclosingList(Node*, Node* rootList = 0);
-HTMLElement* enclosingListChild(Node*);
+Node* enclosingListChild(Node*);
 
 // -------------------------------------------------------------------------
 // Element
@@ -231,8 +232,11 @@ VisibleSelection avoidIntersectionWithNode(const VisibleSelection&, Node*);
 VisibleSelection selectionForParagraphIteration(const VisibleSelection&);
     
 
-// Miscellaneous functions on String
-    
+// Miscellaneous functions on Text
+inline bool isWhitespace(UChar c)
+{
+    return c == noBreakSpace || c == ' ' || c == '\n' || c == '\t';
+}
 String stringWithRebalancedWhitespace(const String&, bool, bool);
 const String& nonBreakingSpaceString();
 
diff --git a/Source/WebCore/editing/mac/SelectionControllerMac.mm b/Source/WebCore/editing/mac/SelectionControllerMac.mm
index 730eb60..119d406 100644
--- a/Source/WebCore/editing/mac/SelectionControllerMac.mm
+++ b/Source/WebCore/editing/mac/SelectionControllerMac.mm
@@ -33,6 +33,19 @@
 
 namespace WebCore {
 
+static CGRect accessibilityConvertScreenRect(CGRect bounds)
+{
+    NSArray *screens = [NSScreen screens];
+    if ([screens count]) {
+        CGFloat screenHeight = NSHeight([[screens objectAtIndex:0] frame]);
+        bounds.origin.y = (screenHeight - (bounds.origin.y + bounds.size.height));
+    } else
+        bounds = CGRectZero;    
+    
+    return bounds;
+}
+    
+    
 void SelectionController::notifyAccessibilityForSelectionChange()
 {
     Document* document = m_frame->document();
@@ -58,8 +71,8 @@ void SelectionController::notifyAccessibilityForSelectionChange()
     viewRect = frameView->contentsToScreen(viewRect);
     CGRect cgCaretRect = CGRectMake(selectionRect.x(), selectionRect.y(), selectionRect.width(), selectionRect.height());
     CGRect cgViewRect = CGRectMake(viewRect.x(), viewRect.y(), viewRect.width(), viewRect.height());
-    cgCaretRect = [[WebCoreViewFactory sharedFactory] accessibilityConvertScreenRect:cgCaretRect];
-    cgViewRect = [[WebCoreViewFactory sharedFactory] accessibilityConvertScreenRect:cgViewRect];
+    cgCaretRect = accessibilityConvertScreenRect(cgCaretRect);
+    cgViewRect = accessibilityConvertScreenRect(cgViewRect);
 
     UAZoomChangeFocus(&cgViewRect, &cgCaretRect, kUAZoomFocusTypeInsertionPoint);
 }
diff --git a/Source/WebCore/editing/markup.cpp b/Source/WebCore/editing/markup.cpp
index 4cbdcce..34c3ec7 100644
--- a/Source/WebCore/editing/markup.cpp
+++ b/Source/WebCore/editing/markup.cpp
@@ -27,7 +27,6 @@
 #include "markup.h"
 
 #include "CDATASection.h"
-#include "CharacterNames.h"
 #include "CSSComputedStyleDeclaration.h"
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSPrimitiveValue.h"
@@ -56,6 +55,7 @@
 #include "htmlediting.h"
 #include "visible_units.h"
 #include <wtf/StdLibExtras.h>
+#include <wtf/unicode/CharacterNames.h>
 
 using namespace std;
 
@@ -124,7 +124,7 @@ public:
     }
 
     Node* serializeNodes(Node* startNode, Node* pastEnd);
-    void appendString(const String& s) { return MarkupAccumulator::appendString(s); }
+    virtual void appendString(const String& s) { return MarkupAccumulator::appendString(s); }
     void wrapWithNode(Node*, bool convertBlocksToInlines = false, RangeFullySelectsNode = DoesFullySelectNode);
     void wrapWithStyleNode(CSSStyleDeclaration*, Document*, bool isBlock = false);
     String takeResults();
@@ -184,7 +184,8 @@ String StyledMarkupAccumulator::takeResults()
 
     concatenateMarkup(result);
 
-    return String::adopt(result);
+    // We remove '\0' characters because they are not visibly rendered to the user.
+    return String::adopt(result).replace(0, "");
 }
 
 void StyledMarkupAccumulator::appendText(Vector<UChar>& out, Text* text)
@@ -194,7 +195,7 @@ void StyledMarkupAccumulator::appendText(Vector<UChar>& out, Text* text)
         return;
     }
 
-    bool useRenderedText = !enclosingNodeWithTag(Position(text, 0), selectTag);
+    bool useRenderedText = !enclosingNodeWithTag(firstPositionInNode(text), selectTag);
     String content = useRenderedText ? renderedText(text, m_range) : stringValueForRange(text, m_range);
     Vector<UChar> buffer;
     appendCharactersReplacingEntities(buffer, content.characters(), content.length(), EntityMaskInPCDATA);
@@ -267,7 +268,7 @@ void StyledMarkupAccumulator::appendElement(Vector<UChar>& out, Element* element
     }
 
     if (element->isHTMLElement() && (shouldAnnotate() || addDisplayInline)) {
-        RefPtr<CSSMutableStyleDeclaration> style = static_cast<HTMLElement*>(element)->getInlineStyleDecl()->copy();
+        RefPtr<CSSMutableStyleDeclaration> style = toHTMLElement(element)->getInlineStyleDecl()->copy();
         if (shouldAnnotate()) {
             RefPtr<CSSMutableStyleDeclaration> styleFromMatchedRules = styleFromMatchedRulesForElement(const_cast<Element*>(element));
             // Styles from the inline style declaration, held in the variable "style", take precedence 
@@ -337,7 +338,7 @@ Node* StyledMarkupAccumulator::serializeNodes(Node* startNode, Node* pastEnd)
             // Don't write out empty block containers that aren't fully selected.
             continue;
 
-        if (!n->renderer() && !enclosingNodeWithTag(Position(n, 0), selectTag)) {
+        if (!n->renderer() && !enclosingNodeWithTag(firstPositionInOrBeforeNode(n), selectTag)) {
             next = n->traverseNextSibling();
             // Don't skip over pastEnd.
             if (pastEnd && pastEnd->isDescendantOf(n))
@@ -495,7 +496,7 @@ static Node* highestAncestorToWrapMarkup(const Range* range, Node* fullySelected
 
     Node* checkAncestor = specialCommonAncestor ? specialCommonAncestor : commonAncestor;
     if (checkAncestor->renderer()) {
-        Node* newSpecialCommonAncestor = highestEnclosingNodeOfType(Position(checkAncestor, 0), &isElementPresentational);
+        Node* newSpecialCommonAncestor = highestEnclosingNodeOfType(firstPositionInNode(checkAncestor), &isElementPresentational);
         if (newSpecialCommonAncestor)
             specialCommonAncestor = newSpecialCommonAncestor;
     }
@@ -509,7 +510,7 @@ static Node* highestAncestorToWrapMarkup(const Range* range, Node* fullySelected
     if (!specialCommonAncestor && isTabSpanNode(commonAncestor))
         specialCommonAncestor = commonAncestor;
 
-    if (Node *enclosingAnchor = enclosingNodeWithTag(Position(specialCommonAncestor ? specialCommonAncestor : commonAncestor, 0), aTag))
+    if (Node *enclosingAnchor = enclosingNodeWithTag(firstPositionInNode(specialCommonAncestor ? specialCommonAncestor : commonAncestor), aTag))
         specialCommonAncestor = enclosingAnchor;
 
     if (shouldAnnotate == AnnotateForInterchange && fullySelectedRoot) {
@@ -579,7 +580,7 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
         }
     }
 
-    Node* body = enclosingNodeWithTag(Position(commonAncestor, 0), bodyTag);
+    Node* body = enclosingNodeWithTag(firstPositionInNode(commonAncestor), bodyTag);
     Node* fullySelectedRoot = 0;
     // FIXME: Do this for all fully selected blocks, not just the body.
     if (body && areRangesEqual(VisibleSelection::selectionFromContentsOfNode(body).toNormalizedRange().get(), range))
diff --git a/Source/WebCore/editing/visible_units.cpp b/Source/WebCore/editing/visible_units.cpp
index 3582aa9..391d6e6 100644
--- a/Source/WebCore/editing/visible_units.cpp
+++ b/Source/WebCore/editing/visible_units.cpp
@@ -292,7 +292,7 @@ static unsigned previousWordPositionBoundary(const UChar* characters, unsigned l
 VisiblePosition previousWordPosition(const VisiblePosition &c)
 {
     VisiblePosition prev = previousBoundary(c, previousWordPositionBoundary);
-    return c.honorEditableBoundaryAtOrAfter(prev);
+    return c.honorEditableBoundaryAtOrBefore(prev);
 }
 
 static unsigned nextWordPositionBoundary(const UChar* characters, unsigned length, unsigned offset, BoundarySearchContextAvailability mayHaveMoreContext, bool& needMoreContext)
@@ -308,7 +308,7 @@ static unsigned nextWordPositionBoundary(const UChar* characters, unsigned lengt
 VisiblePosition nextWordPosition(const VisiblePosition &c)
 {
     VisiblePosition next = nextBoundary(c, nextWordPositionBoundary);    
-    return c.honorEditableBoundaryAtOrBefore(next);
+    return c.honorEditableBoundaryAtOrAfter(next);
 }
 
 // ---------
@@ -391,7 +391,7 @@ VisiblePosition startOfLine(const VisiblePosition& c)
 {
     VisiblePosition visPos = startPositionForLine(c);
 
-    return c.honorEditableBoundaryAtOrAfter(visPos);
+    return c.honorEditableBoundaryAtOrBefore(visPos);
 }
 
 static VisiblePosition endPositionForLine(const VisiblePosition& c)
@@ -458,7 +458,7 @@ VisiblePosition endOfLine(const VisiblePosition& c)
         visPos = endPositionForLine(visPos);
     }
     
-    return c.honorEditableBoundaryAtOrBefore(visPos);
+    return c.honorEditableBoundaryAtOrAfter(visPos);
 }
 
 bool inSameLine(const VisiblePosition &a, const VisiblePosition &b)
@@ -536,7 +536,7 @@ VisiblePosition previousLinePosition(const VisiblePosition &visiblePosition, int
         while (n && startBlock == enclosingNodeWithNonInlineRenderer(n))
             n = previousLeafWithSameEditability(n);
         while (n) {
-            if (highestEditableRoot(Position(n, 0)) != highestRoot)
+            if (highestEditableRoot(firstPositionInOrBeforeNode(n)) != highestRoot)
                 break;
             Position pos(n, caretMinOffset(n));
             if (pos.isCandidate()) {
@@ -567,7 +567,7 @@ VisiblePosition previousLinePosition(const VisiblePosition &visiblePosition, int
         RenderObject* renderer = root->closestLeafChildForLogicalLeftPosition(x - absPos.x(), isEditablePosition(p))->renderer();
         Node* node = renderer->node();
         if (node && editingIgnoresContent(node))
-            return Position(node->parentNode(), node->nodeIndex());
+            return positionInParentBeforeNode(node);
         return renderer->positionForPoint(IntPoint(x - absPos.x(), root->lineTop()));
     }
     
@@ -583,7 +583,7 @@ static Node* nextLeafWithSameEditability(Node* node, int offset)
     bool editable = node->isContentEditable();
     ASSERT(offset >= 0);
     Node* child = node->childNode(offset);
-    Node* n = child ? child->nextLeafNode() : node->nextLeafNode();
+    Node* n = child ? child->nextLeafNode() : node->lastDescendant()->nextLeafNode();
     while (n) {
         if (editable == n->isContentEditable())
             return n;
@@ -645,7 +645,7 @@ VisiblePosition nextLinePosition(const VisiblePosition &visiblePosition, int x)
         while (n && startBlock == enclosingNodeWithNonInlineRenderer(n))
             n = nextLeafWithSameEditability(n);
         while (n) {
-            if (highestEditableRoot(Position(n, 0)) != highestRoot)
+            if (highestEditableRoot(firstPositionInOrBeforeNode(n)) != highestRoot)
                 break;
             Position pos(n, caretMinOffset(n));
             if (pos.isCandidate()) {
@@ -672,7 +672,7 @@ VisiblePosition nextLinePosition(const VisiblePosition &visiblePosition, int x)
         RenderObject* renderer = root->closestLeafChildForLogicalLeftPosition(x - absPos.x(), isEditablePosition(p))->renderer();
         Node* node = renderer->node();
         if (node && editingIgnoresContent(node))
-            return Position(node->parentNode(), node->nodeIndex());
+            return positionInParentBeforeNode(node);
         return renderer->positionForPoint(IntPoint(x - absPos.x(), root->lineTop()));
     }    
 
@@ -720,7 +720,7 @@ static unsigned previousSentencePositionBoundary(const UChar* characters, unsign
 VisiblePosition previousSentencePosition(const VisiblePosition &c)
 {
     VisiblePosition prev = previousBoundary(c, previousSentencePositionBoundary);
-    return c.honorEditableBoundaryAtOrAfter(prev);
+    return c.honorEditableBoundaryAtOrBefore(prev);
 }
 
 static unsigned nextSentencePositionBoundary(const UChar* characters, unsigned length, unsigned, BoundarySearchContextAvailability, bool&)
@@ -734,7 +734,7 @@ static unsigned nextSentencePositionBoundary(const UChar* characters, unsigned l
 VisiblePosition nextSentencePosition(const VisiblePosition &c)
 {
     VisiblePosition next = nextBoundary(c, nextSentencePositionBoundary);    
-    return c.honorEditableBoundaryAtOrBefore(next);
+    return c.honorEditableBoundaryAtOrAfter(next);
 }
 
 VisiblePosition startOfParagraph(const VisiblePosition& c, EditingBoundaryCrossingRule boundaryCrossingRule)
@@ -913,7 +913,7 @@ VisiblePosition startOfBlock(const VisiblePosition &c)
     Node *startNode = p.node();
     if (!startNode)
         return VisiblePosition();
-    return VisiblePosition(Position(startNode->enclosingBlockFlowElement(), 0), DOWNSTREAM);
+    return VisiblePosition(firstPositionInNode(startNode->enclosingBlockFlowElement()), DOWNSTREAM);
 }
 
 VisiblePosition endOfBlock(const VisiblePosition &c)
@@ -1133,7 +1133,7 @@ VisiblePosition logicalStartOfLine(const VisiblePosition& c)
     // Please refer to https://bugs.webkit.org/show_bug.cgi?id=49107 for detail.
     VisiblePosition visPos = logicalStartPositionForLine(c);
     
-    return c.honorEditableBoundaryAtOrAfter(visPos);
+    return c.honorEditableBoundaryAtOrBefore(visPos);
 }
 
 static VisiblePosition logicalEndPositionForLine(const VisiblePosition& c)
@@ -1190,7 +1190,7 @@ VisiblePosition logicalEndOfLine(const VisiblePosition& c)
     if (!inSameLogicalLine(c, visPos))
         visPos = visPos.previous();
     
-    return c.honorEditableBoundaryAtOrBefore(visPos);
+    return c.honorEditableBoundaryAtOrAfter(visPos);
 }
 
 VisiblePosition leftBoundaryOfLine(const VisiblePosition& c, TextDirection direction)
diff --git a/Source/WebCore/features.pri b/Source/WebCore/features.pri
index fdf11ed..b3f0e2d 100644
--- a/Source/WebCore/features.pri
+++ b/Source/WebCore/features.pri
@@ -73,7 +73,8 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
 !contains(DEFINES, ENABLE_INSPECTOR=.): DEFINES += ENABLE_INSPECTOR=1
 !contains(DEFINES, ENABLE_3D_RENDERING=.): DEFINES += ENABLE_3D_RENDERING=1
 !contains(DEFINES, ENABLE_WEB_AUDIO=.): DEFINES += ENABLE_WEB_AUDIO=0
-!contains(DEFINES, ENABLE_3D_CANVAS=.): DEFINES += ENABLE_3D_CANVAS=0
+!contains(DEFINES, ENABLE_WEBGL=.): DEFINES += ENABLE_WEBGL=0
+!contains(DEFINES, ENABLE_MEDIA_STATISTICS=.): DEFINES += ENABLE_MEDIA_STATISTICS=0
 
 # SVG support
 !contains(DEFINES, ENABLE_SVG=0) {
@@ -209,3 +210,4 @@ contains(DEFINES, ENABLE_METER_TAG=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_METE
 contains(DEFINES, ENABLE_PROGRESS_TAG=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_PROGRESS_TAG=1
 contains(DEFINES, ENABLE_GEOLOCATION=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_GEOLOCATION=1
 contains(DEFINES, ENABLE_BLOB=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_BLOB=1
+contains(DEFINES, ENABLE_MEDIA_STATISTICS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_MEDIA_STATISTICS=1
diff --git a/Source/WebCore/fileapi/Entry.cpp b/Source/WebCore/fileapi/Entry.cpp
index 9c3fa4e..53cd576 100644
--- a/Source/WebCore/fileapi/Entry.cpp
+++ b/Source/WebCore/fileapi/Entry.cpp
@@ -32,13 +32,17 @@
 
 #if ENABLE(FILE_SYSTEM)
 
+#include "AsyncFileSystem.h"
 #include "DirectoryEntry.h"
 #include "EntryCallback.h"
 #include "ErrorCallback.h"
 #include "FileError.h"
 #include "FileSystemCallbacks.h"
 #include "MetadataCallback.h"
+#include "ScriptExecutionContext.h"
+#include "SecurityOrigin.h"
 #include "VoidCallback.h"
+#include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
@@ -82,11 +86,15 @@ void Entry::getParent(PassRefPtr<EntryCallback> successCallback, PassRefPtr<Erro
         filesystem()->scheduleCallback(errorCallback.release(), FileError::create(FileError::INVALID_MODIFICATION_ERR));
 }
 
-String Entry::toURI(const String&)
+String Entry::toURI()
 {
-    // FIXME: to be implemented.
-    ASSERT_NOT_REACHED();
-    return String();
+    StringBuilder uriBuilder;
+    uriBuilder.append("filesystem:");
+    uriBuilder.append(filesystem()->scriptExecutionContext()->securityOrigin()->toString());
+    uriBuilder.append("/");
+    uriBuilder.append(m_fileSystem->asyncFileSystem()->type() == AsyncFileSystem::Temporary ? "temporary" : "persistent");
+    uriBuilder.append(m_fullPath);
+    return uriBuilder.toString();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/fileapi/Entry.h b/Source/WebCore/fileapi/Entry.h
index 9367f4f..d871262 100644
--- a/Source/WebCore/fileapi/Entry.h
+++ b/Source/WebCore/fileapi/Entry.h
@@ -57,7 +57,7 @@ public:
     void remove(PassRefPtr<VoidCallback> successCallback = 0, PassRefPtr<ErrorCallback> errorCallback = 0) const;
     void getParent(PassRefPtr<EntryCallback> successCallback = 0, PassRefPtr<ErrorCallback> errorCallback = 0) const;
 
-    String toURI(const String& mimeType = String());
+    String toURI();
 
 protected:
     Entry(PassRefPtr<DOMFileSystemBase>, const String& fullPath);
diff --git a/Source/WebCore/fileapi/Entry.idl b/Source/WebCore/fileapi/Entry.idl
index f6fcdb3..f144b31 100644
--- a/Source/WebCore/fileapi/Entry.idl
+++ b/Source/WebCore/fileapi/Entry.idl
@@ -43,6 +43,7 @@ module storage {
         void getMetadata(in [Optional, Callback] MetadataCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
         void moveTo(in DirectoryEntry parent, in [Optional, ConvertUndefinedOrNullToNullString] DOMString name, in [Optional, Callback] EntryCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
         void copyTo(in DirectoryEntry parent, in [Optional, ConvertUndefinedOrNullToNullString] DOMString name, in [Optional, Callback] EntryCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
+        DOMString toURI();
         void remove(in [Optional, Callback] VoidCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
         void getParent(in [Optional, Callback] EntryCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
     };
diff --git a/Source/WebCore/fileapi/FileStreamProxy.cpp b/Source/WebCore/fileapi/FileStreamProxy.cpp
index 5daf983..92b07cd 100644
--- a/Source/WebCore/fileapi/FileStreamProxy.cpp
+++ b/Source/WebCore/fileapi/FileStreamProxy.cpp
@@ -83,6 +83,8 @@ static void didStart(ScriptExecutionContext*, FileStreamProxy* proxy)
 
 void FileStreamProxy::startOnFileThread()
 {
+    if (!client())
+        return;
     m_stream->start();
     m_context->postTask(createCallbackTask(&didStart, this));
 }
diff --git a/Source/WebCore/history/CachedFrame.cpp b/Source/WebCore/history/CachedFrame.cpp
index ab6b4d6..0059691 100644
--- a/Source/WebCore/history/CachedFrame.cpp
+++ b/Source/WebCore/history/CachedFrame.cpp
@@ -65,7 +65,7 @@ CachedFrameBase::CachedFrameBase(Frame* frame)
     , m_documentLoader(frame->loader()->documentLoader())
     , m_view(frame->view())
     , m_mousePressNode(frame->eventHandler()->mousePressNode())
-    , m_url(frame->loader()->url())
+    , m_url(frame->document()->url())
     , m_isMainFrame(!frame->tree()->parent())
 {
 }
@@ -135,10 +135,6 @@ CachedFrame::CachedFrame(Frame* frame)
     if (frame->page()->focusController()->focusedFrame() == frame)
         frame->page()->focusController()->setFocusedFrame(frame->page()->mainFrame());
 
-    // Active DOM objects must be suspended before we cached the frame script data
-    m_document->suspendActiveDOMObjects(ActiveDOMObject::DocumentWillBecomeInactive);
-    m_cachedFrameScriptData = adoptPtr(new ScriptCachedFrameData(frame));
-    
     // Custom scrollbar renderers will get reattached when the document comes out of the page cache
     m_view->detachCustomScrollbars();
 
@@ -146,13 +142,21 @@ CachedFrame::CachedFrame(Frame* frame)
     frame->clearTimers();
     m_document->setInPageCache(true);
     frame->loader()->stopLoading(UnloadEventPolicyUnloadAndPageHide);
-    
-    frame->loader()->client()->savePlatformDataToCachedFrame(this);
 
     // Create the CachedFrames for all Frames in the FrameTree.
     for (Frame* child = frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
         m_childFrames.append(CachedFrame::create(child));
 
+    // Active DOM objects must be suspended before we cache the frame script data,
+    // but after we've fired the pagehide event, in case that creates more objects.
+    // Suspending must also happen after we've recursed over child frames, in case
+    // those create more objects.
+    // FIXME: It's still possible to have objects created after suspending in some cases, see http://webkit.org/b/53733 for more details.
+    m_document->suspendActiveDOMObjects(ActiveDOMObject::DocumentWillBecomeInactive);
+    m_cachedFrameScriptData = adoptPtr(new ScriptCachedFrameData(frame));
+
+    frame->loader()->client()->savePlatformDataToCachedFrame(this);
+
     // Deconstruct the FrameTree, to restore it later.
     // We do this for two reasons:
     // 1 - We reuse the main frame, so when it navigates to a new page load it needs to start with a blank FrameTree.
diff --git a/Source/WebCore/history/HistoryItem.cpp b/Source/WebCore/history/HistoryItem.cpp
index 805d5aa..c698db3 100644
--- a/Source/WebCore/history/HistoryItem.cpp
+++ b/Source/WebCore/history/HistoryItem.cpp
@@ -40,7 +40,7 @@
 
 namespace WebCore {
 
-const uint32_t backForwardTreeEncodingVersion = 1;
+const uint32_t backForwardTreeEncodingVersion = 2;
 
 static long long generateSequenceNumber()
 {
@@ -716,8 +716,6 @@ void HistoryItem::encodeBackForwardTreeNode(Encoder& encoder) const
 
     encoder.encodeInt64(m_itemSequenceNumber);
 
-    encoder.encodeString(m_originalURLString);
-
     encoder.encodeString(m_referrer);
 
     encoder.encodeInt32(m_scrollPoint.x());
@@ -820,9 +818,6 @@ resume:
     if (!decoder.decodeInt64(node->m_itemSequenceNumber))
         return 0;
 
-    if (!decoder.decodeString(node->m_originalURLString))
-        return 0;
-
     if (!decoder.decodeString(node->m_referrer))
         return 0;
 
diff --git a/Source/WebCore/history/HistoryItem.h b/Source/WebCore/history/HistoryItem.h
index 526cae2..235f756 100644
--- a/Source/WebCore/history/HistoryItem.h
+++ b/Source/WebCore/history/HistoryItem.h
@@ -234,7 +234,6 @@ private:
     HistoryItem* findTargetItem();
 
     void encodeBackForwardTreeNode(Encoder&) const;
-    static PassRefPtr<HistoryItem> decodeBackForwardTreeNode(const String& urlString, const String& title, const String& originalURLString, Decoder&);
 
     /* When adding new member variables to this class, please notify the Qt team.
      * qt/HistoryItemQt.cpp contains code to serialize history items.
diff --git a/Source/WebCore/history/PageCache.cpp b/Source/WebCore/history/PageCache.cpp
index a5dfb1e..d57df65 100644
--- a/Source/WebCore/history/PageCache.cpp
+++ b/Source/WebCore/history/PageCache.cpp
@@ -111,7 +111,7 @@ static bool logCanCacheFrameDecision(Frame* frame, int indentLevel)
             PCLOG("   -Frame contains plugins");
             cannotCache = true;
         }
-        if (frame->loader()->url().protocolIs("https")) {
+        if (frame->document()->url().protocolIs("https")) {
             PCLOG("   -Frame is HTTPS");
             cannotCache = true;
         }
@@ -260,7 +260,7 @@ bool PageCache::canCachePageContainingThisFrame(Frame* frame)
         // they would need to be destroyed and then recreated, and there is no way that we can recreate
         // the right NPObjects. See <rdar://problem/5197041> for more information.
         && !frame->loader()->subframeLoader()->containsPlugins()
-        && !frame->loader()->url().protocolIs("https")
+        && !frame->document()->url().protocolIs("https")
         && (!frame->domWindow() || !frame->domWindow()->hasEventListeners(eventNames().unloadEvent))
 #if ENABLE(DATABASE)
         && !frame->document()->hasOpenDatabases()
diff --git a/Source/WebCore/html/DOMURL.cpp b/Source/WebCore/html/DOMURL.cpp
index 87f9f45..d0f0aeb 100644
--- a/Source/WebCore/html/DOMURL.cpp
+++ b/Source/WebCore/html/DOMURL.cpp
@@ -37,6 +37,20 @@ namespace WebCore {
 DOMURL::DOMURL(ScriptExecutionContext* scriptExecutionContext)
     : m_scriptExecutionContext(scriptExecutionContext)
 {
+    if (m_scriptExecutionContext)
+        m_scriptExecutionContext->createdDomUrl(this);
+}
+
+DOMURL::~DOMURL()
+{
+    if (m_scriptExecutionContext)
+        m_scriptExecutionContext->destroyedDomUrl(this);
+}
+
+void DOMURL::contextDestroyed()
+{
+    ASSERT(m_scriptExecutionContext);
+    m_scriptExecutionContext = 0;
 }
 
 String DOMURL::createObjectURL(Blob* blob)
diff --git a/Source/WebCore/html/DOMURL.h b/Source/WebCore/html/DOMURL.h
index 57f3000..dff4dd8 100644
--- a/Source/WebCore/html/DOMURL.h
+++ b/Source/WebCore/html/DOMURL.h
@@ -40,10 +40,14 @@ class ScriptExecutionContext;
 class DOMURL : public RefCounted<DOMURL> {
 public:
     static PassRefPtr<DOMURL> create(ScriptExecutionContext* scriptExecutionContext) { return adoptRef(new DOMURL(scriptExecutionContext)); }
+    ~DOMURL();
 
     String createObjectURL(Blob*);
     void revokeObjectURL(const String&);
-    
+
+    void contextDestroyed();
+    ScriptExecutionContext* scriptExecutionContext() const { return m_scriptExecutionContext; }
+
 private:
     explicit DOMURL(ScriptExecutionContext*);
 
diff --git a/Source/WebCore/html/FTPDirectoryDocument.cpp b/Source/WebCore/html/FTPDirectoryDocument.cpp
index 2a08696..dc89045 100644
--- a/Source/WebCore/html/FTPDirectoryDocument.cpp
+++ b/Source/WebCore/html/FTPDirectoryDocument.cpp
@@ -26,7 +26,6 @@
 #if ENABLE(FTPDIR)
 #include "FTPDirectoryDocument.h"
 
-#include "CharacterNames.h"
 #include "HTMLDocumentParser.h"
 #include "HTMLNames.h"
 #include "HTMLTableElement.h"
@@ -37,11 +36,11 @@
 #include "Settings.h"
 #include "SharedBuffer.h"
 #include "Text.h"
-
 #include <wtf/text/CString.h>
 #include <wtf/text/StringConcatenate.h>
 #include <wtf/CurrentTime.h>
 #include <wtf/StdLibExtras.h>
+#include <wtf/unicode/CharacterNames.h>
 
 using namespace std;
 
diff --git a/Source/WebCore/html/FormAssociatedElement.cpp b/Source/WebCore/html/FormAssociatedElement.cpp
index 574dfe5..3571744 100644
--- a/Source/WebCore/html/FormAssociatedElement.cpp
+++ b/Source/WebCore/html/FormAssociatedElement.cpp
@@ -59,11 +59,24 @@ void FormAssociatedElement::willMoveToNewOwnerDocument()
         element->document()->unregisterFormElementWithFormAttribute(this);
 }
 
+void FormAssociatedElement::insertedIntoDocument()
+{
+    HTMLElement* element = toHTMLElement(this);
+    if (element->fastHasAttribute(formAttr))
+        element->document()->registerFormElementWithFormAttribute(this);
+}
+
+void FormAssociatedElement::removedFromDocument()
+{
+    HTMLElement* element = toHTMLElement(this);
+    if (element->fastHasAttribute(formAttr))
+        element->document()->unregisterFormElementWithFormAttribute(this);
+}
+
 void FormAssociatedElement::insertedIntoTree()
 {
     HTMLElement* element = toHTMLElement(this);
     if (element->fastHasAttribute(formAttr)) {
-        element->document()->registerFormElementWithFormAttribute(this);
         Element* formElement = element->document()->getElementById(element->fastGetAttribute(formAttr));
         if (formElement && formElement->hasTagName(formTag)) {
             if (m_form)
@@ -94,8 +107,6 @@ static inline Node* findRoot(Node* n)
 void FormAssociatedElement::removedFromTree()
 {
     HTMLElement* element = toHTMLElement(this);
-    if (element->fastHasAttribute(formAttr))
-        element->document()->unregisterFormElementWithFormAttribute(this);
 
     // If the form and element are both in the same tree, preserve the connection to the form.
     // Otherwise, null out our form and remove ourselves from the form's list of elements.
diff --git a/Source/WebCore/html/FormAssociatedElement.h b/Source/WebCore/html/FormAssociatedElement.h
index ebefdc6..aa5abd9 100644
--- a/Source/WebCore/html/FormAssociatedElement.h
+++ b/Source/WebCore/html/FormAssociatedElement.h
@@ -63,7 +63,8 @@ protected:
 
     void insertedIntoTree();
     void removedFromTree();
-
+    void insertedIntoDocument();
+    void removedFromDocument();
     void willMoveToNewOwnerDocument();
 
     void setForm(HTMLFormElement* form) { m_form = form; }
diff --git a/Source/WebCore/html/HTMLAnchorElement.cpp b/Source/WebCore/html/HTMLAnchorElement.cpp
index dcdde28..0c10022 100644
--- a/Source/WebCore/html/HTMLAnchorElement.cpp
+++ b/Source/WebCore/html/HTMLAnchorElement.cpp
@@ -541,7 +541,7 @@ bool isMiddleMouseButtonEvent(Event* event)
 
 bool isLinkClick(Event* event)
 {
-    return event->type() == eventNames().clickEvent || (event->type() == eventNames().mouseupEvent && isMiddleMouseButtonEvent(event));
+    return event->type() == eventNames().clickEvent && (!event->isMouseEvent() || static_cast<MouseEvent*>(event)->button() != RightButton);
 }
 
 void handleLinkClick(Event* event, Document* document, const String& url, const String& target, bool hideReferrer)
@@ -551,8 +551,6 @@ void handleLinkClick(Event* event, Document* document, const String& url, const
     Frame* frame = document->frame();
     if (!frame)
         return;
-    // FIXME: This seems wrong.  Why are we manufactuing a user gesture?
-    UserGestureIndicator indicator(DefinitelyProcessingUserGesture);
     frame->loader()->urlSelected(document->completeURL(url), target, event, false, false, hideReferrer ? NoReferrer : SendReferrer);
 }
 
diff --git a/Source/WebCore/html/HTMLAreaElement.cpp b/Source/WebCore/html/HTMLAreaElement.cpp
index ac4c865..9832d06 100644
--- a/Source/WebCore/html/HTMLAreaElement.cpp
+++ b/Source/WebCore/html/HTMLAreaElement.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2009, 2011 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -30,7 +30,7 @@
 #include "HTMLNames.h"
 #include "HitTestResult.h"
 #include "Path.h"
-#include "RenderObject.h"
+#include "RenderImage.h"
 
 using namespace std;
 
@@ -64,7 +64,7 @@ void HTMLAreaElement::parseMappedAttribute(Attribute* attr)
         else if (equalIgnoringCase(attr->value(), "rect"))
             m_shape = Rect;
     } else if (attr->name() == coordsAttr) {
-        m_coords.set(newCoordsArray(attr->value().string(), m_coordsLen));
+        m_coords = newCoordsArray(attr->value().string(), m_coordsLen);
     } else if (attr->name() == altAttr || attr->name() == accesskeyAttr) {
         // Do nothing.
     } else
@@ -86,7 +86,7 @@ bool HTMLAreaElement::mapMouseEvent(int x, int y, const IntSize& size, HitTestRe
     return true;
 }
 
-Path HTMLAreaElement::getPath(RenderObject* obj) const
+Path HTMLAreaElement::computePath(RenderObject* obj) const
 {
     if (!obj)
         return Path();
@@ -111,9 +111,9 @@ Path HTMLAreaElement::getPath(RenderObject* obj) const
     return p;
 }
     
-IntRect HTMLAreaElement::getRect(RenderObject* obj) const
+IntRect HTMLAreaElement::computeRect(RenderObject* obj) const
 {
-    return enclosingIntRect(getPath(obj).boundingRect());
+    return enclosingIntRect(computePath(obj).boundingRect());
 }
 
 Path HTMLAreaElement::getRegion(const IntSize& size) const
@@ -196,33 +196,34 @@ bool HTMLAreaElement::isFocusable() const
     return supportsFocus() && Element::tabIndex() >= 0;
 }
     
-void HTMLAreaElement::dispatchBlurEvent()
+void HTMLAreaElement::setFocus(bool shouldBeFocused)
 {
-    HTMLAnchorElement::dispatchBlurEvent();
-    
-    // On a blur, we might need to remove our focus rings by repainting.
-    updateFocusAppearance(false);
+    if (focused() == shouldBeFocused)
+        return;
+
+    HTMLAnchorElement::setFocus(shouldBeFocused);
+
+    HTMLImageElement* imageElement = this->imageElement();
+    if (!imageElement)
+        return;
+
+    RenderObject* renderer = imageElement->renderer();
+    if (!renderer || !renderer->isImage())
+        return;
+
+    toRenderImage(renderer)->areaElementFocusChanged(this);
 }
     
 void HTMLAreaElement::updateFocusAppearance(bool restorePreviousSelection)
 {
     if (!isFocusable())
         return;
-    
-    ContainerNode* parent = parentNode();
-    if (!parent || !parent->hasTagName(mapTag))
-        return;
-    
-    HTMLImageElement* imageElement = static_cast<HTMLMapElement*>(parent)->imageElement();
+
+    HTMLImageElement* imageElement = this->imageElement();
     if (!imageElement)
         return;
-    
-    // This will handle scrolling to the image if necessary.
+
     imageElement->updateFocusAppearance(restorePreviousSelection);
-    
-    RenderObject* imageRenderer = imageElement->renderer();
-    if (imageRenderer)
-        imageRenderer->setNeedsLayout(true);
 }
     
 bool HTMLAreaElement::supportsFocus() const
diff --git a/Source/WebCore/html/HTMLAreaElement.h b/Source/WebCore/html/HTMLAreaElement.h
index 42d4198..34f5ba9 100644
--- a/Source/WebCore/html/HTMLAreaElement.h
+++ b/Source/WebCore/html/HTMLAreaElement.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2008, 2009, 2011 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -41,8 +41,8 @@ public:
 
     bool mapMouseEvent(int x, int y, const IntSize&, HitTestResult&);
 
-    IntRect getRect(RenderObject*) const;
-    Path getPath(RenderObject*) const;
+    IntRect computeRect(RenderObject*) const;
+    Path computePath(RenderObject*) const;
 
     // The parent map's image.
     HTMLImageElement* imageElement() const;
@@ -57,7 +57,7 @@ private:
     virtual bool isMouseFocusable() const;
     virtual bool isFocusable() const;
     virtual void updateFocusAppearance(bool /*restorePreviousSelection*/);
-    virtual void dispatchBlurEvent();
+    virtual void setFocus(bool);
     
     enum Shape { Default, Poly, Rect, Circle, Unknown };
     Path getRegion(const IntSize&) const;
diff --git a/Source/WebCore/html/HTMLAttributeNames.in b/Source/WebCore/html/HTMLAttributeNames.in
index eac9a73..d195a6f 100644
--- a/Source/WebCore/html/HTMLAttributeNames.in
+++ b/Source/WebCore/html/HTMLAttributeNames.in
@@ -41,6 +41,7 @@ aria-readonly
 aria-relevant
 aria-required
 aria-selected
+aria-sort
 aria-valuemax
 aria-valuemin
 aria-valuenow
diff --git a/Source/WebCore/html/HTMLCanvasElement.cpp b/Source/WebCore/html/HTMLCanvasElement.cpp
index 0fdb7b2..09e8d04 100644
--- a/Source/WebCore/html/HTMLCanvasElement.cpp
+++ b/Source/WebCore/html/HTMLCanvasElement.cpp
@@ -48,7 +48,11 @@
 #include <math.h>
 #include <stdio.h>
 
-#if ENABLE(3D_CANVAS)    
+#if USE(JSC)
+#include <runtime/JSLock.h>
+#endif
+
+#if ENABLE(WEBGL)    
 #include "WebGLContextAttributes.h"
 #include "WebGLRenderingContext.h"
 #endif
@@ -166,7 +170,7 @@ CanvasRenderingContext* HTMLCanvasElement::getContext(const String& type, Canvas
         }
         return m_context.get();
     }
-#if ENABLE(3D_CANVAS)    
+#if ENABLE(WEBGL)    
     Settings* settings = document()->settings();
     if (settings && settings->webGLEnabled()
 #if !PLATFORM(CHROMIUM) && !PLATFORM(QT)
@@ -232,7 +236,7 @@ void HTMLCanvasElement::reset()
     IntSize oldSize = size();
     setSurfaceSize(IntSize(w, h)); // The image buffer gets cleared here.
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
     if (m_context && m_context->is3d() && oldSize != size())
         static_cast<WebGLRenderingContext*>(m_context.get())->reshape(width(), height());
 #endif
@@ -279,7 +283,7 @@ void HTMLCanvasElement::paint(GraphicsContext* context, const IntRect& r)
     }
 }
 
-#if ENABLE(3D_CANVAS)    
+#if ENABLE(WEBGL)    
 bool HTMLCanvasElement::is3D() const
 {
     return m_context && m_context->is3d();
@@ -344,10 +348,10 @@ String HTMLCanvasElement::toDataURL(const String& mimeType, const double* qualit
 
 IntRect HTMLCanvasElement::convertLogicalToDevice(const FloatRect& logicalRect) const
 {
-    float left = floorf(logicalRect.left() * m_pageScaleFactor);
-    float top = floorf(logicalRect.top() * m_pageScaleFactor);
-    float right = ceilf(logicalRect.right() * m_pageScaleFactor);
-    float bottom = ceilf(logicalRect.bottom() * m_pageScaleFactor);
+    float left = floorf(logicalRect.x() * m_pageScaleFactor);
+    float top = floorf(logicalRect.y() * m_pageScaleFactor);
+    float right = ceilf(logicalRect.maxX() * m_pageScaleFactor);
+    float bottom = ceilf(logicalRect.maxY() * m_pageScaleFactor);
     
     return IntRect(IntPoint(left, top), convertToValidDeviceSize(right - left, bottom - top));
 }
@@ -408,8 +412,10 @@ void HTMLCanvasElement::createImageBuffer() const
     m_imageBuffer->context()->setImageInterpolationQuality(DefaultInterpolationQuality);
 
 #if USE(JSC)
-    if (hasCachedDOMNodeWrapperUnchecked(document(), const_cast<HTMLCanvasElement*>(this)))
+    if (hasCachedDOMNodeWrapperUnchecked(document(), const_cast<HTMLCanvasElement*>(this))) {
+        JSC::JSLock lock(JSC::SilenceAssertionsOnly);
         scriptExecutionContext()->globalData()->heap.reportExtraMemoryCost(m_imageBuffer->dataSize());
+    }
 #endif
 }
 
diff --git a/Source/WebCore/html/HTMLCanvasElement.h b/Source/WebCore/html/HTMLCanvasElement.h
index 1f32dec..5c8ac9a 100644
--- a/Source/WebCore/html/HTMLCanvasElement.h
+++ b/Source/WebCore/html/HTMLCanvasElement.h
@@ -118,7 +118,7 @@ public:
 
     AffineTransform baseTransform() const;
 
-#if ENABLE(3D_CANVAS)    
+#if ENABLE(WEBGL)    
     bool is3D() const;
 #endif
 
diff --git a/Source/WebCore/html/HTMLCollection.cpp b/Source/WebCore/html/HTMLCollection.cpp
index 9b4e566..7d776d1 100644
--- a/Source/WebCore/html/HTMLCollection.cpp
+++ b/Source/WebCore/html/HTMLCollection.cpp
@@ -264,7 +264,7 @@ bool HTMLCollection::checkForNameMatch(Element* element, bool checkName, const A
     if (!element->isHTMLElement())
         return false;
     
-    HTMLElement* e = static_cast<HTMLElement*>(element);
+    HTMLElement* e = toHTMLElement(element);
     if (!checkName)
         return e->getIdAttribute() == name;
 
@@ -318,7 +318,7 @@ void HTMLCollection::updateNameCache() const
     for (Element* element = itemAfter(0); element; element = itemAfter(element)) {
         if (!element->isHTMLElement())
             continue;
-        HTMLElement* e = static_cast<HTMLElement*>(element);
+        HTMLElement* e = toHTMLElement(element);
         const AtomicString& idAttrVal = e->getIdAttribute();
         const AtomicString& nameAttrVal = e->getAttribute(nameAttr);
         if (!idAttrVal.isEmpty()) {
diff --git a/Source/WebCore/html/HTMLDocument.cpp b/Source/WebCore/html/HTMLDocument.cpp
index 84ad706..dd41514 100644
--- a/Source/WebCore/html/HTMLDocument.cpp
+++ b/Source/WebCore/html/HTMLDocument.cpp
@@ -69,7 +69,7 @@
 #include "HTMLBodyElement.h"
 #include "HTMLElementFactory.h"
 #include "HTMLNames.h"
-#include "InspectorController.h"
+#include "InspectorInstrumentation.h"
 #include "KURL.h"
 #include "Page.h"
 #include "Settings.h"
@@ -79,8 +79,8 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLDocument::HTMLDocument(Frame* frame, const KURL& url, const KURL& baseURL)
-    : Document(frame, url, false, true, baseURL)
+HTMLDocument::HTMLDocument(Frame* frame, const KURL& url)
+    : Document(frame, url, false, true)
 {
     clearXMLVersion();
 }
@@ -277,11 +277,7 @@ void HTMLDocument::releaseEvents()
 
 PassRefPtr<DocumentParser> HTMLDocument::createParser()
 {
-    bool reportErrors = false;
-#if ENABLE(INSPECTOR)
-    if (Page* page = this->page())
-        reportErrors = page->inspectorController()->hasFrontend();
-#endif
+    bool reportErrors = InspectorInstrumentation::hasFrontend(this->page());
     return HTMLDocumentParser::create(this, reportErrors);
 }
 
diff --git a/Source/WebCore/html/HTMLDocument.h b/Source/WebCore/html/HTMLDocument.h
index 37edd87..3310b71 100644
--- a/Source/WebCore/html/HTMLDocument.h
+++ b/Source/WebCore/html/HTMLDocument.h
@@ -35,9 +35,9 @@ class HTMLElement;
 
 class HTMLDocument : public Document, public CachedResourceClient {
 public:
-    static PassRefPtr<HTMLDocument> create(Frame* frame, const KURL& url, const KURL& baseURL = KURL())
+    static PassRefPtr<HTMLDocument> create(Frame* frame, const KURL& url)
     {
-        return adoptRef(new HTMLDocument(frame, url, baseURL));
+        return adoptRef(new HTMLDocument(frame, url));
     }
     virtual ~HTMLDocument();
 
@@ -80,7 +80,7 @@ public:
     bool hasExtraNamedItem(AtomicStringImpl* name);
 
 protected:
-    HTMLDocument(Frame* frame, const KURL& url, const KURL& baseURL = KURL());
+    HTMLDocument(Frame*, const KURL&);
 
 #ifdef ANDROID_INSTRUMENT
     // Overridden to resolve the ambiguous
diff --git a/Source/WebCore/html/HTMLElement.cpp b/Source/WebCore/html/HTMLElement.cpp
index b7eca06..22fc2f2 100644
--- a/Source/WebCore/html/HTMLElement.cpp
+++ b/Source/WebCore/html/HTMLElement.cpp
@@ -371,7 +371,7 @@ void HTMLElement::setOuterHTML(const String& html, ExceptionCode& ec)
         ec = NO_MODIFICATION_ALLOWED_ERR;
         return;
     }
-    HTMLElement* parent = static_cast<HTMLElement*>(p);
+    HTMLElement* parent = toHTMLElement(p);
 
     RefPtr<DocumentFragment> fragment = createFragmentFromSource(html, parent, ec);
     if (fragment) {
@@ -735,6 +735,8 @@ void HTMLElement::setContentEditable(const String& enabled, ExceptionCode& ec)
         setAttribute(contenteditableAttr, "true", ec);
     else if (equalIgnoringCase(enabled, "false"))
         setAttribute(contenteditableAttr, "false", ec);
+    else if (equalIgnoringCase(enabled, "plaintext-only"))
+        setAttribute(contenteditableAttr, "plaintext-only");
     else if (equalIgnoringCase(enabled, "inherit"))
         removeAttribute(contenteditableAttr, ec);
     else
@@ -850,7 +852,7 @@ HTMLFormElement* HTMLElement::shadowAncestorOwnerForm()
 
     if (!ancestorNode->isHTMLElement())
         return 0;
-    HTMLElement* ancestorHTML = static_cast<HTMLElement*>(ancestorNode);
+    HTMLElement* ancestorHTML = toHTMLElement(ancestorNode);
     if (!ancestorHTML)
         return 0;
     return ancestorHTML->form();
diff --git a/Source/WebCore/html/HTMLElement.h b/Source/WebCore/html/HTMLElement.h
index ad84f5d..2f6bc41 100644
--- a/Source/WebCore/html/HTMLElement.h
+++ b/Source/WebCore/html/HTMLElement.h
@@ -108,6 +108,18 @@ private:
     HTMLFormElement* shadowAncestorOwnerForm();
 };
 
+inline HTMLElement* toHTMLElement(Node* node)
+{
+    ASSERT(!node || node->isHTMLElement());
+    return static_cast<HTMLElement*>(node);
+}
+
+inline const HTMLElement* toHTMLElement(const Node* node)
+{
+    ASSERT(!node || node->isHTMLElement());
+    return static_cast<const HTMLElement*>(node);
+}
+
 inline HTMLElement::HTMLElement(const QualifiedName& tagName, Document* document)
     : StyledElement(tagName, document, CreateHTMLElement)
 {
diff --git a/Source/WebCore/html/HTMLEmbedElement.cpp b/Source/WebCore/html/HTMLEmbedElement.cpp
index df97280..f419e2a 100644
--- a/Source/WebCore/html/HTMLEmbedElement.cpp
+++ b/Source/WebCore/html/HTMLEmbedElement.cpp
@@ -138,7 +138,7 @@ void HTMLEmbedElement::parametersForPlugin(Vector<String>& paramNames, Vector<St
 
 // FIXME: This should be unified with HTMLObjectElement::updateWidget and
 // moved down into HTMLPluginImageElement.cpp
-void HTMLEmbedElement::updateWidget(bool onlyCreateNonNetscapePlugins)
+void HTMLEmbedElement::updateWidget(PluginCreationOption pluginCreationOption)
 {
     ASSERT(!renderEmbeddedObject()->pluginCrashedOrWasMissing());
     // FIXME: We should ASSERT(needsWidgetUpdate()), but currently
@@ -153,7 +153,10 @@ void HTMLEmbedElement::updateWidget(bool onlyCreateNonNetscapePlugins)
     // <object> which modifies url and serviceType before calling these.
     if (!allowedToLoadFrameURL(m_url))
         return;
-    if (onlyCreateNonNetscapePlugins && wouldLoadAsNetscapePlugin(m_url, m_serviceType))
+    // FIXME: It's sadness that we have this special case here.
+    //        See http://trac.webkit.org/changeset/25128 and
+    //        plugins/netscape-plugin-setwindow-size.html
+    if (pluginCreationOption == CreateOnlyNonNetscapePlugins && wouldLoadAsNetscapePlugin(m_url, m_serviceType))
         return;
 
     // FIXME: These should be joined into a PluginParameters class.
diff --git a/Source/WebCore/html/HTMLEmbedElement.h b/Source/WebCore/html/HTMLEmbedElement.h
index 70eb0dc..863c09b 100644
--- a/Source/WebCore/html/HTMLEmbedElement.h
+++ b/Source/WebCore/html/HTMLEmbedElement.h
@@ -47,7 +47,7 @@ private:
 
     virtual RenderWidget* renderWidgetForJSBindings() const;
 
-    virtual void updateWidget(bool onlyCreateNonNetscapePlugins);
+    virtual void updateWidget(PluginCreationOption);
 
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
diff --git a/Source/WebCore/html/HTMLFormControlElement.cpp b/Source/WebCore/html/HTMLFormControlElement.cpp
index bb42dfd..2f3db08 100644
--- a/Source/WebCore/html/HTMLFormControlElement.cpp
+++ b/Source/WebCore/html/HTMLFormControlElement.cpp
@@ -26,7 +26,6 @@
 #include "HTMLFormControlElement.h"
 
 #include "Attribute.h"
-#include "CharacterNames.h"
 #include "Chrome.h"
 #include "ChromeClient.h"
 #include "Document.h"
@@ -49,6 +48,7 @@
 #include "ValidityState.h"
 #include <limits>
 #include <wtf/Vector.h>
+#include <wtf/unicode/CharacterNames.h>
 
 namespace WebCore {
 
@@ -165,6 +165,18 @@ void HTMLFormControlElement::removedFromTree(bool deep)
     HTMLElement::removedFromTree(deep);
 }
 
+void HTMLFormControlElement::insertedIntoDocument()
+{
+    HTMLElement::insertedIntoDocument();
+    FormAssociatedElement::insertedIntoDocument();
+}
+
+void HTMLFormControlElement::removedFromDocument()
+{
+    HTMLElement::removedFromDocument();
+    FormAssociatedElement::removedFromDocument();
+}
+
 const AtomicString& HTMLFormControlElement::formControlName() const
 {
     const AtomicString& name = fastGetAttribute(nameAttr);
@@ -570,8 +582,8 @@ bool HTMLTextFormControlElement::placeholderShouldBeVisible() const
 {
     return supportsPlaceholder()
         && isEmptyValue()
-        && document()->focusedNode() != this
-        && !isPlaceholderEmpty();
+        && !isPlaceholderEmpty()
+        && (document()->focusedNode() != this || (renderer() && renderer()->theme()->shouldShowPlaceholderWhenFocused()));
 }
 
 void HTMLTextFormControlElement::updatePlaceholderVisibility(bool placeholderValueChanged)
diff --git a/Source/WebCore/html/HTMLFormControlElement.h b/Source/WebCore/html/HTMLFormControlElement.h
index c88905c..368dcfa 100644
--- a/Source/WebCore/html/HTMLFormControlElement.h
+++ b/Source/WebCore/html/HTMLFormControlElement.h
@@ -111,6 +111,8 @@ protected:
     virtual void attach();
     virtual void insertedIntoTree(bool deep);
     virtual void removedFromTree(bool deep);
+    virtual void insertedIntoDocument();
+    virtual void removedFromDocument();
     virtual void willMoveToNewOwnerDocument();
 
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
@@ -170,14 +172,13 @@ protected:
     HTMLFormControlElementWithState(const QualifiedName& tagName, Document*, HTMLFormElement*);
 
     virtual bool autoComplete() const;
-
+    virtual void finishParsingChildren();
     virtual void willMoveToNewOwnerDocument();
     virtual void didMoveToNewOwnerDocument();
     virtual void defaultEventHandler(Event*);
 
 private:
     virtual bool shouldSaveAndRestoreFormControlState() const;
-    virtual void finishParsingChildren();
 };
 
 // FIXME: Give this class its own header file.
diff --git a/Source/WebCore/html/HTMLFormElement.cpp b/Source/WebCore/html/HTMLFormElement.cpp
index d778601..8535027 100644
--- a/Source/WebCore/html/HTMLFormElement.cpp
+++ b/Source/WebCore/html/HTMLFormElement.cpp
@@ -221,8 +221,7 @@ bool HTMLFormElement::validateInteractively(Event* event)
     }
 
     Vector<RefPtr<FormAssociatedElement> > unhandledInvalidControls;
-    collectUnhandledInvalidControls(unhandledInvalidControls);
-    if (unhandledInvalidControls.isEmpty())
+    if (!checkInvalidControlsAndCollectUnhandled(unhandledInvalidControls))
         return true;
     // If the form has invalid controls, abort submission.
 
@@ -463,7 +462,7 @@ unsigned HTMLFormElement::formElementIndex(FormAssociatedElement* associatedElem
             if (node->isHTMLElement()
                     && (static_cast<Element*>(node)->isFormControlElement()
                         || node->hasTagName(objectTag))
-                    && static_cast<HTMLElement*>(node)->form() == this)
+                    && toHTMLElement(node)->form() == this)
                 ++i;
         }
     }
@@ -586,8 +585,7 @@ HTMLFormControlElement* HTMLFormElement::defaultButton() const
 bool HTMLFormElement::checkValidity()
 {
     Vector<RefPtr<FormAssociatedElement> > controls;
-    collectUnhandledInvalidControls(controls);
-    return controls.isEmpty();
+    return !checkInvalidControlsAndCollectUnhandled(controls);
 }
 
 void HTMLFormElement::broadcastFormEvent(const AtomicString& eventName)
@@ -623,7 +621,7 @@ void HTMLFormElement::dispatchFormChange()
     broadcastFormEvent(eventNames().formchangeEvent);
 }
 
-void HTMLFormElement::collectUnhandledInvalidControls(Vector<RefPtr<FormAssociatedElement> >& unhandledInvalidControls)
+bool HTMLFormElement::checkInvalidControlsAndCollectUnhandled(Vector<RefPtr<FormAssociatedElement> >& unhandledInvalidControls)
 {
     RefPtr<HTMLFormElement> protector(this);
     // Copy m_associatedElements because event handlers called from
@@ -632,10 +630,15 @@ void HTMLFormElement::collectUnhandledInvalidControls(Vector<RefPtr<FormAssociat
     elements.reserveCapacity(m_associatedElements.size());
     for (unsigned i = 0; i < m_associatedElements.size(); ++i)
         elements.append(m_associatedElements[i]);
+    bool hasInvalidControls = false;
     for (unsigned i = 0; i < elements.size(); ++i) {
-        if (elements[i]->form() == this && elements[i]->isFormControlElement())
-            static_cast<HTMLFormControlElement*>(elements[i].get())->checkValidity(&unhandledInvalidControls);
+        if (elements[i]->form() == this && elements[i]->isFormControlElement()) {
+            HTMLFormControlElement* control = static_cast<HTMLFormControlElement*>(elements[i].get());
+            if (!control->checkValidity(&unhandledInvalidControls) && control->form() == this)
+                hasInvalidControls = true;
+        }
     }
+    return hasInvalidControls;
 }
 
 HTMLFormControlElement* HTMLFormElement::elementForAlias(const AtomicString& alias)
diff --git a/Source/WebCore/html/HTMLFormElement.h b/Source/WebCore/html/HTMLFormElement.h
index 7d7f4f8..f723533 100644
--- a/Source/WebCore/html/HTMLFormElement.h
+++ b/Source/WebCore/html/HTMLFormElement.h
@@ -144,8 +144,9 @@ private:
     bool validateInteractively(Event*);
 
     // Validates each of the controls, and stores controls of which 'invalid'
-    // event was not canceled to the specified vector.
-    void collectUnhandledInvalidControls(Vector<RefPtr<FormAssociatedElement> >&);
+    // event was not canceled to the specified vector. Returns true if there
+    // are any invalid controls in this form.
+    bool checkInvalidControlsAndCollectUnhandled(Vector<RefPtr<FormAssociatedElement> >&);
 
     void broadcastFormEvent(const AtomicString&);
 
diff --git a/Source/WebCore/html/HTMLFrameElementBase.cpp b/Source/WebCore/html/HTMLFrameElementBase.cpp
index 47465c6..cf079ea 100644
--- a/Source/WebCore/html/HTMLFrameElementBase.cpp
+++ b/Source/WebCore/html/HTMLFrameElementBase.cpp
@@ -80,7 +80,7 @@ bool HTMLFrameElementBase::isURLAllowed() const
     // But we don't allow more than one.
     bool foundSelfReference = false;
     for (Frame* frame = document()->frame(); frame; frame = frame->tree()->parent()) {
-        if (equalIgnoringFragmentIdentifier(frame->loader()->url(), completeURL)) {
+        if (equalIgnoringFragmentIdentifier(frame->document()->url(), completeURL)) {
             if (foundSelfReference)
                 return false;
             foundSelfReference = true;
diff --git a/Source/WebCore/html/HTMLFrameSetElement.cpp b/Source/WebCore/html/HTMLFrameSetElement.cpp
index 0bb6c56..50f921b 100644
--- a/Source/WebCore/html/HTMLFrameSetElement.cpp
+++ b/Source/WebCore/html/HTMLFrameSetElement.cpp
@@ -75,12 +75,12 @@ void HTMLFrameSetElement::parseMappedAttribute(Attribute* attr)
 {
     if (attr->name() == rowsAttr) {
         if (!attr->isNull()) {
-            m_rowLengths.set(newLengthArray(attr->value().string(), m_totalRows));
+            m_rowLengths = newLengthArray(attr->value().string(), m_totalRows);
             setNeedsStyleRecalc();
         }
     } else if (attr->name() == colsAttr) {
         if (!attr->isNull()) {
-            m_colLengths.set(newLengthArray(attr->value().string(), m_totalCols));
+            m_colLengths = newLengthArray(attr->value().string(), m_totalCols);
             setNeedsStyleRecalc();
         }
     } else if (attr->name() == frameborderAttr) {
diff --git a/Source/WebCore/html/HTMLImageLoader.cpp b/Source/WebCore/html/HTMLImageLoader.cpp
index 710c177..ab4ae29 100644
--- a/Source/WebCore/html/HTMLImageLoader.cpp
+++ b/Source/WebCore/html/HTMLImageLoader.cpp
@@ -33,6 +33,7 @@
 
 #if USE(JSC)
 #include "JSDOMWindowBase.h"
+#include <runtime/JSLock.h>
 #endif
 
 namespace WebCore {
@@ -76,6 +77,7 @@ void HTMLImageLoader::notifyFinished(CachedResource*)
 #if USE(JSC)
     if (!loadError) {
         if (!elem->inDocument()) {
+            JSC::JSLock lock(JSC::SilenceAssertionsOnly);
             JSC::JSGlobalData* globalData = JSDOMWindowBase::commonJSGlobalData();
             globalData->heap.reportExtraMemoryCost(cachedImage->encodedSize());
         }
diff --git a/Source/WebCore/html/HTMLInputElement.cpp b/Source/WebCore/html/HTMLInputElement.cpp
index 0d20389..14dd149 100644
--- a/Source/WebCore/html/HTMLInputElement.cpp
+++ b/Source/WebCore/html/HTMLInputElement.cpp
@@ -45,6 +45,7 @@
 #include "KeyboardEvent.h"
 #include "LocalizedStrings.h"
 #include "MouseEvent.h"
+#include "PlatformMouseEvent.h"
 #include "RenderTextControlSingleLine.h"
 #include "RenderTheme.h"
 #include "RuntimeEnabledFeatures.h"
@@ -69,7 +70,7 @@ using namespace HTMLNames;
 
 const int maxSavedResults = 256;
 
-HTMLInputElement::HTMLInputElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
+HTMLInputElement::HTMLInputElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form, bool createdByParser)
     : HTMLTextFormControlElement(tagName, document, form)
     , m_maxResults(-1)
     , m_isChecked(false)
@@ -79,14 +80,16 @@ HTMLInputElement::HTMLInputElement(const QualifiedName& tagName, Document* docum
     , m_isActivatedSubmit(false)
     , m_autocomplete(Uninitialized)
     , m_isAutofilled(false)
+    , m_stateRestored(false)
+    , m_parsingInProgress(createdByParser)
     , m_inputType(InputType::createText(this))
 {
     ASSERT(hasTagName(inputTag) || hasTagName(isindexTag));
 }
 
-PassRefPtr<HTMLInputElement> HTMLInputElement::create(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
+PassRefPtr<HTMLInputElement> HTMLInputElement::create(const QualifiedName& tagName, Document* document, HTMLFormElement* form, bool createdByParser)
 {
-    return adoptRef(new HTMLInputElement(tagName, document, form));
+    return adoptRef(new HTMLInputElement(tagName, document, form, createdByParser));
 }
 
 HTMLInputElement::~HTMLInputElement()
@@ -146,7 +149,7 @@ void HTMLInputElement::updateCheckedRadioButtons()
             control->setNeedsValidityCheck();
         }
     }
-   
+
     if (renderer() && renderer()->style()->hasAppearance())
         renderer()->theme()->stateChanged(renderer(), CheckedState);
 }
@@ -356,7 +359,7 @@ void HTMLInputElement::applyStep(double count, ExceptionCode& ec)
     if (newValue > m_inputType->maximum())
         newValue = m_inputType->maximum();
     setValueAsNumber(newValue, ec);
-    
+
     if (AXObjectCache::accessibilityEnabled())
          document()->axObjectCache()->postNotification(renderer(), AXObjectCache::AXValueChanged, true);
 }
@@ -386,7 +389,7 @@ bool HTMLInputElement::isMouseFocusable() const
 }
 
 void HTMLInputElement::updateFocusAppearance(bool restorePreviousSelection)
-{        
+{
     if (isTextField())
         InputElement::updateFocusAppearance(m_data, this, this, restorePreviousSelection);
     else
@@ -517,6 +520,7 @@ bool HTMLInputElement::saveFormControlState(String& result) const
 void HTMLInputElement::restoreFormControlState(const String& state)
 {
     m_inputType->restoreFormControlState(state);
+    m_stateRestored = true;
 }
 
 bool HTMLInputElement::canStartSelection() const
@@ -539,11 +543,11 @@ void HTMLInputElement::accessKeyAction(bool sendToAnyElement)
 bool HTMLInputElement::mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const
 {
     if (((attrName == heightAttr || attrName == widthAttr) && m_inputType->shouldRespectHeightAndWidthAttributes())
-        || attrName == vspaceAttr 
+        || attrName == vspaceAttr
         || attrName == hspaceAttr) {
         result = eUniversal;
         return false;
-    } 
+    }
 
     if (attrName == alignAttr && m_inputType->shouldRespectAlignAttribute()) {
         // Share with <img> since the alignment behavior is the same.
@@ -585,11 +589,14 @@ void HTMLInputElement::parseMappedAttribute(Attribute* attr)
         setFormControlValueMatchesRenderer(false);
         setNeedsValidityCheck();
     } else if (attr->name() == checkedAttr) {
-        if (m_reflectsCheckedAttribute) {
+        // Another radio button in the same group might be checked by state
+        // restore. We shouldn't call setChecked() even if this has the checked
+        // attribute. So, delay the setChecked() call until
+        // finishParsingChildren() is called if parsing is in progress.
+        if (!m_parsingInProgress && m_reflectsCheckedAttribute) {
             setChecked(!attr->isNull());
             m_reflectsCheckedAttribute = true;
         }
-        setNeedsValidityCheck();
     } else if (attr->name() == maxlengthAttr) {
         InputElement::parseMaxLengthAttribute(m_data, this, this, attr);
         setNeedsValidityCheck();
@@ -658,6 +665,18 @@ void HTMLInputElement::parseMappedAttribute(Attribute* attr)
         HTMLTextFormControlElement::parseMappedAttribute(attr);
 }
 
+void HTMLInputElement::finishParsingChildren()
+{
+    m_parsingInProgress = false;
+    HTMLFormControlElementWithState::finishParsingChildren();
+    if (!m_stateRestored) {
+        bool checked = hasAttribute(checkedAttr);
+        if (checked)
+            setChecked(checked);
+        m_reflectsCheckedAttribute = true;
+    }
+}
+
 bool HTMLInputElement::rendererIsNeeded(RenderStyle* style)
 {
     return m_inputType->rendererIsNeeded() && HTMLFormControlElementWithState::rendererIsNeeded(style);
@@ -756,6 +775,7 @@ void HTMLInputElement::setChecked(bool nowChecked, bool sendChangeEvent)
     setNeedsStyleRecalc();
 
     updateCheckedRadioButtons();
+    setNeedsValidityCheck();
 
     // Ideally we'd do this from the render tree (matching
     // RenderTextView), but it's not possible to do it at the moment
@@ -883,6 +903,7 @@ void HTMLInputElement::setValue(const String& value, bool sendChangeEvent)
             cacheSelection(max, max);
         m_data.setSuggestedValue(String());
     }
+    m_inputType->valueChanged();
 
     // Don't dispatch the change event when focused, it will be dispatched
     // when the control loses focus.
@@ -958,6 +979,8 @@ void* HTMLInputElement::preDispatchEventHandler(Event* event)
 {
     if (event->type() != eventNames().clickEvent)
         return 0;
+    if (!event->isMouseEvent() || static_cast<MouseEvent*>(event)->button() != LeftButton)
+        return 0;
     // FIXME: Check whether there are any cases where this actually ends up leaking.
     return m_inputType->willDispatchClick().leakPtr();
 }
@@ -965,8 +988,6 @@ void* HTMLInputElement::preDispatchEventHandler(Event* event)
 void HTMLInputElement::postDispatchEventHandler(Event* event, void* dataFromPreDispatch)
 {
     OwnPtr<ClickHandlingState> state = adoptPtr(static_cast<ClickHandlingState*>(dataFromPreDispatch));
-    if (event->type() != eventNames().clickEvent)
-        return;
     if (!state)
         return;
     m_inputType->didDispatchClick(event, *state);
@@ -974,7 +995,7 @@ void HTMLInputElement::postDispatchEventHandler(Event* event, void* dataFromPreD
 
 void HTMLInputElement::defaultEventHandler(Event* evt)
 {
-    if (evt->isMouseEvent() && evt->type() == eventNames().clickEvent) {
+    if (evt->isMouseEvent() && evt->type() == eventNames().clickEvent && static_cast<MouseEvent*>(evt)->button() == LeftButton) {
         m_inputType->handleClickEvent(static_cast<MouseEvent*>(evt));
         if (evt->defaultHandled())
             return;
@@ -1134,7 +1155,7 @@ void HTMLInputElement::setAutofilled(bool autofilled)
 {
     if (autofilled == m_isAutofilled)
         return;
-        
+
     m_isAutofilled = autofilled;
     setNeedsStyleRecalc();
 }
@@ -1144,6 +1165,11 @@ FileList* HTMLInputElement::files()
     return m_inputType->files();
 }
 
+String HTMLInputElement::visibleValue() const
+{
+    return m_inputType->visibleValue();
+}
+
 bool HTMLInputElement::isAcceptableValue(const String& proposedValue) const
 {
     return m_inputType->isAcceptableValue(proposedValue);
@@ -1225,7 +1251,7 @@ void HTMLInputElement::willMoveToNewOwnerDocument()
     // Always unregister for cache callbacks when leaving a document, even if we would otherwise like to be registered
     if (needsActivationCallback())
         document()->unregisterForDocumentActivationCallbacks(this);
-        
+
     document()->checkedRadioButtons().removeButton(this);
 
     HTMLFormControlElementWithState::willMoveToNewOwnerDocument();
@@ -1234,10 +1260,10 @@ void HTMLInputElement::willMoveToNewOwnerDocument()
 void HTMLInputElement::didMoveToNewOwnerDocument()
 {
     registerForActivationCallbackIfNeeded();
-        
+
     HTMLFormControlElementWithState::didMoveToNewOwnerDocument();
 }
-    
+
 void HTMLInputElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
 {
     HTMLFormControlElementWithState::addSubresourceAttributeURLs(urls);
diff --git a/Source/WebCore/html/HTMLInputElement.h b/Source/WebCore/html/HTMLInputElement.h
index 403248c..757992a 100644
--- a/Source/WebCore/html/HTMLInputElement.h
+++ b/Source/WebCore/html/HTMLInputElement.h
@@ -37,7 +37,7 @@ class KURL;
 
 class HTMLInputElement : public HTMLTextFormControlElement, public InputElement {
 public:
-    static PassRefPtr<HTMLInputElement> create(const QualifiedName&, Document*, HTMLFormElement*);
+    static PassRefPtr<HTMLInputElement> create(const QualifiedName&, Document*, HTMLFormElement*, bool createdByParser);
     virtual ~HTMLInputElement();
 
     DEFINE_ATTRIBUTE_EVENT_LISTENER(webkitspeechchange);
@@ -198,7 +198,7 @@ public:
     void updateCheckedRadioButtons();
     
 protected:
-    HTMLInputElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
+    HTMLInputElement(const QualifiedName&, Document*, HTMLFormElement*, bool createdByParser);
 
     virtual void defaultEventHandler(Event*);
 
@@ -240,6 +240,7 @@ private:
 
     virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
     virtual void parseMappedAttribute(Attribute*);
+    virtual void finishParsingChildren();
 
     virtual void copyNonAttributeProperties(const Element* source);
 
@@ -258,6 +259,7 @@ private:
 
     virtual void cacheSelection(int start, int end);
 
+    virtual String visibleValue() const;
     virtual bool isAcceptableValue(const String&) const;
     virtual String sanitizeValue(const String&) const;
     virtual bool hasUnacceptableValue() const;
@@ -312,6 +314,8 @@ private:
 #if ENABLE(DATALIST)
     bool m_hasNonEmptyList : 1;
 #endif
+    bool m_stateRestored : 1;
+    bool m_parsingInProgress : 1;
     OwnPtr<InputType> m_inputType;
 };
 
diff --git a/Source/WebCore/html/HTMLIsIndexElement.cpp b/Source/WebCore/html/HTMLIsIndexElement.cpp
index a23a353..f865790 100644
--- a/Source/WebCore/html/HTMLIsIndexElement.cpp
+++ b/Source/WebCore/html/HTMLIsIndexElement.cpp
@@ -33,7 +33,7 @@ namespace WebCore {
 using namespace HTMLNames;
 
 HTMLIsIndexElement::HTMLIsIndexElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
-    : HTMLInputElement(tagName, document, form)
+    : HTMLInputElement(tagName, document, form, false)
 {
     ASSERT(hasTagName(isindexTag));
     setDefaultName(isindexTag.localName());
diff --git a/Source/WebCore/html/HTMLKeygenElement.cpp b/Source/WebCore/html/HTMLKeygenElement.cpp
index 881a0a8..b90335e 100644
--- a/Source/WebCore/html/HTMLKeygenElement.cpp
+++ b/Source/WebCore/html/HTMLKeygenElement.cpp
@@ -29,6 +29,7 @@
 #include "Document.h"
 #include "FormDataList.h"
 #include "HTMLNames.h"
+#include "HTMLSelectElement.h"
 #include "HTMLOptionElement.h"
 #include "SSLKeyGenerator.h"
 #include "Text.h"
@@ -40,20 +41,41 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+class KeygenSelectElement : public HTMLSelectElement {
+public:
+    static PassRefPtr<KeygenSelectElement> create(Document* document)
+    {
+        return adoptRef(new KeygenSelectElement(document));
+    }
+
+    virtual const AtomicString& shadowPseudoId() const
+    {
+        DEFINE_STATIC_LOCAL(AtomicString, pseudoId, ("-webkit-keygen-select"));
+        return pseudoId;
+    }
+
+protected:
+    KeygenSelectElement(Document* document)
+        : HTMLSelectElement(selectTag, document, 0)
+    {
+    }
+};
+
 inline HTMLKeygenElement::HTMLKeygenElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
-    : HTMLSelectElement(tagName, document, form)
+    : HTMLFormControlElementWithState(tagName, document, form)
 {
     ASSERT(hasTagName(keygenTag));
 
-    // FIXME: This markup should go in the shadow tree.
-    // Add one option element for each key size.
+    // Create a select element with one option element for each key size.
+    RefPtr<HTMLSelectElement> select = KeygenSelectElement::create(document);
     Vector<String> keys;
     getSupportedKeySizes(keys);
     for (size_t i = 0; i < keys.size(); ++i) {
         RefPtr<HTMLOptionElement> option = HTMLOptionElement::create(document, this->form());
-        parserAddChild(option);
+        select->parserAddChild(option);
         option->parserAddChild(Text::create(document, keys[i]));
     }
+    setShadowRoot(select);
 }
 
 PassRefPtr<HTMLKeygenElement> HTMLKeygenElement::create(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
@@ -61,22 +83,18 @@ PassRefPtr<HTMLKeygenElement> HTMLKeygenElement::create(const QualifiedName& tag
     return adoptRef(new HTMLKeygenElement(tagName, document, form));
 }
 
-const AtomicString& HTMLKeygenElement::formControlType() const
-{
-    DEFINE_STATIC_LOCAL(const AtomicString, keygen, ("keygen"));
-    return keygen;
-}
-
 void HTMLKeygenElement::parseMappedAttribute(Attribute* attr)
 {
+    // Reflect disabled attribute on the shadow select element
+    if (attr->name() == disabledAttr)
+        selectShadow()->setAttribute(attr->name(), attr->value());
+
     if (attr->name() == challengeAttr)
         m_challenge = attr->value();
     else if (attr->name() == keytypeAttr)
         m_keyType = attr->value();
-    else {
-        // Skip HTMLSelectElement parsing.
+    else
         HTMLFormControlElement::parseMappedAttribute(attr);
-    }
 }
 
 bool HTMLKeygenElement::appendFormData(FormDataList& encoded_values, bool)
@@ -84,11 +102,27 @@ bool HTMLKeygenElement::appendFormData(FormDataList& encoded_values, bool)
     // Only RSA is supported at this time.
     if (!m_keyType.isNull() && !equalIgnoringCase(m_keyType, "rsa"))
         return false;
-    String value = signedPublicKeyAndChallengeString(selectedIndex(), m_challenge, document()->baseURL());
+    String value = signedPublicKeyAndChallengeString(selectShadow()->selectedIndex(), m_challenge, document()->baseURL());
     if (value.isNull())
         return false;
     encoded_values.appendData(name(), value.utf8());
     return true;
 }
 
+const AtomicString& HTMLKeygenElement::formControlType() const
+{
+    DEFINE_STATIC_LOCAL(const AtomicString, keygen, ("keygen"));
+    return keygen;
+}
+
+void HTMLKeygenElement::reset()
+{
+    static_cast<HTMLFormControlElement*>(selectShadow())->reset();
+}
+
+HTMLSelectElement* HTMLKeygenElement::selectShadow()
+{
+    return static_cast<HTMLSelectElement*>(shadowRoot());
+}
+
 } // namespace
diff --git a/Source/WebCore/html/HTMLKeygenElement.h b/Source/WebCore/html/HTMLKeygenElement.h
index 3dc4ad2..a7a8a64 100644
--- a/Source/WebCore/html/HTMLKeygenElement.h
+++ b/Source/WebCore/html/HTMLKeygenElement.h
@@ -24,11 +24,13 @@
 #ifndef HTMLKeygenElement_h
 #define HTMLKeygenElement_h
 
-#include "HTMLSelectElement.h"
+#include "HTMLFormControlElement.h"
 
 namespace WebCore {
 
-class HTMLKeygenElement : public HTMLSelectElement {
+class HTMLSelectElement;
+
+class HTMLKeygenElement : public HTMLFormControlElementWithState {
 public:
     static PassRefPtr<HTMLKeygenElement> create(const QualifiedName&, Document*, HTMLFormElement*);
 
@@ -37,13 +39,21 @@ public:
 private:
     HTMLKeygenElement(const QualifiedName&, Document*, HTMLFormElement*);
 
-    virtual bool isResettable() const { return true; }
+    virtual bool canStartSelection() const { return false; }
 
-    virtual const AtomicString& formControlType() const;
     virtual void parseMappedAttribute(Attribute*);
+
     virtual bool appendFormData(FormDataList&, bool);
+    virtual const AtomicString& formControlType() const;
     virtual bool isOptionalFormControl() const { return false; }
 
+    virtual bool isEnumeratable() const { return true; }
+
+    virtual bool isResettable() const { return true; }
+    virtual void reset();
+
+    HTMLSelectElement* selectShadow();
+
     AtomicString m_challenge;
     AtomicString m_keyType;
 };
diff --git a/Source/WebCore/html/HTMLLinkElement.cpp b/Source/WebCore/html/HTMLLinkElement.cpp
index 8b2ae08..04cfda4 100644
--- a/Source/WebCore/html/HTMLLinkElement.cpp
+++ b/Source/WebCore/html/HTMLLinkElement.cpp
@@ -56,6 +56,7 @@ inline HTMLLinkElement::HTMLLinkElement(const QualifiedName& tagName, Document*
     , m_disabledState(Unset)
     , m_loading(false)
     , m_createdByParser(createdByParser)
+    , m_isInShadowTree(false)
     , m_pendingSheetType(None)
 {
     ASSERT(hasTagName(linkTag));
@@ -204,7 +205,7 @@ void HTMLLinkElement::tokenizeRelAttribute(const AtomicString& rel, RelAttribute
 
 void HTMLLinkElement::process()
 {
-    if (!inDocument()) {
+    if (!inDocument() || m_isInShadowTree) {
         ASSERT(!m_sheet);
         return;
     }
@@ -247,7 +248,7 @@ void HTMLLinkElement::process()
         
         String charset = getAttribute(charsetAttr);
         if (charset.isEmpty() && document()->frame())
-            charset = document()->frame()->loader()->writer()->encoding();
+            charset = document()->charset();
         
         if (m_cachedSheet) {
             removePendingSheet();
@@ -298,6 +299,11 @@ void HTMLLinkElement::process()
 void HTMLLinkElement::insertedIntoDocument()
 {
     HTMLElement::insertedIntoDocument();
+
+    m_isInShadowTree = isInShadowTree();
+    if (m_isInShadowTree)
+        return;
+
     document()->addStyleSheetCandidateNode(this, m_createdByParser);
 
     process();
@@ -307,6 +313,10 @@ void HTMLLinkElement::removedFromDocument()
 {
     HTMLElement::removedFromDocument();
 
+    if (m_isInShadowTree) {
+        ASSERT(!m_sheet);
+        return;
+    }
     document()->removeStyleSheetCandidateNode(this);
 
     if (m_sheet) {
diff --git a/Source/WebCore/html/HTMLLinkElement.h b/Source/WebCore/html/HTMLLinkElement.h
index e1198b1..3798c33 100644
--- a/Source/WebCore/html/HTMLLinkElement.h
+++ b/Source/WebCore/html/HTMLLinkElement.h
@@ -147,6 +147,7 @@ private:
     RelAttribute m_relAttribute;
     bool m_loading;
     bool m_createdByParser;
+    bool m_isInShadowTree;
     
     PendingSheetType m_pendingSheetType;
 };
diff --git a/Source/WebCore/html/HTMLMediaElement.cpp b/Source/WebCore/html/HTMLMediaElement.cpp
index be478b3..04d0a1d 100644
--- a/Source/WebCore/html/HTMLMediaElement.cpp
+++ b/Source/WebCore/html/HTMLMediaElement.cpp
@@ -48,6 +48,7 @@
 #include "HTMLSourceElement.h"
 #include "HTMLVideoElement.h"
 #include "Logging.h"
+#include "MediaControls.h"
 #include "MediaDocument.h"
 #include "MediaError.h"
 #include "MediaList.h"
@@ -2181,6 +2182,7 @@ void HTMLMediaElement::userCancelledLoad()
     m_player.clear();
 #endif
     stopPeriodicTimers();
+    m_loadTimer.stop();
     m_loadState = WaitingForSource;
 
     // 2 - Set the error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORTED.
@@ -2297,7 +2299,7 @@ void HTMLMediaElement::defaultEventHandler(Event* event)
         widget->handleEvent(event);
 #else
     if (renderer() && renderer()->isMedia())
-        toRenderMedia(renderer())->forwardEvent(event);
+        toRenderMedia(renderer())->controls()->forwardEvent(event);
     if (event->defaultHandled())
         return;
     HTMLElement::defaultEventHandler(event);
@@ -2401,7 +2403,7 @@ void HTMLMediaElement::createMediaPlayerProxy()
         m_needWidgetUpdate = false;
 }
 
-void HTMLMediaElement::updateWidget(bool)
+void HTMLMediaElement::updateWidget(PluginCreationOption)
 {
     mediaElement->setNeedWidgetUpdate(false);
 
@@ -2493,6 +2495,22 @@ bool HTMLMediaElement::webkitHasClosedCaptions() const
     return hasClosedCaptions();
 }
 
+#if ENABLE(MEDIA_STATISTICS)
+unsigned long HTMLMediaElement::webkitAudioBytesDecoded() const
+{
+    if (!m_player)
+        return 0;
+    return m_player->audioBytesDecoded();
+}
+
+unsigned long HTMLMediaElement::webkitVideoBytesDecoded() const
+{
+    if (!m_player)
+        return 0;
+    return m_player->videoBytesDecoded();
+}
+#endif
+
 void HTMLMediaElement::mediaCanStart()
 {
     LOG(Media, "HTMLMediaElement::mediaCanStart");
diff --git a/Source/WebCore/html/HTMLMediaElement.h b/Source/WebCore/html/HTMLMediaElement.h
index bdc3447..9778fd4 100644
--- a/Source/WebCore/html/HTMLMediaElement.h
+++ b/Source/WebCore/html/HTMLMediaElement.h
@@ -129,6 +129,12 @@ public:
     bool webkitClosedCaptionsVisible() const;
     void setWebkitClosedCaptionsVisible(bool);
 
+#if ENABLE(MEDIA_STATISTICS)
+// Statistics
+    unsigned long webkitAudioBytesDecoded() const;
+    unsigned long webkitVideoBytesDecoded() const;
+#endif
+
 // controls
     bool controls() const;
     void setControls(bool);
@@ -152,7 +158,7 @@ public:
     void getPluginProxyParams(KURL& url, Vector<String>& names, Vector<String>& values);
     virtual void finishParsingChildren();
     void createMediaPlayerProxy();
-    void updateWidget(bool onlyCreateNonNetscapePlugins);
+    void updateWidget(PluginCreationOption);
 #endif
 
     bool hasSingleSecurityOrigin() const { return !m_player || m_player->hasSingleSecurityOrigin(); }
diff --git a/Source/WebCore/html/HTMLMediaElement.idl b/Source/WebCore/html/HTMLMediaElement.idl
index d6ba79d..9d4602d 100644
--- a/Source/WebCore/html/HTMLMediaElement.idl
+++ b/Source/WebCore/html/HTMLMediaElement.idl
@@ -81,5 +81,11 @@ interface [Conditional=VIDEO] HTMLMediaElement : HTMLElement {
 
     readonly attribute boolean webkitHasClosedCaptions;
     attribute boolean webkitClosedCaptionsVisible;
+
+#if defined(ENABLE_MEDIA_STATISTICS) && ENABLE_MEDIA_STATISTICS
+    // The number of bytes consumed by the media decoder.
+    readonly attribute unsigned long webkitAudioBytesDecoded;
+    readonly attribute unsigned long webkitVideoBytesDecoded;
+#endif
 };
 }
diff --git a/Source/WebCore/html/HTMLObjectElement.cpp b/Source/WebCore/html/HTMLObjectElement.cpp
index a1dde1a..0f05a3a 100644
--- a/Source/WebCore/html/HTMLObjectElement.cpp
+++ b/Source/WebCore/html/HTMLObjectElement.cpp
@@ -236,14 +236,14 @@ bool HTMLObjectElement::hasFallbackContent() const
     return false;
 }
     
-bool HTMLObjectElement::hasValidClassId()
+inline bool HTMLObjectElement::hasValidClassId()
 {
     // HTML5 says that fallback content should be rendered if a non-empty
     // classid is specified for which the UA can't find a suitable plug-in.
     // WebKit supports no classids, with the exception of Qt plug-ins, which use
     // classid to specify which QObject to load.
 #if PLATFORM(QT)
-    return classId().isEmpty() || equalIgnoringCase(serviceType(), "application/x-qt-plugin");
+    return classId().isEmpty() || equalIgnoringCase(serviceType(), "application/x-qt-plugin") || equalIgnoringCase(serviceType(), "application/x-qt-styled-widget");
 #else
     return classId().isEmpty();
 #endif
@@ -251,7 +251,7 @@ bool HTMLObjectElement::hasValidClassId()
 
 // FIXME: This should be unified with HTMLEmbedElement::updateWidget and
 // moved down into HTMLPluginImageElement.cpp
-void HTMLObjectElement::updateWidget(bool onlyCreateNonNetscapePlugins)
+void HTMLObjectElement::updateWidget(PluginCreationOption pluginCreationOption)
 {
     ASSERT(!renderEmbeddedObject()->pluginCrashedOrWasMissing());
     // FIXME: We should ASSERT(needsWidgetUpdate()), but currently
@@ -277,7 +277,7 @@ void HTMLObjectElement::updateWidget(bool onlyCreateNonNetscapePlugins)
     bool fallbackContent = hasFallbackContent();
     renderEmbeddedObject()->setHasFallbackContent(fallbackContent);
 
-    if (onlyCreateNonNetscapePlugins && wouldLoadAsNetscapePlugin(url, serviceType))
+    if (pluginCreationOption == CreateOnlyNonNetscapePlugins && wouldLoadAsNetscapePlugin(url, serviceType))
         return;
 
     ASSERT(!m_inBeforeLoadEventHandler);
@@ -318,6 +318,7 @@ void HTMLObjectElement::insertedIntoDocument()
     }
 
     HTMLPlugInImageElement::insertedIntoDocument();
+    FormAssociatedElement::insertedIntoDocument();
 }
 
 void HTMLObjectElement::removedFromDocument()
@@ -329,6 +330,7 @@ void HTMLObjectElement::removedFromDocument()
     }
 
     HTMLPlugInImageElement::removedFromDocument();
+    FormAssociatedElement::removedFromDocument();
 }
 
 void HTMLObjectElement::attributeChanged(Attribute* attr, bool preserveDecls)
@@ -508,4 +510,9 @@ const AtomicString& HTMLObjectElement::formControlName() const
     return m_name.isNull() ? emptyAtom : m_name;
 }
 
+HTMLFormElement* HTMLObjectElement::virtualForm() const
+{
+    return FormAssociatedElement::form();
+}
+
 }
diff --git a/Source/WebCore/html/HTMLObjectElement.h b/Source/WebCore/html/HTMLObjectElement.h
index cc8a03c..82d63f7 100644
--- a/Source/WebCore/html/HTMLObjectElement.h
+++ b/Source/WebCore/html/HTMLObjectElement.h
@@ -85,7 +85,7 @@ private:
 
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
-    virtual void updateWidget(bool onlyCreateNonNetscapePlugins);
+    virtual void updateWidget(PluginCreationOption);
     void updateDocNamedItem();
 
     bool hasFallbackContent() const;
@@ -98,6 +98,7 @@ private:
 
     virtual void refFormAssociatedElement() { ref(); }
     virtual void derefFormAssociatedElement() { deref(); }
+    virtual HTMLFormElement* virtualForm() const;
 
     virtual const AtomicString& formControlName() const;
 
diff --git a/Source/WebCore/html/HTMLOptionElement.cpp b/Source/WebCore/html/HTMLOptionElement.cpp
index e8f624c..966f837 100644
--- a/Source/WebCore/html/HTMLOptionElement.cpp
+++ b/Source/WebCore/html/HTMLOptionElement.cpp
@@ -194,7 +194,7 @@ void HTMLOptionElement::childrenChanged(bool changedByParser, Node* beforeChange
 HTMLSelectElement* HTMLOptionElement::ownerSelectElement() const
 {
     ContainerNode* select = parentNode();
-    while (select && !(select->hasTagName(selectTag) || select->hasTagName(keygenTag)))
+    while (select && !select->hasTagName(selectTag))
         select = select->parentNode();
 
     if (!select)
@@ -221,6 +221,9 @@ String HTMLOptionElement::label() const
 void HTMLOptionElement::setRenderStyle(PassRefPtr<RenderStyle> newStyle)
 {
     m_style = newStyle;
+    if (HTMLSelectElement* select = ownerSelectElement())
+        if (RenderObject* renderer = select->renderer())
+            renderer->repaint();
 }
 
 RenderStyle* HTMLOptionElement::nonRendererRenderStyle() const
diff --git a/Source/WebCore/html/HTMLOutputElement.cpp b/Source/WebCore/html/HTMLOutputElement.cpp
index 2f1d490..8be5d91 100644
--- a/Source/WebCore/html/HTMLOutputElement.cpp
+++ b/Source/WebCore/html/HTMLOutputElement.cpp
@@ -74,7 +74,7 @@ void HTMLOutputElement::setFor(const String& value)
     m_tokens->setValue(value);
 }
 
-void HTMLOutputElement::childrenChanged(bool createdByParser, Node*, Node*, int)
+void HTMLOutputElement::childrenChanged(bool createdByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     if (createdByParser || m_isSetTextContentInProgress) {
         m_isSetTextContentInProgress = false;
@@ -83,6 +83,7 @@ void HTMLOutputElement::childrenChanged(bool createdByParser, Node*, Node*, int)
 
     if (m_isDefaultValueMode)
         m_defaultValue = textContent();
+    HTMLFormControlElement::childrenChanged(createdByParser, beforeChange, afterChange, childCountDelta);
 }
 
 void HTMLOutputElement::reset()
diff --git a/Source/WebCore/html/HTMLParamElement.cpp b/Source/WebCore/html/HTMLParamElement.cpp
index 2dc9d1d..45a74b2 100644
--- a/Source/WebCore/html/HTMLParamElement.cpp
+++ b/Source/WebCore/html/HTMLParamElement.cpp
@@ -42,6 +42,11 @@ PassRefPtr<HTMLParamElement> HTMLParamElement::create(const QualifiedName& tagNa
     return adoptRef(new HTMLParamElement(tagName, document));
 }
 
+bool HTMLParamElement::isURLParameter(const String& name)
+{
+    return equalIgnoringCase(name, "data") || equalIgnoringCase(name, "movie") || equalIgnoringCase(name, "src");
+}
+
 void HTMLParamElement::parseMappedAttribute(Attribute* attr)
 {
     if (isIdAttributeName(attr->name())) {
@@ -64,7 +69,7 @@ bool HTMLParamElement::isURLAttribute(Attribute* attr) const
         Attribute* attr = attributes()->getAttributeItem(nameAttr);
         if (attr) {
             const AtomicString& value = attr->value();
-            if (equalIgnoringCase(value, "data") || equalIgnoringCase(value, "movie") || equalIgnoringCase(value, "src"))
+            if (isURLParameter(value))
                 return true;
         }
     }
@@ -75,11 +80,9 @@ void HTMLParamElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) cons
 {
     HTMLElement::addSubresourceAttributeURLs(urls);
 
-    if (!equalIgnoringCase(name(), "data") &&
-        !equalIgnoringCase(name(), "movie") &&
-        !equalIgnoringCase(name(), "src"))
+    if (!isURLParameter(name()))
         return;
-    
+
     addSubresourceURL(urls, document()->completeURL(value()));
 }
 
diff --git a/Source/WebCore/html/HTMLParamElement.h b/Source/WebCore/html/HTMLParamElement.h
index f13f8fa..f448547 100644
--- a/Source/WebCore/html/HTMLParamElement.h
+++ b/Source/WebCore/html/HTMLParamElement.h
@@ -34,6 +34,8 @@ public:
     String name() const { return m_name; }
     String value() const { return m_value; }
 
+    static bool isURLParameter(const String&);
+
 private:
     HTMLParamElement(const QualifiedName&, Document*);
 
diff --git a/Source/WebCore/html/HTMLParserErrorCodes.cpp b/Source/WebCore/html/HTMLParserErrorCodes.cpp
index 6f973df..e1861a7 100644
--- a/Source/WebCore/html/HTMLParserErrorCodes.cpp
+++ b/Source/WebCore/html/HTMLParserErrorCodes.cpp
@@ -24,47 +24,5 @@
  */
 
 #include "config.h"
-#include "HTMLParserErrorCodes.h"
 
-namespace WebCore {
-
-const char* htmlParserErrorMessageTemplate(HTMLParserErrorCode errorCode)
-{
-    static const char* const errors[] = { 
-        "%tag1 is not allowed inside %tag2. Moving %tag1 into the nearest enclosing <table>.",
-        "<head> must be a child of <html>. Content ignored.",
-        "%tag1 is not allowed inside %tag2. Moving %tag1 into the <head>.",
-        "Extra %tag1 encountered.  Migrating attributes back to the original %tag1 element and ignoring the tag.",
-        "<area> is not allowed inside %tag1. Moving the <area> into the nearest enclosing <map>.",
-        "%tag1 is not allowed inside %tag2. Content ignored.",
-        "%tag1 is not allowed in a <frameset> page. Content ignored.",
-        "%tag1 is not allowed inside %tag2. Closing %tag2 and trying the insertion again.",
-        "%tag1 is not allowed inside <caption>. Closing the <caption> and trying the insertion again.",
-        "<table> is not allowed inside %tag1. Closing the current <table> and inserting the new <table> as a sibling.",
-        "%tag1 is not allowed inside %tag2. Inserting %tag1 before the <table> instead.",
-        "%tag1 misplaced in <table>. Creating %tag2 and putting %tag1 inside it.",
-        "</br> encountered.  Converting </br> into <br>.",
-        "XML self-closing tag syntax used on %tag1. The tag will not be closed.",
-        "Unmatched </p> encountered.  Converting </p> into <p></p>.",
-        "Unmatched %tag1 encountered.  Ignoring tag.",
-        "%tag1 misnested or not properly closed.  Cloning %tag1 in order to preserve the styles applied by it.",
-        "<form> cannot act as a container inside %tag1 without disrupting the table.  The children of the <form> will be placed inside the %tag1 instead.",
-        "XML self-closing tag syntax used on <script>.  The tag will be closed by WebKit, but not all browsers do this.  Change to <script></script> instead for best cross-browser compatibility."
-    };
-     
-    if (errorCode >= MisplacedTablePartError && errorCode <= IncorrectXMLCloseScriptWarning)
-        return errors[errorCode];
-    return 0;
-}
-
-const char* htmlParserDocumentWriteMessage()
-{
-    return "[The HTML that caused this error was generated by a script.] ";
-}
-
-bool isWarning(HTMLParserErrorCode code)
-{
-    return code >= IncorrectXMLCloseScriptWarning;
-}
-
-}
+// FIXME: Delete this file.
diff --git a/Source/WebCore/html/HTMLParserErrorCodes.h b/Source/WebCore/html/HTMLParserErrorCodes.h
index 4da6b90..1d88bc6 100644
--- a/Source/WebCore/html/HTMLParserErrorCodes.h
+++ b/Source/WebCore/html/HTMLParserErrorCodes.h
@@ -23,38 +23,4 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef HTMLParserErrorCodes_h
-#define HTMLParserErrorCodes_h
-
-namespace WebCore {
-
-enum HTMLParserErrorCode { 
-    MisplacedTablePartError,
-    MisplacedHeadError,
-    MisplacedHeadContentError,
-    RedundantHTMLBodyError,
-    MisplacedAreaError,
-    IgnoredContentError,
-    MisplacedFramesetContentError,
-    MisplacedContentRetryError,
-    MisplacedCaptionContentError,
-    MisplacedTableError,
-    StrayTableContentError,
-    TablePartRequiredError,
-    MalformedBRError,
-    IncorrectXMLSelfCloseError,
-    StrayParagraphCloseError,
-    StrayCloseTagError,
-    ResidualStyleError,
-    FormInsideTablePartError,
-    IncorrectXMLCloseScriptWarning
-};
-
-const char* htmlParserErrorMessageTemplate(HTMLParserErrorCode);
-const char* htmlParserDocumentWriteMessage();
-
-bool isWarning(HTMLParserErrorCode);
-
-}
-
-#endif
+// FIXME: Delete this file.
diff --git a/Source/WebCore/html/HTMLParserQuirks.h b/Source/WebCore/html/HTMLParserQuirks.h
index 3bf22a4..4ac6db8 100644
--- a/Source/WebCore/html/HTMLParserQuirks.h
+++ b/Source/WebCore/html/HTMLParserQuirks.h
@@ -23,27 +23,4 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef HTMLParserQuirks_h
-#define HTMLParserQuirks_h
-
-#include <wtf/Forward.h>
-
-namespace WebCore {
-
-class Node;
-
-class HTMLParserQuirks {
-    WTF_MAKE_NONCOPYABLE(HTMLParserQuirks);
-public:
-    HTMLParserQuirks() { }
-    virtual ~HTMLParserQuirks() { }
-
-    virtual void reset() = 0;
-
-    virtual bool shouldInsertNode(Node* parent, Node* newNode) = 0;
-    virtual bool shouldPopBlock(const AtomicString& tagNameOnStack, const AtomicString& tagNameToPop) = 0;
-};
-
-} // namespace WebCore
-
-#endif // HTMLParserQuirks_h
+// FIXME: Delete this file.
diff --git a/Source/WebCore/html/HTMLPlugInImageElement.cpp b/Source/WebCore/html/HTMLPlugInImageElement.cpp
index 9ac5ad8..db07334 100644
--- a/Source/WebCore/html/HTMLPlugInImageElement.cpp
+++ b/Source/WebCore/html/HTMLPlugInImageElement.cpp
@@ -78,7 +78,7 @@ bool HTMLPlugInImageElement::allowedToLoadFrameURL(const String& url)
     KURL completeURL = document()->completeURL(url);
     bool foundSelfReference = false;
     for (Frame* frame = document()->frame(); frame; frame = frame->tree()->parent()) {
-        if (equalIgnoringFragmentIdentifier(frame->loader()->url(), completeURL)) {
+        if (equalIgnoringFragmentIdentifier(frame->document()->url(), completeURL)) {
             if (foundSelfReference)
                 return false;
             foundSelfReference = true;
@@ -166,8 +166,7 @@ void HTMLPlugInImageElement::updateWidgetIfNecessary()
     if (!renderEmbeddedObject() || renderEmbeddedObject()->pluginCrashedOrWasMissing())
         return;
 
-    // True indicates that this code path should only create non-netscape plugins (no clue why).
-    updateWidget(true);
+    updateWidget(CreateOnlyNonNetscapePlugins);
 }
 
 void HTMLPlugInImageElement::finishParsingChildren()
diff --git a/Source/WebCore/html/HTMLPlugInImageElement.h b/Source/WebCore/html/HTMLPlugInImageElement.h
index f394d40..364262b 100644
--- a/Source/WebCore/html/HTMLPlugInImageElement.h
+++ b/Source/WebCore/html/HTMLPlugInImageElement.h
@@ -29,12 +29,17 @@ namespace WebCore {
 class HTMLImageLoader;
 class FrameLoader;
 
+enum PluginCreationOption {
+    CreateAnyWidgetType,
+    CreateOnlyNonNetscapePlugins,
+};
+
 // Base class for HTMLObjectElement and HTMLEmbedElement
 class HTMLPlugInImageElement : public HTMLPlugInElement {
 public:
     RenderEmbeddedObject* renderEmbeddedObject() const;
 
-    virtual void updateWidget(bool onlyCreateNonNetscapePlugins) = 0;
+    virtual void updateWidget(PluginCreationOption) = 0;
 
     const String& serviceType() const { return m_serviceType; }
     const String& url() const { return m_url; }
diff --git a/Source/WebCore/html/HTMLProgressElement.cpp b/Source/WebCore/html/HTMLProgressElement.cpp
index 4a55a1e..cab0429 100644
--- a/Source/WebCore/html/HTMLProgressElement.cpp
+++ b/Source/WebCore/html/HTMLProgressElement.cpp
@@ -26,9 +26,11 @@
 #include "EventNames.h"
 #include "ExceptionCode.h"
 #include "FormDataList.h"
+#include "HTMLDivElement.h"
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
 #include "HTMLParserIdioms.h"
+#include "ProgressBarValueElement.h"
 #include "RenderProgress.h"
 #include <wtf/StdLibExtras.h>
 
@@ -60,21 +62,19 @@ const AtomicString& HTMLProgressElement::formControlType() const
 
 void HTMLProgressElement::parseMappedAttribute(Attribute* attribute)
 {
-    if (attribute->name() == valueAttr) {
-        if (renderer())
-            renderer()->updateFromElement();
-    } else if (attribute->name() == maxAttr) {
-        if (renderer())
-            renderer()->updateFromElement();
-    } else
+    if (attribute->name() == valueAttr)
+        didElementStateChange();
+    else if (attribute->name() == maxAttr)
+        didElementStateChange();
+    else
         HTMLFormControlElement::parseMappedAttribute(attribute);
 }
 
 void HTMLProgressElement::attach()
 {
+    createShadowSubtreeIfNeeded();
     HTMLFormControlElement::attach();
-    if (renderer())
-        renderer()->updateFromElement();
+    didElementStateChange();
 }
 
 double HTMLProgressElement::value() const
@@ -121,5 +121,18 @@ double HTMLProgressElement::position() const
     return value() / max();
 }
 
+void HTMLProgressElement::didElementStateChange()
+{
+    if (renderer())
+        renderer()->updateFromElement();
+}
+
+void HTMLProgressElement::createShadowSubtreeIfNeeded()
+{
+    if (shadowRoot())
+        return;
+    setShadowRoot(ProgressBarValueElement::create(document()).get());
+}
+
 } // namespace
 #endif
diff --git a/Source/WebCore/html/HTMLProgressElement.h b/Source/WebCore/html/HTMLProgressElement.h
index c80f50f..a0db966 100644
--- a/Source/WebCore/html/HTMLProgressElement.h
+++ b/Source/WebCore/html/HTMLProgressElement.h
@@ -50,6 +50,9 @@ private:
     virtual void parseMappedAttribute(Attribute*);
 
     virtual void attach();
+
+    void didElementStateChange();
+    void createShadowSubtreeIfNeeded();
 };
 
 } // namespace
diff --git a/Source/WebCore/html/HTMLSelectElement.cpp b/Source/WebCore/html/HTMLSelectElement.cpp
index c7f47f2..d23e56a 100644
--- a/Source/WebCore/html/HTMLSelectElement.cpp
+++ b/Source/WebCore/html/HTMLSelectElement.cpp
@@ -49,7 +49,7 @@ static const unsigned maxSelectItems = 10000;
 HTMLSelectElement::HTMLSelectElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
     : HTMLFormControlElementWithState(tagName, document, form)
 {
-    ASSERT(hasTagName(selectTag) || hasTagName(keygenTag));
+    ASSERT(hasTagName(selectTag));
 }
 
 PassRefPtr<HTMLSelectElement> HTMLSelectElement::create(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
@@ -206,7 +206,7 @@ void HTMLSelectElement::remove(HTMLOptionElement* option)
     option->remove(ec);
 }
 
-String HTMLSelectElement::value()
+String HTMLSelectElement::value() const
 {
     const Vector<Element*>& items = listItems();
     for (unsigned i = 0; i < items.size(); i++) {
@@ -464,7 +464,7 @@ void HTMLSelectElement::setOption(unsigned index, HTMLOptionElement* option, Exc
         setLength(index, ec);
         // replace an existing entry ?
     } else if (diff < 0) {
-        before = static_cast<HTMLElement*>(options()->item(index+1));
+        before = toHTMLElement(options()->item(index+1));
         remove(index);
     }
     // finally add the new element
@@ -486,7 +486,7 @@ void HTMLSelectElement::setLength(unsigned newLen, ExceptionCode& ec)
         do {
             RefPtr<Element> option = document()->createElement(optionTag, false);
             ASSERT(option);
-            add(static_cast<HTMLElement*>(option.get()), 0, ec);
+            add(toHTMLElement(option.get()), 0, ec);
             if (ec)
                 break;
         } while (++diff);
diff --git a/Source/WebCore/html/HTMLSelectElement.h b/Source/WebCore/html/HTMLSelectElement.h
index 42e8963..837675c 100644
--- a/Source/WebCore/html/HTMLSelectElement.h
+++ b/Source/WebCore/html/HTMLSelectElement.h
@@ -55,7 +55,7 @@ public:
     void remove(int index);
     void remove(HTMLOptionElement*);
 
-    String value();
+    String value() const;
     void setValue(const String&);
 
     PassRefPtr<HTMLOptionsCollection> options();
diff --git a/Source/WebCore/html/HTMLTagNames.in b/Source/WebCore/html/HTMLTagNames.in
index f5ff077..83d41de 100644
--- a/Source/WebCore/html/HTMLTagNames.in
+++ b/Source/WebCore/html/HTMLTagNames.in
@@ -67,7 +67,7 @@ i interfaceName=HTMLElement
 iframe interfaceName=HTMLIFrameElement
 image mapToTagName=img
 img interfaceName=HTMLImageElement, constructorNeedsFormElement
-input constructorNeedsFormElement
+input constructorNeedsFormElement, constructorNeedsCreatedByParser
 ins interfaceName=HTMLModElement
 isindex interfaceName=HTMLIsIndexElement, constructorNeedsFormElement
 kbd interfaceName=HTMLElement
diff --git a/Source/WebCore/html/HTMLTextAreaElement.cpp b/Source/WebCore/html/HTMLTextAreaElement.cpp
index 2741bfe..b8b04de 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.cpp
+++ b/Source/WebCore/html/HTMLTextAreaElement.cpp
@@ -281,6 +281,7 @@ void HTMLTextAreaElement::updateValue() const
     const_cast<HTMLTextAreaElement*>(this)->setFormControlValueMatchesRenderer(true);
     notifyFormStateChanged(this);
     m_isDirty = true;
+    const_cast<HTMLTextAreaElement*>(this)->updatePlaceholderVisibility(false);
 }
 
 String HTMLTextAreaElement::value() const
diff --git a/Source/WebCore/html/HTMLVideoElement.cpp b/Source/WebCore/html/HTMLVideoElement.cpp
index bbda53a..2004e48 100644
--- a/Source/WebCore/html/HTMLVideoElement.cpp
+++ b/Source/WebCore/html/HTMLVideoElement.cpp
@@ -263,6 +263,24 @@ void HTMLVideoElement::willMoveToNewOwnerDocument()
     HTMLMediaElement::willMoveToNewOwnerDocument();
 }
 
+#if ENABLE(MEDIA_STATISTICS)
+unsigned long HTMLVideoElement::webkitDecodedFrames() const
+{
+    if (!player())
+        return 0;
+
+    return player()->decodedFrames();
+}
+
+unsigned long HTMLVideoElement::webkitDroppedFrames() const
+{
+    if (!player())
+        return 0;
+
+    return player()->droppedFrames();
+}
+#endif
+
 }
 
 #endif
diff --git a/Source/WebCore/html/HTMLVideoElement.h b/Source/WebCore/html/HTMLVideoElement.h
index d893411..dd38a59 100644
--- a/Source/WebCore/html/HTMLVideoElement.h
+++ b/Source/WebCore/html/HTMLVideoElement.h
@@ -55,6 +55,12 @@ public:
     void webkitEnterFullScreen(bool isUserGesture, ExceptionCode& ec) { webkitEnterFullscreen(isUserGesture, ec); }
     void webkitExitFullScreen() { webkitExitFullscreen(); }
 
+#if ENABLE(MEDIA_STATISTICS)
+    // Statistics
+    unsigned long webkitDecodedFrames() const;
+    unsigned long webkitDroppedFrames() const;
+#endif
+
     // Used by canvas to gain raw pixel access
     void paintCurrentFrameInContext(GraphicsContext*, const IntRect&);
 
diff --git a/Source/WebCore/html/HTMLVideoElement.idl b/Source/WebCore/html/HTMLVideoElement.idl
index 770e4b2..50513d4 100644
--- a/Source/WebCore/html/HTMLVideoElement.idl
+++ b/Source/WebCore/html/HTMLVideoElement.idl
@@ -42,5 +42,15 @@ module html {
     
         [NeedsUserGestureCheck] void webkitEnterFullScreen() raises (DOMException);
         void webkitExitFullScreen();
+
+#if defined(ENABLE_MEDIA_STATISTICS) && ENABLE_MEDIA_STATISTICS
+        // The number of frames that have been decoded and made available for
+        // playback.
+        readonly attribute unsigned long webkitDecodedFrames;
+
+        // The number of decoded frames that have been dropped by the player
+        // for performance reasons during playback.
+        readonly attribute unsigned long webkitDroppedFrames;
+#endif
     };
 }
diff --git a/Source/WebCore/html/InputType.cpp b/Source/WebCore/html/InputType.cpp
index 8e3a9e3..21ba7c2 100644
--- a/Source/WebCore/html/InputType.cpp
+++ b/Source/WebCore/html/InputType.cpp
@@ -435,6 +435,10 @@ void InputType::srcAttributeChanged()
 {
 }
 
+void InputType::valueChanged()
+{
+}
+
 void InputType::willMoveToNewOwnerDocument()
 {
 }
@@ -512,6 +516,11 @@ void InputType::didDispatchClick(Event*, const ClickHandlingState&)
 {
 }
 
+String InputType::visibleValue() const
+{
+    return element()->value();
+}
+
 bool InputType::isAcceptableValue(const String&)
 {
     return true;
diff --git a/Source/WebCore/html/InputType.h b/Source/WebCore/html/InputType.h
index 40606d1..8c35af3 100644
--- a/Source/WebCore/html/InputType.h
+++ b/Source/WebCore/html/InputType.h
@@ -152,6 +152,7 @@ public:
     virtual String typeMismatchText() const;
     virtual String valueMissingText() const;
     virtual bool canSetStringValue() const;
+    virtual String visibleValue() const;
     virtual bool isAcceptableValue(const String&);
     virtual String sanitizeValue(const String&);
     virtual bool hasUnacceptableValue();
@@ -197,9 +198,11 @@ public:
     virtual void minOrMaxAttributeChanged();
     virtual void altAttributeChanged();
     virtual void srcAttributeChanged();
+    virtual void valueChanged();
     virtual void willMoveToNewOwnerDocument();
     virtual bool shouldRespectAlignAttribute();
     virtual FileList* files();
+    // Should return true if the corresponding renderer for a type can display a suggested value.
     virtual bool canSetSuggestedValue();
     virtual bool shouldSendChangeEventAfterCheckedChanged();
     virtual bool canSetValue(const String&);
diff --git a/Source/WebCore/html/MediaDocument.cpp b/Source/WebCore/html/MediaDocument.cpp
index d6fe6dd..cd1fdfb 100644
--- a/Source/WebCore/html/MediaDocument.cpp
+++ b/Source/WebCore/html/MediaDocument.cpp
@@ -209,7 +209,7 @@ void MediaDocument::replaceMediaElementTimerFired(Timer<MediaDocument>*)
         embedElement->setAttribute(heightAttr, "100%");
         embedElement->setAttribute(nameAttr, "plugin");
         embedElement->setAttribute(srcAttr, url().string());
-        embedElement->setAttribute(typeAttr, frame()->loader()->writer()->mimeType());
+        embedElement->setAttribute(typeAttr, loader()->writer()->mimeType());
 
         ExceptionCode ec;
         videoElement->parentNode()->replaceChild(embedElement, videoElement, ec);
diff --git a/Source/WebCore/html/NumberInputType.cpp b/Source/WebCore/html/NumberInputType.cpp
index 3916527..0011115 100644
--- a/Source/WebCore/html/NumberInputType.cpp
+++ b/Source/WebCore/html/NumberInputType.cpp
@@ -38,6 +38,7 @@
 #include "HTMLNames.h"
 #include "HTMLParserIdioms.h"
 #include "KeyboardEvent.h"
+#include "LocalizedNumber.h"
 #include "RenderTextControl.h"
 #include <limits>
 #include <wtf/ASCIICType.h>
@@ -49,17 +50,21 @@ namespace WebCore {
 using namespace HTMLNames;
 using namespace std;
 
-static const double numberDefaultMinimum = -FLT_MAX;
-static const double numberDefaultMaximum = FLT_MAX;
-
 static const double numberDefaultStep = 1.0;
 static const double numberStepScaleFactor = 1.0;
 
-static bool isNumberCharacter(UChar ch)
+// Returns true if the specified character can be a part of 'valid floating
+// point number' of HTML5.
+static bool isHTMLNumberCharacter(UChar ch)
 {
     return ch == '+' || ch == '-' || ch == '.' || ch == 'e' || ch == 'E' || isASCIIDigit(ch);
 }
 
+static bool isNumberCharacter(UChar ch)
+{
+    return isLocalizedNumberCharacter(ch) || isHTMLNumberCharacter(ch);
+}
+
 PassOwnPtr<InputType> NumberInputType::create(HTMLInputElement* element)
 {
     return adoptPtr(new NumberInputType(element));
@@ -77,11 +82,11 @@ double NumberInputType::valueAsNumber() const
 
 void NumberInputType::setValueAsNumber(double newValue, ExceptionCode& ec) const
 {
-    if (newValue < numberDefaultMinimum) {
+    if (newValue < -numeric_limits<float>::max()) {
         ec = INVALID_STATE_ERR;
         return;
     }
-    if (newValue > numberDefaultMaximum) {
+    if (newValue > numeric_limits<float>::max()) {
         ec = INVALID_STATE_ERR;
         return;
     }
@@ -120,12 +125,12 @@ bool NumberInputType::supportsRangeLimitation() const
 
 double NumberInputType::minimum() const
 {
-    return parseToDouble(element()->fastGetAttribute(minAttr), numberDefaultMinimum);
+    return parseToDouble(element()->fastGetAttribute(minAttr), -numeric_limits<float>::max());
 }
 
 double NumberInputType::maximum() const
 {
-    return parseToDouble(element()->fastGetAttribute(maxAttr), numberDefaultMaximum);
+    return parseToDouble(element()->fastGetAttribute(maxAttr), numeric_limits<float>::max());
 }
 
 bool NumberInputType::stepMismatch(const String& value, double step) const
@@ -248,13 +253,29 @@ void NumberInputType::handleBlurEvent()
         element()->renderer()->updateFromElement();
 }
 
+String NumberInputType::visibleValue() const
+{
+    String currentValue = element()->value();
+    if (currentValue.isEmpty())
+        return currentValue;
+    double doubleValue = numeric_limits<double>::quiet_NaN();
+    parseToDoubleForNumberType(currentValue, &doubleValue);
+    String localized = formatLocalizedNumber(doubleValue);
+    return localized.isEmpty() ? currentValue : localized;
+}
+
 bool NumberInputType::isAcceptableValue(const String& proposedValue)
 {
-    return proposedValue.isEmpty() || parseToDoubleForNumberType(proposedValue, 0);
+    return proposedValue.isEmpty() || isfinite(parseLocalizedNumber(proposedValue)) || parseToDoubleForNumberType(proposedValue, 0);
 }
 
 String NumberInputType::sanitizeValue(const String& proposedValue)
 {
+    // Try to parse the value as a localized number, then try to parse it as
+    // the standard format.
+    double parsedValue = parseLocalizedNumber(proposedValue);
+    if (isfinite(parsedValue))
+        return serializeForNumberType(parsedValue);
     return parseToDoubleForNumberType(proposedValue, 0) ? proposedValue : String();
 }
 
diff --git a/Source/WebCore/html/NumberInputType.h b/Source/WebCore/html/NumberInputType.h
index 0b23d34..9d97134 100644
--- a/Source/WebCore/html/NumberInputType.h
+++ b/Source/WebCore/html/NumberInputType.h
@@ -64,6 +64,7 @@ private:
     virtual String serialize(double) const;
     virtual double acceptableError(double) const;
     virtual void handleBlurEvent();
+    virtual String visibleValue() const;
     virtual bool isAcceptableValue(const String&);
     virtual String sanitizeValue(const String&);
     virtual bool hasUnacceptableValue();
diff --git a/Source/WebCore/html/PluginDocument.cpp b/Source/WebCore/html/PluginDocument.cpp
index cebb949..94f44cf 100644
--- a/Source/WebCore/html/PluginDocument.cpp
+++ b/Source/WebCore/html/PluginDocument.cpp
@@ -28,6 +28,7 @@
 #include "DocumentLoader.h"
 #include "Frame.h"
 #include "FrameLoaderClient.h"
+#include "FrameView.h"
 #include "HTMLEmbedElement.h"
 #include "HTMLHtmlElement.h"
 #include "HTMLNames.h"
@@ -91,7 +92,7 @@ void PluginDocumentParser::createDocumentStructure()
     
     m_embedElement->setAttribute(nameAttr, "plugin");
     m_embedElement->setAttribute(srcAttr, document()->url().string());
-    m_embedElement->setAttribute(typeAttr, document()->frame()->loader()->writer()->mimeType());
+    m_embedElement->setAttribute(typeAttr, document()->loader()->writer()->mimeType());
 
     static_cast<PluginDocument*>(document())->setPluginNode(m_embedElement);
 
@@ -115,6 +116,13 @@ void PluginDocumentParser::appendBytes(DocumentWriter*, const char*, int, bool)
 
     document()->updateLayout();
 
+    // Below we assume that renderer->widget() to have been created by
+    // document()->updateLayout(). However, in some cases, updateLayout() will 
+    // recurse too many times and delay its post-layout tasks (such as creating
+    // the widget). Here we kick off the pending post-layout tasks so that we
+    // can synchronously redirect data to the plugin.
+    frame->view()->flushAnyPendingPostLayoutTasks();
+
     if (RenderPart* renderer = m_embedElement->renderPart()) {
         if (Widget* widget = renderer->widget()) {
             frame->loader()->client()->redirectDataToPlugin(widget);
diff --git a/Source/WebCore/html/RangeInputType.cpp b/Source/WebCore/html/RangeInputType.cpp
index 7c74206..be7e0c6 100644
--- a/Source/WebCore/html/RangeInputType.cpp
+++ b/Source/WebCore/html/RangeInputType.cpp
@@ -158,6 +158,8 @@ void RangeInputType::handleMouseDownEvent(MouseEvent* event)
 
 void RangeInputType::handleKeydownEvent(KeyboardEvent* event)
 {
+    if (element()->disabled() || element()->readOnly())
+        return;
     const String& key = event->keyIdentifier();
     if (key != "Up" && key != "Right" && key != "Down" && key != "Left")
         return;
@@ -257,6 +259,11 @@ void RangeInputType::minOrMaxAttributeChanged()
     element()->setNeedsStyleRecalc();
 }
 
+void RangeInputType::valueChanged()
+{
+    element()->shadowRoot()->setNeedsStyleRecalc();
+}
+
 String RangeInputType::fallbackValue()
 {
     return serializeForNumberType(StepRange(element()).defaultValue());
diff --git a/Source/WebCore/html/RangeInputType.h b/Source/WebCore/html/RangeInputType.h
index 1447018..ac89d02 100644
--- a/Source/WebCore/html/RangeInputType.h
+++ b/Source/WebCore/html/RangeInputType.h
@@ -63,6 +63,7 @@ private:
     virtual String serialize(double) const;
     virtual void accessKeyAction(bool sendToAnyElement);
     virtual void minOrMaxAttributeChanged();
+    virtual void valueChanged();
     virtual String fallbackValue();
     virtual String sanitizeValue(const String& proposedValue);
     virtual bool shouldRespectListAttribute();
diff --git a/Source/WebCore/html/TextFieldInputType.cpp b/Source/WebCore/html/TextFieldInputType.cpp
index 54527b1..1d06be3 100644
--- a/Source/WebCore/html/TextFieldInputType.cpp
+++ b/Source/WebCore/html/TextFieldInputType.cpp
@@ -52,6 +52,11 @@ bool TextFieldInputType::valueMissing(const String& value) const
     return value.isEmpty();
 }
 
+bool TextFieldInputType::canSetSuggestedValue()
+{
+    return true;
+}
+
 void TextFieldInputType::handleKeydownEvent(KeyboardEvent* event)
 {
     if (!element()->focused())
@@ -64,6 +69,8 @@ void TextFieldInputType::handleKeydownEvent(KeyboardEvent* event)
 
 void TextFieldInputType::handleKeydownEventForSpinButton(KeyboardEvent* event)
 {
+    if (element()->disabled() || element()->readOnly())
+        return;
     const String& key = event->keyIdentifier();
     int step = 0;
     if (key == "Up")
@@ -78,6 +85,8 @@ void TextFieldInputType::handleKeydownEventForSpinButton(KeyboardEvent* event)
 
 void TextFieldInputType::handleWheelEventForSpinButton(WheelEvent* event)
 {
+    if (element()->disabled() || element()->readOnly())
+        return;
     int step = 0;
     if (event->wheelDeltaY() > 0)
         step = 1;
diff --git a/Source/WebCore/html/TextFieldInputType.h b/Source/WebCore/html/TextFieldInputType.h
index e882c82..86ad0ef 100644
--- a/Source/WebCore/html/TextFieldInputType.h
+++ b/Source/WebCore/html/TextFieldInputType.h
@@ -40,6 +40,7 @@ namespace WebCore {
 class TextFieldInputType : public InputType {
 protected:
     TextFieldInputType(HTMLInputElement* element) : InputType(element) { }
+    virtual bool canSetSuggestedValue();
     virtual void handleKeydownEvent(KeyboardEvent*);
     void handleKeydownEventForSpinButton(KeyboardEvent*);
     void handleWheelEventForSpinButton(WheelEvent*);
diff --git a/Source/WebCore/html/TextInputType.cpp b/Source/WebCore/html/TextInputType.cpp
index c37263a..a369976 100644
--- a/Source/WebCore/html/TextInputType.cpp
+++ b/Source/WebCore/html/TextInputType.cpp
@@ -45,12 +45,6 @@ const AtomicString& TextInputType::formControlType() const
     return InputTypeNames::text();
 }
 
-bool TextInputType::canSetSuggestedValue()
-{
-    // FIXME: Should this really be restricted to plain text? What about search, for example?
-    return true;
-}
-
 bool TextInputType::shouldRespectSpeechAttribute()
 {
     return true;
diff --git a/Source/WebCore/html/TextInputType.h b/Source/WebCore/html/TextInputType.h
index 3b6810e..243f656 100644
--- a/Source/WebCore/html/TextInputType.h
+++ b/Source/WebCore/html/TextInputType.h
@@ -42,7 +42,6 @@ public:
 private:
     TextInputType(HTMLInputElement* element) : BaseTextInputType(element) { }
     virtual const AtomicString& formControlType() const;
-    virtual bool canSetSuggestedValue();
     virtual bool shouldRespectSpeechAttribute();
 };
 
diff --git a/Source/WebCore/html/ValidationMessage.cpp b/Source/WebCore/html/ValidationMessage.cpp
index 2c441c7..f772b92 100644
--- a/Source/WebCore/html/ValidationMessage.cpp
+++ b/Source/WebCore/html/ValidationMessage.cpp
@@ -105,7 +105,7 @@ protected:
     ElementWithPseudoId(Document* doc, const AtomicString& pseudoName)
         : HTMLElement(divTag, doc)
         , m_pseudoName(pseudoName) { };
-    virtual AtomicString shadowPseudoId() const { return m_pseudoName; }
+    virtual const AtomicString& shadowPseudoId() const { return m_pseudoName; }
 
 private:
     AtomicString m_pseudoName;
diff --git a/Source/WebCore/html/canvas/ArrayBuffer.cpp b/Source/WebCore/html/canvas/ArrayBuffer.cpp
index 2136f64..4f75cc3 100644
--- a/Source/WebCore/html/canvas/ArrayBuffer.cpp
+++ b/Source/WebCore/html/canvas/ArrayBuffer.cpp
@@ -24,9 +24,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "ArrayBuffer.h"
 
 #include <wtf/RefPtr.h>
@@ -100,5 +97,3 @@ void* ArrayBuffer::tryAllocate(unsigned numElements, unsigned elementByteSize)
 }
 
 }
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/html/canvas/ArrayBuffer.idl b/Source/WebCore/html/canvas/ArrayBuffer.idl
index 79a4685..6f63e65 100644
--- a/Source/WebCore/html/canvas/ArrayBuffer.idl
+++ b/Source/WebCore/html/canvas/ArrayBuffer.idl
@@ -26,7 +26,6 @@
 module html {
 
     interface [
-        Conditional=3D_CANVAS|BLOB,
         CanBeConstructed,
         CustomConstructFunction,
         NoStaticTables,
diff --git a/Source/WebCore/html/canvas/ArrayBufferView.cpp b/Source/WebCore/html/canvas/ArrayBufferView.cpp
index 7f41bda..a2f61ca 100644
--- a/Source/WebCore/html/canvas/ArrayBufferView.cpp
+++ b/Source/WebCore/html/canvas/ArrayBufferView.cpp
@@ -24,9 +24,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "ArrayBufferView.h"
 
 #include "ArrayBuffer.h"
@@ -105,5 +102,3 @@ void ArrayBufferView::calculateOffsetAndLength(int start, int end, unsigned arra
 }
 
 }
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/html/canvas/ArrayBufferView.idl b/Source/WebCore/html/canvas/ArrayBufferView.idl
index be217c1..1ea451d 100644
--- a/Source/WebCore/html/canvas/ArrayBufferView.idl
+++ b/Source/WebCore/html/canvas/ArrayBufferView.idl
@@ -24,7 +24,7 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS|BLOB, CustomToJS, NoStaticTables, OmitConstructor] ArrayBufferView {
+    interface [CustomToJS, NoStaticTables, OmitConstructor] ArrayBufferView {
         readonly attribute ArrayBuffer buffer;
         readonly attribute unsigned long byteOffset;
         readonly attribute unsigned long byteLength;
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index e029128..9ef2dba 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -234,7 +234,7 @@ void CanvasRenderingContext2D::setAllAttributesToDefault()
     if (!context)
         return;
 
-    context->setShadow(FloatSize(), 0, Color::transparent, ColorSpaceDeviceRGB);
+    context->setLegacyShadow(FloatSize(), 0, Color::transparent, ColorSpaceDeviceRGB);
     context->setAlpha(1);
     context->setCompositeOperation(CompositeSourceOver);
 }
@@ -574,7 +574,7 @@ void CanvasRenderingContext2D::setStrokeColor(const String& color)
 {
     if (color == state().m_unparsedStrokeColor)
         return;
-    setStrokeStyle(CanvasStyle::createFromString(color));
+    setStrokeStyle(CanvasStyle::createFromString(color, canvas()->document()));
     state().m_unparsedStrokeColor = color;
 }
 
@@ -615,7 +615,7 @@ void CanvasRenderingContext2D::setFillColor(const String& color)
 {
     if (color == state().m_unparsedFillColor)
         return;
-    setFillStyle(CanvasStyle::createFromString(color));
+    setFillStyle(CanvasStyle::createFromString(color, canvas()->document()));
     state().m_unparsedFillColor = color;
 }
 
@@ -1000,7 +1000,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     if (!c)
         return;
 
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, state().m_shadowColor, ColorSpaceDeviceRGB);
+    c->setLegacyShadow(FloatSize(width, -height), state().m_shadowBlur, state().m_shadowColor, ColorSpaceDeviceRGB);
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, const String& color, float alpha)
@@ -1018,7 +1018,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     if (!c)
         return;
 
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, state().m_shadowColor, ColorSpaceDeviceRGB);
+    c->setLegacyShadow(FloatSize(width, -height), state().m_shadowBlur, state().m_shadowColor, ColorSpaceDeviceRGB);
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, float grayLevel, float alpha)
@@ -1031,7 +1031,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     if (!c)
         return;
 
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, state().m_shadowColor, ColorSpaceDeviceRGB);
+    c->setLegacyShadow(FloatSize(width, -height), state().m_shadowBlur, state().m_shadowColor, ColorSpaceDeviceRGB);
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, float r, float g, float b, float a)
@@ -1044,7 +1044,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     if (!c)
         return;
 
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, state().m_shadowColor, ColorSpaceDeviceRGB);
+    c->setLegacyShadow(FloatSize(width, -height), state().m_shadowBlur, state().m_shadowColor, ColorSpaceDeviceRGB);
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, float c, float m, float y, float k, float a)
@@ -1064,7 +1064,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     CGContextSetShadowWithColor(dc->platformContext(), adjustedShadowSize(width, -height), blur, shadowColor);
     CGColorRelease(shadowColor);
 #else
-    dc->setShadow(IntSize(width, -height), blur, state().m_shadowColor, ColorSpaceDeviceRGB);
+    dc->setLegacyShadow(FloatSize(width, -height), blur, state().m_shadowColor, ColorSpaceDeviceRGB);
 #endif
 }
 
@@ -1084,7 +1084,7 @@ void CanvasRenderingContext2D::applyShadow()
 
     float width = state().m_shadowOffset.width();
     float height = state().m_shadowOffset.height();
-    c->setShadow(FloatSize(width, -height), state().m_shadowBlur, state().m_shadowColor, ColorSpaceDeviceRGB);
+    c->setLegacyShadow(FloatSize(width, -height), state().m_shadowBlur, state().m_shadowColor, ColorSpaceDeviceRGB);
 }
 
 static IntSize size(HTMLImageElement* image)
@@ -1105,8 +1105,8 @@ static IntSize size(HTMLVideoElement* video)
 
 static inline FloatRect normalizeRect(const FloatRect& rect)
 {
-    return FloatRect(min(rect.x(), rect.right()),
-        min(rect.y(), rect.bottom()),
+    return FloatRect(min(rect.x(), rect.maxX()),
+        min(rect.y(), rect.maxY()),
         max(rect.width(), -rect.width()),
         max(rect.height(), -rect.height()));
 }
@@ -1760,7 +1760,8 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
         return;
 
     const Font& font = accessFont();
-    
+    const FontMetrics& fontMetrics = font.fontMetrics();
+
     // FIXME: Handle maxWidth.
     // FIXME: Need to turn off font smoothing.
 
@@ -1770,21 +1771,21 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
 
     unsigned length = text.length();
     const UChar* string = text.characters();
-    TextRun textRun(string, length, 0, 0, 0, rtl, override, false, false);
+    TextRun textRun(string, length, false, 0, 0, TextRun::AllowTrailingExpansion, rtl, override, false, false);
 
     // Draw the item text at the correct point.
     FloatPoint location(x, y);
     switch (state().m_textBaseline) {
     case TopTextBaseline:
     case HangingTextBaseline:
-        location.setY(y + font.ascent());
+        location.setY(y + fontMetrics.ascent());
         break;
     case BottomTextBaseline:
     case IdeographicTextBaseline:
-        location.setY(y - font.descent());
+        location.setY(y - fontMetrics.descent());
         break;
     case MiddleTextBaseline:
-        location.setY(y - font.descent() + font.height() / 2);
+        location.setY(y - fontMetrics.descent() + fontMetrics.height() / 2);
         break;
     case AlphabeticTextBaseline:
     default:
@@ -1792,7 +1793,7 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
         break;
     }
 
-    float width = font.width(TextRun(text, false, 0, 0, rtl, override));
+    float width = font.width(TextRun(text, false, 0, 0, TextRun::AllowTrailingExpansion, rtl, override));
 
     TextAlign align = state().m_textAlign;
     if (align == StartTextAlign)
@@ -1812,8 +1813,8 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
     }
 
     // The slop built in to this mask rect matches the heuristic used in FontCGWin.cpp for GDI text.
-    FloatRect textRect = FloatRect(location.x() - font.height() / 2, location.y() - font.ascent() - font.lineGap(),
-                                   width + font.height(), font.lineSpacing());
+    FloatRect textRect = FloatRect(location.x() - fontMetrics.height() / 2, location.y() - fontMetrics.ascent() - fontMetrics.lineGap(),
+                                   width + fontMetrics.height(), fontMetrics.lineSpacing());
     if (!fill)
         textRect.inflate(c->strokeThickness() / 2);
 
diff --git a/Source/WebCore/html/canvas/CanvasStyle.cpp b/Source/WebCore/html/canvas/CanvasStyle.cpp
index a4e87e3..ee8567c 100644
--- a/Source/WebCore/html/canvas/CanvasStyle.cpp
+++ b/Source/WebCore/html/canvas/CanvasStyle.cpp
@@ -51,14 +51,16 @@
 
 namespace WebCore {
 
-enum ColorParseResult { ParsedRGBA, ParsedCurrentColor, ParseFailed };
+enum ColorParseResult { ParsedRGBA, ParsedCurrentColor, ParsedSystemColor, ParseFailed };
 
-static ColorParseResult parseColor(RGBA32& parsedColor, const String& colorString)
+static ColorParseResult parseColor(RGBA32& parsedColor, const String& colorString, Document* document = 0)
 {
     if (equalIgnoringCase(colorString, "currentcolor"))
         return ParsedCurrentColor;
     if (CSSParser::parseColor(parsedColor, colorString))
         return ParsedRGBA;
+    if (CSSParser::parseSystemColor(parsedColor, colorString, document))
+        return ParsedSystemColor;
     return ParseFailed;
 }
 
@@ -73,9 +75,10 @@ RGBA32 currentColor(HTMLCanvasElement* canvas)
 
 bool parseColorOrCurrentColor(RGBA32& parsedColor, const String& colorString, HTMLCanvasElement* canvas)
 {
-    ColorParseResult parseResult = parseColor(parsedColor, colorString);
+    ColorParseResult parseResult = parseColor(parsedColor, colorString, canvas ? canvas->document() : 0);
     switch (parseResult) {
     case ParsedRGBA:
+    case ParsedSystemColor:
         return true;
     case ParsedCurrentColor:
         parsedColor = currentColor(canvas);
@@ -131,12 +134,13 @@ CanvasStyle::CanvasStyle(PassRefPtr<CanvasPattern> pattern)
 {
 }
 
-PassRefPtr<CanvasStyle> CanvasStyle::createFromString(const String& color)
+PassRefPtr<CanvasStyle> CanvasStyle::createFromString(const String& color, Document* document)
 {
     RGBA32 rgba;
-    ColorParseResult parseResult = parseColor(rgba, color);
+    ColorParseResult parseResult = parseColor(rgba, color, document);
     switch (parseResult) {
     case ParsedRGBA:
+    case ParsedSystemColor:
         return adoptRef(new CanvasStyle(rgba));
     case ParsedCurrentColor:
         return adoptRef(new CanvasStyle(CurrentColor));
diff --git a/Source/WebCore/html/canvas/CanvasStyle.h b/Source/WebCore/html/canvas/CanvasStyle.h
index 91dc923..1c136d3 100644
--- a/Source/WebCore/html/canvas/CanvasStyle.h
+++ b/Source/WebCore/html/canvas/CanvasStyle.h
@@ -35,13 +35,14 @@ namespace WebCore {
 
     class CanvasGradient;
     class CanvasPattern;
+    class Document;
     class GraphicsContext;
     class HTMLCanvasElement;
 
     class CanvasStyle : public RefCounted<CanvasStyle> {
     public:
         static PassRefPtr<CanvasStyle> createFromRGBA(RGBA32 rgba) { return adoptRef(new CanvasStyle(rgba)); }
-        static PassRefPtr<CanvasStyle> createFromString(const String& color);
+        static PassRefPtr<CanvasStyle> createFromString(const String& color, Document* = 0);
         static PassRefPtr<CanvasStyle> createFromStringWithOverrideAlpha(const String& color, float alpha);
         static PassRefPtr<CanvasStyle> createFromGrayLevelWithAlpha(float grayLevel, float alpha) { return adoptRef(new CanvasStyle(grayLevel, alpha)); }
         static PassRefPtr<CanvasStyle> createFromRGBAChannels(float r, float g, float b, float a) { return adoptRef(new CanvasStyle(r, g, b, a)); }
diff --git a/Source/WebCore/html/canvas/DataView.cpp b/Source/WebCore/html/canvas/DataView.cpp
index 82b10b3..e00443d 100755
--- a/Source/WebCore/html/canvas/DataView.cpp
+++ b/Source/WebCore/html/canvas/DataView.cpp
@@ -24,9 +24,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "DataView.h"
 
 #include "CheckedInt.h"
@@ -231,5 +228,3 @@ void DataView::setFloat64(unsigned byteOffset, double value, bool littleEndian,
 }
 
 }
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/html/canvas/DataView.h b/Source/WebCore/html/canvas/DataView.h
index 5707aa3..a8aba5c 100755
--- a/Source/WebCore/html/canvas/DataView.h
+++ b/Source/WebCore/html/canvas/DataView.h
@@ -75,7 +75,7 @@ private:
     DataView(PassRefPtr<ArrayBuffer>, unsigned byteOffset, unsigned byteLength);
 
     template<typename T>
-    inline bool beyondRange(unsigned byteOffset) const { return byteOffset + sizeof(T) > m_byteLength; }
+    inline bool beyondRange(unsigned byteOffset) const { return byteOffset >= m_byteLength || byteOffset + sizeof(T) > m_byteLength; }
 
     template<typename T>
     T getData(unsigned byteOffset, bool littleEndian, ExceptionCode&) const;
diff --git a/Source/WebCore/html/canvas/DataView.idl b/Source/WebCore/html/canvas/DataView.idl
index f99a814..2e173d7 100755
--- a/Source/WebCore/html/canvas/DataView.idl
+++ b/Source/WebCore/html/canvas/DataView.idl
@@ -26,7 +26,6 @@
 module html {
 
     interface [
-        Conditional=3D_CANVAS|BLOB,
         CanBeConstructed,
         CustomConstructFunction,
         CustomToJS,
diff --git a/Source/WebCore/html/canvas/Float32Array.cpp b/Source/WebCore/html/canvas/Float32Array.cpp
index 1b26aef..209b20f 100644
--- a/Source/WebCore/html/canvas/Float32Array.cpp
+++ b/Source/WebCore/html/canvas/Float32Array.cpp
@@ -25,9 +25,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "Float32Array.h"
 
 namespace WebCore {
@@ -52,16 +49,14 @@ Float32Array::Float32Array(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset,
 {
 }
 
-PassRefPtr<Float32Array> Float32Array::slice(int start) const
+PassRefPtr<Float32Array> Float32Array::subarray(int start) const
 {
-    return slice(start, length());
+    return subarray(start, length());
 }
 
-PassRefPtr<Float32Array> Float32Array::slice(int start, int end) const
+PassRefPtr<Float32Array> Float32Array::subarray(int start, int end) const
 {
-    return sliceImpl<Float32Array>(start, end);
+    return subarrayImpl<Float32Array>(start, end);
 }
 
 }
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/html/canvas/Float32Array.h b/Source/WebCore/html/canvas/Float32Array.h
index d00a7c5..ee1ea56 100644
--- a/Source/WebCore/html/canvas/Float32Array.h
+++ b/Source/WebCore/html/canvas/Float32Array.h
@@ -56,8 +56,8 @@ public:
         return result;
     }
 
-    PassRefPtr<Float32Array> slice(int start) const;
-    PassRefPtr<Float32Array> slice(int start, int end) const;
+    PassRefPtr<Float32Array> subarray(int start) const;
+    PassRefPtr<Float32Array> subarray(int start, int end) const;
 
 private:
     Float32Array(PassRefPtr<ArrayBuffer> buffer,
diff --git a/Source/WebCore/html/canvas/Float32Array.idl b/Source/WebCore/html/canvas/Float32Array.idl
index b979d29..c797f31 100644
--- a/Source/WebCore/html/canvas/Float32Array.idl
+++ b/Source/WebCore/html/canvas/Float32Array.idl
@@ -26,7 +26,6 @@
 
 module html {
     interface [
-        Conditional=3D_CANVAS|BLOB,
         CanBeConstructed,
         CustomConstructFunction,
         V8CustomConstructor,
@@ -40,7 +39,7 @@ module html {
         const unsigned int BYTES_PER_ELEMENT = 4;
 
         readonly attribute unsigned long length;
-        Float32Array slice(in long start, in [Optional] long end);
+        Float32Array subarray(in long start, in [Optional] long end);
 
         // void set(in Float32Array array, [Optional] in unsigned long offset);
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/Int16Array.cpp b/Source/WebCore/html/canvas/Int16Array.cpp
index a3d04bc..9aaa1d5 100644
--- a/Source/WebCore/html/canvas/Int16Array.cpp
+++ b/Source/WebCore/html/canvas/Int16Array.cpp
@@ -24,9 +24,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "Int16Array.h"
 
 namespace WebCore {
@@ -51,16 +48,14 @@ Int16Array::Int16Array(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, unsi
 {
 }
 
-PassRefPtr<Int16Array> Int16Array::slice(int start) const
+PassRefPtr<Int16Array> Int16Array::subarray(int start) const
 {
-    return slice(start, length());
+    return subarray(start, length());
 }
 
-PassRefPtr<Int16Array> Int16Array::slice(int start, int end) const
+PassRefPtr<Int16Array> Int16Array::subarray(int start, int end) const
 {
-    return sliceImpl<Int16Array>(start, end);
+    return subarrayImpl<Int16Array>(start, end);
 }
 
 }
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/html/canvas/Int16Array.h b/Source/WebCore/html/canvas/Int16Array.h
index a6286c6..6c4f54b 100644
--- a/Source/WebCore/html/canvas/Int16Array.h
+++ b/Source/WebCore/html/canvas/Int16Array.h
@@ -41,8 +41,8 @@ public:
     using TypedArrayBase<short>::set;
     using IntegralTypedArrayBase<short>::set;
 
-    PassRefPtr<Int16Array> slice(int start) const;
-    PassRefPtr<Int16Array> slice(int start, int end) const;
+    PassRefPtr<Int16Array> subarray(int start) const;
+    PassRefPtr<Int16Array> subarray(int start, int end) const;
 
 private:
     Int16Array(PassRefPtr<ArrayBuffer> buffer,
diff --git a/Source/WebCore/html/canvas/Int16Array.idl b/Source/WebCore/html/canvas/Int16Array.idl
index f1f5c8b..40123d7 100644
--- a/Source/WebCore/html/canvas/Int16Array.idl
+++ b/Source/WebCore/html/canvas/Int16Array.idl
@@ -25,7 +25,6 @@
 
 module html {
     interface [
-        Conditional=3D_CANVAS|BLOB,
         CanBeConstructed,
         CustomConstructFunction,
         V8CustomConstructor,
@@ -39,7 +38,7 @@ module html {
         const unsigned int BYTES_PER_ELEMENT = 2;
 
         readonly attribute unsigned long length;
-        Int16Array slice(in long start, in [Optional] long end);
+        Int16Array subarray(in long start, in [Optional] long end);
 
         // void set(in Int16Array array, [Optional] in unsigned long offset);
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/Int32Array.cpp b/Source/WebCore/html/canvas/Int32Array.cpp
index 266c941..6d2793c 100644
--- a/Source/WebCore/html/canvas/Int32Array.cpp
+++ b/Source/WebCore/html/canvas/Int32Array.cpp
@@ -25,9 +25,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "Int32Array.h"
 
 namespace WebCore {
@@ -52,16 +49,14 @@ Int32Array::Int32Array(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, unsi
 {
 }
 
-PassRefPtr<Int32Array> Int32Array::slice(int start) const
+PassRefPtr<Int32Array> Int32Array::subarray(int start) const
 {
-    return slice(start, length());
+    return subarray(start, length());
 }
 
-PassRefPtr<Int32Array> Int32Array::slice(int start, int end) const
+PassRefPtr<Int32Array> Int32Array::subarray(int start, int end) const
 {
-    return sliceImpl<Int32Array>(start, end);
+    return subarrayImpl<Int32Array>(start, end);
 }
 
 }
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/html/canvas/Int32Array.h b/Source/WebCore/html/canvas/Int32Array.h
index 068a677..c657300 100644
--- a/Source/WebCore/html/canvas/Int32Array.h
+++ b/Source/WebCore/html/canvas/Int32Array.h
@@ -37,13 +37,12 @@ public:
     static PassRefPtr<Int32Array> create(int* array, unsigned length);
     static PassRefPtr<Int32Array> create(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, unsigned length);
 
-#if !COMPILER(RVCT)
-    using TypedArrayBase<int>::set;
-    using IntegralTypedArrayBase<int>::set;
-#endif
+    // Can’t use "using" here due to a bug in the RVCT compiler.
+    void set(TypedArrayBase<int>* array, unsigned offset, ExceptionCode& ec) { return TypedArrayBase<int>::set(array, offset, ec); }
+    void set(unsigned index, double value) { return IntegralTypedArrayBase<int>::set(index, value); }
 
-    PassRefPtr<Int32Array> slice(int start) const;
-    PassRefPtr<Int32Array> slice(int start, int end) const;
+    PassRefPtr<Int32Array> subarray(int start) const;
+    PassRefPtr<Int32Array> subarray(int start, int end) const;
 
 private:
     Int32Array(PassRefPtr<ArrayBuffer> buffer,
diff --git a/Source/WebCore/html/canvas/Int32Array.idl b/Source/WebCore/html/canvas/Int32Array.idl
index f96b53c..dd9082a 100644
--- a/Source/WebCore/html/canvas/Int32Array.idl
+++ b/Source/WebCore/html/canvas/Int32Array.idl
@@ -26,7 +26,6 @@
 
 module html {
     interface [
-        Conditional=3D_CANVAS|BLOB,
         CanBeConstructed,
         CustomConstructFunction,
         V8CustomConstructor,
@@ -40,7 +39,7 @@ module html {
         const unsigned int BYTES_PER_ELEMENT = 4;
 
         readonly attribute unsigned long length;
-        Int32Array slice(in long start, in [Optional] long end);
+        Int32Array subarray(in long start, in [Optional] long end);
 
         // void set(in Int32Array array, [Optional] in unsigned long offset);
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/Int8Array.cpp b/Source/WebCore/html/canvas/Int8Array.cpp
index 89ed316..ceb7579 100644
--- a/Source/WebCore/html/canvas/Int8Array.cpp
+++ b/Source/WebCore/html/canvas/Int8Array.cpp
@@ -25,9 +25,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "Int8Array.h"
 
 namespace WebCore {
@@ -52,16 +49,14 @@ Int8Array::Int8Array(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, unsign
 {
 }
 
-PassRefPtr<Int8Array> Int8Array::slice(int start) const
+PassRefPtr<Int8Array> Int8Array::subarray(int start) const
 {
-    return slice(start, length());
+    return subarray(start, length());
 }
 
-PassRefPtr<Int8Array> Int8Array::slice(int start, int end) const
+PassRefPtr<Int8Array> Int8Array::subarray(int start, int end) const
 {
-    return sliceImpl<Int8Array>(start, end);
+    return subarrayImpl<Int8Array>(start, end);
 }
 
 }
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/html/canvas/Int8Array.h b/Source/WebCore/html/canvas/Int8Array.h
index a5df302..aabdb97 100644
--- a/Source/WebCore/html/canvas/Int8Array.h
+++ b/Source/WebCore/html/canvas/Int8Array.h
@@ -39,11 +39,12 @@ public:
     static PassRefPtr<Int8Array> create(signed char* array, unsigned length);
     static PassRefPtr<Int8Array> create(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, unsigned length);
 
-    using TypedArrayBase<signed char>::set;
-    using IntegralTypedArrayBase<signed char>::set;
+    // Can’t use "using" here due to a bug in the RVCT compiler.
+    void set(TypedArrayBase<signed char>* array, unsigned offset, ExceptionCode& ec) { return TypedArrayBase<signed char>::set(array, offset, ec); }
+    void set(unsigned index, double value) { return IntegralTypedArrayBase<signed char>::set(index, value); }
 
-    PassRefPtr<Int8Array> slice(int start) const;
-    PassRefPtr<Int8Array> slice(int start, int end) const;
+    PassRefPtr<Int8Array> subarray(int start) const;
+    PassRefPtr<Int8Array> subarray(int start, int end) const;
 
 private:
     Int8Array(PassRefPtr<ArrayBuffer> buffer,
diff --git a/Source/WebCore/html/canvas/Int8Array.idl b/Source/WebCore/html/canvas/Int8Array.idl
index 08a608b..ab000f2 100644
--- a/Source/WebCore/html/canvas/Int8Array.idl
+++ b/Source/WebCore/html/canvas/Int8Array.idl
@@ -26,7 +26,6 @@
 
 module html {
     interface [
-        Conditional=3D_CANVAS|BLOB,
         CanBeConstructed,
         CustomConstructFunction,
         V8CustomConstructor,
@@ -40,7 +39,7 @@ module html {
         const unsigned int BYTES_PER_ELEMENT = 1;
 
         readonly attribute unsigned long length;
-        Int8Array slice(in long start, in [Optional] long end);
+        Int8Array subarray(in long start, in [Optional] long end);
 
         // void set(in Int8Array array, [Optional] in unsigned long offset);
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/OESStandardDerivatives.cpp b/Source/WebCore/html/canvas/OESStandardDerivatives.cpp
index 25aae2f..5bd3163 100644
--- a/Source/WebCore/html/canvas/OESStandardDerivatives.cpp
+++ b/Source/WebCore/html/canvas/OESStandardDerivatives.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "OESStandardDerivatives.h"
 
@@ -51,4 +51,4 @@ PassRefPtr<OESStandardDerivatives> OESStandardDerivatives::create()
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/html/canvas/OESStandardDerivatives.idl b/Source/WebCore/html/canvas/OESStandardDerivatives.idl
index a9d1dd6..6c0f788 100644
--- a/Source/WebCore/html/canvas/OESStandardDerivatives.idl
+++ b/Source/WebCore/html/canvas/OESStandardDerivatives.idl
@@ -24,7 +24,7 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS, OmitConstructor, DontCheckEnums] OESStandardDerivatives {
+    interface [Conditional=WEBGL, OmitConstructor, DontCheckEnums] OESStandardDerivatives {
         const unsigned int FRAGMENT_SHADER_DERIVATIVE_HINT_OES = 0x8B8B;
     };
 }
diff --git a/Source/WebCore/html/canvas/OESTextureFloat.cpp b/Source/WebCore/html/canvas/OESTextureFloat.cpp
index dab3caf..9518764 100644
--- a/Source/WebCore/html/canvas/OESTextureFloat.cpp
+++ b/Source/WebCore/html/canvas/OESTextureFloat.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "OESTextureFloat.h"
 
@@ -51,4 +51,4 @@ PassRefPtr<OESTextureFloat> OESTextureFloat::create()
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/html/canvas/OESTextureFloat.idl b/Source/WebCore/html/canvas/OESTextureFloat.idl
index e255875..3319fd9 100644
--- a/Source/WebCore/html/canvas/OESTextureFloat.idl
+++ b/Source/WebCore/html/canvas/OESTextureFloat.idl
@@ -24,6 +24,6 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS, OmitConstructor] OESTextureFloat {
+    interface [Conditional=WEBGL, OmitConstructor] OESTextureFloat {
     };
 }
diff --git a/Source/WebCore/html/canvas/TypedArrayBase.h b/Source/WebCore/html/canvas/TypedArrayBase.h
index a828620..e2a7c63 100644
--- a/Source/WebCore/html/canvas/TypedArrayBase.h
+++ b/Source/WebCore/html/canvas/TypedArrayBase.h
@@ -104,7 +104,7 @@ protected:
     }
 
     template <class Subclass>
-    PassRefPtr<Subclass> sliceImpl(int start, int end) const
+    PassRefPtr<Subclass> subarrayImpl(int start, int end) const
     {
         unsigned offset, length;
         calculateOffsetAndLength(start, end, m_length, &offset, &length);
diff --git a/Source/WebCore/html/canvas/Uint16Array.cpp b/Source/WebCore/html/canvas/Uint16Array.cpp
index 5312888..92b2361 100644
--- a/Source/WebCore/html/canvas/Uint16Array.cpp
+++ b/Source/WebCore/html/canvas/Uint16Array.cpp
@@ -25,9 +25,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "Uint16Array.h"
 
 namespace WebCore {
@@ -52,16 +49,14 @@ Uint16Array::Uint16Array(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, un
 {
 }
 
-PassRefPtr<Uint16Array> Uint16Array::slice(int start) const
+PassRefPtr<Uint16Array> Uint16Array::subarray(int start) const
 {
-    return slice(start, length());
+    return subarray(start, length());
 }
 
-PassRefPtr<Uint16Array> Uint16Array::slice(int start, int end) const
+PassRefPtr<Uint16Array> Uint16Array::subarray(int start, int end) const
 {
-    return sliceImpl<Uint16Array>(start, end);
+    return subarrayImpl<Uint16Array>(start, end);
 }
 
 }
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/html/canvas/Uint16Array.h b/Source/WebCore/html/canvas/Uint16Array.h
index f63b67d..8ef04a4 100644
--- a/Source/WebCore/html/canvas/Uint16Array.h
+++ b/Source/WebCore/html/canvas/Uint16Array.h
@@ -39,11 +39,12 @@ public:
     static PassRefPtr<Uint16Array> create(unsigned short* array, unsigned length);
     static PassRefPtr<Uint16Array> create(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, unsigned length);
 
-    using TypedArrayBase<unsigned short>::set;
-    using IntegralTypedArrayBase<unsigned short>::set;
+    // Can’t use "using" here due to a bug in the RVCT compiler.
+    void set(TypedArrayBase<unsigned short>* array, unsigned offset, ExceptionCode& ec) { return TypedArrayBase<unsigned short>::set(array, offset, ec); }
+    void set(unsigned index, double value) { return IntegralTypedArrayBase<unsigned short>::set(index, value); }
 
-    PassRefPtr<Uint16Array> slice(int start) const;
-    PassRefPtr<Uint16Array> slice(int start, int end) const;
+    PassRefPtr<Uint16Array> subarray(int start) const;
+    PassRefPtr<Uint16Array> subarray(int start, int end) const;
 
 private:
     Uint16Array(PassRefPtr<ArrayBuffer> buffer,
diff --git a/Source/WebCore/html/canvas/Uint16Array.idl b/Source/WebCore/html/canvas/Uint16Array.idl
index 8e778b4..fc8775d 100644
--- a/Source/WebCore/html/canvas/Uint16Array.idl
+++ b/Source/WebCore/html/canvas/Uint16Array.idl
@@ -26,7 +26,6 @@
 
 module html {
     interface [
-        Conditional=3D_CANVAS|BLOB,
         CanBeConstructed,
         CustomConstructFunction,
         V8CustomConstructor,
@@ -40,7 +39,7 @@ module html {
         const unsigned int BYTES_PER_ELEMENT = 2;
 
         readonly attribute unsigned long length;
-        Uint16Array slice(in long start, in [Optional] long end);
+        Uint16Array subarray(in long start, in [Optional] long end);
 
         // void set(in Uint16Array array, [Optional] in unsigned long offset);
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/Uint32Array.cpp b/Source/WebCore/html/canvas/Uint32Array.cpp
index f5bd959..621b53c 100644
--- a/Source/WebCore/html/canvas/Uint32Array.cpp
+++ b/Source/WebCore/html/canvas/Uint32Array.cpp
@@ -25,9 +25,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "Uint32Array.h"
 
 namespace WebCore {
@@ -52,16 +49,14 @@ Uint32Array::Uint32Array(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, un
 {
 }
 
-PassRefPtr<Uint32Array> Uint32Array::slice(int start) const
+PassRefPtr<Uint32Array> Uint32Array::subarray(int start) const
 {
-    return slice(start, length());
+    return subarray(start, length());
 }
 
-PassRefPtr<Uint32Array> Uint32Array::slice(int start, int end) const
+PassRefPtr<Uint32Array> Uint32Array::subarray(int start, int end) const
 {
-    return sliceImpl<Uint32Array>(start, end);
+    return subarrayImpl<Uint32Array>(start, end);
 }
 
 }
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/html/canvas/Uint32Array.h b/Source/WebCore/html/canvas/Uint32Array.h
index 9c0f137..196a67f 100644
--- a/Source/WebCore/html/canvas/Uint32Array.h
+++ b/Source/WebCore/html/canvas/Uint32Array.h
@@ -39,11 +39,12 @@ public:
     static PassRefPtr<Uint32Array> create(unsigned int* array, unsigned length);
     static PassRefPtr<Uint32Array> create(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, unsigned length);
 
-    using TypedArrayBase<unsigned int>::set;
-    using IntegralTypedArrayBase<unsigned int>::set;
+    // Can’t use "using" here due to a bug in the RVCT compiler.
+    void set(TypedArrayBase<unsigned int>* array, unsigned offset, ExceptionCode& ec) { return TypedArrayBase<unsigned int>::set(array, offset, ec); }
+    void set(unsigned index, double value) { return IntegralTypedArrayBase<unsigned int>::set(index, value); }
 
-    PassRefPtr<Uint32Array> slice(int start) const;
-    PassRefPtr<Uint32Array> slice(int start, int end) const;
+    PassRefPtr<Uint32Array> subarray(int start) const;
+    PassRefPtr<Uint32Array> subarray(int start, int end) const;
 
 private:
     Uint32Array(PassRefPtr<ArrayBuffer> buffer,
diff --git a/Source/WebCore/html/canvas/Uint32Array.idl b/Source/WebCore/html/canvas/Uint32Array.idl
index 9fbf30c..4d95eab 100644
--- a/Source/WebCore/html/canvas/Uint32Array.idl
+++ b/Source/WebCore/html/canvas/Uint32Array.idl
@@ -26,7 +26,6 @@
 
 module html {
     interface [
-        Conditional=3D_CANVAS|BLOB,
         CanBeConstructed,
         CustomConstructFunction,
         V8CustomConstructor,
@@ -40,7 +39,7 @@ module html {
         const unsigned int BYTES_PER_ELEMENT = 4;
 
         readonly attribute unsigned long length;
-        Uint32Array slice(in long start, in [Optional] long end);
+        Uint32Array subarray(in long start, in [Optional] long end);
 
         // void set(in Uint32Array array, [Optional] in unsigned long offset);
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/Uint8Array.cpp b/Source/WebCore/html/canvas/Uint8Array.cpp
index 99b8a09..572e7ec 100644
--- a/Source/WebCore/html/canvas/Uint8Array.cpp
+++ b/Source/WebCore/html/canvas/Uint8Array.cpp
@@ -25,9 +25,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "Uint8Array.h"
 
 namespace WebCore {
@@ -52,16 +49,14 @@ Uint8Array::Uint8Array(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, unsi
 {
 }
 
-PassRefPtr<Uint8Array> Uint8Array::slice(int start) const
+PassRefPtr<Uint8Array> Uint8Array::subarray(int start) const
 {
-    return slice(start, length());
+    return subarray(start, length());
 }
 
-PassRefPtr<Uint8Array> Uint8Array::slice(int start, int end) const
+PassRefPtr<Uint8Array> Uint8Array::subarray(int start, int end) const
 {
-    return sliceImpl<Uint8Array>(start, end);
+    return subarrayImpl<Uint8Array>(start, end);
 }
 
 }
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/html/canvas/Uint8Array.h b/Source/WebCore/html/canvas/Uint8Array.h
index 66154b5..a3a42dc 100644
--- a/Source/WebCore/html/canvas/Uint8Array.h
+++ b/Source/WebCore/html/canvas/Uint8Array.h
@@ -39,13 +39,12 @@ public:
     static PassRefPtr<Uint8Array> create(unsigned char* array, unsigned length);
     static PassRefPtr<Uint8Array> create(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, unsigned length);
 
-#if !COMPILER(RVCT)
-    using TypedArrayBase<unsigned char>::set;
-    using IntegralTypedArrayBase<unsigned char>::set;
-#endif
+    // Can’t use "using" here due to a bug in the RVCT compiler.
+    void set(TypedArrayBase<unsigned char>* array, unsigned offset, ExceptionCode& ec) { return TypedArrayBase<unsigned char>::set(array, offset, ec); }
+    void set(unsigned index, double value) { return IntegralTypedArrayBase<unsigned char>::set(index, value); }
 
-    PassRefPtr<Uint8Array> slice(int start) const;
-    PassRefPtr<Uint8Array> slice(int start, int end) const;
+    PassRefPtr<Uint8Array> subarray(int start) const;
+    PassRefPtr<Uint8Array> subarray(int start, int end) const;
 
 private:
     Uint8Array(PassRefPtr<ArrayBuffer> buffer,
diff --git a/Source/WebCore/html/canvas/Uint8Array.idl b/Source/WebCore/html/canvas/Uint8Array.idl
index 7fe7e21..1bdd299 100644
--- a/Source/WebCore/html/canvas/Uint8Array.idl
+++ b/Source/WebCore/html/canvas/Uint8Array.idl
@@ -26,7 +26,6 @@
 
 module html {
     interface [
-        Conditional=3D_CANVAS|BLOB,
         CanBeConstructed,
         CustomConstructFunction,
         V8CustomConstructor,
@@ -40,7 +39,7 @@ module html {
         const unsigned int BYTES_PER_ELEMENT = 1;
 
         readonly attribute unsigned long length;
-        Uint8Array slice(in long start, in [Optional] long end);
+        Uint8Array subarray(in long start, in [Optional] long end);
 
         // void set(in Uint8Array array, [Optional] in unsigned long offset);
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/WebGLActiveInfo.idl b/Source/WebCore/html/canvas/WebGLActiveInfo.idl
index 28f7136..d544970 100644
--- a/Source/WebCore/html/canvas/WebGLActiveInfo.idl
+++ b/Source/WebCore/html/canvas/WebGLActiveInfo.idl
@@ -26,7 +26,7 @@
 module html {
 
     interface [
-        Conditional=3D_CANVAS
+        Conditional=WEBGL
     ] WebGLActiveInfo {
         readonly attribute int size;
         readonly attribute unsigned int type;
diff --git a/Source/WebCore/html/canvas/WebGLBuffer.cpp b/Source/WebCore/html/canvas/WebGLBuffer.cpp
index 849472b..ee0ebe6 100644
--- a/Source/WebCore/html/canvas/WebGLBuffer.cpp
+++ b/Source/WebCore/html/canvas/WebGLBuffer.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "WebGLBuffer.h"
 
@@ -34,7 +34,7 @@
 #include "WebGLRenderingContext.h"
 
 namespace WebCore {
-    
+
 PassRefPtr<WebGLBuffer> WebGLBuffer::create(WebGLRenderingContext* ctx)
 {
     return adoptRef(new WebGLBuffer(ctx));
@@ -207,4 +207,4 @@ void WebGLBuffer::clearCachedMaxIndices()
 
 }
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/html/canvas/WebGLBuffer.h b/Source/WebCore/html/canvas/WebGLBuffer.h
index ec79a2d..6153cf1 100644
--- a/Source/WebCore/html/canvas/WebGLBuffer.h
+++ b/Source/WebCore/html/canvas/WebGLBuffer.h
@@ -42,10 +42,10 @@ public:
     static PassRefPtr<WebGLBuffer> create(WebGLRenderingContext*);
 
     bool associateBufferData(GC3Dsizeiptr size);
-    bool associateBufferData(ArrayBuffer* array);
-    bool associateBufferData(ArrayBufferView* array);
-    bool associateBufferSubData(GC3Dintptr offset, ArrayBuffer* array);
-    bool associateBufferSubData(GC3Dintptr offset, ArrayBufferView* array);
+    bool associateBufferData(ArrayBuffer*);
+    bool associateBufferData(ArrayBufferView*);
+    bool associateBufferSubData(GC3Dintptr offset, ArrayBuffer*);
+    bool associateBufferSubData(GC3Dintptr offset, ArrayBufferView*);
 
     GC3Dsizeiptr byteLength() const;
     const ArrayBuffer* elementArrayBuffer() const { return m_elementArrayBuffer.get(); }
diff --git a/Source/WebCore/html/canvas/WebGLBuffer.idl b/Source/WebCore/html/canvas/WebGLBuffer.idl
index 30b7606..2b6daec 100644
--- a/Source/WebCore/html/canvas/WebGLBuffer.idl
+++ b/Source/WebCore/html/canvas/WebGLBuffer.idl
@@ -24,6 +24,6 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] WebGLBuffer {
+    interface [Conditional=WEBGL] WebGLBuffer {
     };
 }
diff --git a/Source/WebCore/html/canvas/WebGLContextAttributes.cpp b/Source/WebCore/html/canvas/WebGLContextAttributes.cpp
index a0725ca..6a47ea9 100644
--- a/Source/WebCore/html/canvas/WebGLContextAttributes.cpp
+++ b/Source/WebCore/html/canvas/WebGLContextAttributes.cpp
@@ -26,7 +26,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "WebGLContextAttributes.h"
 
@@ -114,4 +114,4 @@ GraphicsContext3D::Attributes WebGLContextAttributes::attributes() const
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/html/canvas/WebGLContextAttributes.idl b/Source/WebCore/html/canvas/WebGLContextAttributes.idl
index be2b20c..0fa0c2c 100644
--- a/Source/WebCore/html/canvas/WebGLContextAttributes.idl
+++ b/Source/WebCore/html/canvas/WebGLContextAttributes.idl
@@ -26,7 +26,7 @@
 
 module html {
     interface [
-        Conditional=3D_CANVAS,
+        Conditional=WEBGL,
         OmitConstructor
     ] WebGLContextAttributes {
         attribute boolean alpha;
diff --git a/Source/WebCore/html/canvas/WebGLContextEvent.idl b/Source/WebCore/html/canvas/WebGLContextEvent.idl
index 30973a9..9ee4769 100644
--- a/Source/WebCore/html/canvas/WebGLContextEvent.idl
+++ b/Source/WebCore/html/canvas/WebGLContextEvent.idl
@@ -25,7 +25,7 @@
 
 module html {
     interface [
-        Conditional=3D_CANVAS,
+        Conditional=WEBGL,
     ] WebGLContextEvent : Event {
         readonly attribute DOMString statusMessage;
         [StrictTypeChecking] void initEvent(in DOMString eventTypeArg,
diff --git a/Source/WebCore/html/canvas/WebGLExtension.cpp b/Source/WebCore/html/canvas/WebGLExtension.cpp
index 580e635..64b0bf5 100644
--- a/Source/WebCore/html/canvas/WebGLExtension.cpp
+++ b/Source/WebCore/html/canvas/WebGLExtension.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "WebGLExtension.h"
 
@@ -41,4 +41,4 @@ WebGLExtension::~WebGLExtension()
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/html/canvas/WebGLFramebuffer.cpp b/Source/WebCore/html/canvas/WebGLFramebuffer.cpp
index dbc714b..4b721eb 100644
--- a/Source/WebCore/html/canvas/WebGLFramebuffer.cpp
+++ b/Source/WebCore/html/canvas/WebGLFramebuffer.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "WebGLFramebuffer.h"
 
@@ -354,4 +354,4 @@ bool WebGLFramebuffer::initializeRenderbuffers()
 
 }
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/html/canvas/WebGLFramebuffer.idl b/Source/WebCore/html/canvas/WebGLFramebuffer.idl
index 8c1d9fd..7211d15 100644
--- a/Source/WebCore/html/canvas/WebGLFramebuffer.idl
+++ b/Source/WebCore/html/canvas/WebGLFramebuffer.idl
@@ -24,6 +24,6 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] WebGLFramebuffer {
+    interface [Conditional=WEBGL] WebGLFramebuffer {
     };
 }
diff --git a/Source/WebCore/html/canvas/WebGLGetInfo.cpp b/Source/WebCore/html/canvas/WebGLGetInfo.cpp
index 6aff82f..d0c8c65 100644
--- a/Source/WebCore/html/canvas/WebGLGetInfo.cpp
+++ b/Source/WebCore/html/canvas/WebGLGetInfo.cpp
@@ -26,7 +26,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "WebGLGetInfo.h"
 
@@ -63,9 +63,9 @@ WebGLGetInfo::WebGLGetInfo(float value)
 {
 }
 
-WebGLGetInfo::WebGLGetInfo(long value)
-    : m_type(kTypeLong)
-    , m_long(value)
+WebGLGetInfo::WebGLGetInfo(int value)
+    : m_type(kTypeInt)
+    , m_int(value)
 {
 }
 
@@ -80,9 +80,9 @@ WebGLGetInfo::WebGLGetInfo(const String& value)
 {
 }
 
-WebGLGetInfo::WebGLGetInfo(unsigned long value)
-    : m_type(kTypeUnsignedLong)
-    , m_unsignedLong(value)
+WebGLGetInfo::WebGLGetInfo(unsigned int value)
+    : m_type(kTypeUnsignedInt)
+    , m_unsignedInt(value)
 {
 }
 
@@ -161,10 +161,10 @@ float WebGLGetInfo::getFloat() const
     return m_float;
 }
 
-long WebGLGetInfo::getLong() const
+int WebGLGetInfo::getInt() const
 {
-    ASSERT(getType() == kTypeLong);
-    return m_long;
+    ASSERT(getType() == kTypeInt);
+    return m_int;
 }
 
 const String& WebGLGetInfo::getString() const
@@ -173,10 +173,10 @@ const String& WebGLGetInfo::getString() const
     return m_string;
 }
 
-unsigned long WebGLGetInfo::getUnsignedLong() const
+unsigned int WebGLGetInfo::getUnsignedInt() const
 {
-    ASSERT(getType() == kTypeUnsignedLong);
-    return m_unsignedLong;
+    ASSERT(getType() == kTypeUnsignedInt);
+    return m_unsignedInt;
 }
 
 PassRefPtr<WebGLBuffer> WebGLGetInfo::getWebGLBuffer() const
@@ -229,4 +229,4 @@ PassRefPtr<Uint8Array> WebGLGetInfo::getWebGLUnsignedByteArray() const
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/html/canvas/WebGLGetInfo.h b/Source/WebCore/html/canvas/WebGLGetInfo.h
index caee520..91f9233 100644
--- a/Source/WebCore/html/canvas/WebGLGetInfo.h
+++ b/Source/WebCore/html/canvas/WebGLGetInfo.h
@@ -53,10 +53,10 @@ public:
         kTypeBool,
         kTypeBoolArray,
         kTypeFloat,
-        kTypeLong,
+        kTypeInt,
         kTypeNull,
         kTypeString,
-        kTypeUnsignedLong,
+        kTypeUnsignedInt,
         kTypeWebGLBuffer,
         kTypeWebGLFloatArray,
         kTypeWebGLFramebuffer,
@@ -71,11 +71,11 @@ public:
     WebGLGetInfo(bool value);
     WebGLGetInfo(const bool* value, int size);
     WebGLGetInfo(float value);
-    WebGLGetInfo(long value);
+    WebGLGetInfo(int value);
     // Represents the null value and type.
     WebGLGetInfo();
     WebGLGetInfo(const String& value);
-    WebGLGetInfo(unsigned long value);
+    WebGLGetInfo(unsigned int value);
     WebGLGetInfo(PassRefPtr<WebGLBuffer> value);
     WebGLGetInfo(PassRefPtr<Float32Array> value);
     WebGLGetInfo(PassRefPtr<WebGLFramebuffer> value);
@@ -94,9 +94,9 @@ public:
     bool getBool() const;
     const Vector<bool>& getBoolArray() const;
     float getFloat() const;
-    long getLong() const;
+    int getInt() const;
     const String& getString() const;
-    unsigned long getUnsignedLong() const;
+    unsigned int getUnsignedInt() const;
     PassRefPtr<WebGLBuffer> getWebGLBuffer() const;
     PassRefPtr<Float32Array> getWebGLFloatArray() const;
     PassRefPtr<WebGLFramebuffer> getWebGLFramebuffer() const;
@@ -113,9 +113,9 @@ private:
     bool m_bool;
     Vector<bool> m_boolArray;
     float m_float;
-    long m_long;
+    int m_int;
     String m_string;
-    unsigned long m_unsignedLong;
+    unsigned int m_unsignedInt;
     RefPtr<WebGLBuffer> m_webglBuffer;
     RefPtr<Float32Array> m_webglFloatArray;
     RefPtr<WebGLFramebuffer> m_webglFramebuffer;
diff --git a/Source/WebCore/html/canvas/WebGLObject.cpp b/Source/WebCore/html/canvas/WebGLObject.cpp
index 41ad0f1..d47013e 100644
--- a/Source/WebCore/html/canvas/WebGLObject.cpp
+++ b/Source/WebCore/html/canvas/WebGLObject.cpp
@@ -25,14 +25,14 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "WebGLObject.h"
 
 #include "WebGLRenderingContext.h"
 
 namespace WebCore {
-    
+
 WebGLObject::WebGLObject(WebGLRenderingContext* context)
     : m_object(0)
     , m_context(context)
@@ -68,4 +68,4 @@ void WebGLObject::deleteObject()
 
 }
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/html/canvas/WebGLProgram.cpp b/Source/WebCore/html/canvas/WebGLProgram.cpp
index b3fa363..d3efda4 100644
--- a/Source/WebCore/html/canvas/WebGLProgram.cpp
+++ b/Source/WebCore/html/canvas/WebGLProgram.cpp
@@ -25,14 +25,14 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "WebGLProgram.h"
 
 #include "WebGLRenderingContext.h"
 
 namespace WebCore {
-    
+
 PassRefPtr<WebGLProgram> WebGLProgram::create(WebGLRenderingContext* ctx)
 {
     return adoptRef(new WebGLProgram(ctx));
@@ -103,7 +103,7 @@ bool WebGLProgram::isUsingVertexAttrib0() const
     return false;
 }
 
-WebGLShader* WebGLProgram::getAttachedShader(GraphicsContext3D::WebGLEnumType type)
+WebGLShader* WebGLProgram::getAttachedShader(GC3Denum type)
 {
     switch (type) {
     case GraphicsContext3D::VERTEX_SHADER:
@@ -157,4 +157,4 @@ bool WebGLProgram::detachShader(WebGLShader* shader)
 
 }
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/html/canvas/WebGLProgram.h b/Source/WebCore/html/canvas/WebGLProgram.h
index f2acef8..0dd3ba0 100644
--- a/Source/WebCore/html/canvas/WebGLProgram.h
+++ b/Source/WebCore/html/canvas/WebGLProgram.h
@@ -60,7 +60,7 @@ public:
     // will never be linked so many times.
     void increaseLinkCount() { ++m_linkCount; }
 
-    WebGLShader* getAttachedShader(GraphicsContext3D::WebGLEnumType);
+    WebGLShader* getAttachedShader(GC3Denum);
     bool attachShader(WebGLShader*);
     bool detachShader(WebGLShader*);
 
diff --git a/Source/WebCore/html/canvas/WebGLProgram.idl b/Source/WebCore/html/canvas/WebGLProgram.idl
index 562fa3a..480dfce 100644
--- a/Source/WebCore/html/canvas/WebGLProgram.idl
+++ b/Source/WebCore/html/canvas/WebGLProgram.idl
@@ -24,6 +24,6 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] WebGLProgram {
+    interface [Conditional=WEBGL] WebGLProgram {
     };
 }
diff --git a/Source/WebCore/html/canvas/WebGLRenderbuffer.cpp b/Source/WebCore/html/canvas/WebGLRenderbuffer.cpp
index 03a419a..93b9165 100644
--- a/Source/WebCore/html/canvas/WebGLRenderbuffer.cpp
+++ b/Source/WebCore/html/canvas/WebGLRenderbuffer.cpp
@@ -25,14 +25,14 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "WebGLRenderbuffer.h"
 
 #include "WebGLRenderingContext.h"
 
 namespace WebCore {
-    
+
 PassRefPtr<WebGLRenderbuffer> WebGLRenderbuffer::create(WebGLRenderingContext* ctx)
 {
     return adoptRef(new WebGLRenderbuffer(ctx));
@@ -57,4 +57,4 @@ void WebGLRenderbuffer::deleteObjectImpl(Platform3DObject object)
 
 }
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/html/canvas/WebGLRenderbuffer.idl b/Source/WebCore/html/canvas/WebGLRenderbuffer.idl
index 2524433..5aa7db8 100644
--- a/Source/WebCore/html/canvas/WebGLRenderbuffer.idl
+++ b/Source/WebCore/html/canvas/WebGLRenderbuffer.idl
@@ -24,6 +24,6 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] WebGLRenderbuffer {
+    interface [Conditional=WEBGL] WebGLRenderbuffer {
     };
 }
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
index a3b9699..bd155c9 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "WebGLRenderingContext.h"
 
@@ -48,6 +48,7 @@
 #include "OESTextureFloat.h"
 #include "RenderBox.h"
 #include "RenderLayer.h"
+#include "Settings.h"
 #include "Uint16Array.h"
 #include "WebGLActiveInfo.h"
 #include "WebGLBuffer.h"
@@ -341,17 +342,33 @@ void WebGLRenderingContext::WebGLRenderingContextRestoreTimer::fired()
     }
 }
 
+class WebGLRenderingContextLostCallback : public GraphicsContext3D::ContextLostCallback {
+public:
+    WebGLRenderingContextLostCallback(WebGLRenderingContext* cb) : m_contextLostCallback(cb) {}
+    virtual void onContextLost() { m_contextLostCallback->forceLostContext(); }
+    virtual ~WebGLRenderingContextLostCallback() {}
+private:
+    WebGLRenderingContext* m_contextLostCallback;
+};
+
 PassOwnPtr<WebGLRenderingContext> WebGLRenderingContext::create(HTMLCanvasElement* canvas, WebGLContextAttributes* attrs)
 {
     HostWindow* hostWindow = canvas->document()->view()->root()->hostWindow();
     GraphicsContext3D::Attributes attributes = attrs ? attrs->attributes() : GraphicsContext3D::Attributes();
+
+    if (attributes.antialias) {
+        Page* p = canvas->document()->page();
+        if (p && !p->settings()->openGLMultisamplingEnabled())
+            attributes.antialias = false;
+    }
+
     RefPtr<GraphicsContext3D> context(GraphicsContext3D::create(attributes, hostWindow));
 
     if (!context) {
         canvas->dispatchEvent(WebGLContextEvent::create(eventNames().webglcontextcreationerrorEvent, false, true, "Could not create a WebGL context."));
         return 0;
     }
-        
+
     return new WebGLRenderingContext(canvas, context, attributes);
 }
 
@@ -416,6 +433,8 @@ void WebGLRenderingContext::initializeNewContext()
 
     m_context->reshape(canvas()->width(), canvas()->height());
     m_context->viewport(0, 0, canvas()->width(), canvas()->height());
+
+    m_context->setContextLostCallback(adoptPtr(new WebGLRenderingContextLostCallback(this)));
 }
 
 void WebGLRenderingContext::setupFlags()
@@ -437,6 +456,7 @@ void WebGLRenderingContext::setupFlags()
 WebGLRenderingContext::~WebGLRenderingContext()
 {
     detachAndRemoveAllObjects();
+    m_context->setContextLostCallback(0);
 }
 
 void WebGLRenderingContext::markContextChanged()
@@ -487,7 +507,24 @@ void WebGLRenderingContext::reshape(int width, int height)
 
 unsigned int WebGLRenderingContext::sizeInBytes(GC3Denum type)
 {
-    return m_context->sizeInBytes(type);
+    switch (type) {
+    case GraphicsContext3D::BYTE:
+        return sizeof(GC3Dbyte);
+    case GraphicsContext3D::UNSIGNED_BYTE:
+        return sizeof(GC3Dubyte);
+    case GraphicsContext3D::SHORT:
+        return sizeof(GC3Dshort);
+    case GraphicsContext3D::UNSIGNED_SHORT:
+        return sizeof(GC3Dushort);
+    case GraphicsContext3D::INT:
+        return sizeof(GC3Dint);
+    case GraphicsContext3D::UNSIGNED_INT:
+        return sizeof(GC3Duint);
+    case GraphicsContext3D::FLOAT:
+        return sizeof(GC3Dfloat);
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
 }
 
 void WebGLRenderingContext::activeTexture(GC3Denum texture, ExceptionCode& ec)
@@ -529,20 +566,33 @@ void WebGLRenderingContext::bindAttribLocation(WebGLProgram* program, GC3Duint i
     cleanupAfterGraphicsCall(false);
 }
 
+bool WebGLRenderingContext::checkObjectToBeBound(WebGLObject* object, bool& deleted)
+{
+    deleted = false;
+    if (isContextLost())
+        return false;
+    if (object) {
+        if (object->context() != this) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+            return false;
+        }
+        deleted = !object->object();
+    }
+    return true;
+}
+
 void WebGLRenderingContext::bindBuffer(GC3Denum target, WebGLBuffer* buffer, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (isContextLost())
+    bool deleted;
+    if (!checkObjectToBeBound(buffer, deleted))
         return;
-    if (buffer && buffer->context() != this) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
+    if (deleted)
+        buffer = 0;
     if (buffer && buffer->getTarget() && buffer->getTarget() != target) {
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
         return;
     }
-
     if (target == GraphicsContext3D::ARRAY_BUFFER)
         m_boundArrayBuffer = buffer;
     else if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER)
@@ -558,16 +608,14 @@ void WebGLRenderingContext::bindBuffer(GC3Denum target, WebGLBuffer* buffer, Exc
     cleanupAfterGraphicsCall(false);
 }
 
-
 void WebGLRenderingContext::bindFramebuffer(GC3Denum target, WebGLFramebuffer* buffer, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (isContextLost())
-        return;
-    if (buffer && buffer->context() != this) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+    bool deleted;
+    if (!checkObjectToBeBound(buffer, deleted))
         return;
-    }
+    if (deleted)
+        buffer = 0;
     if (target != GraphicsContext3D::FRAMEBUFFER) {
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
         return;
@@ -582,12 +630,11 @@ void WebGLRenderingContext::bindFramebuffer(GC3Denum target, WebGLFramebuffer* b
 void WebGLRenderingContext::bindRenderbuffer(GC3Denum target, WebGLRenderbuffer* renderBuffer, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (isContextLost())
+    bool deleted;
+    if (!checkObjectToBeBound(renderBuffer, deleted))
         return;
-    if (renderBuffer && renderBuffer->context() != this) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
+    if (deleted)
+        renderBuffer = 0;
     if (target != GraphicsContext3D::RENDERBUFFER) {
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
         return;
@@ -599,13 +646,15 @@ void WebGLRenderingContext::bindRenderbuffer(GC3Denum target, WebGLRenderbuffer*
     cleanupAfterGraphicsCall(false);
 }
 
-
 void WebGLRenderingContext::bindTexture(GC3Denum target, WebGLTexture* texture, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (isContextLost())
+    bool deleted;
+    if (!checkObjectToBeBound(texture, deleted))
         return;
-    if (texture && texture->context() != this) {
+    if (deleted)
+        texture = 0;
+    if (texture && texture->getTarget() && texture->getTarget() != target) {
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
         return;
     }
@@ -667,7 +716,7 @@ void WebGLRenderingContext::blendFunc(GC3Denum sfactor, GC3Denum dfactor)
         return;
     m_context->blendFunc(sfactor, dfactor);
     cleanupAfterGraphicsCall(false);
-}       
+}
 
 void WebGLRenderingContext::blendFuncSeparate(GC3Denum srcRGB, GC3Denum dstRGB, GC3Denum srcAlpha, GC3Denum dstAlpha)
 {
@@ -685,6 +734,10 @@ void WebGLRenderingContext::bufferData(GC3Denum target, GC3Dsizeiptr size, GC3De
     WebGLBuffer* buffer = validateBufferDataParameters(target, usage);
     if (!buffer)
         return;
+    if (size < 0) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
     if (!isErrorGeneratedOnOutOfBoundsAccesses()) {
         if (!buffer->associateBufferData(size)) {
             m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
@@ -750,6 +803,10 @@ void WebGLRenderingContext::bufferSubData(GC3Denum target, GC3Dintptr offset, Ar
     WebGLBuffer* buffer = validateBufferDataParameters(target, GraphicsContext3D::STATIC_DRAW);
     if (!buffer)
         return;
+    if (offset < 0) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
     if (!data)
         return;
     if (!isErrorGeneratedOnOutOfBoundsAccesses()) {
@@ -771,6 +828,10 @@ void WebGLRenderingContext::bufferSubData(GC3Denum target, GC3Dintptr offset, Ar
     WebGLBuffer* buffer = validateBufferDataParameters(target, GraphicsContext3D::STATIC_DRAW);
     if (!buffer)
         return;
+    if (offset < 0) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
     if (!data)
         return;
     if (!isErrorGeneratedOnOutOfBoundsAccesses()) {
@@ -972,7 +1033,7 @@ PassRefPtr<WebGLBuffer> WebGLRenderingContext::createBuffer()
     addObject(o.get());
     return o;
 }
-        
+
 PassRefPtr<WebGLFramebuffer> WebGLRenderingContext::createFramebuffer()
 {
     if (isContextLost())
@@ -1018,7 +1079,7 @@ PassRefPtr<WebGLShader> WebGLRenderingContext::createShader(GC3Denum type, Excep
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
         return 0;
     }
-    
+
     RefPtr<WebGLShader> o = WebGLShader::create(this, type);
     addObject(o.get());
     return o;
@@ -1032,13 +1093,27 @@ void WebGLRenderingContext::cullFace(GC3Denum mode)
     cleanupAfterGraphicsCall(false);
 }
 
+bool WebGLRenderingContext::deleteObject(WebGLObject* object)
+{
+    if (isContextLost() || !object)
+        return false;
+    if (object->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return false;
+    }
+    if (object->object())
+        object->deleteObject();
+    return true;
+}
+
 void WebGLRenderingContext::deleteBuffer(WebGLBuffer* buffer)
 {
-    if (isContextLost() || !buffer)
+    if (!deleteObject(buffer))
         return;
-    
-    buffer->deleteObject();
-
+    if (m_boundArrayBuffer == buffer)
+        m_boundArrayBuffer = 0;
+    if (m_boundElementArrayBuffer == buffer)
+        m_boundElementArrayBuffer = 0;
     if (!isGLES2Compliant()) {
         VertexAttribState& state = m_vertexAttribState[0];
         if (buffer == state.bufferBinding) {
@@ -1056,54 +1131,47 @@ void WebGLRenderingContext::deleteBuffer(WebGLBuffer* buffer)
 
 void WebGLRenderingContext::deleteFramebuffer(WebGLFramebuffer* framebuffer)
 {
-    if (isContextLost() || !framebuffer)
+    if (!deleteObject(framebuffer))
         return;
     if (framebuffer == m_framebufferBinding) {
         m_framebufferBinding = 0;
         // Have to call bindFramebuffer here to bind back to internal fbo.
         m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, 0);
     }
-    framebuffer->deleteObject();
 }
 
 void WebGLRenderingContext::deleteProgram(WebGLProgram* program)
 {
-    if (isContextLost() || !program)
-        return;
-    if (program->context() != this) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-    if (!program->object())
-        return;
-    program->deleteObject();
+    deleteObject(program);
+    // We don't reset m_currentProgram to 0 here because the deletion of the
+    // current program is delayed.
 }
 
 void WebGLRenderingContext::deleteRenderbuffer(WebGLRenderbuffer* renderbuffer)
 {
-    if (isContextLost() || !renderbuffer)
+    if (!deleteObject(renderbuffer))
         return;
     if (renderbuffer == m_renderbufferBinding)
         m_renderbufferBinding = 0;
-    renderbuffer->deleteObject();
     if (m_framebufferBinding)
         m_framebufferBinding->removeAttachment(renderbuffer);
 }
 
 void WebGLRenderingContext::deleteShader(WebGLShader* shader)
 {
-    if (isContextLost() || !shader)
-        return;
-    
-    shader->deleteObject();
+    deleteObject(shader);
 }
 
 void WebGLRenderingContext::deleteTexture(WebGLTexture* texture)
 {
-    if (isContextLost() || !texture)
+    if (!deleteObject(texture))
         return;
-    
-    texture->deleteObject();
+    for (size_t i = 0; i < m_textureUnits.size(); ++i) {
+        if (texture == m_textureUnits[i].m_texture2DBinding)
+            m_textureUnits[i].m_texture2DBinding = 0;
+        if (texture == m_textureUnits[i].m_textureCubeMapBinding)
+            m_textureUnits[i].m_textureCubeMapBinding = 0;
+    }
     if (m_framebufferBinding)
         m_framebufferBinding->removeAttachment(texture);
 }
@@ -1150,7 +1218,6 @@ void WebGLRenderingContext::detachShader(WebGLProgram* program, WebGLShader* sha
     cleanupAfterGraphicsCall(false);
 }
 
-
 void WebGLRenderingContext::disable(GC3Denum cap)
 {
     if (isContextLost() || !validateCapability(cap))
@@ -1168,7 +1235,7 @@ void WebGLRenderingContext::disableVertexAttribArray(GC3Duint index, ExceptionCo
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
         return;
     }
-    
+
     if (index < m_vertexAttribState.size())
         m_vertexAttribState[index].enabled = false;
 
@@ -1291,8 +1358,8 @@ bool WebGLRenderingContext::validateIndexArrayPrecise(GC3Dsizei count, GC3Denum
                 lastIndex = *p;
             ++p;
         }
-    }    
-        
+    }
+
     // Then set the last index in the index array and make sure it is valid.
     numElementsRequired = lastIndex + 1;
     return numElementsRequired > 0;
@@ -1336,10 +1403,10 @@ bool WebGLRenderingContext::validateRenderingState(int numElementsRequired)
             }
         }
     }
-    
+
     if (smallestNumElements == INT_MAX)
         smallestNumElements = 0;
-    
+
     return numElementsRequired <= smallestNumElements;
 }
 
@@ -1435,6 +1502,11 @@ void WebGLRenderingContext::drawElements(GC3Denum mode, GC3Dsizei count, GC3Denu
     if (!count)
         return;
 
+    if (!m_boundElementArrayBuffer) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
     int numElements = 0;
     if (!isErrorGeneratedOnOutOfBoundsAccesses()) {
         // Ensure we have a valid rendering state
@@ -1495,12 +1567,12 @@ void WebGLRenderingContext::enableVertexAttribArray(GC3Duint index, ExceptionCod
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
         return;
     }
-    
+
     if (index >= m_vertexAttribState.size())
         m_vertexAttribState.resize(index + 1);
-        
+
     m_vertexAttribState[index].enabled = true;
-    
+
     m_context->enableVertexAttribArray(index);
     cleanupAfterGraphicsCall(false);
 }
@@ -1513,7 +1585,6 @@ void WebGLRenderingContext::finish()
     cleanupAfterGraphicsCall(true);
 }
 
-
 void WebGLRenderingContext::flush()
 {
     if (isContextLost())
@@ -1689,7 +1760,7 @@ bool WebGLRenderingContext::getAttachedShaders(WebGLProgram* program, Vector<Web
     GC3Dint numShaders = 0;
     m_context->getProgramiv(objectOrZero(program), GraphicsContext3D::ATTACHED_SHADERS, &numShaders);
     if (numShaders) {
-        OwnArrayPtr<Platform3DObject> shaders(new Platform3DObject[numShaders]);
+        OwnArrayPtr<Platform3DObject> shaders = adoptArrayPtr(new Platform3DObject[numShaders]);
         GC3Dsizei count = 0;
         m_context->getAttachedShaders(objectOrZero(program), numShaders, &count, shaders.get());
         if (count != numShaders)
@@ -1735,8 +1806,8 @@ WebGLGetInfo WebGLRenderingContext::getBufferParameter(GC3Denum target, GC3Denum
     GC3Dint value = 0;
     m_context->getBufferParameteriv(target, pname, &value);
     if (pname == GraphicsContext3D::BUFFER_SIZE)
-        return WebGLGetInfo(static_cast<long>(value));
-    return WebGLGetInfo(static_cast<unsigned long>(value));
+        return WebGLGetInfo(value);
+    return WebGLGetInfo(static_cast<unsigned int>(value));
 }
 
 PassRefPtr<WebGLContextAttributes> WebGLRenderingContext::getContextAttributes()
@@ -1809,8 +1880,8 @@ WebGLGetInfo WebGLRenderingContext::getFramebufferAttachmentParameter(GC3Denum t
         GC3Dint value = 0;
         m_context->getFramebufferAttachmentParameteriv(target, attachment, pname, &value);
         if (pname == GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE)
-            return WebGLGetInfo(static_cast<unsigned long>(value));
-        return WebGLGetInfo(static_cast<long>(value));
+            return WebGLGetInfo(static_cast<unsigned int>(value));
+        return WebGLGetInfo(value);
     }
 
     WebGLStateRestorer(this, false);
@@ -1839,13 +1910,13 @@ WebGLGetInfo WebGLRenderingContext::getParameter(GC3Denum pname, ExceptionCode&
     WebGLStateRestorer(this, false);
     switch (pname) {
     case GraphicsContext3D::ACTIVE_TEXTURE:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::ALIASED_LINE_WIDTH_RANGE:
         return getWebGLFloatArrayParameter(pname);
     case GraphicsContext3D::ALIASED_POINT_SIZE_RANGE:
         return getWebGLFloatArrayParameter(pname);
     case GraphicsContext3D::ALPHA_BITS:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::ARRAY_BUFFER_BINDING:
         return WebGLGetInfo(PassRefPtr<WebGLBuffer>(m_boundArrayBuffer));
     case GraphicsContext3D::BLEND:
@@ -1853,19 +1924,19 @@ WebGLGetInfo WebGLRenderingContext::getParameter(GC3Denum pname, ExceptionCode&
     case GraphicsContext3D::BLEND_COLOR:
         return getWebGLFloatArrayParameter(pname);
     case GraphicsContext3D::BLEND_DST_ALPHA:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::BLEND_DST_RGB:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::BLEND_EQUATION_ALPHA:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::BLEND_EQUATION_RGB:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::BLEND_SRC_ALPHA:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::BLEND_SRC_RGB:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::BLUE_BITS:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::COLOR_CLEAR_VALUE:
         return getWebGLFloatArrayParameter(pname);
     case GraphicsContext3D::COLOR_WRITEMASK:
@@ -1876,15 +1947,15 @@ WebGLGetInfo WebGLRenderingContext::getParameter(GC3Denum pname, ExceptionCode&
     case GraphicsContext3D::CULL_FACE:
         return getBooleanParameter(pname);
     case GraphicsContext3D::CULL_FACE_MODE:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::CURRENT_PROGRAM:
         return WebGLGetInfo(PassRefPtr<WebGLProgram>(m_currentProgram));
     case GraphicsContext3D::DEPTH_BITS:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::DEPTH_CLEAR_VALUE:
         return getFloatParameter(pname);
     case GraphicsContext3D::DEPTH_FUNC:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::DEPTH_RANGE:
         return getWebGLFloatArrayParameter(pname);
     case GraphicsContext3D::DEPTH_TEST:
@@ -1898,43 +1969,43 @@ WebGLGetInfo WebGLRenderingContext::getParameter(GC3Denum pname, ExceptionCode&
     case GraphicsContext3D::FRAMEBUFFER_BINDING:
         return WebGLGetInfo(PassRefPtr<WebGLFramebuffer>(m_framebufferBinding));
     case GraphicsContext3D::FRONT_FACE:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::GENERATE_MIPMAP_HINT:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::GREEN_BITS:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::LINE_WIDTH:
         return getFloatParameter(pname);
     case GraphicsContext3D::MAX_COMBINED_TEXTURE_IMAGE_UNITS:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::MAX_CUBE_MAP_TEXTURE_SIZE:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::MAX_FRAGMENT_UNIFORM_VECTORS:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::MAX_RENDERBUFFER_SIZE:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::MAX_TEXTURE_IMAGE_UNITS:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::MAX_TEXTURE_SIZE:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::MAX_VARYING_VECTORS:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::MAX_VERTEX_ATTRIBS:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::MAX_VERTEX_TEXTURE_IMAGE_UNITS:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::MAX_VERTEX_UNIFORM_VECTORS:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::MAX_VIEWPORT_DIMS:
         return getWebGLIntArrayParameter(pname);
     case GraphicsContext3D::NUM_COMPRESSED_TEXTURE_FORMATS:
         // WebGL 1.0 specifies that there are no compressed texture formats.
-        return WebGLGetInfo(static_cast<long>(0));
+        return WebGLGetInfo(static_cast<int>(0));
     case GraphicsContext3D::NUM_SHADER_BINARY_FORMATS:
         // FIXME: should we always return 0 for this?
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::PACK_ALIGNMENT:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::POLYGON_OFFSET_FACTOR:
         return getFloatParameter(pname);
     case GraphicsContext3D::POLYGON_OFFSET_FILL:
@@ -1942,19 +2013,19 @@ WebGLGetInfo WebGLRenderingContext::getParameter(GC3Denum pname, ExceptionCode&
     case GraphicsContext3D::POLYGON_OFFSET_UNITS:
         return getFloatParameter(pname);
     case GraphicsContext3D::RED_BITS:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::RENDERBUFFER_BINDING:
         return WebGLGetInfo(PassRefPtr<WebGLRenderbuffer>(m_renderbufferBinding));
     case GraphicsContext3D::RENDERER:
         return WebGLGetInfo(m_context->getString(GraphicsContext3D::RENDERER));
     case GraphicsContext3D::SAMPLE_BUFFERS:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::SAMPLE_COVERAGE_INVERT:
         return getBooleanParameter(pname);
     case GraphicsContext3D::SAMPLE_COVERAGE_VALUE:
         return getFloatParameter(pname);
     case GraphicsContext3D::SAMPLES:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::SCISSOR_BOX:
         return getWebGLIntArrayParameter(pname);
     case GraphicsContext3D::SCISSOR_TEST:
@@ -1962,54 +2033,53 @@ WebGLGetInfo WebGLRenderingContext::getParameter(GC3Denum pname, ExceptionCode&
     case GraphicsContext3D::SHADING_LANGUAGE_VERSION:
         return WebGLGetInfo("WebGL GLSL ES 1.0 (" + m_context->getString(GraphicsContext3D::SHADING_LANGUAGE_VERSION) + ")");
     case GraphicsContext3D::STENCIL_BACK_FAIL:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::STENCIL_BACK_FUNC:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::STENCIL_BACK_PASS_DEPTH_FAIL:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::STENCIL_BACK_PASS_DEPTH_PASS:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::STENCIL_BACK_REF:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::STENCIL_BACK_VALUE_MASK:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::STENCIL_BACK_WRITEMASK:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::STENCIL_BITS:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::STENCIL_CLEAR_VALUE:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::STENCIL_FAIL:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::STENCIL_FUNC:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::STENCIL_PASS_DEPTH_FAIL:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::STENCIL_PASS_DEPTH_PASS:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::STENCIL_REF:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::STENCIL_TEST:
         return getBooleanParameter(pname);
     case GraphicsContext3D::STENCIL_VALUE_MASK:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::STENCIL_WRITEMASK:
-        return getUnsignedLongParameter(pname);
+        return getUnsignedIntParameter(pname);
     case GraphicsContext3D::SUBPIXEL_BITS:
-        return getLongParameter(pname);
+        return getIntParameter(pname);
     case GraphicsContext3D::TEXTURE_BINDING_2D:
         return WebGLGetInfo(PassRefPtr<WebGLTexture>(m_textureUnits[m_activeTextureUnit].m_texture2DBinding));
     case GraphicsContext3D::TEXTURE_BINDING_CUBE_MAP:
         return WebGLGetInfo(PassRefPtr<WebGLTexture>(m_textureUnits[m_activeTextureUnit].m_textureCubeMapBinding));
     case GraphicsContext3D::UNPACK_ALIGNMENT:
-        // FIXME: should this be "long" in the spec?
         return getIntParameter(pname);
     case GraphicsContext3D::UNPACK_FLIP_Y_WEBGL:
         return WebGLGetInfo(m_unpackFlipY);
     case GraphicsContext3D::UNPACK_PREMULTIPLY_ALPHA_WEBGL:
         return WebGLGetInfo(m_unpackPremultiplyAlpha);
     case GraphicsContext3D::UNPACK_COLORSPACE_CONVERSION_WEBGL:
-        return WebGLGetInfo(static_cast<unsigned long>(m_unpackColorspaceConversion));
+        return WebGLGetInfo(m_unpackColorspaceConversion);
     case GraphicsContext3D::VENDOR:
         return WebGLGetInfo("Webkit (" + m_context->getString(GraphicsContext3D::VENDOR) + ")");
     case GraphicsContext3D::VERSION:
@@ -2018,7 +2088,7 @@ WebGLGetInfo WebGLRenderingContext::getParameter(GC3Denum pname, ExceptionCode&
         return getWebGLIntArrayParameter(pname);
     case Extensions3D::FRAGMENT_SHADER_DERIVATIVE_HINT_OES: // OES_standard_derivatives
         if (m_oesStandardDerivatives)
-            return getUnsignedLongParameter(Extensions3D::FRAGMENT_SHADER_DERIVATIVE_HINT_OES);
+            return getUnsignedIntParameter(Extensions3D::FRAGMENT_SHADER_DERIVATIVE_HINT_OES);
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
         return WebGLGetInfo();
     default:
@@ -2043,14 +2113,11 @@ WebGLGetInfo WebGLRenderingContext::getProgramParameter(WebGLProgram* program, G
         return WebGLGetInfo(static_cast<bool>(value));
     case GraphicsContext3D::LINK_STATUS:
         return WebGLGetInfo(program->getLinkStatus());
-    case GraphicsContext3D::INFO_LOG_LENGTH:
     case GraphicsContext3D::ATTACHED_SHADERS:
     case GraphicsContext3D::ACTIVE_ATTRIBUTES:
-    case GraphicsContext3D::ACTIVE_ATTRIBUTE_MAX_LENGTH:
     case GraphicsContext3D::ACTIVE_UNIFORMS:
-    case GraphicsContext3D::ACTIVE_UNIFORM_MAX_LENGTH:
         m_context->getProgramiv(objectOrZero(program), pname, &value);
-        return WebGLGetInfo(static_cast<long>(value));
+        return WebGLGetInfo(value);
     default:
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
         return WebGLGetInfo();
@@ -2085,13 +2152,13 @@ WebGLGetInfo WebGLRenderingContext::getRenderbufferParameter(GC3Denum target, GC
     if (m_renderbufferBinding->getInternalFormat() == GraphicsContext3D::DEPTH_STENCIL
         && !m_renderbufferBinding->isValid()) {
         ASSERT(!isDepthStencilSupported());
-        long value = 0;
+        int value = 0;
         switch (pname) {
         case GraphicsContext3D::RENDERBUFFER_WIDTH:
-            value = static_cast<long>(m_renderbufferBinding->getWidth());
+            value = m_renderbufferBinding->getWidth();
             break;
         case GraphicsContext3D::RENDERBUFFER_HEIGHT:
-            value = static_cast<long>(m_renderbufferBinding->getHeight());
+            value = m_renderbufferBinding->getHeight();
             break;
         case GraphicsContext3D::RENDERBUFFER_RED_SIZE:
         case GraphicsContext3D::RENDERBUFFER_GREEN_SIZE:
@@ -2106,7 +2173,7 @@ WebGLGetInfo WebGLRenderingContext::getRenderbufferParameter(GC3Denum target, GC
             value = 8;
             break;
         case GraphicsContext3D::RENDERBUFFER_INTERNAL_FORMAT:
-            return WebGLGetInfo(static_cast<unsigned long>(m_renderbufferBinding->getInternalFormat()));
+            return WebGLGetInfo(m_renderbufferBinding->getInternalFormat());
         default:
             m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
             return WebGLGetInfo();
@@ -2126,9 +2193,9 @@ WebGLGetInfo WebGLRenderingContext::getRenderbufferParameter(GC3Denum target, GC
     case GraphicsContext3D::RENDERBUFFER_DEPTH_SIZE:
     case GraphicsContext3D::RENDERBUFFER_STENCIL_SIZE:
         m_context->getRenderbufferParameteriv(target, pname, &value);
-        return WebGLGetInfo(static_cast<long>(value));
+        return WebGLGetInfo(value);
     case GraphicsContext3D::RENDERBUFFER_INTERNAL_FORMAT:
-        return WebGLGetInfo(static_cast<unsigned long>(m_renderbufferBinding->getInternalFormat()));
+        return WebGLGetInfo(m_renderbufferBinding->getInternalFormat());
     default:
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
         return WebGLGetInfo();
@@ -2150,11 +2217,7 @@ WebGLGetInfo WebGLRenderingContext::getShaderParameter(WebGLShader* shader, GC3D
         return WebGLGetInfo(static_cast<bool>(value));
     case GraphicsContext3D::SHADER_TYPE:
         m_context->getShaderiv(objectOrZero(shader), pname, &value);
-        return WebGLGetInfo(static_cast<unsigned long>(value));
-    case GraphicsContext3D::INFO_LOG_LENGTH:
-    case GraphicsContext3D::SHADER_SOURCE_LENGTH:
-        m_context->getShaderiv(objectOrZero(shader), pname, &value);
-        return WebGLGetInfo(static_cast<long>(value));
+        return WebGLGetInfo(static_cast<unsigned int>(value));
     default:
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
         return WebGLGetInfo();
@@ -2179,8 +2242,7 @@ String WebGLRenderingContext::getShaderSource(WebGLShader* shader, ExceptionCode
         return String();
     if (!validateWebGLObject(shader))
         return "";
-    WebGLStateRestorer(this, false);
-    return m_context->getShaderSource(objectOrZero(shader));
+    return shader->getSource();
 }
 
 Vector<String> WebGLRenderingContext::getSupportedExtensions()
@@ -2210,7 +2272,7 @@ WebGLGetInfo WebGLRenderingContext::getTexParameter(GC3Denum target, GC3Denum pn
     case GraphicsContext3D::TEXTURE_WRAP_S:
     case GraphicsContext3D::TEXTURE_WRAP_T:
         m_context->getTexParameteriv(target, pname, &value);
-        return WebGLGetInfo(static_cast<unsigned long>(value));
+        return WebGLGetInfo(static_cast<unsigned int>(value));
     default:
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
         return WebGLGetInfo();
@@ -2227,7 +2289,7 @@ WebGLGetInfo WebGLRenderingContext::getUniform(WebGLProgram* program, const WebG
         return WebGLGetInfo();
     }
     GC3Dint location = uniformLocation->location();
-    
+
     WebGLStateRestorer(this, false);
     // FIXME: make this more efficient using WebGLUniformLocation and caching types in it
     GC3Dint activeUniforms = 0;
@@ -2314,9 +2376,13 @@ WebGLGetInfo WebGLRenderingContext::getUniform(WebGLProgram* program, const WebG
                     baseType = GraphicsContext3D::FLOAT;
                     length = 16;
                     break;
+                case GraphicsContext3D::SAMPLER_2D:
+                case GraphicsContext3D::SAMPLER_CUBE:
+                    baseType = GraphicsContext3D::INT;
+                    length = 1;
+                    break;
                 default:
                     // Can't handle this type
-                    // FIXME: what to do about samplers?
                     m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
                     return WebGLGetInfo();
                 }
@@ -2332,7 +2398,7 @@ WebGLGetInfo WebGLRenderingContext::getUniform(WebGLProgram* program, const WebG
                     GC3Dint value[4] = {0};
                     m_context->getUniformiv(objectOrZero(program), location, value);
                     if (length == 1)
-                        return WebGLGetInfo(static_cast<long>(value[0]));
+                        return WebGLGetInfo(value[0]);
                     return WebGLGetInfo(Int32Array::create(value, length));
                 }
                 case GraphicsContext3D::BOOL: {
@@ -2399,16 +2465,16 @@ WebGLGetInfo WebGLRenderingContext::getVertexAttrib(GC3Duint index, GC3Denum pna
         return WebGLGetInfo(m_vertexAttribState[index].normalized);
     case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_SIZE:
         if (index >= m_vertexAttribState.size())
-            return WebGLGetInfo(static_cast<long>(4));
-        return WebGLGetInfo(static_cast<long>(m_vertexAttribState[index].size));
+            return WebGLGetInfo(static_cast<int>(4));
+        return WebGLGetInfo(m_vertexAttribState[index].size);
     case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_STRIDE:
         if (index >= m_vertexAttribState.size())
-            return WebGLGetInfo(static_cast<long>(0));
-        return WebGLGetInfo(static_cast<long>(m_vertexAttribState[index].originalStride));
+            return WebGLGetInfo(static_cast<int>(0));
+        return WebGLGetInfo(m_vertexAttribState[index].originalStride);
     case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_TYPE:
         if (index >= m_vertexAttribState.size())
-            return WebGLGetInfo(static_cast<unsigned long>(GraphicsContext3D::FLOAT));
-        return WebGLGetInfo(static_cast<unsigned long>(m_vertexAttribState[index].type));
+            return WebGLGetInfo(static_cast<unsigned int>(GraphicsContext3D::FLOAT));
+        return WebGLGetInfo(m_vertexAttribState[index].type);
     case GraphicsContext3D::CURRENT_VERTEX_ATTRIB:
         if (index >= m_vertexAttribState.size()) {
             float value[4] = { 0.0f, 0.0f, 0.0f, 1.0f };
@@ -2760,6 +2826,7 @@ void WebGLRenderingContext::shaderSource(WebGLShader* shader, const String& stri
     String stringWithoutComments = StripComments(string).result();
     if (!validateString(stringWithoutComments))
         return;
+    shader->setSource(string);
     m_context->shaderSource(objectOrZero(shader), stringWithoutComments);
     cleanupAfterGraphicsCall(false);
 }
@@ -2980,6 +3047,7 @@ void WebGLRenderingContext::texImage2D(GC3Denum target, GC3Dint level, GC3Denum
                    m_unpackFlipY, m_unpackPremultiplyAlpha, ec);
 }
 
+#if ENABLE(VIDEO)
 PassRefPtr<Image> WebGLRenderingContext::videoFrameToImage(HTMLVideoElement* video)
 {
     if (!video || !video->videoWidth() || !video->videoHeight()) {
@@ -3010,6 +3078,7 @@ void WebGLRenderingContext::texImage2D(GC3Denum target, GC3Dint level, GC3Denum
         return;
     texImage2DImpl(target, level, internalformat, format, type, image.get(), m_unpackFlipY, m_unpackPremultiplyAlpha, ec);
 }
+#endif
 
 void WebGLRenderingContext::texParameter(GC3Denum target, GC3Denum pname, GC3Dfloat paramf, GC3Dint parami, bool isFloat)
 {
@@ -3062,12 +3131,21 @@ void WebGLRenderingContext::texSubImage2DBase(GC3Denum target, GC3Dint level, GC
     ec = 0;
     if (isContextLost())
         return;
-    if (!validateTexFuncFormatAndType(format, type))
+    if (!validateTexFuncParameters(target, level, format, width, height, 0, format, type))
         return;
-    if (!validateTextureBinding(target, true))
+    if (!validateSize(xoffset, yoffset))
         return;
-    if (!validateSize(xoffset, yoffset) || !validateSize(width, height))
+    WebGLTexture* tex = validateTextureBinding(target, true);
+    if (!tex)
         return;
+    if (xoffset + width > tex->getWidth(target, level) || yoffset + height > tex->getHeight(target, level)) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    if (tex->getInternalFormat(target, level) != format || tex->getType(target, level) != type) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
     m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
     cleanupAfterGraphicsCall(false);
 }
@@ -3159,6 +3237,7 @@ void WebGLRenderingContext::texSubImage2D(GC3Denum target, GC3Dint level, GC3Din
                       m_unpackFlipY, m_unpackPremultiplyAlpha, ec);
 }
 
+#if ENABLE(VIDEO)
 void WebGLRenderingContext::texSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xoffset, GC3Dint yoffset,
                                           GC3Denum format, GC3Denum type, HTMLVideoElement* video, ExceptionCode& ec)
 {
@@ -3170,6 +3249,7 @@ void WebGLRenderingContext::texSubImage2D(GC3Denum target, GC3Dint level, GC3Din
         return;
     texSubImage2DImpl(target, level, xoffset, yoffset, format, type, image.get(), m_unpackFlipY, m_unpackPremultiplyAlpha, ec);
 }
+#endif
 
 void WebGLRenderingContext::uniform1f(const WebGLUniformLocation* location, GC3Dfloat x, ExceptionCode& ec)
 {
@@ -3508,13 +3588,12 @@ void WebGLRenderingContext::uniformMatrix4fv(const WebGLUniformLocation* locatio
 void WebGLRenderingContext::useProgram(WebGLProgram* program, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (isContextLost())
+    bool deleted;
+    if (!checkObjectToBeBound(program, deleted))
         return;
-    if (program && program->context() != this) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-    if (program && program->object() && !program->getLinkStatus()) {
+    if (deleted)
+        program = 0;
+    if (program && !program->getLinkStatus()) {
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
         cleanupAfterGraphicsCall(false);
         return;
@@ -3524,7 +3603,7 @@ void WebGLRenderingContext::useProgram(WebGLProgram* program, ExceptionCode& ec)
             m_currentProgram->onDetached();
         m_currentProgram = program;
         m_context->useProgram(objectOrZero(program));
-        if (program && program->object())
+        if (program)
             program->onAttached();
     }
     cleanupAfterGraphicsCall(false);
@@ -3732,7 +3811,7 @@ void WebGLRenderingContext::detachAndRemoveAllObjects()
     HashSet<RefPtr<WebGLObject> >::iterator pend = m_canvasObjects.end();
     for (HashSet<RefPtr<WebGLObject> >::iterator it = m_canvasObjects.begin(); it != pend; ++it)
         (*it)->detachContext();
-        
+
     m_canvasObjects.clear();
 }
 
@@ -3814,22 +3893,16 @@ WebGLGetInfo WebGLRenderingContext::getFloatParameter(GC3Denum pname)
 
 WebGLGetInfo WebGLRenderingContext::getIntParameter(GC3Denum pname)
 {
-    return getLongParameter(pname);
-}
-
-WebGLGetInfo WebGLRenderingContext::getLongParameter(GC3Denum pname)
-{
     GC3Dint value = 0;
     m_context->getIntegerv(pname, &value);
-    return WebGLGetInfo(static_cast<long>(value));
+    return WebGLGetInfo(value);
 }
 
-WebGLGetInfo WebGLRenderingContext::getUnsignedLongParameter(GC3Denum pname)
+WebGLGetInfo WebGLRenderingContext::getUnsignedIntParameter(GC3Denum pname)
 {
     GC3Dint value = 0;
     m_context->getIntegerv(pname, &value);
-    GC3Duint uValue = static_cast<GC3Duint>(value);
-    return WebGLGetInfo(static_cast<unsigned long>(uValue));
+    return WebGLGetInfo(static_cast<unsigned int>(value));
 }
 
 WebGLGetInfo WebGLRenderingContext::getWebGLFloatArrayParameter(GC3Denum pname)
@@ -4382,7 +4455,7 @@ bool WebGLRenderingContext::validateUniformMatrixParameters(const WebGLUniformLo
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
         return false;
     }
-    if (size < requiredMinSize) {
+    if (size < requiredMinSize || (size % requiredMinSize)) {
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
         return false;
     }
@@ -4518,34 +4591,49 @@ void WebGLRenderingContext::initVertexAttrib0()
     m_vertexAttrib0BufferValue[1] = 0.0f;
     m_vertexAttrib0BufferValue[2] = 0.0f;
     m_vertexAttrib0BufferValue[3] = 1.0f;
+    m_forceAttrib0BufferRefill = false;
+    m_vertexAttrib0UsedBefore = false;
 }
 
 bool WebGLRenderingContext::simulateVertexAttrib0(GC3Dsizei numVertex)
 {
     const VertexAttribState& state = m_vertexAttribState[0];
-    if (state.enabled || !m_currentProgram || !m_currentProgram->object()
-        || !m_currentProgram->isUsingVertexAttrib0())
+    if (!m_currentProgram)
         return false;
+    bool usingVertexAttrib0 = m_currentProgram->isUsingVertexAttrib0();
+    if (usingVertexAttrib0)
+        m_vertexAttrib0UsedBefore = true;
+    if (state.enabled && usingVertexAttrib0)
+        return false;
+    if (!usingVertexAttrib0 && !m_vertexAttrib0UsedBefore)
+        return false;
+    m_vertexAttrib0UsedBefore = true;
     m_context->bindBuffer(GraphicsContext3D::ARRAY_BUFFER, m_vertexAttrib0Buffer->object());
     GC3Dsizeiptr bufferDataSize = (numVertex + 1) * 4 * sizeof(GC3Dfloat);
-    if (bufferDataSize > m_vertexAttrib0BufferSize
-        || state.value[0] != m_vertexAttrib0BufferValue[0]
-        || state.value[1] != m_vertexAttrib0BufferValue[1]
-        || state.value[2] != m_vertexAttrib0BufferValue[2]
-        || state.value[3] != m_vertexAttrib0BufferValue[3]) {
-        OwnArrayPtr<GC3Dfloat> bufferData(new GC3Dfloat[(numVertex + 1) * 4]);
+    if (bufferDataSize > m_vertexAttrib0BufferSize) {
+        m_context->bufferData(GraphicsContext3D::ARRAY_BUFFER, bufferDataSize, 0, GraphicsContext3D::DYNAMIC_DRAW);
+        m_vertexAttrib0BufferSize = bufferDataSize;
+        m_forceAttrib0BufferRefill = true;
+    }
+    if (usingVertexAttrib0
+        && (m_forceAttrib0BufferRefill
+            || state.value[0] != m_vertexAttrib0BufferValue[0]
+            || state.value[1] != m_vertexAttrib0BufferValue[1]
+            || state.value[2] != m_vertexAttrib0BufferValue[2]
+            || state.value[3] != m_vertexAttrib0BufferValue[3])) {
+        OwnArrayPtr<GC3Dfloat> bufferData = adoptArrayPtr(new GC3Dfloat[(numVertex + 1) * 4]);
         for (GC3Dsizei ii = 0; ii < numVertex + 1; ++ii) {
             bufferData[ii * 4] = state.value[0];
             bufferData[ii * 4 + 1] = state.value[1];
             bufferData[ii * 4 + 2] = state.value[2];
             bufferData[ii * 4 + 3] = state.value[3];
         }
-        m_context->bufferData(GraphicsContext3D::ARRAY_BUFFER, bufferDataSize, bufferData.get(), GraphicsContext3D::DYNAMIC_DRAW);
-        m_vertexAttrib0BufferSize = bufferDataSize;
         m_vertexAttrib0BufferValue[0] = state.value[0];
         m_vertexAttrib0BufferValue[1] = state.value[1];
         m_vertexAttrib0BufferValue[2] = state.value[2];
         m_vertexAttrib0BufferValue[3] = state.value[3];
+        m_forceAttrib0BufferRefill = false;
+        m_context->bufferSubData(GraphicsContext3D::ARRAY_BUFFER, 0, bufferDataSize, bufferData.get());
     }
     m_context->vertexAttribPointer(0, 4, GraphicsContext3D::FLOAT, 0, 0, 0);
     return true;
@@ -4588,7 +4676,7 @@ WebGLExtension* WebGLRenderingContext::getExtensionNumber(int i)
 }
 
 WebGLRenderingContext::LRUImageBufferCache::LRUImageBufferCache(int capacity)
-    : m_buffers(new OwnPtr<ImageBuffer>[capacity])
+    : m_buffers(adoptArrayPtr(new OwnPtr<ImageBuffer>[capacity]))
     , m_capacity(capacity)
 {
 }
@@ -4625,4 +4713,4 @@ void WebGLRenderingContext::LRUImageBufferCache::bubbleToFront(int idx)
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.h b/Source/WebCore/html/canvas/WebGLRenderingContext.h
index 01b5438..dd71620 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.h
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.h
@@ -69,13 +69,13 @@ public:
     virtual bool isAccelerated() const { return true; }
     virtual bool paintsIntoCanvasBuffer() const;
 
-    void activeTexture(GC3Denum texture, ExceptionCode& ec);
-    void attachShader(WebGLProgram*, WebGLShader*, ExceptionCode& ec);
-    void bindAttribLocation(WebGLProgram*, GC3Duint index, const String& name, ExceptionCode& ec);
-    void bindBuffer(GC3Denum target, WebGLBuffer*, ExceptionCode& ec);
-    void bindFramebuffer(GC3Denum target, WebGLFramebuffer*, ExceptionCode& ec);
-    void bindRenderbuffer(GC3Denum target, WebGLRenderbuffer*, ExceptionCode& ec);
-    void bindTexture(GC3Denum target, WebGLTexture*, ExceptionCode& ec);
+    void activeTexture(GC3Denum texture, ExceptionCode&);
+    void attachShader(WebGLProgram*, WebGLShader*, ExceptionCode&);
+    void bindAttribLocation(WebGLProgram*, GC3Duint index, const String& name, ExceptionCode&);
+    void bindBuffer(GC3Denum target, WebGLBuffer*, ExceptionCode&);
+    void bindFramebuffer(GC3Denum target, WebGLFramebuffer*, ExceptionCode&);
+    void bindRenderbuffer(GC3Denum target, WebGLRenderbuffer*, ExceptionCode&);
+    void bindTexture(GC3Denum target, WebGLTexture*, ExceptionCode&);
     void blendColor(GC3Dfloat red, GC3Dfloat green, GC3Dfloat blue, GC3Dfloat alpha);
     void blendEquation(GC3Denum mode);
     void blendEquationSeparate(GC3Denum modeRGB, GC3Denum modeAlpha);
@@ -94,7 +94,7 @@ public:
     void clearDepth(GC3Dfloat);
     void clearStencil(GC3Dint);
     void colorMask(GC3Dboolean red, GC3Dboolean green, GC3Dboolean blue, GC3Dboolean alpha);
-    void compileShader(WebGLShader*, ExceptionCode& ec);
+    void compileShader(WebGLShader*, ExceptionCode&);
 
     // void compressedTexImage2D(GC3Denum target, GC3Dint level, GC3Denum internalformat, GC3Dsizei width, GC3Dsizei height, GC3Dint border, GC3Dsizei imageSize, const void* data);
     // void compressedTexSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xoffset, GC3Dint yoffset, GC3Dsizei width, GC3Dsizei GC3Dsizei height, GC3Denum format, GC3Dsizei imageSize, const void* data);
@@ -131,8 +131,8 @@ public:
     void enableVertexAttribArray(GC3Duint index, ExceptionCode&);
     void finish();
     void flush();
-    void framebufferRenderbuffer(GC3Denum target, GC3Denum attachment, GC3Denum renderbuffertarget, WebGLRenderbuffer*, ExceptionCode& ec);
-    void framebufferTexture2D(GC3Denum target, GC3Denum attachment, GC3Denum textarget, WebGLTexture*, GC3Dint level, ExceptionCode& ec);
+    void framebufferRenderbuffer(GC3Denum target, GC3Denum attachment, GC3Denum renderbuffertarget, WebGLRenderbuffer*, ExceptionCode&);
+    void framebufferTexture2D(GC3Denum target, GC3Denum attachment, GC3Denum textarget, WebGLTexture*, GC3Dint level, ExceptionCode&);
     void frontFace(GC3Denum mode);
     void generateMipmap(GC3Denum target);
 
@@ -147,10 +147,10 @@ public:
     WebGLGetInfo getFramebufferAttachmentParameter(GC3Denum target, GC3Denum attachment, GC3Denum pname, ExceptionCode&);
     WebGLGetInfo getParameter(GC3Denum pname, ExceptionCode&);
     WebGLGetInfo getProgramParameter(WebGLProgram*, GC3Denum pname, ExceptionCode&);
-    String getProgramInfoLog(WebGLProgram*, ExceptionCode& ec);
+    String getProgramInfoLog(WebGLProgram*, ExceptionCode&);
     WebGLGetInfo getRenderbufferParameter(GC3Denum target, GC3Denum pname, ExceptionCode&);
-    WebGLGetInfo getShaderParameter(WebGLShader*, GC3Denum pname, ExceptionCode& ec);
-    String getShaderInfoLog(WebGLShader*, ExceptionCode& ec);
+    WebGLGetInfo getShaderParameter(WebGLShader*, GC3Denum pname, ExceptionCode&);
+    String getShaderInfoLog(WebGLShader*, ExceptionCode&);
 
     // TBD
     // void glGetShaderPrecisionFormat (GC3Denum shadertype, GC3Denum precisiontype, GC3Dint* range, GC3Dint* precision);
@@ -192,30 +192,34 @@ public:
 
     void texImage2D(GC3Denum target, GC3Dint level, GC3Denum internalformat,
                     GC3Dsizei width, GC3Dsizei height, GC3Dint border,
-                    GC3Denum format, GC3Denum type, ArrayBufferView* pixels, ExceptionCode&);
+                    GC3Denum format, GC3Denum type, ArrayBufferView*, ExceptionCode&);
     void texImage2D(GC3Denum target, GC3Dint level, GC3Denum internalformat,
-                    GC3Denum format, GC3Denum type, ImageData* pixels, ExceptionCode&);
+                    GC3Denum format, GC3Denum type, ImageData*, ExceptionCode&);
     void texImage2D(GC3Denum target, GC3Dint level, GC3Denum internalformat,
-                    GC3Denum format, GC3Denum type, HTMLImageElement* image, ExceptionCode&);
+                    GC3Denum format, GC3Denum type, HTMLImageElement*, ExceptionCode&);
     void texImage2D(GC3Denum target, GC3Dint level, GC3Denum internalformat,
-                    GC3Denum format, GC3Denum type, HTMLCanvasElement* canvas, ExceptionCode&);
+                    GC3Denum format, GC3Denum type, HTMLCanvasElement*, ExceptionCode&);
+#if ENABLE(VIDEO)
     void texImage2D(GC3Denum target, GC3Dint level, GC3Denum internalformat,
-                    GC3Denum format, GC3Denum type, HTMLVideoElement* video, ExceptionCode&);
+                    GC3Denum format, GC3Denum type, HTMLVideoElement*, ExceptionCode&);
+#endif
 
     void texParameterf(GC3Denum target, GC3Denum pname, GC3Dfloat param);
     void texParameteri(GC3Denum target, GC3Denum pname, GC3Dint param);
 
     void texSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xoffset, GC3Dint yoffset,
                        GC3Dsizei width, GC3Dsizei height,
-                       GC3Denum format, GC3Denum type, ArrayBufferView* pixels, ExceptionCode&);
+                       GC3Denum format, GC3Denum type, ArrayBufferView*, ExceptionCode&);
     void texSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xoffset, GC3Dint yoffset,
-                       GC3Denum format, GC3Denum type, ImageData* pixels, ExceptionCode&);
+                       GC3Denum format, GC3Denum type, ImageData*, ExceptionCode&);
     void texSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xoffset, GC3Dint yoffset,
-                       GC3Denum format, GC3Denum type, HTMLImageElement* image, ExceptionCode&);
+                       GC3Denum format, GC3Denum type, HTMLImageElement*, ExceptionCode&);
     void texSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xoffset, GC3Dint yoffset,
-                       GC3Denum format, GC3Denum type, HTMLCanvasElement* canvas, ExceptionCode&);
+                       GC3Denum format, GC3Denum type, HTMLCanvasElement*, ExceptionCode&);
+#if ENABLE(VIDEO)
     void texSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xoffset, GC3Dint yoffset,
-                       GC3Denum format, GC3Denum type, HTMLVideoElement* video, ExceptionCode&);
+                       GC3Denum format, GC3Denum type, HTMLVideoElement*, ExceptionCode&);
+#endif
 
     void uniform1f(const WebGLUniformLocation* location, GC3Dfloat x, ExceptionCode&);
     void uniform1fv(const WebGLUniformLocation* location, Float32Array* v, ExceptionCode&);
@@ -334,9 +338,11 @@ public:
     // If numElements <= 0, we only check if each enabled vertex attribute is bound to a buffer.
     bool validateRenderingState(int numElements);
 
-    bool validateWebGLObject(WebGLObject* object);
+    bool validateWebGLObject(WebGLObject*);
 
-    PassRefPtr<Image> videoFrameToImage(HTMLVideoElement* video);
+#if ENABLE(VIDEO)
+    PassRefPtr<Image> videoFrameToImage(HTMLVideoElement*);
+#endif
 
     RefPtr<GraphicsContext3D> m_context;
 
@@ -399,6 +405,8 @@ public:
     RefPtr<WebGLBuffer> m_vertexAttrib0Buffer;
     long m_vertexAttrib0BufferSize;
     GC3Dfloat m_vertexAttrib0BufferValue[4];
+    bool m_forceAttrib0BufferRefill;
+    bool m_vertexAttrib0UsedBefore;
 
     RefPtr<WebGLProgram> m_currentProgram;
     RefPtr<WebGLFramebuffer> m_framebufferBinding;
@@ -457,20 +465,19 @@ public:
     RefPtr<WebKitLoseContext> m_webkitLoseContext;
 
     // Helpers for getParameter and others
-    WebGLGetInfo getBooleanParameter(GC3Denum pname);
-    WebGLGetInfo getBooleanArrayParameter(GC3Denum pname);
-    WebGLGetInfo getFloatParameter(GC3Denum pname);
-    WebGLGetInfo getIntParameter(GC3Denum pname);
-    WebGLGetInfo getLongParameter(GC3Denum pname);
-    WebGLGetInfo getUnsignedLongParameter(GC3Denum pname);
-    WebGLGetInfo getWebGLFloatArrayParameter(GC3Denum pname);
-    WebGLGetInfo getWebGLIntArrayParameter(GC3Denum pname);
+    WebGLGetInfo getBooleanParameter(GC3Denum);
+    WebGLGetInfo getBooleanArrayParameter(GC3Denum);
+    WebGLGetInfo getFloatParameter(GC3Denum);
+    WebGLGetInfo getIntParameter(GC3Denum);
+    WebGLGetInfo getUnsignedIntParameter(GC3Denum);
+    WebGLGetInfo getWebGLFloatArrayParameter(GC3Denum);
+    WebGLGetInfo getWebGLIntArrayParameter(GC3Denum);
 
     void texImage2DBase(GC3Denum target, GC3Dint level, GC3Denum internalformat,
                         GC3Dsizei width, GC3Dsizei height, GC3Dint border,
                         GC3Denum format, GC3Denum type, void* pixels, ExceptionCode&);
     void texImage2DImpl(GC3Denum target, GC3Dint level, GC3Denum internalformat,
-                        GC3Denum format, GC3Denum type, Image* image,
+                        GC3Denum format, GC3Denum type, Image*,
                         bool flipY, bool premultiplyAlpha, ExceptionCode&);
     void texSubImage2DBase(GC3Denum target, GC3Dint level, GC3Dint xoffset, GC3Dint yoffset,
                            GC3Dsizei width, GC3Dsizei height,
@@ -547,7 +554,7 @@ public:
 
     // Helper function to print warnings to console. Currently
     // used only to warn about use of obsolete functions.
-    void printWarningToConsole(const String& message);
+    void printWarningToConsole(const String&);
 
     // Helper function to validate input parameters for framebuffer functions.
     // Generate GL error if parameters are illegal.
@@ -563,20 +570,29 @@ public:
     bool validateCapability(GC3Denum);
 
     // Helper function to validate input parameters for uniform functions.
-    bool validateUniformParameters(const WebGLUniformLocation* location, Float32Array* v, GC3Dsizei mod);
-    bool validateUniformParameters(const WebGLUniformLocation* location, Int32Array* v, GC3Dsizei mod);
-    bool validateUniformParameters(const WebGLUniformLocation* location, void* v, GC3Dsizei size, GC3Dsizei mod);
-    bool validateUniformMatrixParameters(const WebGLUniformLocation* location, GC3Dboolean transpose, Float32Array* v, GC3Dsizei mod);
-    bool validateUniformMatrixParameters(const WebGLUniformLocation* location, GC3Dboolean transpose, void* v, GC3Dsizei size, GC3Dsizei mod);
+    bool validateUniformParameters(const WebGLUniformLocation*, Float32Array*, GC3Dsizei mod);
+    bool validateUniformParameters(const WebGLUniformLocation*, Int32Array*, GC3Dsizei mod);
+    bool validateUniformParameters(const WebGLUniformLocation*, void*, GC3Dsizei size, GC3Dsizei mod);
+    bool validateUniformMatrixParameters(const WebGLUniformLocation*, GC3Dboolean transpose, Float32Array*, GC3Dsizei mod);
+    bool validateUniformMatrixParameters(const WebGLUniformLocation*, GC3Dboolean transpose, void*, GC3Dsizei size, GC3Dsizei mod);
 
     // Helper function to validate parameters for bufferData.
     // Return the current bound buffer to target, or 0 if parameters are invalid.
     WebGLBuffer* validateBufferDataParameters(GC3Denum target, GC3Denum usage);
 
     // Helper functions for vertexAttribNf{v}.
-    void vertexAttribfImpl(GC3Duint index, GC3Dsizei expectedSize, GC3Dfloat v0, GC3Dfloat v1, GC3Dfloat v2, GC3Dfloat v3);
-    void vertexAttribfvImpl(GC3Duint index, Float32Array* v, GC3Dsizei expectedSize);
-    void vertexAttribfvImpl(GC3Duint index, GC3Dfloat* v, GC3Dsizei size, GC3Dsizei expectedSize);
+    void vertexAttribfImpl(GC3Duint index, GC3Dsizei expectedSize, GC3Dfloat, GC3Dfloat, GC3Dfloat, GC3Dfloat);
+    void vertexAttribfvImpl(GC3Duint index, Float32Array*, GC3Dsizei expectedSize);
+    void vertexAttribfvImpl(GC3Duint index, GC3Dfloat*, GC3Dsizei size, GC3Dsizei expectedSize);
+
+    // Helper function for delete* (deleteBuffer, deleteProgram, etc) functions.
+    // Return false if caller should return without further processing.
+    bool deleteObject(WebGLObject*);
+
+    // Helper function for bind* (bindBuffer, bindTexture, etc) and useProgram.
+    // If the object has already been deleted, set deleted to true upon return.
+    // Return false if caller should return without further processing.
+    bool checkObjectToBeBound(WebGLObject*, bool& deleted);
 
     // Helpers for simulating vertexAttrib0
     void initVertexAttrib0();
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.idl b/Source/WebCore/html/canvas/WebGLRenderingContext.idl
index 40b9bb0..7a19814 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.idl
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.idl
@@ -26,7 +26,7 @@
 module html {
 
     interface [
-        Conditional=3D_CANVAS,
+        Conditional=WEBGL,
         InterfaceUUID=98fb48ae-7216-489c-862b-8e1217fc4443,
         ImplementationUUID=ab4f0781-152f-450e-9546-5b3987491a54,
         CustomMarkFunction,
@@ -258,9 +258,7 @@ module html {
         const unsigned int VALIDATE_STATUS                  = 0x8B83;
         const unsigned int ATTACHED_SHADERS                 = 0x8B85;
         const unsigned int ACTIVE_UNIFORMS                  = 0x8B86;
-        const unsigned int ACTIVE_UNIFORM_MAX_LENGTH        = 0x8B87;
         const unsigned int ACTIVE_ATTRIBUTES                = 0x8B89;
-        const unsigned int ACTIVE_ATTRIBUTE_MAX_LENGTH      = 0x8B8A;
         const unsigned int SHADING_LANGUAGE_VERSION         = 0x8B8C;
         const unsigned int CURRENT_PROGRAM                  = 0x8B8D;
 
@@ -389,8 +387,6 @@ module html {
 
         /* Shader Source */
         const unsigned int COMPILE_STATUS                 = 0x8B81;
-        const unsigned int INFO_LOG_LENGTH                = 0x8B84;
-        const unsigned int SHADER_SOURCE_LENGTH           = 0x8B88;
         const unsigned int SHADER_COMPILER                = 0x8DFA;
 
         /* Shader Precision-Specified Types */
@@ -613,8 +609,10 @@ module html {
                                                      in unsigned long format, in unsigned long type, in HTMLImageElement image) raises (DOMException);
         [StrictTypeChecking] void         texImage2D(in unsigned long target, in long level, in unsigned long internalformat,
                                                      in unsigned long format, in unsigned long type, in HTMLCanvasElement canvas) raises (DOMException);
+#if defined(ENABLE_VIDEO) && ENABLE_VIDEO
         [StrictTypeChecking] void         texImage2D(in unsigned long target, in long level, in unsigned long internalformat,
                                                      in unsigned long format, in unsigned long type, in HTMLVideoElement video) raises (DOMException);
+#endif
 
         [StrictTypeChecking] void         texSubImage2D(in unsigned long target, in long level, in long xoffset, in long yoffset, 
                                                         in long width, in long height, 
@@ -625,8 +623,10 @@ module html {
                                                         in unsigned long format, in unsigned long type, in HTMLImageElement image) raises (DOMException);
         [StrictTypeChecking] void         texSubImage2D(in unsigned long target, in long level, in long xoffset, in long yoffset,
                                                         in unsigned long format, in unsigned long type, in HTMLCanvasElement canvas) raises (DOMException);
+#if defined(ENABLE_VIDEO) && ENABLE_VIDEO
         [StrictTypeChecking] void         texSubImage2D(in unsigned long target, in long level, in long xoffset, in long yoffset,
                                                         in unsigned long format, in unsigned long type, in HTMLVideoElement video) raises (DOMException);
+#endif
 
         [StrictTypeChecking] void uniform1f(in WebGLUniformLocation location, in float x) raises(DOMException);
         [StrictTypeChecking, Custom] void uniform1fv(in WebGLUniformLocation location, in Float32Array v) raises(DOMException);
diff --git a/Source/WebCore/html/canvas/WebGLShader.cpp b/Source/WebCore/html/canvas/WebGLShader.cpp
index a07023f..59695e4 100644
--- a/Source/WebCore/html/canvas/WebGLShader.cpp
+++ b/Source/WebCore/html/canvas/WebGLShader.cpp
@@ -25,14 +25,14 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "WebGLShader.h"
 
 #include "WebGLRenderingContext.h"
 
 namespace WebCore {
-    
+
 PassRefPtr<WebGLShader> WebGLShader::create(WebGLRenderingContext* ctx, GC3Denum type)
 {
     return adoptRef(new WebGLShader(ctx, type));
@@ -41,6 +41,7 @@ PassRefPtr<WebGLShader> WebGLShader::create(WebGLRenderingContext* ctx, GC3Denum
 WebGLShader::WebGLShader(WebGLRenderingContext* ctx, GC3Denum type)
     : WebGLObject(ctx)
     , m_type(type)
+    , m_source("")
 {
     setObject(context()->graphicsContext3D()->createShader(type));
 }
@@ -52,4 +53,4 @@ void WebGLShader::deleteObjectImpl(Platform3DObject object)
 
 }
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/html/canvas/WebGLShader.h b/Source/WebCore/html/canvas/WebGLShader.h
index 5deaf20..1d7a10c 100644
--- a/Source/WebCore/html/canvas/WebGLShader.h
+++ b/Source/WebCore/html/canvas/WebGLShader.h
@@ -40,6 +40,9 @@ public:
     static PassRefPtr<WebGLShader> create(WebGLRenderingContext*, GC3Denum);
 
     GC3Denum getType() const { return m_type; }
+    const String& getSource() const { return m_source; }
+
+    void setSource(const String& source) { m_source = source; }
 
 private:
     WebGLShader(WebGLRenderingContext*, GC3Denum);
@@ -49,6 +52,7 @@ private:
     virtual bool isShader() const { return true; }
 
     GC3Denum m_type;
+    String m_source;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/canvas/WebGLShader.idl b/Source/WebCore/html/canvas/WebGLShader.idl
index 45e7f54..21bba65 100644
--- a/Source/WebCore/html/canvas/WebGLShader.idl
+++ b/Source/WebCore/html/canvas/WebGLShader.idl
@@ -24,6 +24,6 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] WebGLShader {
+    interface [Conditional=WEBGL] WebGLShader {
     };
 }
diff --git a/Source/WebCore/html/canvas/WebGLTexture.cpp b/Source/WebCore/html/canvas/WebGLTexture.cpp
index a57500f..e8e8bf8 100644
--- a/Source/WebCore/html/canvas/WebGLTexture.cpp
+++ b/Source/WebCore/html/canvas/WebGLTexture.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "WebGLTexture.h"
 
@@ -33,7 +33,7 @@
 #include "WebGLRenderingContext.h"
 
 namespace WebCore {
-    
+
 PassRefPtr<WebGLTexture> WebGLTexture::create(WebGLRenderingContext* ctx)
 {
     return adoptRef(new WebGLTexture(ctx));
@@ -353,4 +353,4 @@ const WebGLTexture::LevelInfo* WebGLTexture::getLevelInfo(GC3Denum target, GC3Di
 
 }
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/html/canvas/WebGLTexture.h b/Source/WebCore/html/canvas/WebGLTexture.h
index 27eb8ee..6bd1272 100644
--- a/Source/WebCore/html/canvas/WebGLTexture.h
+++ b/Source/WebCore/html/canvas/WebGLTexture.h
@@ -44,6 +44,8 @@ public:
     void setParameteri(GC3Denum pname, GC3Dint param);
     void setParameterf(GC3Denum pname, GC3Dfloat param);
 
+    GC3Denum getTarget() const { return m_target; }
+
     int getMinFilter() const { return m_minFilter; }
 
     void setLevelInfo(GC3Denum target, GC3Dint level, GC3Denum internalFormat, GC3Dsizei width, GC3Dsizei height, GC3Denum type);
diff --git a/Source/WebCore/html/canvas/WebGLTexture.idl b/Source/WebCore/html/canvas/WebGLTexture.idl
index da7e066..d287f35 100644
--- a/Source/WebCore/html/canvas/WebGLTexture.idl
+++ b/Source/WebCore/html/canvas/WebGLTexture.idl
@@ -24,6 +24,6 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] WebGLTexture {
+    interface [Conditional=WEBGL] WebGLTexture {
     };
 }
diff --git a/Source/WebCore/html/canvas/WebGLUniformLocation.cpp b/Source/WebCore/html/canvas/WebGLUniformLocation.cpp
index a8220b0..1aeddb5 100644
--- a/Source/WebCore/html/canvas/WebGLUniformLocation.cpp
+++ b/Source/WebCore/html/canvas/WebGLUniformLocation.cpp
@@ -26,12 +26,12 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "WebGLUniformLocation.h"
 
 namespace WebCore {
-    
+
 PassRefPtr<WebGLUniformLocation> WebGLUniformLocation::create(WebGLProgram* program, GC3Dint location)
 {
     return adoptRef(new WebGLUniformLocation(program, location));
@@ -64,4 +64,4 @@ GC3Dint WebGLUniformLocation::location() const
 
 }
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/html/canvas/WebGLUniformLocation.h b/Source/WebCore/html/canvas/WebGLUniformLocation.h
index 3ef9fa8..6e05c7a 100644
--- a/Source/WebCore/html/canvas/WebGLUniformLocation.h
+++ b/Source/WebCore/html/canvas/WebGLUniformLocation.h
@@ -39,14 +39,14 @@ class WebGLUniformLocation : public RefCounted<WebGLUniformLocation> {
 public:
     virtual ~WebGLUniformLocation() { }
 
-    static PassRefPtr<WebGLUniformLocation> create(WebGLProgram* program, GC3Dint location);
+    static PassRefPtr<WebGLUniformLocation> create(WebGLProgram*, GC3Dint location);
 
     WebGLProgram* program() const;
 
     GC3Dint location() const;
 
 protected:
-    WebGLUniformLocation(WebGLProgram* program, GC3Dint location);
+    WebGLUniformLocation(WebGLProgram*, GC3Dint location);
 
 private:
     RefPtr<WebGLProgram> m_program;
diff --git a/Source/WebCore/html/canvas/WebGLUniformLocation.idl b/Source/WebCore/html/canvas/WebGLUniformLocation.idl
index b080241..5cd6404 100644
--- a/Source/WebCore/html/canvas/WebGLUniformLocation.idl
+++ b/Source/WebCore/html/canvas/WebGLUniformLocation.idl
@@ -25,6 +25,6 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] WebGLUniformLocation {
+    interface [Conditional=WEBGL] WebGLUniformLocation {
     };
 }
diff --git a/Source/WebCore/html/canvas/WebKitLoseContext.cpp b/Source/WebCore/html/canvas/WebKitLoseContext.cpp
index c7dd078..05e82f4 100644
--- a/Source/WebCore/html/canvas/WebKitLoseContext.cpp
+++ b/Source/WebCore/html/canvas/WebKitLoseContext.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "WebKitLoseContext.h"
 
@@ -60,4 +60,4 @@ void WebKitLoseContext::loseContext()
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/html/canvas/WebKitLoseContext.idl b/Source/WebCore/html/canvas/WebKitLoseContext.idl
index 741aa4a..83fc909 100644
--- a/Source/WebCore/html/canvas/WebKitLoseContext.idl
+++ b/Source/WebCore/html/canvas/WebKitLoseContext.idl
@@ -24,7 +24,7 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS, OmitConstructor] WebKitLoseContext {
+    interface [Conditional=WEBGL, OmitConstructor] WebKitLoseContext {
         [StrictTypeChecking] void loseContext();
     };
 }
diff --git a/Source/WebCore/html/parser/HTMLConstructionSite.cpp b/Source/WebCore/html/parser/HTMLConstructionSite.cpp
index c46b9b9..a026ef9 100644
--- a/Source/WebCore/html/parser/HTMLConstructionSite.cpp
+++ b/Source/WebCore/html/parser/HTMLConstructionSite.cpp
@@ -130,10 +130,20 @@ void HTMLConstructionSite::attachAtSite(const AttachmentSite& site, PassRefPtr<N
         child->attach();
 }
 
-HTMLConstructionSite::HTMLConstructionSite(Document* document, FragmentScriptingPermission scriptingPermission, bool isParsingFragment)
+HTMLConstructionSite::HTMLConstructionSite(Document* document)
     : m_document(document)
+    , m_attachmentRoot(document)
+    , m_fragmentScriptingPermission(FragmentScriptingAllowed)
+    , m_isParsingFragment(false)
+    , m_redirectAttachToFosterParent(false)
+{
+}
+
+HTMLConstructionSite::HTMLConstructionSite(DocumentFragment* fragment, FragmentScriptingPermission scriptingPermission)
+    : m_document(fragment->document())
+    , m_attachmentRoot(fragment)
     , m_fragmentScriptingPermission(scriptingPermission)
-    , m_isParsingFragment(isParsingFragment)
+    , m_isParsingFragment(true)
     , m_redirectAttachToFosterParent(false)
 {
 }
@@ -145,6 +155,7 @@ HTMLConstructionSite::~HTMLConstructionSite()
 void HTMLConstructionSite::detach()
 {
     m_document = 0;
+    m_attachmentRoot = 0;
 }
 
 void HTMLConstructionSite::setForm(HTMLFormElement* form)
@@ -170,7 +181,7 @@ void HTMLConstructionSite::insertHTMLHtmlStartTagBeforeHTML(AtomicHTMLToken& tok
 {
     RefPtr<HTMLHtmlElement> element = HTMLHtmlElement::create(m_document);
     element->setAttributeMap(token.takeAtributes(), m_fragmentScriptingPermission);
-    m_openElements.pushHTMLHtmlElement(attach<Element>(m_document, element.get()));
+    m_openElements.pushHTMLHtmlElement(attach<Element>(m_attachmentRoot, element.get()));
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     element->insertedByParser();
 #endif
@@ -205,7 +216,16 @@ void HTMLConstructionSite::insertHTMLBodyStartTagInBody(AtomicHTMLToken& token)
 void HTMLConstructionSite::insertDoctype(AtomicHTMLToken& token)
 {
     ASSERT(token.type() == HTMLToken::DOCTYPE);
-    attach(m_document, DocumentType::create(m_document, token.name(), String::adopt(token.publicIdentifier()), String::adopt(token.systemIdentifier())));
+    attach(m_attachmentRoot, DocumentType::create(m_document, token.name(), String::adopt(token.publicIdentifier()), String::adopt(token.systemIdentifier())));
+    
+    // DOCTYPE nodes are only processed when parsing fragments w/o contextElements, which
+    // never occurs.  However, if we ever chose to support such, this code is subtly wrong,
+    // because context-less fragments can determine their own quirks mode, and thus change
+    // parsing rules (like <p> inside <table>).  For now we ASSERT that we never hit this code
+    // in a fragment, as changing the owning document's compatibility mode would be wrong.
+    ASSERT(!m_isParsingFragment);
+    if (m_isParsingFragment)
+        return;
     
     if (token.forceQuirks())
         m_document->setCompatibilityMode(Document::QuirksMode);
@@ -222,7 +242,7 @@ void HTMLConstructionSite::insertComment(AtomicHTMLToken& token)
 void HTMLConstructionSite::insertCommentOnDocument(AtomicHTMLToken& token)
 {
     ASSERT(token.type() == HTMLToken::Comment);
-    attach(m_document, Comment::create(m_document, token.comment()));
+    attach(m_attachmentRoot, Comment::create(m_document, token.comment()));
 }
 
 void HTMLConstructionSite::insertCommentOnHTMLHtmlElement(AtomicHTMLToken& token)
diff --git a/Source/WebCore/html/parser/HTMLConstructionSite.h b/Source/WebCore/html/parser/HTMLConstructionSite.h
index 5a4a65d..0298503 100644
--- a/Source/WebCore/html/parser/HTMLConstructionSite.h
+++ b/Source/WebCore/html/parser/HTMLConstructionSite.h
@@ -43,7 +43,8 @@ class Element;
 class HTMLConstructionSite {
     WTF_MAKE_NONCOPYABLE(HTMLConstructionSite);
 public:
-    HTMLConstructionSite(Document*, FragmentScriptingPermission, bool isParsingFragment);
+    HTMLConstructionSite(Document*);
+    HTMLConstructionSite(DocumentFragment*, FragmentScriptingPermission);
     ~HTMLConstructionSite();
 
     void detach();
@@ -130,6 +131,12 @@ private:
     void dispatchDocumentElementAvailableIfNeeded();
 
     Document* m_document;
+    
+    // This is the root ContainerNode to which the parser attaches all newly
+    // constructed nodes. It points to a DocumentFragment when parsing fragments
+    // and a Document in all other cases.
+    ContainerNode* m_attachmentRoot;
+    
     RefPtr<Element> m_head;
     RefPtr<HTMLFormElement> m_form;
     mutable HTMLElementStack m_openElements;
diff --git a/Source/WebCore/html/parser/HTMLDocumentParser.cpp b/Source/WebCore/html/parser/HTMLDocumentParser.cpp
index 93e1309..2fe9486 100644
--- a/Source/WebCore/html/parser/HTMLDocumentParser.cpp
+++ b/Source/WebCore/html/parser/HTMLDocumentParser.cpp
@@ -39,7 +39,6 @@
 #include "InspectorInstrumentation.h"
 #include "NestingLevelIncrementer.h"
 #include "Settings.h"
-#include "XSSAuditor.h"
 #include <wtf/CurrentTime.h>
 
 #ifdef ANDROID_INSTRUMENT
@@ -85,6 +84,7 @@ HTMLDocumentParser::HTMLDocumentParser(HTMLDocument* document, bool reportErrors
     , m_scriptRunner(HTMLScriptRunner::create(document, this))
     , m_treeBuilder(HTMLTreeBuilder::create(this, document, reportErrors, usePreHTML5ParserQuirks(document)))
     , m_parserScheduler(HTMLParserScheduler::create(this))
+    , m_xssFilter(this)
     , m_endWasDelayed(false)
     , m_writeNestingLevel(0)
 {
@@ -96,6 +96,7 @@ HTMLDocumentParser::HTMLDocumentParser(DocumentFragment* fragment, Element* cont
     : ScriptableDocumentParser(fragment->document())
     , m_tokenizer(HTMLTokenizer::create(usePreHTML5ParserQuirks(fragment->document())))
     , m_treeBuilder(HTMLTreeBuilder::create(this, fragment, contextElement, scriptingPermission, usePreHTML5ParserQuirks(fragment->document())))
+    , m_xssFilter(this)
     , m_endWasDelayed(false)
     , m_writeNestingLevel(0)
 {
@@ -230,8 +231,13 @@ void HTMLDocumentParser::pumpTokenizer(SynchronousMode mode)
         if (!m_treeBuilder->isParsingFragment()
             && document()->frame() && document()->frame()->navigationScheduler()->locationChangePending())
             break;
+
+        m_sourceTracker.start(m_input, m_token);
         if (!m_tokenizer->nextToken(m_input.current(), m_token))
             break;
+        m_sourceTracker.end(m_input, m_token);
+
+        m_xssFilter.filterToken(m_token);
 
         m_treeBuilder->constructTreeFromToken(m_token);
         m_token.clear();
@@ -274,7 +280,12 @@ void HTMLDocumentParser::pumpTokenizer(SynchronousMode mode)
 
 bool HTMLDocumentParser::hasInsertionPoint()
 {
-    return m_input.hasInsertionPoint();
+    // FIXME: The wasCreatedByScript() branch here might not be fully correct.
+    //        Our model of the EOF character differs slightly from the one in
+    //        the spec because our treatment is uniform between network-sourced
+    //        and script-sourced input streams whereas the spec treats them
+    //        differently.
+    return m_input.hasInsertionPoint() || (wasCreatedByScript() && !m_input.haveSeenEndOfFile());
 }
 
 void HTMLDocumentParser::insert(const SegmentedString& source)
@@ -414,6 +425,11 @@ bool HTMLDocumentParser::inScriptExecution() const
     return m_scriptRunner->isExecutingScript();
 }
 
+String HTMLDocumentParser::sourceForToken(const HTMLToken& token)
+{
+    return m_sourceTracker.sourceForToken(token);
+}
+
 int HTMLDocumentParser::lineNumber() const
 {
     return m_tokenizer->lineNumber();
@@ -460,9 +476,7 @@ void HTMLDocumentParser::stopWatchingForLoad(CachedResource* cachedScript)
 
 bool HTMLDocumentParser::shouldLoadExternalScriptFromSrc(const AtomicString& srcValue)
 {
-    if (!xssAuditor())
-        return true;
-    return xssAuditor()->canLoadExternalScriptFromSrc(srcValue);
+    return document()->contentSecurityPolicy()->canLoadExternalScriptFromSrc(srcValue);
 }
 
 void HTMLDocumentParser::notifyFinished(CachedResource* cachedResource)
diff --git a/Source/WebCore/html/parser/HTMLDocumentParser.h b/Source/WebCore/html/parser/HTMLDocumentParser.h
index f925269..be2ca1b 100644
--- a/Source/WebCore/html/parser/HTMLDocumentParser.h
+++ b/Source/WebCore/html/parser/HTMLDocumentParser.h
@@ -30,10 +30,12 @@
 #include "FragmentScriptingPermission.h"
 #include "HTMLInputStream.h"
 #include "HTMLScriptRunnerHost.h"
+#include "HTMLSourceTracker.h"
 #include "HTMLToken.h"
 #include "ScriptableDocumentParser.h"
 #include "SegmentedString.h"
 #include "Timer.h"
+#include "XSSFilter.h"
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
@@ -71,8 +73,11 @@ public:
     static bool usePreHTML5ParserQuirks(Document*);
 
     HTMLTokenizer* tokenizer() const { return m_tokenizer.get(); }
+    String sourceForToken(const HTMLToken&);
 
     virtual TextPosition0 textPosition() const;
+    virtual int lineNumber() const;
+
     virtual void suspendScheduledTasks();
     virtual void resumeScheduledTasks();
 
@@ -97,7 +102,6 @@ private:
     virtual bool isWaitingForScripts() const;
     virtual bool isExecutingScript() const;
     virtual void executeScriptsWaitingForStylesheets();
-    virtual int lineNumber() const;
 
     // HTMLScriptRunnerHost
     virtual void watchForLoad(CachedResource*);
@@ -141,6 +145,8 @@ private:
     OwnPtr<HTMLTreeBuilder> m_treeBuilder;
     OwnPtr<HTMLPreloadScanner> m_preloadScanner;
     OwnPtr<HTMLParserScheduler> m_parserScheduler;
+    HTMLSourceTracker m_sourceTracker;
+    XSSFilter m_xssFilter;
 
     bool m_endWasDelayed;
     unsigned m_writeNestingLevel;
diff --git a/Source/WebCore/html/parser/HTMLInputStream.h b/Source/WebCore/html/parser/HTMLInputStream.h
index d95ec31..512ae88 100644
--- a/Source/WebCore/html/parser/HTMLInputStream.h
+++ b/Source/WebCore/html/parser/HTMLInputStream.h
@@ -67,17 +67,7 @@ public:
 
     bool hasInsertionPoint() const
     {
-        if (&m_first != m_last)
-            return true;
-        if (!haveSeenEndOfFile()) {
-            // FIXME: Somehow we need to understand the difference between
-            // input streams that are coming off the network and streams that
-            // were created with document.open(). In the later case, we always
-            // have an isertion point at the end of the stream until someone
-            // calls document.close().
-            return true;
-        }
-        return false;
+        return &m_first != m_last;
     }
 
     void markEndOfFile()
diff --git a/Source/WebCore/html/parser/HTMLParserIdioms.cpp b/Source/WebCore/html/parser/HTMLParserIdioms.cpp
index 91ff8d3..2be6af9 100644
--- a/Source/WebCore/html/parser/HTMLParserIdioms.cpp
+++ b/Source/WebCore/html/parser/HTMLParserIdioms.cpp
@@ -25,6 +25,7 @@
 #include "config.h"
 #include "HTMLParserIdioms.h"
 
+#include <limits>
 #include <wtf/MathExtras.h>
 #include <wtf/dtoa.h>
 #include <wtf/text/AtomicString.h>
@@ -85,7 +86,7 @@ bool parseToDoubleForNumberType(const String& string, double* result)
 
     // Numbers are considered finite IEEE 754 single-precision floating point values.
     // See HTML5 2.4.4.3 `Real numbers.'
-    if (-FLT_MAX > value || value > FLT_MAX)
+    if (-std::numeric_limits<float>::max() > value || value > std::numeric_limits<float>::max())
         return false;
 
     if (result) {
diff --git a/Source/WebCore/html/parser/HTMLScriptRunner.cpp b/Source/WebCore/html/parser/HTMLScriptRunner.cpp
index 2fe1d30..c99858d 100644
--- a/Source/WebCore/html/parser/HTMLScriptRunner.cpp
+++ b/Source/WebCore/html/parser/HTMLScriptRunner.cpp
@@ -264,6 +264,7 @@ bool HTMLScriptRunner::requestPendingScript(PendingScript& pendingScript, Elemen
     ASSERT(!pendingScript.element());
     const AtomicString& srcValue = script->getAttribute(srcAttr);
     // Allow the host to disllow script loads (using the XSSAuditor, etc.)
+    // FIXME: this check should be performed on the final URL in a redirect chain.
     if (!m_host->shouldLoadExternalScriptFromSrc(srcValue))
         return false;
     // FIXME: We need to resolve the url relative to the element.
diff --git a/Source/WebCore/html/parser/HTMLSourceTracker.cpp b/Source/WebCore/html/parser/HTMLSourceTracker.cpp
new file mode 100644
index 0000000..cf43105
--- /dev/null
+++ b/Source/WebCore/html/parser/HTMLSourceTracker.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2010 Adam Barth. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "HTMLSourceTracker.h"
+
+namespace WebCore {
+
+HTMLSourceTracker::HTMLSourceTracker()
+{
+}
+
+void HTMLSourceTracker::start(const HTMLInputStream& input, HTMLToken& token)
+{
+    m_sourceFromPreviousSegments = token.type() == HTMLToken::Uninitialized ? String() : m_sourceFromPreviousSegments + m_source.toString();
+    m_source = input.current();
+    token.setBaseOffset(input.current().numberOfCharactersConsumed() - m_sourceFromPreviousSegments.length());
+}
+
+void HTMLSourceTracker::end(const HTMLInputStream& input, HTMLToken& token)
+{
+    m_cachedSourceForToken = String();
+    // FIXME: This work should really be done by the HTMLTokenizer.
+    token.end(input.current().numberOfCharactersConsumed());
+}
+
+String HTMLSourceTracker::sourceForToken(const HTMLToken& token)
+{
+    if (token.type() == HTMLToken::EndOfFile)
+        return String(); // Hides the null character we use to mark the end of file.
+
+    if (!m_cachedSourceForToken.isEmpty())
+        return m_cachedSourceForToken;
+
+    ASSERT(!token.startIndex());
+    UChar* data = 0;
+    int length = token.endIndex() - token.startIndex() - m_sourceFromPreviousSegments.length();
+    String source = String::createUninitialized(length, data);
+    for (int i = 0; i < length; ++i) {
+        data[i] = *m_source;
+        m_source.advance();
+    }
+    m_cachedSourceForToken = m_sourceFromPreviousSegments + source;
+    return m_cachedSourceForToken;
+}
+
+}
diff --git a/Source/WebCore/html/parser/HTMLSourceTracker.h b/Source/WebCore/html/parser/HTMLSourceTracker.h
new file mode 100644
index 0000000..17ae191
--- /dev/null
+++ b/Source/WebCore/html/parser/HTMLSourceTracker.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2010 Adam Barth. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HTMLSourceTracker_h
+#define HTMLSourceTracker_h
+
+#include "HTMLInputStream.h"
+#include "HTMLToken.h"
+
+namespace WebCore {
+
+class HTMLSourceTracker {
+    WTF_MAKE_NONCOPYABLE(HTMLSourceTracker);
+public:
+    HTMLSourceTracker();
+
+    // FIXME: Once we move "end" into HTMLTokenizer, rename "start" to
+    // something that makes it obvious that this method can be called multiple
+    // times.
+    void start(const HTMLInputStream&, HTMLToken&);
+    void end(const HTMLInputStream&, HTMLToken&);
+
+    String sourceForToken(const HTMLToken&);
+
+private:
+    String m_sourceFromPreviousSegments;
+    SegmentedString m_source;
+    String m_cachedSourceForToken;
+};
+
+}
+
+#endif
diff --git a/Source/WebCore/html/parser/HTMLToken.h b/Source/WebCore/html/parser/HTMLToken.h
index 1cbc151..aa16ab2 100644
--- a/Source/WebCore/html/parser/HTMLToken.h
+++ b/Source/WebCore/html/parser/HTMLToken.h
@@ -64,20 +64,26 @@ public:
 
     HTMLToken() { clear(); }
 
-    void clear(int startIndex = 0)
+    void clear()
     {
         m_type = Uninitialized;
-        m_range.m_start = startIndex;
-        m_range.m_end = startIndex;
+        m_range.m_start = 0;
+        m_range.m_end = 0;
+        m_baseOffset = 0;
         m_data.clear();
     }
 
     int startIndex() const { return m_range.m_start; }
     int endIndex() const { return m_range.m_end; }
 
-    void end(int endIndex)
+    void setBaseOffset(int offset)
     {
-        m_range.m_end = endIndex;
+        m_baseOffset = offset;
+    }
+
+    void end(int endOffset)
+    {
+        m_range.m_end = endOffset - m_baseOffset;
     }
 
     void makeEndOfFile()
@@ -172,29 +178,30 @@ public:
 #endif
     }
 
-    void beginAttributeName(int index)
+    void beginAttributeName(int offset)
     {
-        m_currentAttribute->m_nameRange.m_start = index;
+        m_currentAttribute->m_nameRange.m_start = offset - m_baseOffset;
     }
 
-    void endAttributeName(int index)
+    void endAttributeName(int offset)
     {
+        int index = offset - m_baseOffset;
         m_currentAttribute->m_nameRange.m_end = index;
         m_currentAttribute->m_valueRange.m_start = index;
         m_currentAttribute->m_valueRange.m_end = index;
     }
 
-    void beginAttributeValue(int index)
+    void beginAttributeValue(int offset)
     {
-        m_currentAttribute->m_valueRange.m_start = index;
+        m_currentAttribute->m_valueRange.m_start = offset - m_baseOffset;
 #ifndef NDEBUG
         m_currentAttribute->m_valueRange.m_end = 0;
 #endif
     }
 
-    void endAttributeValue(int index)
+    void endAttributeValue(int offset)
     {
-        m_currentAttribute->m_valueRange.m_end = index;
+        m_currentAttribute->m_valueRange.m_end = offset - m_baseOffset;
     }
 
     void appendToAttributeName(UChar character)
@@ -213,6 +220,13 @@ public:
         m_currentAttribute->m_value.append(character);
     }
 
+    void appendToAttributeValue(size_t i, const String& value)
+    {
+        ASSERT(!value.isEmpty());
+        ASSERT(m_type == StartTag || m_type == EndTag);
+        m_attributes[i].m_value.append(value.characters(), value.length());
+    }
+
     Type type() const { return m_type; }
 
     bool selfClosing() const
@@ -239,6 +253,18 @@ public:
         return m_data;
     }
 
+    void eraseCharacters()
+    {
+        ASSERT(m_type == Character);
+        m_data.clear();
+    }
+
+    void eraseValueOfAttribute(size_t i)
+    {
+        ASSERT(m_type == StartTag || m_type == EndTag);
+        m_attributes[i].m_value.clear();
+    }
+
     const DataVector& characters() const
     {
         ASSERT(m_type == Character);
@@ -331,9 +357,8 @@ private:
     };
 
     Type m_type;
-
-    // Which characters from the input stream are represented by this token.
-    Range m_range;
+    Range m_range; // Always starts at zero.
+    int m_baseOffset;
 
     // "name" for DOCTYPE, StartTag, and EndTag
     // "characters" for Character
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
index 97cee13..d2931ac 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
@@ -26,8 +26,8 @@
 #include "config.h"
 #include "HTMLTreeBuilder.h"
 
-#include "CharacterNames.h"
 #include "Comment.h"
+#include "DOMWindow.h"
 #include "DocumentFragment.h"
 #include "DocumentType.h"
 #include "Frame.h"
@@ -50,6 +50,7 @@
 #include "XLinkNames.h"
 #include "XMLNSNames.h"
 #include "XMLNames.h"
+#include <wtf/unicode/CharacterNames.h>
 
 namespace WebCore {
 
@@ -341,7 +342,7 @@ private:
 HTMLTreeBuilder::HTMLTreeBuilder(HTMLDocumentParser* parser, HTMLDocument* document, bool reportErrors, bool usePreHTML5ParserQuirks)
     : m_framesetOk(true)
     , m_document(document)
-    , m_tree(document, FragmentScriptingAllowed, false)
+    , m_tree(document)
     , m_reportErrors(reportErrors)
     , m_isPaused(false)
     , m_insertionMode(InitialMode)
@@ -359,8 +360,8 @@ HTMLTreeBuilder::HTMLTreeBuilder(HTMLDocumentParser* parser, HTMLDocument* docum
 HTMLTreeBuilder::HTMLTreeBuilder(HTMLDocumentParser* parser, DocumentFragment* fragment, Element* contextElement, FragmentScriptingPermission scriptingPermission, bool usePreHTML5ParserQuirks)
     : m_framesetOk(true)
     , m_fragmentContext(fragment, contextElement, scriptingPermission)
-    , m_document(m_fragmentContext.document())
-    , m_tree(m_document, scriptingPermission, true)
+    , m_document(fragment->document())
+    , m_tree(fragment, scriptingPermission)
     , m_reportErrors(false) // FIXME: Why not report errors in fragments?
     , m_isPaused(false)
     , m_insertionMode(InitialMode)
@@ -374,7 +375,6 @@ HTMLTreeBuilder::HTMLTreeBuilder(HTMLDocumentParser* parser, DocumentFragment* f
     if (contextElement) {
         // Steps 4.2-4.6 of the HTML5 Fragment Case parsing algorithm:
         // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-end.html#fragment-case
-        m_document->setCompatibilityMode(contextElement->document()->compatibilityMode());
         processFakeStartTag(htmlTag);
         resetInsertionModeAppropriately();
         m_tree.setForm(closestFormAncestor(contextElement));
@@ -403,27 +403,24 @@ HTMLTreeBuilder::FragmentParsingContext::FragmentParsingContext()
 }
 
 HTMLTreeBuilder::FragmentParsingContext::FragmentParsingContext(DocumentFragment* fragment, Element* contextElement, FragmentScriptingPermission scriptingPermission)
-    : m_dummyDocumentForFragmentParsing(HTMLDocument::create(0, KURL(), fragment->document()->baseURI()))
-    , m_fragment(fragment)
+    : m_fragment(fragment)
     , m_contextElement(contextElement)
     , m_scriptingPermission(scriptingPermission)
 {
-    m_dummyDocumentForFragmentParsing->setCompatibilityMode(fragment->document()->compatibilityMode());
-}
-
-Document* HTMLTreeBuilder::FragmentParsingContext::document() const
-{
-    ASSERT(m_fragment);
-    return m_dummyDocumentForFragmentParsing.get();
+    ASSERT(!fragment->hasChildNodes());
 }
 
 void HTMLTreeBuilder::FragmentParsingContext::finished()
 {
-    // Populate the DocumentFragment with the parsed content now that we're done.
-    ContainerNode* root = m_dummyDocumentForFragmentParsing.get();
-    if (m_contextElement)
-        root = m_dummyDocumentForFragmentParsing->documentElement();
-    m_fragment->takeAllChildrenFrom(root);
+    if (!m_contextElement)
+        return;
+    
+    // The HTML5 spec says to return the children of the fragment's document
+    // element when there is a context element (10.4.7).
+    RefPtr<ContainerNode> documentElement = firstElementChild(m_fragment);
+    m_fragment->removeChildren();
+    ASSERT(documentElement);
+    m_fragment->takeAllChildrenFrom(documentElement.get());
 }
 
 HTMLTreeBuilder::FragmentParsingContext::~FragmentParsingContext()
@@ -2807,6 +2804,20 @@ void HTMLTreeBuilder::finished()
     m_document->finishedParsing();
 }
 
+void HTMLTreeBuilder::parseError(AtomicHTMLToken&)
+{
+    DEFINE_STATIC_LOCAL(String, parseErrorMessage, ("HTML parse error (recovered gracefully)"));
+
+    if (!m_reportErrors)
+        return;
+
+    DOMWindow* domWindow = m_document->domWindow();
+    if (!domWindow)
+        return;
+
+    domWindow->console()->addMessage(HTMLMessageSource, LogMessageType, WarningMessageLevel, parseErrorMessage, m_parser->lineNumber(), m_document->url().string());
+}
+
 bool HTMLTreeBuilder::scriptEnabled(Frame* frame)
 {
     if (!frame)
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.h b/Source/WebCore/html/parser/HTMLTreeBuilder.h
index 309ac6f..0cec667 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.h
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.h
@@ -183,8 +183,7 @@ private:
 
     bool m_framesetOk;
 
-    // FIXME: Implement error reporting.
-    void parseError(AtomicHTMLToken&) { }
+    void parseError(AtomicHTMLToken&);
 
     InsertionMode insertionMode() const { return m_insertionMode; }
     void setInsertionMode(InsertionMode mode)
@@ -212,7 +211,6 @@ private:
         FragmentParsingContext(DocumentFragment*, Element* contextElement, FragmentScriptingPermission);
         ~FragmentParsingContext();
 
-        Document* document() const;
         DocumentFragment* fragment() const { return m_fragment; }
         Element* contextElement() const { ASSERT(m_fragment); return m_contextElement; }
         FragmentScriptingPermission scriptingPermission() const { ASSERT(m_fragment); return m_scriptingPermission; }
@@ -220,7 +218,6 @@ private:
         void finished();
 
     private:
-        RefPtr<Document> m_dummyDocumentForFragmentParsing;
         DocumentFragment* m_fragment;
         Element* m_contextElement;
 
diff --git a/Source/WebCore/html/parser/HTMLViewSourceParser.cpp b/Source/WebCore/html/parser/HTMLViewSourceParser.cpp
index ace8590..7cdbdc7 100644
--- a/Source/WebCore/html/parser/HTMLViewSourceParser.cpp
+++ b/Source/WebCore/html/parser/HTMLViewSourceParser.cpp
@@ -49,35 +49,27 @@ void HTMLViewSourceParser::insert(const SegmentedString&)
 
 void HTMLViewSourceParser::pumpTokenizer()
 {
-    while (m_tokenizer->nextToken(m_input.current(), m_token)) {
-        m_token.end(m_input.current().numberOfCharactersConsumed());
+    while (true) {
+        m_sourceTracker.start(m_input, m_token);
+        if (!m_tokenizer->nextToken(m_input.current(), m_token))
+            break;
+        m_sourceTracker.end(m_input, m_token);
+
         document()->addSource(sourceForToken(), m_token);
         updateTokenizerState();
-        m_token.clear(m_input.current().numberOfCharactersConsumed());
+        m_token.clear();
     }
 }
 
 void HTMLViewSourceParser::append(const SegmentedString& input)
 {
     m_input.appendToEnd(input);
-    m_source.append(input);
     pumpTokenizer();
 }
 
 String HTMLViewSourceParser::sourceForToken()
 {
-    if (m_token.type() == HTMLToken::EndOfFile)
-        return String();
-
-    ASSERT(m_source.numberOfCharactersConsumed() == m_token.startIndex());
-    UChar* data = 0;
-    int length = m_token.endIndex() - m_token.startIndex();
-    String source = String::createUninitialized(length, data);
-    for (int i = 0; i < length; ++i) {
-        data[i] = *m_source;
-        m_source.advance();
-    }
-    return source;
+    return m_sourceTracker.sourceForToken(m_token);
 }
 
 void HTMLViewSourceParser::updateTokenizerState()
diff --git a/Source/WebCore/html/parser/HTMLViewSourceParser.h b/Source/WebCore/html/parser/HTMLViewSourceParser.h
index abe55b4..2e6ddfe 100644
--- a/Source/WebCore/html/parser/HTMLViewSourceParser.h
+++ b/Source/WebCore/html/parser/HTMLViewSourceParser.h
@@ -28,6 +28,7 @@
 
 #include "DecodedDataDocumentParser.h"
 #include "HTMLInputStream.h"
+#include "HTMLSourceTracker.h"
 #include "HTMLToken.h"
 #include "HTMLTokenizer.h"
 #include "HTMLViewSourceDocument.h"
@@ -69,8 +70,8 @@ private:
     void updateTokenizerState();
 
     HTMLInputStream m_input;
-    SegmentedString m_source;
     HTMLToken m_token;
+    HTMLSourceTracker m_sourceTracker;
     OwnPtr<HTMLTokenizer> m_tokenizer;
 };
 
diff --git a/Source/WebCore/html/parser/XSSFilter.cpp b/Source/WebCore/html/parser/XSSFilter.cpp
new file mode 100644
index 0000000..de31f76
--- /dev/null
+++ b/Source/WebCore/html/parser/XSSFilter.cpp
@@ -0,0 +1,450 @@
+/*
+ * Copyright (C) 2011 Adam Barth. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "XSSFilter.h"
+
+#include "DOMWindow.h"
+#include "Document.h"
+#include "DocumentLoader.h"
+#include "Frame.h"
+#include "HTMLDocumentParser.h"
+#include "HTMLNames.h"
+#include "HTMLParamElement.h"
+#include "HTMLParserIdioms.h"
+#include "Settings.h"
+#include "TextEncoding.h"
+#include "TextResourceDecoder.h"
+#include <wtf/text/CString.h>
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+namespace {
+
+bool isNonCanonicalCharacter(UChar c)
+{
+    // We remove all non-ASCII characters, including non-printable ASCII characters.
+    //
+    // Note, we don't remove backslashes like PHP stripslashes(), which among other things converts "\\0" to the \0 character.
+    // Instead, we remove backslashes and zeros (since the string "\\0" =(remove backslashes)=> "0"). However, this has the 
+    // adverse effect that we remove any legitimate zeros from a string.
+    //
+    // For instance: new String("http://localhost:8000") => new String("http://localhost:8").
+    return (c == '\\' || c == '0' || c == '\0' || c >= 127);
+}
+
+String canonicalize(const String& string)
+{
+    return string.removeCharacters(&isNonCanonicalCharacter);
+}
+
+bool isRequiredForInjection(UChar c)
+{
+    return (c == '\'' || c == '"' || c == '<' || c == '>');
+}
+
+bool hasName(const HTMLToken& token, const QualifiedName& name)
+{
+    return equalIgnoringNullity(token.name(), static_cast<const String&>(name.localName()));
+}
+
+bool findAttributeWithName(const HTMLToken& token, const QualifiedName& name, size_t& indexOfMatchingAttribute)
+{
+    for (size_t i = 0; i < token.attributes().size(); ++i) {
+        if (equalIgnoringNullity(token.attributes().at(i).m_name, name.localName())) {
+            indexOfMatchingAttribute = i;
+            return true;
+        }
+    }
+    return false;
+}
+
+bool isNameOfInlineEventHandler(const Vector<UChar, 32>& name)
+{
+    const size_t lengthOfShortestInlineEventHandlerName = 5; // To wit: oncut.
+    if (name.size() < lengthOfShortestInlineEventHandlerName)
+        return false;
+    return name[0] == 'o' && name[1] == 'n';
+}
+
+bool containsJavaScriptURL(const Vector<UChar, 32>& value)
+{
+    static const char javaScriptScheme[] = "javascript:";
+    static const size_t lengthOfJavaScriptScheme = sizeof(javaScriptScheme) - 1;
+
+    size_t i;
+    for (i = 0; i < value.size(); ++i) {
+        if (!isHTMLSpace(value[i]))
+            break;
+    }
+
+    if (value.size() - i < lengthOfJavaScriptScheme)
+        return false;
+
+    return equalIgnoringCase(value.data() + i, javaScriptScheme, lengthOfJavaScriptScheme);
+}
+
+String decodeURL(const String& string, const TextEncoding& encoding)
+{
+    String workingString = string;
+    workingString.replace('+', ' ');
+    workingString = decodeURLEscapeSequences(workingString);
+    CString workingStringUTF8 = workingString.utf8();
+    String decodedString = encoding.decode(workingStringUTF8.data(), workingStringUTF8.length());
+    // FIXME: Is this check necessary?
+    if (decodedString.isEmpty())
+        return canonicalize(workingString);
+    return canonicalize(decodedString);
+}
+
+}
+
+XSSFilter::XSSFilter(HTMLDocumentParser* parser)
+    : m_parser(parser)
+    , m_isEnabled(false)
+    , m_xssProtection(XSSProtectionEnabled)
+    , m_state(Uninitialized)
+{
+    ASSERT(m_parser);
+    if (Frame* frame = parser->document()->frame()) {
+        if (Settings* settings = frame->settings())
+            m_isEnabled = settings->xssAuditorEnabled();
+    }
+    // Although tempting to call init() at this point, the various objects
+    // we want to reference might not all have been constructed yet.
+}
+
+void XSSFilter::init()
+{
+    const size_t miniumLengthForSuffixTree = 512; // FIXME: Tune this parameter.
+    const int suffixTreeDepth = 5;
+
+    ASSERT(m_state == Uninitialized);
+    m_state = Initial;
+
+    if (!m_isEnabled)
+        return;
+    
+    // In theory, the Document could have detached from the Frame after the
+    // XSSFilter was constructed.
+    if (!m_parser->document()->frame()) {
+        m_isEnabled = false;
+        return;
+    }
+
+    const KURL& url = m_parser->document()->url();
+
+    if (url.protocolIsData()) {
+        m_isEnabled = false;
+        return;
+    }
+
+    TextResourceDecoder* decoder = m_parser->document()->decoder();
+    m_decodedURL = decoder ? decodeURL(url.string(), decoder->encoding()) : url.string();
+    if (m_decodedURL.find(isRequiredForInjection, 0) == notFound)
+        m_decodedURL = String();
+
+    if (DocumentLoader* documentLoader = m_parser->document()->frame()->loader()->documentLoader()) {
+        DEFINE_STATIC_LOCAL(String, XSSProtectionHeader, ("X-XSS-Protection"));
+        m_xssProtection = parseXSSProtectionHeader(documentLoader->response().httpHeaderField(XSSProtectionHeader));
+
+        FormData* httpBody = documentLoader->originalRequest().httpBody();
+        if (httpBody && !httpBody->isEmpty()) {
+            String httpBodyAsString = httpBody->flattenToString();
+            m_decodedHTTPBody = decoder ? decodeURL(httpBodyAsString, decoder->encoding()) : httpBodyAsString;
+            if (m_decodedHTTPBody.find(isRequiredForInjection, 0) == notFound)
+                m_decodedHTTPBody = String();
+            if (m_decodedHTTPBody.length() >= miniumLengthForSuffixTree)
+                m_decodedHTTPBodySuffixTree = adoptPtr(new SuffixTree<ASCIICodebook>(m_decodedHTTPBody, suffixTreeDepth));
+        }
+    }
+
+    if (m_decodedURL.isEmpty() && m_decodedHTTPBody.isEmpty())
+        m_isEnabled = false;
+}
+
+void XSSFilter::filterToken(HTMLToken& token)
+{
+    if (m_state == Uninitialized) {
+        init();
+        ASSERT(m_state == Initial);
+    }
+
+    if (!m_isEnabled || m_xssProtection == XSSProtectionDisabled)
+        return;
+
+    bool didBlockScript = false;
+
+    switch (m_state) {
+    case Uninitialized:
+        ASSERT_NOT_REACHED();
+        break;
+    case Initial: 
+        didBlockScript = filterTokenInitial(token);
+        break;
+    case AfterScriptStartTag:
+        didBlockScript = filterTokenAfterScriptStartTag(token);
+        ASSERT(m_state == Initial);
+        m_cachedSnippet = String();
+        break;
+    }
+
+    if (didBlockScript) {
+        // FIXME: Consider using a more helpful console message.
+        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
+        // FIXME: We should add the real line number to the console.
+        m_parser->document()->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
+
+        if (m_xssProtection == XSSProtectionBlockEnabled) {
+            m_parser->document()->frame()->loader()->stopAllLoaders();
+            m_parser->document()->frame()->navigationScheduler()->scheduleLocationChange(m_parser->document()->securityOrigin(), blankURL(), String());
+        }
+    }
+}
+
+bool XSSFilter::filterTokenInitial(HTMLToken& token)
+{
+    ASSERT(m_state == Initial);
+
+    if (token.type() != HTMLToken::StartTag)
+        return false;
+
+    bool didBlockScript = eraseDangerousAttributesIfInjected(token);
+
+    if (hasName(token, scriptTag))
+        didBlockScript |= filterScriptToken(token);
+    else if (hasName(token, objectTag))
+        didBlockScript |= filterObjectToken(token);
+    else if (hasName(token, paramTag))
+        didBlockScript |= filterParamToken(token);
+    else if (hasName(token, embedTag))
+        didBlockScript |= filterEmbedToken(token);
+    else if (hasName(token, appletTag))
+        didBlockScript |= filterAppletToken(token);
+    else if (hasName(token, metaTag))
+        didBlockScript |= filterMetaToken(token);
+    else if (hasName(token, baseTag))
+        didBlockScript |= filterBaseToken(token);
+
+    return didBlockScript;
+}
+
+bool XSSFilter::filterTokenAfterScriptStartTag(HTMLToken& token)
+{
+    ASSERT(m_state == AfterScriptStartTag);
+    m_state = Initial;
+
+    if (token.type() != HTMLToken::Character) {
+        ASSERT(token.type() == HTMLToken::EndTag || token.type() == HTMLToken::EndOfFile);
+        return false;
+    }
+
+    int start = 0;
+    // FIXME: We probably want to grab only the first few characters of the
+    //        contents of the script element.
+    int end = token.endIndex() - token.startIndex();
+    if (isContainedInRequest(m_cachedSnippet + snippetForRange(token, start, end))) {
+        token.eraseCharacters();
+        token.appendToCharacter(' '); // Technically, character tokens can't be empty.
+        return true;
+    }
+    return false;
+}
+
+bool XSSFilter::filterScriptToken(HTMLToken& token)
+{
+    ASSERT(m_state == Initial);
+    ASSERT(token.type() == HTMLToken::StartTag);
+    ASSERT(hasName(token, scriptTag));
+
+    if (eraseAttributeIfInjected(token, srcAttr, blankURL().string()))
+        return true;
+
+    m_state = AfterScriptStartTag;
+    m_cachedSnippet = m_parser->sourceForToken(token);
+    return false;
+}
+
+bool XSSFilter::filterObjectToken(HTMLToken& token)
+{
+    ASSERT(m_state == Initial);
+    ASSERT(token.type() == HTMLToken::StartTag);
+    ASSERT(hasName(token, objectTag));
+
+    bool didBlockScript = false;
+
+    didBlockScript |= eraseAttributeIfInjected(token, dataAttr, blankURL().string());
+    didBlockScript |= eraseAttributeIfInjected(token, typeAttr);
+    didBlockScript |= eraseAttributeIfInjected(token, classidAttr);
+
+    return didBlockScript;
+}
+
+bool XSSFilter::filterParamToken(HTMLToken& token)
+{
+    ASSERT(m_state == Initial);
+    ASSERT(token.type() == HTMLToken::StartTag);
+    ASSERT(hasName(token, paramTag));
+
+    size_t indexOfNameAttribute;
+    if (!findAttributeWithName(token, nameAttr, indexOfNameAttribute))
+        return false;
+
+    const HTMLToken::Attribute& nameAttribute = token.attributes().at(indexOfNameAttribute);
+    String name = String(nameAttribute.m_value.data(), nameAttribute.m_value.size());
+
+    if (!HTMLParamElement::isURLParameter(name))
+        return false;
+
+    return eraseAttributeIfInjected(token, valueAttr, blankURL().string());
+}
+
+bool XSSFilter::filterEmbedToken(HTMLToken& token)
+{
+    ASSERT(m_state == Initial);
+    ASSERT(token.type() == HTMLToken::StartTag);
+    ASSERT(hasName(token, embedTag));
+
+    bool didBlockScript = false;
+
+    didBlockScript |= eraseAttributeIfInjected(token, srcAttr, blankURL().string());
+    didBlockScript |= eraseAttributeIfInjected(token, typeAttr);
+
+    return didBlockScript;
+}
+
+bool XSSFilter::filterAppletToken(HTMLToken& token)
+{
+    ASSERT(m_state == Initial);
+    ASSERT(token.type() == HTMLToken::StartTag);
+    ASSERT(hasName(token, appletTag));
+
+    bool didBlockScript = false;
+
+    didBlockScript |= eraseAttributeIfInjected(token, codeAttr);
+    didBlockScript |= eraseAttributeIfInjected(token, objectAttr);
+
+    return didBlockScript;
+}
+
+bool XSSFilter::filterMetaToken(HTMLToken& token)
+{
+    ASSERT(m_state == Initial);
+    ASSERT(token.type() == HTMLToken::StartTag);
+    ASSERT(hasName(token, metaTag));
+
+    return eraseAttributeIfInjected(token, http_equivAttr);
+}
+
+bool XSSFilter::filterBaseToken(HTMLToken& token)
+{
+    ASSERT(m_state == Initial);
+    ASSERT(token.type() == HTMLToken::StartTag);
+    ASSERT(hasName(token, baseTag));
+
+    return eraseAttributeIfInjected(token, hrefAttr);
+}
+
+bool XSSFilter::eraseDangerousAttributesIfInjected(HTMLToken& token)
+{
+    DEFINE_STATIC_LOCAL(String, safeJavaScriptURL, ("javascript:void(0)"));
+
+    bool didBlockScript = false;
+    for (size_t i = 0; i < token.attributes().size(); ++i) {
+        const HTMLToken::Attribute& attribute = token.attributes().at(i);
+        bool isInlineEventHandler = isNameOfInlineEventHandler(attribute.m_name);
+        bool valueContainsJavaScriptURL = isInlineEventHandler ? false : containsJavaScriptURL(attribute.m_value);
+        if (!isInlineEventHandler && !valueContainsJavaScriptURL)
+            continue;
+        if (!isContainedInRequest(snippetForAttribute(token, attribute)))
+            continue;
+        token.eraseValueOfAttribute(i);
+        if (valueContainsJavaScriptURL)
+            token.appendToAttributeValue(i, safeJavaScriptURL);
+        didBlockScript = true;
+    }
+    return didBlockScript;
+}
+
+bool XSSFilter::eraseAttributeIfInjected(HTMLToken& token, const QualifiedName& attributeName, const String& replacementValue)
+{
+    size_t indexOfAttribute;
+    if (findAttributeWithName(token, attributeName, indexOfAttribute)) {
+        const HTMLToken::Attribute& attribute = token.attributes().at(indexOfAttribute);
+        if (isContainedInRequest(snippetForAttribute(token, attribute))) {
+            if (attributeName == srcAttr && isSameOriginResource(String(attribute.m_value.data(), attribute.m_value.size())))
+                return false;
+            token.eraseValueOfAttribute(indexOfAttribute);
+            if (!replacementValue.isEmpty())
+                token.appendToAttributeValue(indexOfAttribute, replacementValue);
+            return true;
+        }
+    }
+    return false;
+}
+
+String XSSFilter::snippetForRange(const HTMLToken& token, int start, int end)
+{
+    // FIXME: There's an extra allocation here that we could save by
+    //        passing the range to the parser.
+    return m_parser->sourceForToken(token).substring(start, end - start);
+}
+
+String XSSFilter::snippetForAttribute(const HTMLToken& token, const HTMLToken::Attribute& attribute)
+{
+    // FIXME: We should grab one character before the name also.
+    int start = attribute.m_nameRange.m_start - token.startIndex();
+    // FIXME: We probably want to grab only the first few characters of the attribute value.
+    int end = attribute.m_valueRange.m_end - token.startIndex();
+    return snippetForRange(token, start, end);
+}
+
+bool XSSFilter::isContainedInRequest(const String& snippet)
+{
+    ASSERT(!snippet.isEmpty());
+    String canonicalizedSnippet = canonicalize(snippet);
+    ASSERT(!canonicalizedSnippet.isEmpty());
+    if (m_decodedURL.find(canonicalizedSnippet, 0, false) != notFound)
+        return true;
+    if (m_decodedHTTPBodySuffixTree && !m_decodedHTTPBodySuffixTree->mightContain(canonicalizedSnippet))
+        return false;
+    return m_decodedHTTPBody.find(canonicalizedSnippet, 0, false) != notFound;
+}
+
+bool XSSFilter::isSameOriginResource(const String& url)
+{
+    // If the resource is loaded from the same URL as the enclosing page, it's
+    // probably not an XSS attack, so we reduce false positives by allowing the
+    // request. If the resource has a query string, we're more suspicious,
+    // however, because that's pretty rare and the attacker might be able to
+    // trick a server-side script into doing something dangerous with the query
+    // string.
+    KURL resourceURL(m_parser->document()->url(), url);
+    return (m_parser->document()->url().host() == resourceURL.host() && resourceURL.query().isEmpty());
+}
+
+}
diff --git a/Source/WebCore/html/parser/XSSFilter.h b/Source/WebCore/html/parser/XSSFilter.h
new file mode 100644
index 0000000..2c7d428
--- /dev/null
+++ b/Source/WebCore/html/parser/XSSFilter.h
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2011 Adam Barth. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef XSSFilter_h
+#define XSSFilter_h
+
+#include "HTMLToken.h"
+#include "HTTPParsers.h"
+#include "SuffixTree.h"
+
+namespace WebCore {
+
+class HTMLDocumentParser;
+
+class XSSFilter {
+    WTF_MAKE_NONCOPYABLE(XSSFilter);
+public:
+    explicit XSSFilter(HTMLDocumentParser*);
+
+    void filterToken(HTMLToken&);
+
+private:
+    enum State {
+        Uninitialized,
+        Initial,
+        AfterScriptStartTag,
+    };
+
+    void init();
+
+    bool filterTokenInitial(HTMLToken&);
+    bool filterTokenAfterScriptStartTag(HTMLToken&);
+
+    bool filterScriptToken(HTMLToken&);
+    bool filterObjectToken(HTMLToken&);
+    bool filterParamToken(HTMLToken&);
+    bool filterEmbedToken(HTMLToken&);
+    bool filterAppletToken(HTMLToken&);
+    bool filterMetaToken(HTMLToken&);
+    bool filterBaseToken(HTMLToken&);
+
+    bool eraseDangerousAttributesIfInjected(HTMLToken&);
+    bool eraseAttributeIfInjected(HTMLToken&, const QualifiedName&, const String& replacementValue = String());
+
+    String snippetForRange(const HTMLToken&, int start, int end);
+    String snippetForAttribute(const HTMLToken&, const HTMLToken::Attribute&);
+
+    bool isContainedInRequest(const String&);
+    bool isSameOriginResource(const String& url);
+
+    HTMLDocumentParser* m_parser;
+    bool m_isEnabled;
+    XSSProtectionDisposition m_xssProtection;
+
+    String m_decodedURL;
+    String m_decodedHTTPBody;
+    OwnPtr<SuffixTree<ASCIICodebook> > m_decodedHTTPBodySuffixTree;
+
+    State m_state;
+    String m_cachedSnippet;
+};
+
+}
+
+#endif
diff --git a/Source/WebCore/html/shadow/MediaControls.cpp b/Source/WebCore/html/shadow/MediaControls.cpp
new file mode 100644
index 0000000..731a934
--- /dev/null
+++ b/Source/WebCore/html/shadow/MediaControls.cpp
@@ -0,0 +1,572 @@
+/*
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(VIDEO)
+#include "MediaControls.h"
+
+#include "EventNames.h"
+#include "FloatConversion.h"
+#include "HTMLNames.h"
+#include "MediaControlElements.h"
+#include "MouseEvent.h"
+#include "Page.h"
+#include "RenderLayer.h"
+#include "RenderTheme.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/MathExtras.h>
+
+
+using namespace std;
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+static const double cTimeUpdateRepeatDelay = 0.2;
+static const double cOpacityAnimationRepeatDelay = 0.05;
+
+MediaControls::MediaControls(HTMLMediaElement* mediaElement)
+    : m_mediaElement(mediaElement)
+    , m_timeUpdateTimer(this, &MediaControls::timeUpdateTimerFired)
+    , m_opacityAnimationTimer(this, &MediaControls::opacityAnimationTimerFired)
+    , m_opacityAnimationStartTime(0)
+    , m_opacityAnimationDuration(0)
+    , m_opacityAnimationFrom(0)
+    , m_opacityAnimationTo(1.0f)
+    , m_mouseOver(false)
+{
+}
+
+void MediaControls::updateStyle()
+{
+    if (!m_controlsShadowRoot)
+        return;
+
+    if (m_panel)
+        m_panel->updateStyle();
+    if (m_muteButton)
+        m_muteButton->updateStyle();
+    if (m_playButton)
+        m_playButton->updateStyle();
+    if (m_seekBackButton)
+        m_seekBackButton->updateStyle();
+    if (m_seekForwardButton)
+        m_seekForwardButton->updateStyle();
+    if (m_rewindButton)
+        m_rewindButton->updateStyle();
+    if (m_returnToRealtimeButton)
+        m_returnToRealtimeButton->updateStyle();
+    if (m_toggleClosedCaptionsButton)
+        m_toggleClosedCaptionsButton->updateStyle();
+    if (m_statusDisplay)
+        m_statusDisplay->updateStyle();
+    if (m_timelineContainer)
+        m_timelineContainer->updateStyle();
+    if (m_timeline)
+        m_timeline->updateStyle();
+    if (m_fullscreenButton)
+        m_fullscreenButton->updateStyle();
+    if (m_currentTimeDisplay)
+        m_currentTimeDisplay->updateStyle();
+    if (m_timeRemainingDisplay)
+        m_timeRemainingDisplay->updateStyle();
+    if (m_volumeSliderContainer)
+        m_volumeSliderContainer->updateStyle();
+    if (m_volumeSliderMuteButton)
+        m_volumeSliderMuteButton->updateStyle();
+    if (m_volumeSlider)
+        m_volumeSlider->updateStyle();
+}
+
+void MediaControls::destroy()
+{
+    ASSERT(m_mediaElement->renderer());
+
+    if (m_controlsShadowRoot && m_controlsShadowRoot->renderer()) {
+
+        // detach the panel before removing the shadow renderer to prevent a crash in m_controlsShadowRoot->detach() 
+        //  when display: style changes
+        m_panel->detach();
+
+        m_mediaElement->renderer()->removeChild(m_controlsShadowRoot->renderer());
+        m_controlsShadowRoot->detach();
+        m_controlsShadowRoot = 0;
+    }
+}
+
+void MediaControls::update()
+{
+    HTMLMediaElement* media = m_mediaElement;
+    if (!media->controls() || !media->inActiveDocument()) {
+        if (m_controlsShadowRoot) {
+            m_controlsShadowRoot->detach();
+            m_panel = 0;
+            m_muteButton = 0;
+            m_playButton = 0;
+            m_statusDisplay = 0;
+            m_timelineContainer = 0;
+            m_timeline = 0;
+            m_seekBackButton = 0;
+            m_seekForwardButton = 0;
+            m_rewindButton = 0;
+            m_returnToRealtimeButton = 0;
+            m_currentTimeDisplay = 0;
+            m_timeRemainingDisplay = 0;
+            m_fullscreenButton = 0;
+            m_volumeSliderContainer = 0;
+            m_volumeSlider = 0;
+            m_volumeSliderMuteButton = 0;
+            m_controlsShadowRoot = 0;
+            m_toggleClosedCaptionsButton = 0;
+        }
+        m_opacityAnimationTo = 1.0f;
+        m_opacityAnimationTimer.stop();
+        m_timeUpdateTimer.stop();
+        return;
+    }
+
+    if (!m_controlsShadowRoot) {
+        createControlsShadowRoot();
+        createPanel();
+        if (m_panel) {
+            createRewindButton();
+            createPlayButton();
+            createReturnToRealtimeButton();
+            createStatusDisplay();
+            createTimelineContainer();
+            if (m_timelineContainer) {
+                createCurrentTimeDisplay();
+                createTimeline();
+                createTimeRemainingDisplay();
+            }
+            createSeekBackButton();
+            createSeekForwardButton();
+            createToggleClosedCaptionsButton();
+            createFullscreenButton();
+            createMuteButton();
+            createVolumeSliderContainer();
+            if (m_volumeSliderContainer) {
+                createVolumeSlider();
+                createVolumeSliderMuteButton();
+            }
+            m_panel->attach();
+        }
+    }
+
+    if (media->canPlay()) {
+        if (m_timeUpdateTimer.isActive())
+            m_timeUpdateTimer.stop();
+    } else if (media->renderer()->style()->visibility() == VISIBLE && m_timeline && m_timeline->renderer() && m_timeline->renderer()->style()->display() != NONE) {
+        m_timeUpdateTimer.startRepeating(cTimeUpdateRepeatDelay);
+    }
+
+    if (m_panel) {
+        // update() might alter the opacity of the element, especially if we are in the middle
+        // of an animation. This is the only element concerned as we animate only this element.
+        float opacityBeforeChangingStyle = m_panel->renderer() ? m_panel->renderer()->style()->opacity() : 0;
+        m_panel->update();
+        changeOpacity(m_panel.get(), opacityBeforeChangingStyle);
+    }
+    if (m_muteButton)
+        m_muteButton->update();
+    if (m_playButton)
+        m_playButton->update();
+    if (m_timelineContainer)
+        m_timelineContainer->update();
+    if (m_volumeSliderContainer)
+        m_volumeSliderContainer->update();
+    if (m_timeline)
+        m_timeline->update();
+    if (m_currentTimeDisplay)
+        m_currentTimeDisplay->update();
+    if (m_timeRemainingDisplay)
+        m_timeRemainingDisplay->update();
+    if (m_seekBackButton)
+        m_seekBackButton->update();
+    if (m_seekForwardButton)
+        m_seekForwardButton->update();
+    if (m_rewindButton)
+        m_rewindButton->update();
+    if (m_returnToRealtimeButton)
+        m_returnToRealtimeButton->update();
+    if (m_toggleClosedCaptionsButton)
+        m_toggleClosedCaptionsButton->update();
+    if (m_statusDisplay)
+        m_statusDisplay->update();
+    if (m_fullscreenButton)
+        m_fullscreenButton->update();
+    if (m_volumeSlider)
+        m_volumeSlider->update();
+    if (m_volumeSliderMuteButton)
+        m_volumeSliderMuteButton->update();
+
+    updateTimeDisplay();
+    updateControlVisibility();
+}
+
+void MediaControls::createControlsShadowRoot()
+{
+    ASSERT(!m_controlsShadowRoot);
+    m_controlsShadowRoot = MediaControlShadowRootElement::create(m_mediaElement);
+    m_mediaElement->renderer()->addChild(m_controlsShadowRoot->renderer());
+}
+
+void MediaControls::createPanel()
+{
+    ASSERT(!m_panel);
+    m_panel = MediaControlPanelElement::create(m_mediaElement);
+    m_panel->attachToParent(m_controlsShadowRoot.get());
+}
+
+void MediaControls::createMuteButton()
+{
+    ASSERT(!m_muteButton);
+    m_muteButton = MediaControlMuteButtonElement::create(m_mediaElement);
+    m_muteButton->attachToParent(m_panel.get());
+}
+
+void MediaControls::createPlayButton()
+{
+    ASSERT(!m_playButton);
+    m_playButton = MediaControlPlayButtonElement::create(m_mediaElement);
+    m_playButton->attachToParent(m_panel.get());
+}
+
+void MediaControls::createSeekBackButton()
+{
+    ASSERT(!m_seekBackButton);
+    m_seekBackButton = MediaControlSeekBackButtonElement::create(m_mediaElement);
+    m_seekBackButton->attachToParent(m_panel.get());
+}
+
+void MediaControls::createSeekForwardButton()
+{
+    ASSERT(!m_seekForwardButton);
+    m_seekForwardButton = MediaControlSeekForwardButtonElement::create(m_mediaElement);
+    m_seekForwardButton->attachToParent(m_panel.get());
+}
+
+void MediaControls::createRewindButton()
+{
+    ASSERT(!m_rewindButton);
+    m_rewindButton = MediaControlRewindButtonElement::create(m_mediaElement);
+    m_rewindButton->attachToParent(m_panel.get());
+}
+
+void MediaControls::createReturnToRealtimeButton()
+{
+    ASSERT(!m_returnToRealtimeButton);
+    m_returnToRealtimeButton = MediaControlReturnToRealtimeButtonElement::create(m_mediaElement);
+    m_returnToRealtimeButton->attachToParent(m_panel.get());
+}
+
+void MediaControls::createToggleClosedCaptionsButton()
+{
+    ASSERT(!m_toggleClosedCaptionsButton);
+    m_toggleClosedCaptionsButton = MediaControlToggleClosedCaptionsButtonElement::create(m_mediaElement);
+    m_toggleClosedCaptionsButton->attachToParent(m_panel.get());
+}
+
+void MediaControls::createStatusDisplay()
+{
+    ASSERT(!m_statusDisplay);
+    m_statusDisplay = MediaControlStatusDisplayElement::create(m_mediaElement);
+    m_statusDisplay->attachToParent(m_panel.get());
+}
+
+void MediaControls::createTimelineContainer()
+{
+    ASSERT(!m_timelineContainer);
+    m_timelineContainer = MediaControlTimelineContainerElement::create(m_mediaElement);
+    m_timelineContainer->attachToParent(m_panel.get());
+}
+
+void MediaControls::createTimeline()
+{
+    ASSERT(!m_timeline);
+    m_timeline = MediaControlTimelineElement::create(m_mediaElement);
+    m_timeline->setAttribute(precisionAttr, "float");
+    m_timeline->attachToParent(m_timelineContainer.get());
+}
+
+void MediaControls::createVolumeSliderContainer()
+{
+    ASSERT(!m_volumeSliderContainer);
+    m_volumeSliderContainer = MediaControlVolumeSliderContainerElement::create(m_mediaElement);
+    m_volumeSliderContainer->attachToParent(m_panel.get());
+}
+
+void MediaControls::createVolumeSlider()
+{
+    ASSERT(!m_volumeSlider);
+    m_volumeSlider = MediaControlVolumeSliderElement::create(m_mediaElement);
+    m_volumeSlider->setAttribute(precisionAttr, "float");
+    m_volumeSlider->setAttribute(maxAttr, "1");
+    m_volumeSlider->setAttribute(valueAttr, String::number(m_mediaElement->volume()));
+    m_volumeSlider->attachToParent(m_volumeSliderContainer.get());
+}
+
+void MediaControls::createVolumeSliderMuteButton()
+{
+    ASSERT(!m_volumeSliderMuteButton);
+    m_volumeSliderMuteButton = MediaControlVolumeSliderMuteButtonElement::create(m_mediaElement);
+    m_volumeSliderMuteButton->attachToParent(m_volumeSliderContainer.get());
+}
+
+void MediaControls::createCurrentTimeDisplay()
+{
+    ASSERT(!m_currentTimeDisplay);
+    m_currentTimeDisplay = MediaControlCurrentTimeDisplayElement::create(m_mediaElement);
+    m_currentTimeDisplay->attachToParent(m_timelineContainer.get());
+}
+
+void MediaControls::createTimeRemainingDisplay()
+{
+    ASSERT(!m_timeRemainingDisplay);
+    m_timeRemainingDisplay = MediaControlTimeRemainingDisplayElement::create(m_mediaElement);
+    m_timeRemainingDisplay->attachToParent(m_timelineContainer.get());
+}
+
+void MediaControls::createFullscreenButton()
+{
+    ASSERT(!m_fullscreenButton);
+    m_fullscreenButton = MediaControlFullscreenButtonElement::create(m_mediaElement);
+    m_fullscreenButton->attachToParent(m_panel.get());
+}
+
+void MediaControls::timeUpdateTimerFired(Timer<MediaControls>*)
+{
+    if (m_timeline)
+        m_timeline->update(false);
+    updateTimeDisplay();
+}
+
+void MediaControls::updateTimeDisplay()
+{
+    ASSERT(m_mediaElement->renderer());
+
+    if (!m_currentTimeDisplay || !m_currentTimeDisplay->renderer() || m_currentTimeDisplay->renderer()->style()->display() == NONE || m_mediaElement->renderer()->style()->visibility() != VISIBLE)
+        return;
+
+    float now = m_mediaElement->currentTime();
+    float duration = m_mediaElement->duration();
+
+    // Allow the theme to format the time
+    ExceptionCode ec;
+    m_currentTimeDisplay->setInnerText(m_mediaElement->renderer()->theme()->formatMediaControlsCurrentTime(now, duration), ec);
+    m_currentTimeDisplay->setCurrentValue(now);
+    m_timeRemainingDisplay->setInnerText(m_mediaElement->renderer()->theme()->formatMediaControlsRemainingTime(now, duration), ec);
+    m_timeRemainingDisplay->setCurrentValue(now - duration);
+}
+
+RenderBox* MediaControls::renderBox()
+{
+    return m_controlsShadowRoot ? m_controlsShadowRoot->renderBox() : 0;
+}
+
+void MediaControls::updateControlVisibility()
+{
+    if (!m_panel || !m_panel->renderer())
+        return;
+
+    // Don't fade for audio controls.
+    HTMLMediaElement* media = m_mediaElement;
+    if (!media->hasVideo())
+        return;
+
+    ASSERT(media->renderer());
+
+    // Don't fade if the media element is not visible
+    if (media->renderer()->style()->visibility() != VISIBLE)
+        return;
+    
+    bool shouldHideController = !m_mouseOver && !media->canPlay();
+
+    // Do fading manually, css animations don't work with shadow trees
+
+    float animateFrom = m_panel->renderer()->style()->opacity();
+    float animateTo = shouldHideController ? 0.0f : 1.0f;
+
+    if (animateFrom == animateTo)
+        return;
+
+    if (m_opacityAnimationTimer.isActive()) {
+        if (m_opacityAnimationTo == animateTo)
+            return;
+        m_opacityAnimationTimer.stop();
+    }
+
+    if (animateFrom < animateTo)
+        m_opacityAnimationDuration = m_panel->renderer()->theme()->mediaControlsFadeInDuration();
+    else
+        m_opacityAnimationDuration = m_panel->renderer()->theme()->mediaControlsFadeOutDuration();
+
+    m_opacityAnimationFrom = animateFrom;
+    m_opacityAnimationTo = animateTo;
+
+    m_opacityAnimationStartTime = currentTime();
+    m_opacityAnimationTimer.startRepeating(cOpacityAnimationRepeatDelay);
+}
+
+void MediaControls::changeOpacity(HTMLElement* e, float opacity)
+{
+    if (!e || !e->renderer() || !e->renderer()->style())
+        return;
+    RefPtr<RenderStyle> s = RenderStyle::clone(e->renderer()->style());
+    s->setOpacity(opacity);
+    // z-index can't be auto if opacity is used
+    s->setZIndex(0);
+    e->renderer()->setStyle(s.release());
+}
+
+void MediaControls::opacityAnimationTimerFired(Timer<MediaControls>*)
+{
+    double time = currentTime() - m_opacityAnimationStartTime;
+    if (time >= m_opacityAnimationDuration) {
+        time = m_opacityAnimationDuration;
+        m_opacityAnimationTimer.stop();
+    }
+    float opacity = narrowPrecisionToFloat(m_opacityAnimationFrom + (m_opacityAnimationTo - m_opacityAnimationFrom) * time / m_opacityAnimationDuration);
+    changeOpacity(m_panel.get(), opacity);
+}
+
+void MediaControls::updateVolumeSliderContainer(bool visible)
+{
+    if (!m_mediaElement->hasAudio() || !m_volumeSliderContainer || !m_volumeSlider)
+        return;
+
+    if (visible && !m_volumeSliderContainer->isVisible()) {
+        if (!m_muteButton || !m_muteButton->renderer() || !m_muteButton->renderBox())
+            return;
+
+        RefPtr<RenderStyle> s = m_volumeSliderContainer->styleForElement();
+        int height = s->height().isPercent() ? 0 : s->height().value();
+        int width = s->width().isPercent() ? 0 : s->width().value();
+        IntPoint offset = m_mediaElement->document()->page()->theme()->volumeSliderOffsetFromMuteButton(m_muteButton->renderer()->node(), IntSize(width, height));
+        int x = offset.x() + m_muteButton->renderBox()->offsetLeft();
+        int y = offset.y() + m_muteButton->renderBox()->offsetTop();
+
+        m_volumeSliderContainer->setPosition(x, y);
+        m_volumeSliderContainer->setVisible(true);
+        m_volumeSliderContainer->update();
+        m_volumeSlider->update();
+    } else if (!visible && m_volumeSliderContainer->isVisible()) {
+        m_volumeSliderContainer->setVisible(false);
+        m_volumeSliderContainer->updateStyle();
+    }
+}
+
+void MediaControls::forwardEvent(Event* event)
+{
+    ASSERT(m_mediaElement->renderer());
+
+    if (event->isMouseEvent() && m_controlsShadowRoot) {
+        MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
+        IntPoint point(mouseEvent->absoluteLocation());
+
+        bool defaultHandled = false;
+        if (m_volumeSliderMuteButton && m_volumeSliderMuteButton->hitTest(point)) {
+            m_volumeSliderMuteButton->defaultEventHandler(event);
+            defaultHandled = event->defaultHandled();
+        }
+
+        bool showVolumeSlider = false;
+        if (!defaultHandled && m_muteButton && m_muteButton->hitTest(point)) {
+            m_muteButton->defaultEventHandler(event);
+            if (event->type() != eventNames().mouseoutEvent)
+                showVolumeSlider = true;
+        }
+
+        if (m_volumeSliderContainer && m_volumeSliderContainer->hitTest(point))
+            showVolumeSlider = true;
+
+        if (m_volumeSlider && m_volumeSlider->hitTest(point)) {
+            m_volumeSlider->defaultEventHandler(event);
+            showVolumeSlider = true;
+        }
+
+        updateVolumeSliderContainer(showVolumeSlider);
+
+        if (m_playButton && m_playButton->hitTest(point))
+            m_playButton->defaultEventHandler(event);
+
+        if (m_seekBackButton && m_seekBackButton->hitTest(point))
+            m_seekBackButton->defaultEventHandler(event);
+
+        if (m_seekForwardButton && m_seekForwardButton->hitTest(point))
+            m_seekForwardButton->defaultEventHandler(event);
+
+        if (m_rewindButton && m_rewindButton->hitTest(point))
+            m_rewindButton->defaultEventHandler(event);
+
+        if (m_returnToRealtimeButton && m_returnToRealtimeButton->hitTest(point))
+            m_returnToRealtimeButton->defaultEventHandler(event);
+
+       if (m_toggleClosedCaptionsButton && m_toggleClosedCaptionsButton->hitTest(point))
+            m_toggleClosedCaptionsButton->defaultEventHandler(event);
+
+        if (m_timeline && m_timeline->hitTest(point))
+            m_timeline->defaultEventHandler(event);
+
+        if (m_fullscreenButton && m_fullscreenButton->hitTest(point))
+            m_fullscreenButton->defaultEventHandler(event);
+
+        if (event->type() == eventNames().mouseoverEvent) {
+            m_mouseOver = true;
+            updateControlVisibility();
+        }
+        if (event->type() == eventNames().mouseoutEvent) {
+            // When the scrollbar thumb captures mouse events, we should treat the mouse as still being over our renderer if the new target is a descendant
+            Node* mouseOverNode = mouseEvent->relatedTarget() ? mouseEvent->relatedTarget()->toNode() : 0;
+            RenderObject* mouseOverRenderer = mouseOverNode ? mouseOverNode->renderer() : 0;
+            m_mouseOver = mouseOverRenderer && mouseOverRenderer->isDescendantOf(m_mediaElement->renderer());
+            updateControlVisibility();
+        }
+    }
+}
+
+// We want the timeline slider to be at least 100 pixels wide.
+static const int minWidthToDisplayTimeDisplays = 16 + 16 + 45 + 100 + 45 + 16 + 1;
+
+void MediaControls::updateTimeDisplayVisibility()
+{
+    ASSERT(m_mediaElement->renderer());
+
+    if (!m_currentTimeDisplay && !m_timeRemainingDisplay)
+        return;
+
+    int width = m_mediaElement->renderBox()->width();
+    bool shouldShowTimeDisplays = width >= minWidthToDisplayTimeDisplays * m_mediaElement->renderer()->style()->effectiveZoom();
+
+    m_currentTimeDisplay->setVisible(shouldShowTimeDisplays);
+    m_timeRemainingDisplay->setVisible(shouldShowTimeDisplays);
+}
+
+}
+
+#endif
diff --git a/Source/WebCore/html/shadow/MediaControls.h b/Source/WebCore/html/shadow/MediaControls.h
new file mode 100644
index 0000000..98e017f
--- /dev/null
+++ b/Source/WebCore/html/shadow/MediaControls.h
@@ -0,0 +1,141 @@
+/*
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef MediaControls_h
+#define MediaControls_h
+
+#if ENABLE(VIDEO)
+
+#include "Timer.h"
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class HTMLElement;
+class HTMLInputElement;
+class HTMLMediaElement;
+class Event;
+class MediaControlMuteButtonElement;
+class MediaControlPlayButtonElement;
+class MediaControlSeekButtonElement;
+class MediaControlShadowRootElement;
+class MediaControlRewindButtonElement;
+class MediaControlReturnToRealtimeButtonElement;
+class MediaControlToggleClosedCaptionsButtonElement;
+class MediaControlTimelineElement;
+class MediaControlVolumeSliderElement;
+class MediaControlFullscreenButtonElement;
+class MediaControlTimeDisplayElement;
+class MediaControlStatusDisplayElement;
+class MediaControlTimelineContainerElement;
+class MediaControlVolumeSliderContainerElement;
+class MediaControlElement;
+class MediaPlayer;
+
+class RenderBox;
+class RenderMedia;
+
+class MediaControls {
+public:
+    MediaControls(HTMLMediaElement*);
+
+    void destroy();
+    void update();
+    void updateStyle();
+    void forwardEvent(Event*);
+    void updateTimeDisplay();
+    void updateTimeDisplayVisibility();
+
+    // FIXME: This is temporary to allow RenderMedia::layout tweak the position of controls.
+    // Once shadow DOM refactoring is complete, the tweaking will be in MediaControlsShadowRoot and this accessor will no longer be necessary.
+    RenderBox* renderBox();
+
+private:
+    void createControlsShadowRoot();
+    void destroyControlsShadowRoot();
+    void createPanel();
+    void createMuteButton();
+    void createPlayButton();
+    void createSeekBackButton();
+    void createSeekForwardButton();
+    void createRewindButton();
+    void createReturnToRealtimeButton();
+    void createToggleClosedCaptionsButton();
+    void createStatusDisplay();
+    void createTimelineContainer();
+    void createTimeline();
+    void createVolumeSliderContainer();
+    void createVolumeSlider();
+    void createVolumeSliderMuteButton();
+    void createCurrentTimeDisplay();
+    void createTimeRemainingDisplay();
+    void createFullscreenButton();
+
+    void timeUpdateTimerFired(Timer<MediaControls>*);
+
+    void updateControlVisibility();
+    void changeOpacity(HTMLElement*, float opacity);
+    void opacityAnimationTimerFired(Timer<MediaControls>*);
+
+    void updateVolumeSliderContainer(bool visible);
+
+private:
+    RefPtr<MediaControlShadowRootElement> m_controlsShadowRoot;
+    RefPtr<MediaControlElement> m_panel;
+    RefPtr<MediaControlMuteButtonElement> m_muteButton;
+    RefPtr<MediaControlPlayButtonElement> m_playButton;
+    RefPtr<MediaControlSeekButtonElement> m_seekBackButton;
+    RefPtr<MediaControlSeekButtonElement> m_seekForwardButton;
+    RefPtr<MediaControlRewindButtonElement> m_rewindButton;
+    RefPtr<MediaControlReturnToRealtimeButtonElement> m_returnToRealtimeButton;
+    RefPtr<MediaControlToggleClosedCaptionsButtonElement> m_toggleClosedCaptionsButton;
+    RefPtr<MediaControlTimelineElement> m_timeline;
+    RefPtr<MediaControlVolumeSliderElement> m_volumeSlider;
+    RefPtr<MediaControlMuteButtonElement> m_volumeSliderMuteButton;
+    RefPtr<MediaControlFullscreenButtonElement> m_fullscreenButton;
+    RefPtr<MediaControlTimelineContainerElement> m_timelineContainer;
+    RefPtr<MediaControlVolumeSliderContainerElement> m_volumeSliderContainer;
+    RefPtr<MediaControlTimeDisplayElement> m_currentTimeDisplay;
+    RefPtr<MediaControlTimeDisplayElement> m_timeRemainingDisplay;
+    RefPtr<MediaControlStatusDisplayElement> m_statusDisplay;
+
+    HTMLMediaElement* m_mediaElement;
+    Timer<MediaControls> m_timeUpdateTimer;
+    Timer<MediaControls> m_opacityAnimationTimer;
+
+    double m_opacityAnimationStartTime;
+    double m_opacityAnimationDuration;
+    float m_opacityAnimationFrom;
+    float m_opacityAnimationTo;
+
+    bool m_mouseOver;
+};
+
+
+}
+
+#endif
+#endif
diff --git a/Source/WebCore/html/shadow/ProgressBarValueElement.h b/Source/WebCore/html/shadow/ProgressBarValueElement.h
new file mode 100644
index 0000000..22f4e57
--- /dev/null
+++ b/Source/WebCore/html/shadow/ProgressBarValueElement.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ProgressBarValueElement_h
+#define ProgressBarValueElement_h
+
+#include "HTMLDivElement.h"
+#include "HTMLNames.h"
+#include "RenderProgress.h"
+#include <wtf/Forward.h>
+
+namespace WebCore {
+
+class ProgressBarValueElement : public HTMLDivElement {
+public:
+    ProgressBarValueElement(Document* document) 
+        : HTMLDivElement(HTMLNames::divTag, document)
+    {
+    }
+
+    virtual const AtomicString& shadowPseudoId() const;
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    static PassRefPtr<ProgressBarValueElement> create(Document*);
+
+};
+
+inline const AtomicString& ProgressBarValueElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, pseudId, ("-webkit-progress-bar-value"));
+    return pseudId;
+}
+
+inline RenderObject* ProgressBarValueElement::createRenderer(RenderArena* arena, RenderStyle*)
+{
+    return new (arena) RenderProgressBarValuePart(this);
+}
+
+inline PassRefPtr<ProgressBarValueElement> ProgressBarValueElement::create(Document* document)
+{
+    return adoptRef(new ProgressBarValueElement(document));
+}
+
+}
+
+#endif
diff --git a/Source/WebCore/html/shadow/SliderThumbElement.cpp b/Source/WebCore/html/shadow/SliderThumbElement.cpp
index 758d3c7..2c049cb 100644
--- a/Source/WebCore/html/shadow/SliderThumbElement.cpp
+++ b/Source/WebCore/html/shadow/SliderThumbElement.cpp
@@ -163,6 +163,8 @@ void SliderThumbElement::stopDragging()
         frame->page()->mainFrame()->eventHandler()->setCapturingTouchEventsNode(0);
 #endif
     m_inDragMode = false;
+    if (renderer())
+        renderer()->setNeedsLayout(true);
 }
 
 void SliderThumbElement::defaultEventHandler(Event* event)
@@ -246,5 +248,11 @@ void SliderThumbElement::detach()
     HTMLDivElement::detach();
 }
 
+const AtomicString& SliderThumbElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, sliderThumb, ("-webkit-slider-thumb"));
+    return sliderThumb;
+}
+
 }
 
diff --git a/Source/WebCore/html/shadow/SliderThumbElement.h b/Source/WebCore/html/shadow/SliderThumbElement.h
index 1f1c869..7c4c179 100644
--- a/Source/WebCore/html/shadow/SliderThumbElement.h
+++ b/Source/WebCore/html/shadow/SliderThumbElement.h
@@ -53,7 +53,7 @@ public:
     void dragFrom(const IntPoint&);
     virtual void defaultEventHandler(Event*);
     virtual void detach();
-    virtual AtomicString shadowPseudoId() const;
+    virtual const AtomicString& shadowPseudoId() const;
 
 private:
     SliderThumbElement(Document*);
@@ -77,12 +77,6 @@ inline PassRefPtr<SliderThumbElement> SliderThumbElement::create(Document* docum
     return adoptRef(new SliderThumbElement(document));
 }
 
-inline AtomicString SliderThumbElement::shadowPseudoId() const
-{
-    DEFINE_STATIC_LOCAL(AtomicString, sliderThumb, ("-webkit-slider-thumb"));
-    return sliderThumb;
-}
-
 inline SliderThumbElement* toSliderThumbElement(Node* node)
 {
     ASSERT(!node || node->isHTMLElement());
diff --git a/Source/WebCore/inspector/CodeGeneratorInspector.pm b/Source/WebCore/inspector/CodeGeneratorInspector.pm
index e215a91..e4e19b0 100644
--- a/Source/WebCore/inspector/CodeGeneratorInspector.pm
+++ b/Source/WebCore/inspector/CodeGeneratorInspector.pm
@@ -60,7 +60,7 @@ $typeTransform{"InjectedScript"} = {
     "domainAccessor" => "m_inspectorAgent->injectedScriptAgent()",
 };
 $typeTransform{"Inspector"} = {
-    "forwardHeader" => "InspectorController.h", # FIXME: Temporary solution until extracting the real InspectorAgent from InspectorController.
+    "forwardHeader" => "InspectorAgent.h",
     "domainAccessor" => "m_inspectorAgent",
 };
 $typeTransform{"Network"} = {
@@ -205,18 +205,20 @@ my $namespace;
 my $backendClassName;
 my $backendJSStubName;
 my %backendTypes;
-my %backendMethods;
+my @backendMethods;
 my @backendMethodsImpl;
+my %backendMethodSignatures;
 my $backendConstructor;
 my @backendConstantDeclarations;
 my @backendConstantDefinitions;
 my $backendFooter;
-my @backendStubJS;
+my @backendJSStubs;
 
 my $frontendClassName;
 my %frontendTypes;
-my %frontendMethods;
+my @frontendMethods;
 my @frontendMethodsImpl;
+my %frontendMethodSignatures;
 my $frontendConstructor;
 my @frontendConstantDeclarations;
 my @frontendConstantDefinitions;
@@ -259,17 +261,16 @@ sub GenerateInterface
 
     my $className = $interface->name;
 
-    $frontendClassName = $className . "Frontend";
+    $frontendClassName = "InspectorFrontend";
     $frontendConstructor = "    ${frontendClassName}(InspectorClient* inspectorClient) : m_inspectorClient(inspectorClient) { }";
-    $frontendFooter = "    InspectorClient* m_inspectorClient;";
+    $frontendFooter = "  private:\n    InspectorClient* m_inspectorClient;";
     $frontendTypes{"String"} = 1;
     $frontendTypes{"InspectorClient"} = 1;
     $frontendTypes{"PassRefPtr"} = 1;
 
-    $backendClassName = $className . "BackendDispatcher";
-    $backendJSStubName = $className . "BackendStub";
+    $backendClassName = "InspectorBackendDispatcher";
+    $backendJSStubName = "InspectorBackendStub";
     my @backendHead;
-    push(@backendHead, "    typedef InspectorController InspectorAgent;"); # FIXME: Temporary substitution until extracting InspectorAgent from InspectorController.
     push(@backendHead, "    ${backendClassName}(InspectorAgent* inspectorAgent) : m_inspectorAgent(inspectorAgent) { }");
     push(@backendHead, "    void reportProtocolError(const long callId, const String& errorText) const;");
     push(@backendHead, "    void dispatch(const String& message);");
@@ -281,12 +282,7 @@ sub GenerateInterface
     $backendTypes{"PassRefPtr"} = 1;
     $backendTypes{"Object"} = 1;
 
-    push(@backendMethodsImpl, generateBackendMessageParser());
     generateFunctions($interface);
-
-    # Make dispatcher methods private on the backend.
-    push(@backendConstantDeclarations, "");
-    push(@backendConstantDeclarations, "private:");
 }
 
 sub generateFunctions
@@ -295,55 +291,48 @@ sub generateFunctions
 
     foreach my $function (@{$interface->functions}) {
         if ($function->signature->extendedAttributes->{"notify"}) {
-            generateFrontendFunction($function);
+            generateFrontendFunction($interface, $function);
         } else {
-            generateBackendFunction($function);
+            generateBackendFunction($interface, $function);
         }
     }
-    push(@backendMethodsImpl, generateBackendDispatcher());
-    push(@backendMethodsImpl, generateBackendReportProtocolError());
 
-    foreach my $type (keys %backendTypes) {
-        if ($typeTransform{$type}{"JSONType"}) {
-            push(@backendMethodsImpl, generateArgumentGetters($type));
-        }
-    }
-
-    @backendStubJS = generateBackendStubJS($interface);
+    collectBackendJSStubFunctions($interface);
 }
 
 sub generateFrontendFunction
 {
+    my $interface = shift;
     my $function = shift;
 
     my $functionName = $function->signature->name;
 
-    my $domain = $function->signature->extendedAttributes->{"domain"} || "Inspector";
+    my $domain = $interface->name;
     my @argsFiltered = grep($_->direction eq "out", @{$function->parameters}); # just keep only out parameters for frontend interface.
     map($frontendTypes{$_->type} = 1, @argsFiltered); # register required types.
     my $arguments = join(", ", map($typeTransform{$_->type}->{"param"} . " " . $_->name, @argsFiltered)); # prepare arguments for function signature.
 
     my $signature = "    void ${functionName}(${arguments});";
-    if (!$frontendMethods{${signature}}) {
-        $frontendMethods{${signature}} = 1;
-
-        my @function;
-        push(@function, "void ${frontendClassName}::${functionName}(${arguments})");
-        push(@function, "{");
-        push(@function, "    RefPtr<InspectorObject> ${functionName}Message = InspectorObject::create();");
-        push(@function, "    ${functionName}Message->setString(\"type\", \"event\");");
-        push(@function, "    ${functionName}Message->setString(\"domain\", \"$domain\");");
-        push(@function, "    ${functionName}Message->setString(\"event\", \"$functionName\");");
-        push(@function, "    RefPtr<InspectorObject> payloadDataObject = InspectorObject::create();");
-        my @pushArguments = map("    payloadDataObject->set" . $typeTransform{$_->type}->{"JSONType"} . "(\"" . $_->name . "\", " . $_->name . ");", @argsFiltered);
-        push(@function, @pushArguments);
-        push(@function, "    ${functionName}Message->setObject(\"data\", payloadDataObject);");
-        push(@function, "    m_inspectorClient->sendMessageToFrontend(${functionName}Message->toJSONString());");
-
-        push(@function, "}");
-        push(@function, "");
-        push(@frontendMethodsImpl, @function);
-    }
+    !$frontendMethodSignatures{${signature}} || die "Duplicate frontend function was detected for signature '$signature'.";
+    $frontendMethodSignatures{${signature}} = 1;
+    push(@frontendMethods, $signature);
+
+    my @function;
+    push(@function, "void ${frontendClassName}::${functionName}(${arguments})");
+    push(@function, "{");
+    push(@function, "    RefPtr<InspectorObject> ${functionName}Message = InspectorObject::create();");
+    push(@function, "    ${functionName}Message->setString(\"type\", \"event\");");
+    push(@function, "    ${functionName}Message->setString(\"domain\", \"$domain\");");
+    push(@function, "    ${functionName}Message->setString(\"event\", \"$functionName\");");
+    push(@function, "    RefPtr<InspectorObject> payloadDataObject = InspectorObject::create();");
+    my @pushArguments = map("    payloadDataObject->set" . $typeTransform{$_->type}->{"JSONType"} . "(\"" . $_->name . "\", " . $_->name . ");", @argsFiltered);
+    push(@function, @pushArguments);
+    push(@function, "    ${functionName}Message->setObject(\"data\", payloadDataObject);");
+    push(@function, "    m_inspectorClient->sendMessageToFrontend(${functionName}Message->toJSONString());");
+
+    push(@function, "}");
+    push(@function, "");
+    push(@frontendMethodsImpl, @function);
 }
 
 sub camelCase
@@ -356,29 +345,32 @@ sub camelCase
 
 sub generateBackendFunction
 {
+    my $interface = shift;
     my $function = shift;
 
     my $functionName = $function->signature->name;
+    my $fullQualifiedFunctionName = $interface->name . "_" . $function->signature->name;
 
-    push(@backendConstantDeclarations, "    static const char* ${functionName}Cmd;");
-    push(@backendConstantDefinitions, "const char* ${backendClassName}::${functionName}Cmd = \"${functionName}\";");
+    push(@backendConstantDeclarations, "    static const char* ${fullQualifiedFunctionName}Cmd;");
+    push(@backendConstantDefinitions, "const char* ${backendClassName}::${fullQualifiedFunctionName}Cmd = \"${functionName}\";");
 
     map($backendTypes{$_->type} = 1, @{$function->parameters}); # register required types
     my @inArgs = grep($_->direction eq "in" && !($_->name eq "callId") , @{$function->parameters});
     my @outArgs = grep($_->direction eq "out", @{$function->parameters});
 
-    my $signature = "    void ${functionName}(long callId, InspectorObject* requestMessageObject);";
-    !$backendMethods{${signature}} || die "Duplicate function was detected for signature '$signature'.";
-    $backendMethods{${signature}} = $functionName;
+    my $signature = "    void ${fullQualifiedFunctionName}(long callId, InspectorObject* requestMessageObject);";
+    !$backendMethodSignatures{${signature}} || die "Duplicate function was detected for signature '$signature'.";
+    $backendMethodSignatures{${signature}} = "$fullQualifiedFunctionName";
+    push(@backendMethods, ${signature});
 
     my @function;
     my $requestMessageObject = scalar(@inArgs) ? " requestMessageObject" : "";
-    push(@function, "void ${backendClassName}::${functionName}(long callId, InspectorObject*$requestMessageObject)");
+    push(@function, "void ${backendClassName}::${fullQualifiedFunctionName}(long callId, InspectorObject*$requestMessageObject)");
     push(@function, "{");
     push(@function, "    RefPtr<InspectorArray> protocolErrors = InspectorArray::create();");
     push(@function, "");
 
-    my $domain = $function->signature->extendedAttributes->{"domain"} || "Inspector";
+    my $domain = $interface->name;
     my $domainAccessor = $typeTransform{$domain}->{"domainAccessor"};
     $backendTypes{$domain} = 1;
     push(@function, "    if (!$domainAccessor)");
@@ -463,7 +455,7 @@ sub generateArgumentGetters
     my $return  = $typeTransform{$type}{"return"} ? $typeTransform{$type}{"return"} : $typeTransform{$type}{"param"};
 
     my $typeString = camelCase($type);
-    push(@backendConstantDeclarations, "$return get$typeString(InspectorObject* object, const String& name, InspectorArray* protocolErrors);");
+    push(@backendConstantDeclarations, "    $return get$typeString(InspectorObject* object, const String& name, InspectorArray* protocolErrors);");
     my $getterBody = << "EOF";
 
 $return InspectorBackendDispatcher::get$typeString(InspectorObject* object, const String& name, InspectorArray* protocolErrors)
@@ -491,8 +483,7 @@ EOF
 sub generateBackendDispatcher
 {
     my @body;
-    my @methods = map($backendMethods{$_}, keys %backendMethods);
-    my @mapEntries = map("        dispatchMap.add(${_}Cmd, &${backendClassName}::$_);", @methods);
+    my @mapEntries = map("        dispatchMap.add(${_}Cmd, &${backendClassName}::$_);", map ($backendMethodSignatures{$_}, @backendMethods));
     my $mapEntries = join("\n", @mapEntries);
 
     my $backendDispatcherBody = << "EOF";
@@ -573,30 +564,31 @@ bool ${backendClassName}::getCommandName(const String& message, String* result)
 
     return commandValue->asString(result);
 }
-
 EOF
     return split("\n", $messageParserBody);
 }
 
-sub generateBackendStubJS
+sub collectBackendJSStubFunctions
 {
     my $interface = shift;
-    my @backendFunctions = grep(!$_->signature->extendedAttributes->{"notify"}, @{$interface->functions});
-    my @JSStubs;
+    my @functions = grep(!$_->signature->extendedAttributes->{"notify"}, @{$interface->functions});
+    my $domain = $interface->name;
 
-    foreach my $function (@backendFunctions) {
+    foreach my $function (@functions) {
         my $name = $function->signature->name;
-        my $domain = $function->signature->extendedAttributes->{"domain"};
         my $argumentNames = join(",", map("\"" . $_->name . "\": \"" . $typeTransform{$_->type}->{"JSType"} . "\"", grep($_->direction eq "in", @{$function->parameters})));
-        push(@JSStubs, "    this._registerDelegate('{" .
+        push(@backendJSStubs, "    this._registerDelegate('{" .
             "\"seq\": 0, " .
             "\"domain\": \"$domain\", " .
             "\"command\": \"$name\", " .
             "\"arguments\": {$argumentNames}" .
         "}');");
     }
+}
 
-    my $JSStubs = join("\n", @JSStubs);
+sub generateBackendStubJS
+{
+    my $JSStubs = join("\n", @backendJSStubs);
     my $inspectorBackendStubJS = << "EOF";
 $licenseTemplate
 
@@ -735,7 +727,7 @@ sub generateHeader
     my $forwardHeaders = join("\n", sort(map("#include <" . $typeTransform{$_}->{"forwardHeader"} . ">", grep($typeTransform{$_}->{"forwardHeader"}, keys %{$types}))));
     my $forwardDeclarations = join("\n", sort(map("class " . $typeTransform{$_}->{"forward"} . ";", grep($typeTransform{$_}->{"forward"}, keys %{$types}))));
     my $constantDeclarations = join("\n", @{$constants});
-    my $methodsDeclarations = join("\n", keys %{$methods});
+    my $methodsDeclarations = join("\n", @{$methods});
 
     my $headerBody = << "EOF";
 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
@@ -757,7 +749,6 @@ $constructor
 $constantDeclarations
 $methodsDeclarations
 
-private:
 $footer
 };
 
@@ -792,7 +783,7 @@ sub generateSource
     push(@sourceContent, "");
     push(@sourceContent, "namespace $namespace {");
     push(@sourceContent, "");
-    push (@sourceContent, join("\n", @{$constants}));
+    push(@sourceContent, join("\n", @{$constants}));
     push(@sourceContent, "");
     push(@sourceContent, @{$methods});
     push(@sourceContent, "");
@@ -807,28 +798,46 @@ sub finish
 {
     my $object = shift;
 
+    push(@backendMethodsImpl, generateBackendDispatcher());
+    push(@backendMethodsImpl, generateBackendReportProtocolError());
+
     open(my $SOURCE, ">$outputDir/$frontendClassName.cpp") || die "Couldn't open file $outputDir/$frontendClassName.cpp";
     print $SOURCE join("\n", generateSource($frontendClassName, \%frontendTypes, \@frontendConstantDefinitions, \@frontendMethodsImpl));
     close($SOURCE);
     undef($SOURCE);
 
     open(my $HEADER, ">$outputHeadersDir/$frontendClassName.h") || die "Couldn't open file $outputHeadersDir/$frontendClassName.h";
-    print $HEADER generateHeader($frontendClassName, \%frontendTypes, $frontendConstructor, \@frontendConstantDeclarations, \%frontendMethods, $frontendFooter);
+    print $HEADER generateHeader($frontendClassName, \%frontendTypes, $frontendConstructor, \@frontendConstantDeclarations, \@frontendMethods, $frontendFooter);
     close($HEADER);
     undef($HEADER);
 
+    # Make dispatcher methods private on the backend.
+    push(@backendConstantDeclarations, "");
+    push(@backendConstantDeclarations, "private:");
+
+    foreach my $type (keys %backendTypes) {
+        if ($typeTransform{$type}{"JSONType"}) {
+            push(@backendMethodsImpl, generateArgumentGetters($type));
+        }
+    }
+
+    push(@backendMethodsImpl, generateBackendMessageParser());
+    push(@backendMethodsImpl, "");
+
+    push(@backendConstantDeclarations, "");
+
     open($SOURCE, ">$outputDir/$backendClassName.cpp") || die "Couldn't open file $outputDir/$backendClassName.cpp";
     print $SOURCE join("\n", generateSource($backendClassName, \%backendTypes, \@backendConstantDefinitions, \@backendMethodsImpl));
     close($SOURCE);
     undef($SOURCE);
 
     open($HEADER, ">$outputHeadersDir/$backendClassName.h") || die "Couldn't open file $outputHeadersDir/$backendClassName.h";
-    print $HEADER join("\n", generateHeader($backendClassName, \%backendTypes, $backendConstructor, \@backendConstantDeclarations, \%backendMethods, $backendFooter));
+    print $HEADER join("\n", generateHeader($backendClassName, \%backendTypes, $backendConstructor, \@backendConstantDeclarations, \@backendMethods, $backendFooter));
     close($HEADER);
     undef($HEADER);
 
     open(my $JS_STUB, ">$outputDir/$backendJSStubName.js") || die "Couldn't open file $outputDir/$backendJSStubName.js";
-    print $JS_STUB join("\n", @backendStubJS);
+    print $JS_STUB join("\n", generateBackendStubJS());
     close($JS_STUB);
     undef($JS_STUB);
 }
diff --git a/Source/WebCore/inspector/InjectedScript.cpp b/Source/WebCore/inspector/InjectedScript.cpp
index 1969f34..9fd606b 100644
--- a/Source/WebCore/inspector/InjectedScript.cpp
+++ b/Source/WebCore/inspector/InjectedScript.cpp
@@ -44,20 +44,22 @@ InjectedScript::InjectedScript(ScriptObject injectedScriptObject)
 {
 }
 
-void InjectedScript::evaluate(const String& expression, const String& objectGroup, RefPtr<InspectorValue>* result)
+void InjectedScript::evaluate(const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result)
 {
     ScriptFunctionCall function(m_injectedScriptObject, "evaluate");
     function.appendArgument(expression);
     function.appendArgument(objectGroup);
+    function.appendArgument(includeCommandLineAPI);
     makeCall(function, result);
 }
 
-void InjectedScript::evaluateOnCallFrame(PassRefPtr<InspectorObject> callFrameId, const String& expression, const String& objectGroup, RefPtr<InspectorValue>* result)
+void InjectedScript::evaluateOnCallFrame(PassRefPtr<InspectorObject> callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result)
 {
     ScriptFunctionCall function(m_injectedScriptObject, "evaluateOnCallFrame");
     function.appendArgument(callFrameId->toJSONString());
     function.appendArgument(expression);
     function.appendArgument(objectGroup);
+    function.appendArgument(includeCommandLineAPI);
     makeCall(function, result);
 }
 
@@ -69,20 +71,20 @@ void InjectedScript::evaluateOnSelf(const String& functionBody, PassRefPtr<Inspe
     makeCall(function, result);
 }
 
-void InjectedScript::getCompletions(const String& expression, bool includeInspectorCommandLineAPI, RefPtr<InspectorValue>* result)
+void InjectedScript::getCompletions(const String& expression, bool includeCommandLineAPI, RefPtr<InspectorValue>* result)
 {
     ScriptFunctionCall function(m_injectedScriptObject, "getCompletions");
     function.appendArgument(expression);
-    function.appendArgument(includeInspectorCommandLineAPI);
+    function.appendArgument(includeCommandLineAPI);
     makeCall(function, result);
 }
 
-void InjectedScript::getCompletionsOnCallFrame(PassRefPtr<InspectorObject> callFrameId, const String& expression, bool includeInspectorCommandLineAPI, RefPtr<InspectorValue>* result)
+void InjectedScript::getCompletionsOnCallFrame(PassRefPtr<InspectorObject> callFrameId, const String& expression, bool includeCommandLineAPI, RefPtr<InspectorValue>* result)
 {
     ScriptFunctionCall function(m_injectedScriptObject, "getCompletionsOnCallFrame");
     function.appendArgument(callFrameId->toJSONString());
     function.appendArgument(expression);
-    function.appendArgument(includeInspectorCommandLineAPI);
+    function.appendArgument(includeCommandLineAPI);
     makeCall(function, result);
 }
 
diff --git a/Source/WebCore/inspector/InjectedScript.h b/Source/WebCore/inspector/InjectedScript.h
index 0a3f24b..0dd41ae 100644
--- a/Source/WebCore/inspector/InjectedScript.h
+++ b/Source/WebCore/inspector/InjectedScript.h
@@ -50,11 +50,11 @@ public:
 
     bool hasNoValue() const { return m_injectedScriptObject.hasNoValue(); }
 
-    void evaluate(const String& expression, const String& objectGroup, RefPtr<InspectorValue>* result);
-    void evaluateOnCallFrame(PassRefPtr<InspectorObject> callFrameId, const String& expression, const String& objectGroup, RefPtr<InspectorValue>* result);
+    void evaluate(const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result);
+    void evaluateOnCallFrame(PassRefPtr<InspectorObject> callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result);
     void evaluateOnSelf(const String& functionBody, PassRefPtr<InspectorArray> argumentsArray, RefPtr<InspectorValue>* result);
-    void getCompletions(const String& expression, bool includeInspectorCommandLineAPI, RefPtr<InspectorValue>* result);
-    void getCompletionsOnCallFrame(PassRefPtr<InspectorObject> callFrameId, const String& expression, bool includeInspectorCommandLineAPI, RefPtr<InspectorValue>* result);
+    void getCompletions(const String& expression, bool includeCommandLineAPI, RefPtr<InspectorValue>* result);
+    void getCompletionsOnCallFrame(PassRefPtr<InspectorObject> callFrameId, const String& expression, bool includeCommandLineAPI, RefPtr<InspectorValue>* result);
     void getProperties(PassRefPtr<InspectorObject> objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorValue>* result);
     void pushNodeToFrontend(PassRefPtr<InspectorObject> objectId, RefPtr<InspectorValue>* result);
     void resolveNode(long nodeId, RefPtr<InspectorValue>* result);
diff --git a/Source/WebCore/inspector/InjectedScriptHost.cpp b/Source/WebCore/inspector/InjectedScriptHost.cpp
index d67adaf..fbb4dbf 100644
--- a/Source/WebCore/inspector/InjectedScriptHost.cpp
+++ b/Source/WebCore/inspector/InjectedScriptHost.cpp
@@ -39,9 +39,9 @@
 #include "HTMLFrameOwnerElement.h"
 #include "InjectedScript.h"
 #include "InjectedScriptSource.h"
+#include "InspectorAgent.h"
 #include "InspectorClient.h"
 #include "InspectorConsoleAgent.h"
-#include "InspectorController.h"
 #include "InspectorDOMAgent.h"
 #include "InspectorDOMStorageAgent.h"
 #include "InspectorDatabaseAgent.h"
@@ -69,8 +69,8 @@ using namespace std;
 
 namespace WebCore {
 
-InjectedScriptHost::InjectedScriptHost(InspectorController* inspectorController)
-    : m_inspectorController(inspectorController)
+InjectedScriptHost::InjectedScriptHost(InspectorAgent* inspectorAgent)
+    : m_inspectorAgent(inspectorAgent)
     , m_nextInjectedScriptId(1)
     , m_lastWorkerId(1 << 31) // Distinguish ids of fake workers from real ones, to minimize the chances they overlap.
 {
@@ -89,8 +89,8 @@ void InjectedScriptHost::evaluateOnSelf(const String& functionBody, PassRefPtr<I
 
 void InjectedScriptHost::clearConsoleMessages()
 {
-    if (m_inspectorController)
-        m_inspectorController->consoleAgent()->clearConsoleMessages();
+    if (m_inspectorAgent)
+        m_inspectorAgent->consoleAgent()->clearConsoleMessages();
 }
 
 void InjectedScriptHost::copyText(const String& text)
@@ -130,23 +130,23 @@ long InjectedScriptHost::inspectedNode(unsigned long num)
 #if ENABLE(DATABASE)
 Database* InjectedScriptHost::databaseForId(long databaseId)
 {
-    if (m_inspectorController && m_inspectorController->databaseAgent())
-        return m_inspectorController->databaseAgent()->databaseForId(databaseId);
+    if (m_inspectorAgent && m_inspectorAgent->databaseAgent())
+        return m_inspectorAgent->databaseAgent()->databaseForId(databaseId);
     return 0;
 }
 
 void InjectedScriptHost::selectDatabase(Database* database)
 {
-    if (m_inspectorController && m_inspectorController->databaseAgent())
-        m_inspectorController->databaseAgent()->selectDatabase(database);
+    if (m_inspectorAgent && m_inspectorAgent->databaseAgent())
+        m_inspectorAgent->databaseAgent()->selectDatabase(database);
 }
 #endif
 
 #if ENABLE(DOM_STORAGE)
 void InjectedScriptHost::selectDOMStorage(Storage* storage)
 {
-    if (m_inspectorController && m_inspectorController->domStorageAgent())
-        m_inspectorController->domStorageAgent()->selectDOMStorage(storage);
+    if (m_inspectorAgent && m_inspectorAgent->domStorageAgent())
+        m_inspectorAgent->domStorageAgent()->selectDOMStorage(storage);
 }
 #endif
 
@@ -166,7 +166,7 @@ InjectedScript InjectedScriptHost::injectedScriptForObjectId(InspectorObject* ob
 
 InjectedScript InjectedScriptHost::injectedScriptForMainFrame()
 {
-    return injectedScriptFor(mainWorldScriptState(m_inspectorController->inspectedPage()->mainFrame()));
+    return injectedScriptFor(mainWorldScriptState(m_inspectorAgent->inspectedPage()->mainFrame()));
 }
 
 void InjectedScriptHost::discardInjectedScripts()
@@ -192,16 +192,16 @@ void InjectedScriptHost::releaseWrapperObjectGroup(long injectedScriptId, const
 
 InspectorDOMAgent* InjectedScriptHost::inspectorDOMAgent()
 {
-    if (!m_inspectorController)
+    if (!m_inspectorAgent)
         return 0;
-    return m_inspectorController->domAgent();
+    return m_inspectorAgent->domAgent();
 }
 
 InspectorFrontend* InjectedScriptHost::frontend()
 {
-    if (!m_inspectorController)
+    if (!m_inspectorAgent)
         return 0;
-    return m_inspectorController->frontend();
+    return m_inspectorAgent->frontend();
 }
 
 String InjectedScriptHost::injectedScriptSource()
@@ -223,14 +223,14 @@ long InjectedScriptHost::nextWorkerId()
 
 void InjectedScriptHost::didCreateWorker(long id, const String& url, bool isSharedWorker)
 {
-    if (m_inspectorController)
-        m_inspectorController->didCreateWorker(id, url, isSharedWorker);
+    if (m_inspectorAgent)
+        m_inspectorAgent->didCreateWorker(id, url, isSharedWorker);
 }
 
 void InjectedScriptHost::didDestroyWorker(long id)
 {
-    if (m_inspectorController)
-        m_inspectorController->didDestroyWorker(id);
+    if (m_inspectorAgent)
+        m_inspectorAgent->didDestroyWorker(id);
 }
 #endif // ENABLE(WORKERS)
 
diff --git a/Source/WebCore/inspector/InjectedScriptHost.h b/Source/WebCore/inspector/InjectedScriptHost.h
index 108f118..f51f8da 100644
--- a/Source/WebCore/inspector/InjectedScriptHost.h
+++ b/Source/WebCore/inspector/InjectedScriptHost.h
@@ -31,7 +31,7 @@
 #define InjectedScriptHost_h
 
 #include "Console.h"
-#include "InspectorController.h"
+#include "InspectorAgent.h"
 #include "PlatformString.h"
 #include "ScriptState.h"
 
@@ -52,9 +52,9 @@ class Storage;
 class InjectedScriptHost : public RefCounted<InjectedScriptHost>
 {
 public:
-    static PassRefPtr<InjectedScriptHost> create(InspectorController* inspectorController)
+    static PassRefPtr<InjectedScriptHost> create(InspectorAgent* inspectorAgent)
     {
-        return adoptRef(new InjectedScriptHost(inspectorController));
+        return adoptRef(new InjectedScriptHost(inspectorAgent));
     }
 
     ~InjectedScriptHost();
@@ -62,8 +62,8 @@ public:
     // Part of the protocol.
     void evaluateOnSelf(const String& functionBody, PassRefPtr<InspectorArray> argumentsArray, RefPtr<InspectorValue>* result);
 
-    InspectorController* inspectorController() { return m_inspectorController; }
-    void disconnectController() { m_inspectorController = 0; }
+    InspectorAgent* inspectorAgent() { return m_inspectorAgent; }
+    void disconnectController() { m_inspectorAgent = 0; }
 
     void clearConsoleMessages();
 
@@ -96,14 +96,14 @@ public:
     static bool canAccessInspectedWindow(ScriptState*);
 
 private:
-    InjectedScriptHost(InspectorController* inspectorController);
+    InjectedScriptHost(InspectorAgent*);
     InspectorDOMAgent* inspectorDOMAgent();
     InspectorFrontend* frontend();
     String injectedScriptSource();
     ScriptObject createInjectedScript(const String& source, ScriptState* scriptState, long id);
     void discardInjectedScript(ScriptState*);
 
-    InspectorController* m_inspectorController;
+    InspectorAgent* m_inspectorAgent;
     long m_nextInjectedScriptId;
     long m_lastWorkerId;
     typedef HashMap<long, InjectedScript> IdToInjectedScriptMap;
diff --git a/Source/WebCore/inspector/InjectedScriptSource.js b/Source/WebCore/inspector/InjectedScriptSource.js
index 3aa24a6..c88e8e4 100644
--- a/Source/WebCore/inspector/InjectedScriptSource.js
+++ b/Source/WebCore/inspector/InjectedScriptSource.js
@@ -28,6 +28,20 @@
 
 (function (InjectedScriptHost, inspectedWindow, injectedScriptId) {
 
+function bind(thisObject, memberFunction)
+{
+    var func = memberFunction;
+    var args = Array.prototype.slice.call(arguments, 2);
+    function bound()
+    {
+        return func.apply(thisObject, args.concat(Array.prototype.slice.call(arguments, 0)));
+    }
+    bound.toString = function() {
+        return "bound: " + func;
+    };
+    return bound;
+}
+
 var InjectedScript = function()
 {
     this._lastBoundObjectId = 1;
@@ -186,27 +200,27 @@ InjectedScript.prototype = {
         return Object.keys(propertyNameSet);
     },
 
-    getCompletions: function(expression, includeInspectorCommandLineAPI)
+    getCompletions: function(expression, includeCommandLineAPI)
     {
         var props = {};
         try {
             if (!expression)
                 expression = "this";
-            var expressionResult = this._evaluateOn(inspectedWindow.eval, inspectedWindow, expression, false);
+            var expressionResult = this._evaluateOn(inspectedWindow.eval, inspectedWindow, expression, false, false);
 
             if (typeof expressionResult === "object")
                 this._populatePropertyNames(expressionResult, props);
-    
-            if (includeInspectorCommandLineAPI) {
-                for (var prop in this._commandLineAPI)
-                    props[prop] = true;
+
+            if (includeCommandLineAPI) {
+                for (var prop in CommandLineAPI.members_)
+                    props[CommandLineAPI.members_[prop]] = true;
             }
         } catch(e) {
         }
         return props;
     },
 
-    getCompletionsOnCallFrame: function(callFrameId, expression, includeInspectorCommandLineAPI)
+    getCompletionsOnCallFrame: function(callFrameId, expression, includeCommandLineAPI)
     {
         var props = {};
         try {
@@ -215,7 +229,7 @@ InjectedScript.prototype = {
                 return props;
 
             if (expression) {
-                var expressionResult = this._evaluateOn(callFrame.evaluate, callFrame, expression, true);
+                var expressionResult = this._evaluateOn(callFrame.evaluate, callFrame, expression, true, false);
                 if (typeof expressionResult === "object")
                     this._populatePropertyNames(expressionResult, props);
             } else {
@@ -225,49 +239,52 @@ InjectedScript.prototype = {
                     this._populatePropertyNames(scopeChain[i], props);
             }
     
-            if (includeInspectorCommandLineAPI) {
-                for (var prop in this._commandLineAPI)
-                    props[prop] = true;
+            if (includeCommandLineAPI) {
+                for (var prop in CommandLineAPI.members_)
+                    props[CommandLineAPI.members_[prop]] = true;
             }
         } catch(e) {
         }
         return props;
     },
 
-    evaluate: function(expression, objectGroup)
+    evaluate: function(expression, objectGroup, injectCommandLineAPI)
     {
-        return this._evaluateAndWrap(inspectedWindow.eval, inspectedWindow, expression, objectGroup, false);
+        return this._evaluateAndWrap(inspectedWindow.eval, inspectedWindow, expression, objectGroup, false, injectCommandLineAPI);
     },
 
-    _evaluateAndWrap: function(evalFunction, object, expression, objectGroup, isEvalOnCallFrame)
+    _evaluateAndWrap: function(evalFunction, object, expression, objectGroup, isEvalOnCallFrame, injectCommandLineAPI)
     {
         try {
-            return this._wrapObject(this._evaluateOn(evalFunction, object, expression, isEvalOnCallFrame), objectGroup);
+            return this._wrapObject(this._evaluateOn(evalFunction, object, expression, isEvalOnCallFrame, injectCommandLineAPI), objectGroup);
         } catch (e) {
             return InjectedScript.RemoteObject.fromException(e);
         }
     },
 
-    _evaluateOn: function(evalFunction, object, expression, isEvalOnCallFrame)
+    _evaluateOn: function(evalFunction, object, expression, isEvalOnCallFrame, injectCommandLineAPI)
     {
         // Only install command line api object for the time of evaluation.
         // Surround the expression in with statements to inject our command line API so that
         // the window object properties still take more precedent than our API functions.
-        inspectedWindow.console._commandLineAPI = this._commandLineAPI;
-    
-        // We don't want local variables to be shadowed by global ones when evaluating on CallFrame.
-        if (!isEvalOnCallFrame)
-            expression = "with (window) {\n" + expression + "\n} ";
-        expression = "with (window ? window.console._commandLineAPI : {}) {\n" + expression + "\n}";
-        var value = evalFunction.call(object, expression);
-    
-        delete inspectedWindow.console._commandLineAPI;
-    
-        // When evaluating on call frame error is not thrown, but returned as a value.
-        if (this._type(value) === "error")
-            throw value.toString();
-    
-        return value;
+
+        try {
+            if (injectCommandLineAPI && inspectedWindow.console) {
+                inspectedWindow.console._commandLineAPI = new CommandLineAPI(this._commandLineAPIImpl, isEvalOnCallFrame ? object : null);
+                expression = "with ((window && window.console && window.console._commandLineAPI) || {}) {\n" + expression + "\n}";
+            }
+
+            var value = evalFunction.call(object, expression);
+
+            // When evaluating on call frame error is not thrown, but returned as a value.
+            if (this._type(value) === "error")
+                throw value.toString();
+
+            return value;
+        } finally {
+            if (injectCommandLineAPI && inspectedWindow.console)
+                delete inspectedWindow.console._commandLineAPI;
+        }
     },
 
     getNodeId: function(node)
@@ -291,12 +308,12 @@ InjectedScript.prototype = {
         return result;
     },
 
-    evaluateOnCallFrame: function(callFrameId, code, objectGroup)
+    evaluateOnCallFrame: function(callFrameId, expression, objectGroup, injectCommandLineAPI)
     {
         var callFrame = this._callFrameForId(callFrameId);
         if (!callFrame)
             return false;
-        return this._evaluateAndWrap(callFrame.evaluate, callFrame, code, objectGroup, true);
+        return this._evaluateAndWrap(callFrame.evaluate, callFrame, expression, objectGroup, true, injectCommandLineAPI);
     },
 
     _callFrameForId: function(callFrameId)
@@ -471,49 +488,6 @@ InjectedScript.prototype = {
     {
         // We don't use String(obj) because inspectedWindow.String is undefined if owning frame navigated to another page.
         return "" + obj;
-    },
-
-    _logEvent: function(event)
-    {
-        console.log(event.type, event);
-    },
-
-    _normalizeEventTypes: function(types)
-    {
-        if (typeof types === "undefined")
-            types = [ "mouse", "key", "load", "unload", "abort", "error", "select", "change", "submit", "reset", "focus", "blur", "resize", "scroll" ];
-        else if (typeof types === "string")
-            types = [ types ];
-
-        var result = [];
-        for (var i = 0; i < types.length; i++) {
-            if (types[i] === "mouse")
-                result.splice(0, 0, "mousedown", "mouseup", "click", "dblclick", "mousemove", "mouseover", "mouseout");
-            else if (types[i] === "key")
-                result.splice(0, 0, "keydown", "keyup", "keypress");
-            else
-                result.push(types[i]);
-        }
-        return result;
-    },
-
-    _inspectedNode: function(num)
-    {
-        var nodeId = InjectedScriptHost.inspectedNode(num);
-        return this._nodeForId(nodeId);
-    },
-
-    _bindToScript: function(func)
-    {
-        var args = Array.prototype.slice.call(arguments, 1);
-        function bound()
-        {
-            return func.apply(injectedScript, args.concat(Array.prototype.slice.call(arguments)));
-        }
-        bound.toString = function() {
-            return "bound: " + func;
-        };
-        return bound;
     }
 }
 
@@ -602,15 +576,48 @@ InjectedScript.CallFrameProxy.prototype = {
     }
 }
 
-function CommandLineAPI()
+function CommandLineAPI(commandLineAPIImpl, callFrame)
+{
+    function inScopeVariables(member)
+    {
+        if (!callFrame)
+            return false;
+
+        var scopeChain = callFrame.scopeChain;
+        for (var i = 0; i < scopeChain.length; ++i) {
+            if (member in scopeChain[i])
+                return true;
+        }
+        return false;
+    }
+
+    for (var i = 0; i < CommandLineAPI.members_.length; ++i) {
+        var member = CommandLineAPI.members_[i];
+        if (member in inspectedWindow || inScopeVariables(member))
+            continue;
+
+        this[member] = bind(commandLineAPIImpl, commandLineAPIImpl[member]);
+    }
+
+    for (var i = 0; i < 5; ++i) {
+        var member = "$" + i;
+        if (member in inspectedWindow || inScopeVariables(member))
+            continue;
+
+        this.__defineGetter__("$" + i, bind(commandLineAPIImpl, commandLineAPIImpl._inspectedNode, i));
+    }
+}
+
+CommandLineAPI.members_ = [
+    "$", "$$", "$x", "dir", "dirxml", "keys", "values", "profile", "profileEnd",
+    "monitorEvents", "unmonitorEvents", "inspect", "copy", "clear"
+];
+
+function CommandLineAPIImpl()
 {
-    for (var i = 0; i < 5; ++i)
-        this.__defineGetter__("$" + i, injectedScript._bindToScript(injectedScript._inspectedNode, i));
 }
 
-CommandLineAPI.prototype = {
-    // Only add API functions here, private stuff should go to
-    // InjectedScript so that it is not suggested by the completion.
+CommandLineAPIImpl.prototype = {
     $: function()
     {
         return document.getElementById.apply(document, arguments)
@@ -625,8 +632,8 @@ CommandLineAPI.prototype = {
     {
         var nodes = [];
         try {
-            var doc = context || document;
-            var results = doc.evaluate(xpath, doc, null, XPathResult.ANY_TYPE, null);
+            var doc = (context && context.ownerDocument) || inspectedWindow.document;
+            var results = doc.evaluate(xpath, context || doc, null, XPathResult.ANY_TYPE, null);
             var node;
             while (node = results.iterateNext())
                 nodes.push(node);
@@ -672,10 +679,10 @@ CommandLineAPI.prototype = {
     {
         if (!object || !object.addEventListener || !object.removeEventListener)
             return;
-        types = injectedScript._normalizeEventTypes(types);
+        types = this._normalizeEventTypes(types);
         for (var i = 0; i < types.length; ++i) {
-            object.removeEventListener(types[i], injectedScript._logEvent, false);
-            object.addEventListener(types[i], injectedScript._logEvent, false);
+            object.removeEventListener(types[i], this._logEvent, false);
+            object.addEventListener(types[i], this._logEvent, false);
         }
     },
 
@@ -683,9 +690,9 @@ CommandLineAPI.prototype = {
     {
         if (!object || !object.addEventListener || !object.removeEventListener)
             return;
-        types = injectedScript._normalizeEventTypes(types);
+        types = this._normalizeEventTypes(types);
         for (var i = 0; i < types.length; ++i)
-            object.removeEventListener(types[i], injectedScript._logEvent, false);
+            object.removeEventListener(types[i], this._logEvent, false);
     },
 
     inspect: function(object)
@@ -718,10 +725,39 @@ CommandLineAPI.prototype = {
     clear: function()
     {
         InjectedScriptHost.clearConsoleMessages();
+    },
+
+    _inspectedNode: function(num)
+    {
+        var nodeId = InjectedScriptHost.inspectedNode(num);
+        return injectedScript._nodeForId(nodeId);
+    },
+
+    _normalizeEventTypes: function(types)
+    {
+        if (typeof types === "undefined")
+            types = [ "mouse", "key", "load", "unload", "abort", "error", "select", "change", "submit", "reset", "focus", "blur", "resize", "scroll" ];
+        else if (typeof types === "string")
+            types = [ types ];
+
+        var result = [];
+        for (var i = 0; i < types.length; i++) {
+            if (types[i] === "mouse")
+                result.splice(0, 0, "mousedown", "mouseup", "click", "dblclick", "mousemove", "mouseover", "mouseout");
+            else if (types[i] === "key")
+                result.splice(0, 0, "keydown", "keyup", "keypress");
+            else
+                result.push(types[i]);
+        }
+        return result;
+    },
+
+    _logEvent: function(event)
+    {
+        console.log(event.type, event);
     }
 }
 
-injectedScript._commandLineAPI = new CommandLineAPI();
+injectedScript._commandLineAPIImpl = new CommandLineAPIImpl();
 return injectedScript;
 })
-
diff --git a/Source/WebCore/inspector/Inspector.idl b/Source/WebCore/inspector/Inspector.idl
index 79b33f6..80c24db 100644
--- a/Source/WebCore/inspector/Inspector.idl
+++ b/Source/WebCore/inspector/Inspector.idl
@@ -31,286 +31,249 @@
 
 module core {
     interface [Conditional=INSPECTOR] Inspector {
+        void addScriptToEvaluateOnLoad(in String scriptSource);
+        void removeAllScriptsToEvaluateOnLoad();
+        void reloadPage(in boolean ignoreCache);
+        void populateScriptObjects();
+
+        void openInInspectedWindow(in String url);
+        void setSearchingForNode(in boolean enabled, out boolean newState);
+        [notify] void frontendReused();
+        [notify] void addNodesToSearchResult(out Array nodeIds);
+        [notify] void bringToFront();
+        [notify] void disconnectFromBackend();
+        [notify] void inspectedURLChanged(out String url);
+        [notify] void domContentEventFired(out double time);
+        [notify] void loadEventFired(out double time);
+        [notify] void reset();
+        [notify] void showPanel(out String panel);
+
+        [notify] void evaluateForTestInFrontend(out long testCallId, out String script);
+        void didEvaluateForTestInFrontend(in long testCallId, in String jsonResult);
+
+        void highlightDOMNode(in long nodeId);
+        void hideDOMNodeHighlight();
+        void highlightFrame(in unsigned long frameId);
+        void hideFrameHighlight();
+        [notify] void updateFocusedNode(out long nodeId);
+
+        void setUserAgentOverride(in String userAgent);
+
+        void getCookies(out Array cookies, out String cookiesString);
+        void deleteCookie(in String cookieName, in String domain);
+
+        // FIXME: dispatch on agents.
+        void startTimelineProfiler();
+        void stopTimelineProfiler();
 
-        ///////////////////////////////////////////////////////////////////////
-        // generic Inspector's methods
-        ///////////////////////////////////////////////////////////////////////
-
-        [domain=Inspector] void addScriptToEvaluateOnLoad(in String scriptSource);
-        [domain=Inspector] void removeAllScriptsToEvaluateOnLoad();
-        [domain=Inspector] void reloadPage();
-        [domain=Inspector] void populateScriptObjects();
-
-        [domain=Inspector] void openInInspectedWindow(in String url);
-        [domain=Inspector] void setSearchingForNode(in boolean enabled, out boolean newState);
-        [notify, domain=Inspector] void frontendReused();
-        [notify, domain=Inspector] void addNodesToSearchResult(out Array nodeIds);
-        [notify, domain=Inspector] void bringToFront();
-        [notify, domain=Inspector] void disconnectFromBackend();
-        [notify, domain=Inspector] void inspectedURLChanged(out String url);
-        [notify, domain=Inspector] void domContentEventFired(out double time);
-        [notify, domain=Inspector] void loadEventFired(out double time);
-        [notify, domain=Inspector] void reset();
-        [notify, domain=Inspector] void showPanel(out String panel);
-
-        [notify, domain=Inspector] void evaluateForTestInFrontend(out long testCallId, out String script);
-        [domain=Inspector] void didEvaluateForTestInFrontend(in long testCallId, in String jsonResult);
-
-        [domain=Inspector] void highlightDOMNode(in long nodeId);
-        [domain=Inspector] void hideDOMNodeHighlight();
-        [domain=Inspector] void highlightFrame(in unsigned long frameId);
-        [domain=Inspector] void hideFrameHighlight();
-        [notify, domain=Inspector] void updateFocusedNode(out long nodeId);
-
-        [domain=Inspector] void setExtraHeaders(in Object headers);
-
-        [domain=Inspector] void getCookies(out Array cookies, out String cookiesString);
-        [domain=Inspector] void deleteCookie(in String cookieName, in String domain);
-
-        ///////////////////////////////////////////////////////////////////////
-        // Runtime
-        ///////////////////////////////////////////////////////////////////////
-
-        [domain=Runtime] void evaluate(in String expression, in String objectGroup, out Value result);
-        [domain=Runtime] void getCompletions(in String expression, in boolean includeInspectorCommandLineAPI, out Value result);
-        [domain=Runtime] void getProperties(in Object objectId, in boolean ignoreHasOwnProperty, in boolean abbreviate, out Value result);
-        [domain=Runtime] void setPropertyValue(in Object objectId, in String propertyName, in String expression, out Value result);
-        [domain=Runtime] void releaseWrapperObjectGroup(in long injectedScriptId, in String objectGroup);
-
-        ///////////////////////////////////////////////////////////////////////
-        // Injected Script
-        ///////////////////////////////////////////////////////////////////////
-
-        [domain=InjectedScript] void evaluateOnSelf(in String functionBody, in Array argumentsArray, out Value result);
-
-        ///////////////////////////////////////////////////////////////////////
-        // Console API
-        ///////////////////////////////////////////////////////////////////////
-
-        [domain=Console] void setConsoleMessagesEnabled(in boolean enabled, out boolean newState);
-        [notify, domain=Console] void addConsoleMessage(out Object messageObj);
-        [notify, domain=Console] void updateConsoleMessageExpiredCount(out unsigned long count);
-        [notify, domain=Console] void updateConsoleMessageRepeatCount(out unsigned long count);
-        [domain=Console] void clearConsoleMessages();
-        [notify, domain=Console] void consoleMessagesCleared();
-        [domain=Console] void setMonitoringXHREnabled(in boolean enabled);
-        [notify, domain=Console] void monitoringXHRStateChanged(out boolean enabled);
-
-        ///////////////////////////////////////////////////////////////////////
-        // Network API
-        ///////////////////////////////////////////////////////////////////////
-
-        [domain=Network] void cachedResources(out Object resources);
-        [domain=Network] void resourceContent(in unsigned long frameId, in String url, in boolean base64Encode, out String content);
-
-        [notify, domain=Network] void frameDetachedFromParent(out unsigned long frameId);
-        [notify, domain=Network] void identifierForInitialRequest(out long identifier, out String url, out Object loader, out Value callStack);
-        [notify, domain=Network] void willSendRequest(out long identifier, out double time, out Object request, out Object redirectResponse);
-        [notify, domain=Network] void markResourceAsCached(out long identifier);
-        [notify, domain=Network] void didReceiveResponse(out long identifier, out double time, out String resourceType, out Object response);
-        [notify, domain=Network] void didReceiveContentLength(out long identifier, out double time, out long lengthReceived);
-        [notify, domain=Network] void didFinishLoading(out long identifier, out double finishTime);
-        [notify, domain=Network] void didFailLoading(out long identifier, out double time, out String localizedDescription);
-        [notify, domain=Network] void didLoadResourceFromMemoryCache(out double time, out Object resource);
-        [notify, domain=Network] void setInitialContent(out long identifier, out String sourceString, out String type);
-        [notify, domain=Network] void didCommitLoadForFrame(out Object frame, out Object loader);
-        [notify, domain=Network] void didCreateWebSocket(out unsigned long identifier, out String requestURL);
-        [notify, domain=Network] void willSendWebSocketHandshakeRequest(out unsigned long identifier, out double time, out Object request);
-        [notify, domain=Network] void didReceiveWebSocketHandshakeResponse(out unsigned long identifier, out double time, out Object response);
-        [notify, domain=Network] void didCloseWebSocket(out unsigned long identifier, out double time);
+#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
+        void enableDebugger();
+        void disableDebugger();
+        void enableProfiler();
+        void disableProfiler();
+        void startProfiling();
+        void stopProfiling();
+#endif // ENABLE_JAVASCRIPT_DEBUGGER
+    };
 
-#if defined(ENABLE_DATABASE) && ENABLE_DATABASE
+    interface [Conditional=INSPECTOR] Runtime {
+        void evaluate(in String expression, in String objectGroup, in boolean includeCommandLineAPI, out Value result);
+        void getCompletions(in String expression, in boolean includeCommandLineAPI, out Value result);
+        void getProperties(in Object objectId, in boolean ignoreHasOwnProperty, in boolean abbreviate, out Value result);
+        void setPropertyValue(in Object objectId, in String propertyName, in String expression, out Value result);
+        void releaseWrapperObjectGroup(in long injectedScriptId, in String objectGroup);
+    };
 
-        ///////////////////////////////////////////////////////////////////////
-        // Database API
-        ///////////////////////////////////////////////////////////////////////
+    interface [Conditional=INSPECTOR] InjectedScript {
+        void evaluateOnSelf(in String functionBody, in Array argumentsArray, out Value result);
+    };
 
-        [domain=Database] void getDatabaseTableNames(in long databaseId, out Array tableNames);
-        [domain=Database] void executeSQL(in long databaseId, in String query, out boolean success, out long transactionId);
+    interface [Conditional=INSPECTOR] Console {
+        void setConsoleMessagesEnabled(in boolean enabled, out boolean newState);
+        [notify] void addConsoleMessage(out Object messageObj);
+        [notify] void updateConsoleMessageExpiredCount(out unsigned long count);
+        [notify] void updateConsoleMessageRepeatCount(out unsigned long count);
+        void clearConsoleMessages();
+        [notify] void consoleMessagesCleared();
+        void setMonitoringXHREnabled(in boolean enabled);
+    };
 
-        [notify, domain=Database] void addDatabase(out Object database);
-        [notify, domain=Database] void selectDatabase(out int databaseId);
-        [notify, domain=Database] void sqlTransactionSucceeded(out long transactionId, out Value columnNames, out Value values);
-        [notify, domain=Database] void sqlTransactionFailed(out long transactionId, out Value sqlError);
+    interface [Conditional=INSPECTOR] Network {
+        void cachedResources(out Object resources);
+        void resourceContent(in unsigned long frameId, in String url, in boolean base64Encode, out boolean success, out String content);
+        void setExtraHeaders(in Object headers);
+
+        [notify] void frameDetachedFromParent(out unsigned long frameId);
+        [notify] void identifierForInitialRequest(out long identifier, out String url, out Object loader, out Value callStack);
+        [notify] void willSendRequest(out long identifier, out double time, out Object request, out Object redirectResponse);
+        [notify] void markResourceAsCached(out long identifier);
+        [notify] void didReceiveResponse(out long identifier, out double time, out String resourceType, out Object response);
+        [notify] void didReceiveContentLength(out long identifier, out double time, out long lengthReceived);
+        [notify] void didFinishLoading(out long identifier, out double finishTime);
+        [notify] void didFailLoading(out long identifier, out double time, out String localizedDescription);
+        [notify] void didLoadResourceFromMemoryCache(out double time, out Object resource);
+        [notify] void setInitialContent(out long identifier, out String sourceString, out String type);
+        [notify] void didCommitLoadForFrame(out Object frame, out Object loader);
+        [notify] void didCreateWebSocket(out unsigned long identifier, out String requestURL);
+        [notify] void willSendWebSocketHandshakeRequest(out unsigned long identifier, out double time, out Object request);
+        [notify] void didReceiveWebSocketHandshakeResponse(out unsigned long identifier, out double time, out Object response);
+        [notify] void didCloseWebSocket(out unsigned long identifier, out double time);
+    };
+
+#if defined(ENABLE_DATABASE) && ENABLE_DATABASE
+    interface [Conditional=INSPECTOR] Database {
+        void getDatabaseTableNames(in long databaseId, out Array tableNames);
+        void executeSQL(in long databaseId, in String query, out boolean success, out long transactionId);
+
+        [notify] void addDatabase(out Object database);
+        [notify] void selectDatabase(out int databaseId);
+        [notify] void sqlTransactionSucceeded(out long transactionId, out Value columnNames, out Value values);
+        [notify] void sqlTransactionFailed(out long transactionId, out Value sqlError);
+    };
 #endif
 
 #if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
-
-        ///////////////////////////////////////////////////////////////////////
-        // DOM Storage API
-        ///////////////////////////////////////////////////////////////////////
-
-        [domain=DOMStorage] void getDOMStorageEntries(in long storageId, out Array entries);
-        [domain=DOMStorage] void setDOMStorageItem(in long storageId, in String key, in String value, out boolean success);
-        [domain=DOMStorage] void removeDOMStorageItem(in long storageId, in String key, out boolean success);
-        [notify, domain=DOMStorage] void addDOMStorage(out Object storage);
-        [notify, domain=DOMStorage] void updateDOMStorage(out int storageId);
-        [notify, domain=DOMStorage] void selectDOMStorage(out int storageId);
+    interface [Conditional=INSPECTOR] DOMStorage {
+        void getDOMStorageEntries(in long storageId, out Array entries);
+        void setDOMStorageItem(in long storageId, in String key, in String value, out boolean success);
+        void removeDOMStorageItem(in long storageId, in String key, out boolean success);
+        [notify] void addDOMStorage(out Object storage);
+        [notify] void updateDOMStorage(out int storageId);
+        [notify] void selectDOMStorage(out int storageId);
+    };
 #endif
 
 #if defined(ENABLE_OFFLINE_WEB_APPLICATIONS) && ENABLE_OFFLINE_WEB_APPLICATIONS
-
-        ///////////////////////////////////////////////////////////////////////
-        // AppCache API
-        ///////////////////////////////////////////////////////////////////////
-
-        [domain=ApplicationCache] void getApplicationCaches(out Value applicationCaches);
-        [notify, domain=ApplicationCache] void updateApplicationCacheStatus(out int status);
-        [notify, domain=ApplicationCache] void updateNetworkState(out boolean isNowOnline);
+    interface [Conditional=INSPECTOR] ApplicationCache {
+        void getApplicationCaches(out Value applicationCaches);
+        [notify] void updateApplicationCacheStatus(out int status);
+        [notify] void updateNetworkState(out boolean isNowOnline);
+    };
 #endif
 
-#if defined(ENABLE_FILE_SYSTEM) && ENABLE_FILE_SYSTEM
-
-        ///////////////////////////////////////////////////////////////////////
-        // Filesystem API
-        ///////////////////////////////////////////////////////////////////////
-
-        [domain=FileSystem] void getFileSystemPathAsync(in unsigned int type, in String origin);
-        [domain=FileSystem] void revealFolderInOS(in String path);
+    interface [Conditional=INSPECTOR] DOM {
+        void getChildNodes(in long nodeId);
+        void setAttribute(in long elementId, in String name, in String value, out boolean success);
+        void removeAttribute(in long elementId, in String name, out boolean success);
+        void setTextNodeValue(in long nodeId, in String value, out boolean success);
+        void getEventListenersForNode(in long nodeId, out long outNodeId, out Array listenersArray);
+        void copyNode(in long nodeId);
+        void removeNode(in long nodeId, out long outNodeId);
+        void changeTagName(in long nodeId, in String newTagName, out long outNodeId);
+        void getOuterHTML(in long nodeId, out String outerHTML);
+        void setOuterHTML(in long nodeId, in String outerHTML, out long outNodeId);
+        void addInspectedNode(in long nodeId);
+        void performSearch(in String query, in boolean runSynchronously);
+        void searchCanceled();
+        void pushNodeByPathToFrontend(in String path, out long nodeId);
+        void resolveNode(in long nodeId, out Value result);
+        void getNodeProperties(in long nodeId, in Array propertiesArray, out Value result);
+        void getNodePrototypes(in long nodeId, out Value result);
+        void pushNodeToFrontend(in Object objectId, out Value result);
+
+        [notify] void setDocument(out Value root); // FIXME: should be requested from the front-end as getDocument.
+        [notify] void attributesUpdated(out long id, out Array attributes);
+        [notify] void characterDataModified(out long id, out String newValue);
+        [notify] void setChildNodes(out long parentId, out Array nodes);
+        [notify] void setDetachedRoot(out Object root);
+        [notify] void childNodeCountUpdated(out long id, out int newValue);
+        [notify] void childNodeInserted(out long parentId, out long prevId, out Object node);
+        [notify] void childNodeRemoved(out long parentId, out long id);
+    };
 
-        [notify, domain=FileSystem] void didGetFileSystemPath(out String root, out int type, out String origin);
-        [notify, domain=FileSystem] void didGetFileSystemError(out int type, out String origin);
-        [notify, domain=FileSystem] void didGetFileSystemDisabled();
-#endif
+    interface [Conditional=INSPECTOR] CSS {
+        void getStylesForNode(in long nodeId, out Value styles);
+        void getComputedStyleForNode(in long nodeId, out Value style);
+        void getInlineStyleForNode(in long nodeId, out Value style);
+        void getAllStyles(out Array styleSheetIds);
+        void getStyleSheet(in String styleSheetId, out Value styleSheet);
+        void getStyleSheetText(in String styleSheetId, out String url, out String text);
+        void setStyleSheetText(in String styleSheetId, in String text, out boolean success);
+        void setPropertyText(in Object styleId, in long propertyIndex, in String text, in boolean overwrite, out Value style);
+        void toggleProperty(in Object styleId, in long propertyIndex, in boolean disable, out Value style);
+        void setRuleSelector(in Object ruleId, in String selector, out Value rule);
+        void addRule(in long contextNodeId, in String selector, out Value rule);
+        void getSupportedCSSProperties(out Array cssProperties);
+        void querySelectorAll(in long documentId, in String selector, out Array result);
+    };
 
-        ///////////////////////////////////////////////////////////////////////
-        // DOM API
-        ///////////////////////////////////////////////////////////////////////
-
-        [domain=DOM] void getChildNodes(in long nodeId);
-        [domain=DOM] void setAttribute(in long elementId, in String name, in String value, out boolean success);
-        [domain=DOM] void removeAttribute(in long elementId, in String name, out boolean success);
-        [domain=DOM] void setTextNodeValue(in long nodeId, in String value, out boolean success);
-        [domain=DOM] void getEventListenersForNode(in long nodeId, out long outNodeId, out Array listenersArray);
-        [domain=DOM] void copyNode(in long nodeId);
-        [domain=DOM] void removeNode(in long nodeId, out long outNodeId);
-        [domain=DOM] void changeTagName(in long nodeId, in String newTagName, out long outNodeId);
-        [domain=DOM] void getOuterHTML(in long nodeId, out String outerHTML);
-        [domain=DOM] void setOuterHTML(in long nodeId, in String outerHTML, out long outNodeId);
-        [domain=DOM] void addInspectedNode(in long nodeId);
-        [domain=DOM] void performSearch(in String query, in boolean runSynchronously);
-        [domain=DOM] void searchCanceled();
-        [domain=DOM] void pushNodeByPathToFrontend(in String path, out long nodeId);
-        [domain=DOM] void resolveNode(in long nodeId, out Value result);
-        [domain=DOM] void getNodeProperties(in long nodeId, in Array propertiesArray, out Value result);
-        [domain=DOM] void getNodePrototypes(in long nodeId, out Value result);
-        [domain=DOM] void pushNodeToFrontend(in Object objectId, out Value result);
-
-        [notify, domain=DOM] void setDocument(out Value root); // FIXME: should be requested from the front-end as getDocument.
-        [notify, domain=DOM] void attributesUpdated(out long id, out Array attributes);
-        [notify, domain=DOM] void characterDataModified(out long id, out String newValue);
-        [notify, domain=DOM] void setChildNodes(out long parentId, out Array nodes);
-        [notify, domain=DOM] void setDetachedRoot(out Object root);
-        [notify, domain=DOM] void childNodeCountUpdated(out long id, out int newValue);
-        [notify, domain=DOM] void childNodeInserted(out long parentId, out long prevId, out Object node);
-        [notify, domain=DOM] void childNodeRemoved(out long parentId, out long id);
-
-        ///////////////////////////////////////////////////////////////////////
-        // CSS API
-        ///////////////////////////////////////////////////////////////////////
-
-        [domain=CSS] void getStylesForNode2(in long nodeId, out Value styles);
-        [domain=CSS] void getComputedStyleForNode2(in long nodeId, out Value style);
-        [domain=CSS] void getInlineStyleForNode2(in long nodeId, out Value style);
-        [domain=CSS] void getAllStyles2(out Array styleSheetIds);
-        [domain=CSS] void getStyleSheet2(in String styleSheetId, out Value styleSheet);
-        [domain=CSS] void getStyleSheetText2(in String styleSheetId, out String url, out String text);
-        [domain=CSS] void setStyleSheetText2(in String styleSheetId, in String text, out boolean success);
-        [domain=CSS] void setPropertyText2(in Object styleId, in long propertyIndex, in String text, in boolean overwrite, out Value style);
-        [domain=CSS] void toggleProperty2(in Object styleId, in long propertyIndex, in boolean disable, out Value style);
-        [domain=CSS] void setRuleSelector2(in Object ruleId, in String selector, out Value rule);
-        [domain=CSS] void addRule2(in long contextNodeId, in String selector, out Value rule);
-        [domain=CSS] void getSupportedCSSProperties(out Array cssProperties);
-        [domain=CSS] void querySelectorAll(in long documentId, in String selector, out Array result);
-
-        ///////////////////////////////////////////////////////////////////////
-        // Timeline API
-        ///////////////////////////////////////////////////////////////////////
-
-        [domain=Inspector] void startTimelineProfiler();
-        [domain=Inspector] void stopTimelineProfiler();
-        [notify, domain=Timeline] void timelineProfilerWasStarted();
-        [notify, domain=Timeline] void timelineProfilerWasStopped();
-        [notify, domain=Timeline] void addRecordToTimeline(out Object record);
+    interface [Conditional=INSPECTOR] Timeline {
+        [notify] void timelineProfilerWasStarted();
+        [notify] void timelineProfilerWasStopped();
+        [notify] void addRecordToTimeline(out Object record);
+    };
 
 #if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
+    interface [Conditional=INSPECTOR] Debugger {
+        [notify] void debuggerWasEnabled();
+        [notify] void debuggerWasDisabled();
 
-        ///////////////////////////////////////////////////////////////////////
-        // Debugger API
-        ///////////////////////////////////////////////////////////////////////
-
-        [domain=Inspector] void enableDebugger(in boolean always);
-        [domain=Inspector] void disableDebugger(in boolean always);
-
-        [domain=Inspector] void setAllBrowserBreakpoints(in Object breakpoints);
-
-        [notify, domain=Debugger] void debuggerWasEnabled();
-        [notify, domain=Debugger] void debuggerWasDisabled();
-
-        [notify, domain=Debugger] void parsedScriptSource(out String sourceID, out String url, out int lineOffset, out int columnOffset, out int length, out int scriptWorldType);
-        [notify, domain=Debugger] void failedToParseScriptSource(out String url, out String data, out int firstLine, out int errorLine, out String errorMessage);
-
-        [domain=Debugger] void activateBreakpoints();
-        [domain=Debugger] void deactivateBreakpoints();
-
-        [domain=Debugger] void setBreakpoint(in String sourceID, in unsigned int lineNumber, in String condition, in boolean enabled, out String breakpointId, out unsigned int actualLineNumber);
-        [domain=Debugger] void removeBreakpoint(in String breakpointId);
+        [notify] void parsedScriptSource(out String sourceID, out String url, out int lineOffset, out int columnOffset, out int length, out int scriptWorldType);
+        [notify] void failedToParseScriptSource(out String url, out String data, out int firstLine, out int errorLine, out String errorMessage);
 
-        [domain=BrowserDebugger] void setDOMBreakpoint(in long nodeId, in long type);
-        [domain=BrowserDebugger] void removeDOMBreakpoint(in long nodeId, in long type);
-        [domain=BrowserDebugger] void setEventListenerBreakpoint(in String eventName);
-        [domain=BrowserDebugger] void removeEventListenerBreakpoint(in String eventName);
-        [domain=BrowserDebugger] void setXHRBreakpoint(in String url);
-        [domain=BrowserDebugger] void removeXHRBreakpoint(in String url);
+        void activateBreakpoints();
+        void deactivateBreakpoints();
 
-        [domain=Debugger] void stepOver();
-        [domain=Debugger] void stepInto();
-        [domain=Debugger] void stepOut();
-        [domain=Debugger] void pause();
-        [notify, domain=Debugger] void pausedScript(out Object details);
-        [domain=Debugger] void resume();
-        [notify, domain=Debugger] void resumedScript(); // FIXME: Make this out parameter of resume if possible.
+        void setJavaScriptBreakpoint(in String url, in int lineNumber, in int columnNumber, in String condition, in boolean enabled, out String breakpointId, out Array locations);
+        void setJavaScriptBreakpointBySourceId(in String sourceId, in int lineNumber, in int columnNumber, in String condition, in boolean enabled, out String breakpointId, out int actualLineNumber, out int actualColumnNumber);
+        void removeJavaScriptBreakpoint(in String breakpointId);
+        [notify] void breakpointResolved(out String breakpointId, out String sourceId, out int lineNumber, out int columnNumber);
+        void continueToLocation(in String sourceId, in int lineNumber, in int columnNumber);
 
-        [domain=Debugger] void editScriptSource(in String sourceID, in String newContent, out boolean success, out String result, out Value newCallFrames);
-        [domain=Debugger] void getScriptSource(in String sourceID, out String scriptSource);
+        void stepOver();
+        void stepInto();
+        void stepOut();
+        void pause();
+        [notify] void pausedScript(out Object details);
+        void resume();
+        [notify] void resumedScript(); // FIXME: Make this out parameter of resume if possible.
 
-        [domain=Debugger] void setPauseOnExceptionsState(in long pauseOnExceptionsState, out long newState);
+        void editScriptSource(in String sourceID, in String newContent, out boolean success, out String result, out Value newCallFrames);
+        void getScriptSource(in String sourceID, out String scriptSource);
 
-        [domain=Debugger] void evaluateOnCallFrame(in Object callFrameId, in String expression, in String objectGroup, out Value result);
-        [domain=Debugger] void getCompletionsOnCallFrame(in Object callFrameId, in String expression, in boolean includeInspectorCommandLineAPI, out Value result);
+        void setPauseOnExceptionsState(in long pauseOnExceptionsState, out long newState);
 
-        [notify, domain=Debugger] void breakpointResolved(out String breakpointId, out String sourceID, out unsigned int lineNumber, out String condition, out boolean enabled, out unsigned int originalLineNumber);
+        void evaluateOnCallFrame(in Object callFrameId, in String expression, in String objectGroup, in boolean includeCommandLineAPI, out Value result);
+        void getCompletionsOnCallFrame(in Object callFrameId, in String expression, in boolean includeCommandLineAPI, out Value result);
 
 #if defined(ENABLE_WORKERS) && ENABLE_WORKERS
-        [notify, domain=Debugger] void didCreateWorker(out long id, out String url, out boolean isShared);
-        [notify, domain=Debugger] void didDestroyWorker(out long id);
+        [notify] void didCreateWorker(out long id, out String url, out boolean isShared);
+        [notify] void didDestroyWorker(out long id);
 #endif // ENABLE_WORKERS
 
-        ///////////////////////////////////////////////////////////////////////
-        // Profiler API
-        ///////////////////////////////////////////////////////////////////////
+    };
+#endif // ENABLE_JAVASCRIPT_DEBUGGER
 
-        [domain=Inspector] void enableProfiler(in boolean always);
-        [domain=Inspector] void disableProfiler(in boolean always);
-        [notify, domain=Profiler] void profilerWasEnabled();
-        [notify, domain=Profiler] void profilerWasDisabled();
+#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
+    interface [Conditional=INSPECTOR] BrowserDebugger {
+        void setAllBrowserBreakpoints(in Object breakpoints);
+        void setDOMBreakpoint(in long nodeId, in long type);
+        void removeDOMBreakpoint(in long nodeId, in long type);
+        void setEventListenerBreakpoint(in String eventName);
+        void removeEventListenerBreakpoint(in String eventName);
+        void setXHRBreakpoint(in String url);
+        void removeXHRBreakpoint(in String url);
+    };
+#endif // ENABLE_JAVASCRIPT_DEBUGGER
 
-        [domain=Inspector] void startProfiling(); // FIXME: dispatch on profiler agent.
-        [domain=Inspector] void stopProfiling(); // FIXME: dispatch on profiler agent.
+#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
+    interface [Conditional=INSPECTOR] Profiler {
+        [notify] void profilerWasEnabled();
+        [notify] void profilerWasDisabled();
 
-        [domain=Profiler] void getProfileHeaders(out Array headers);
-        [domain=Profiler] void getProfile(in String type, in unsigned long uid, out Object profile);
-        [domain=Profiler] void removeProfile(in String type, in unsigned long uid);
-        [domain=Profiler] void clearProfiles();
+        void getProfileHeaders(out Array headers);
+        void getProfile(in String type, in unsigned long uid, out Object profile);
+        void removeProfile(in String type, in unsigned long uid);
+        void clearProfiles();
 
         // FIXME: split into Profiler and HeapProfiler.
-        [domain=Profiler] void takeHeapSnapshot();
-        [notify, domain=Profiler] void addProfileHeader(out Object header);
-        [notify, domain=Profiler] void addHeapSnapshotChunk(out unsigned long uid, out String chunk);
-        [notify, domain=Profiler] void finishHeapSnapshot(out unsigned long uid);
-        [notify, domain=Profiler] void setRecordingProfile(out boolean isProfiling);
-        [notify, domain=Profiler] void resetProfiles();
-
-#endif // ENABLE_JAVASCRIPT_DEBUGGER
+        void takeHeapSnapshot(in boolean detailed);
+        [notify] void addProfileHeader(out Object header);
+        [notify] void addHeapSnapshotChunk(out unsigned long uid, out String chunk);
+        [notify] void finishHeapSnapshot(out unsigned long uid);
+        [notify] void setRecordingProfile(out boolean isProfiling);
+        [notify] void resetProfiles();
+        [notify] void reportHeapSnapshotProgress(out int done, out int total);
     };
+#endif // ENABLE_JAVASCRIPT_DEBUGGER
 }
diff --git a/Source/WebCore/inspector/InspectorAgent.cpp b/Source/WebCore/inspector/InspectorAgent.cpp
new file mode 100644
index 0000000..9559099
--- /dev/null
+++ b/Source/WebCore/inspector/InspectorAgent.cpp
@@ -0,0 +1,1269 @@
+/*
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorAgent.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "CachedResource.h"
+#include "CachedResourceLoader.h"
+#include "Chrome.h"
+#include "Cookie.h"
+#include "CookieJar.h"
+#include "DOMWindow.h"
+#include "DOMWrapperWorld.h"
+#include "Document.h"
+#include "DocumentLoader.h"
+#include "Element.h"
+#include "FloatConversion.h"
+#include "FloatQuad.h"
+#include "FloatRect.h"
+#include "Frame.h"
+#include "FrameLoadRequest.h"
+#include "FrameLoader.h"
+#include "FrameTree.h"
+#include "FrameView.h"
+#include "GraphicsContext.h"
+#include "HTMLFrameOwnerElement.h"
+#include "HTTPHeaderMap.h"
+#include "HitTestResult.h"
+#include "InjectedScript.h"
+#include "InjectedScriptHost.h"
+#include "InspectorBrowserDebuggerAgent.h"
+#include "InspectorCSSAgent.h"
+#include "InspectorClient.h"
+#include "InspectorConsoleAgent.h"
+#include "InspectorController.h"
+#include "InspectorDOMAgent.h"
+#include "InspectorDOMStorageResource.h"
+#include "InspectorDatabaseResource.h"
+#include "InspectorDebuggerAgent.h"
+#include "InspectorFrontend.h"
+#include "InspectorFrontendClient.h"
+#include "InspectorInstrumentation.h"
+#include "InspectorProfilerAgent.h"
+#include "InspectorResourceAgent.h"
+#include "InspectorRuntimeAgent.h"
+#include "InspectorState.h"
+#include "InspectorTimelineAgent.h"
+#include "InspectorValues.h"
+#include "InspectorWorkerResource.h"
+#include "IntRect.h"
+#include "Page.h"
+#include "ProgressTracker.h"
+#include "Range.h"
+#include "RenderInline.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
+#include "ScriptArguments.h"
+#include "ScriptCallStack.h"
+#include "ScriptFunctionCall.h"
+#include "ScriptObject.h"
+#include "ScriptProfile.h"
+#include "ScriptProfiler.h"
+#include "ScriptSourceCode.h"
+#include "ScriptState.h"
+#include "SecurityOrigin.h"
+#include "Settings.h"
+#include "SharedBuffer.h"
+#include "TextEncoding.h"
+#include "TextIterator.h"
+#include "TextRun.h"
+#include "UserGestureIndicator.h"
+#include "WindowFeatures.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/ListHashSet.h>
+#include <wtf/RefCounted.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/UnusedParam.h>
+#include <wtf/text/StringConcatenate.h>
+
+#if ENABLE(DATABASE)
+#include "Database.h"
+#include "InspectorDatabaseAgent.h"
+#endif
+
+#if ENABLE(DOM_STORAGE)
+#include "InspectorDOMStorageAgent.h"
+#include "Storage.h"
+#include "StorageArea.h"
+#endif
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+#include "InspectorApplicationCacheAgent.h"
+#endif
+
+using namespace std;
+
+namespace WebCore {
+
+namespace InspectorAgentState {
+static const char searchingForNode[] = "searchingForNode";
+static const char timelineProfilerEnabled[] = "timelineProfilerEnabled";
+static const char userInitiatedProfiling[] = "userInitiatedProfiling";
+static const char debuggerEnabled[] = "debuggerEnabled";
+static const char profilerEnabled[] = "profilerEnabled";
+}
+
+static const char scriptsPanelName[] = "scripts";
+static const char consolePanelName[] = "console";
+static const char profilesPanelName[] = "profiles";
+
+InspectorAgent::InspectorAgent(Page* page, InspectorClient* client)
+    : m_inspectedPage(page)
+    , m_client(client)
+    , m_frontend(0)
+    , m_cssAgent(new InspectorCSSAgent())
+    , m_state(new InspectorState(client))
+    , m_injectedScriptHost(InjectedScriptHost::create(this))
+    , m_consoleAgent(new InspectorConsoleAgent(this))
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    , m_profilerAgent(InspectorProfilerAgent::create(this))
+#endif
+{
+    ASSERT_ARG(page, page);
+    ASSERT_ARG(client, client);
+    InspectorInstrumentation::bindInspectorAgent(m_inspectedPage, this);
+}
+
+InspectorAgent::~InspectorAgent()
+{
+    // These should have been cleared in inspectedPageDestroyed().
+    ASSERT(!m_client);
+    ASSERT(!m_inspectedPage);
+    ASSERT(!m_highlightedNode);
+}
+
+void InspectorAgent::inspectedPageDestroyed()
+{
+    if (m_frontend)
+        m_frontend->disconnectFromBackend();
+
+    hideHighlight();
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    m_debuggerAgent.clear();
+    m_browserDebuggerAgent.clear();
+#endif
+
+    ASSERT(m_inspectedPage);
+    InspectorInstrumentation::unbindInspectorAgent(m_inspectedPage);
+    m_inspectedPage = 0;
+
+    releaseFrontendLifetimeAgents();
+    m_injectedScriptHost->disconnectController();
+
+    m_client->inspectorDestroyed();
+    m_client = 0;
+}
+
+bool InspectorAgent::searchingForNodeInPage() const
+{
+    return m_state->getBoolean(InspectorAgentState::searchingForNode);
+}
+
+void InspectorAgent::restoreInspectorStateFromCookie(const String& inspectorStateCookie)
+{
+    m_state = new InspectorState(m_client, inspectorStateCookie);
+
+    m_frontend->frontendReused();
+    m_frontend->inspectedURLChanged(inspectedURL().string());
+    pushDataCollectedOffline();
+
+    m_resourceAgent = InspectorResourceAgent::restore(m_inspectedPage, m_state.get(), m_frontend);
+    m_timelineAgent = InspectorTimelineAgent::restore(m_state.get(), m_frontend);
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    restoreDebugger(false);
+    restoreProfiler(ProfilerRestoreResetAgent);
+    if (m_state->getBoolean(InspectorAgentState::userInitiatedProfiling))
+        startUserInitiatedProfiling();
+#endif
+}
+
+void InspectorAgent::inspect(Node* node)
+{
+    if (node->nodeType() != Node::ELEMENT_NODE && node->nodeType() != Node::DOCUMENT_NODE)
+        node = node->parentNode();
+    m_nodeToFocus = node;
+
+    if (!m_frontend)
+        return;
+
+    focusNode();
+}
+
+void InspectorAgent::focusNode()
+{
+    if (!enabled())
+        return;
+
+    ASSERT(m_frontend);
+    ASSERT(m_nodeToFocus);
+
+    long id = m_domAgent->pushNodePathToFrontend(m_nodeToFocus.get());
+    m_frontend->updateFocusedNode(id);
+    m_nodeToFocus = 0;
+}
+
+void InspectorAgent::highlight(Node* node)
+{
+    if (!enabled())
+        return;
+    ASSERT_ARG(node, node);
+    m_highlightedNode = node;
+    m_client->highlight(node);
+}
+
+void InspectorAgent::highlightDOMNode(long nodeId)
+{
+    Node* node = 0;
+    if (m_domAgent && (node = m_domAgent->nodeForId(nodeId)))
+        highlight(node);
+}
+
+void InspectorAgent::highlightFrame(unsigned long frameId)
+{
+    Frame* mainFrame = m_inspectedPage->mainFrame();
+    for (Frame* frame = mainFrame; frame; frame = frame->tree()->traverseNext(mainFrame)) {
+        if (reinterpret_cast<uintptr_t>(frame) == frameId && frame->ownerElement()) {
+            highlight(frame->ownerElement());
+            return;
+        }
+    }
+}
+
+void InspectorAgent::hideHighlight()
+{
+    if (!enabled())
+        return;
+    m_highlightedNode = 0;
+    m_client->hideHighlight();
+}
+
+void InspectorAgent::mouseDidMoveOverElement(const HitTestResult& result, unsigned)
+{
+    if (!enabled() || !searchingForNodeInPage())
+        return;
+
+    Node* node = result.innerNode();
+    while (node && node->nodeType() == Node::TEXT_NODE)
+        node = node->parentNode();
+    if (node)
+        highlight(node);
+}
+
+bool InspectorAgent::handleMousePress()
+{
+    if (!enabled() || !searchingForNodeInPage())
+        return false;
+
+    if (m_highlightedNode) {
+        RefPtr<Node> node = m_highlightedNode;
+        setSearchingForNode(false);
+        inspect(node.get());
+    }
+    return true;
+}
+
+void InspectorAgent::didClearWindowObjectInWorld(Frame* frame, DOMWrapperWorld* world)
+{
+    if (world != mainThreadNormalWorld())
+        return;
+
+    if (enabled()) {
+        if (m_frontend && frame == m_inspectedPage->mainFrame())
+            m_injectedScriptHost->discardInjectedScripts();
+
+        if (m_scriptsToEvaluateOnLoad.size()) {
+            ScriptState* scriptState = mainWorldScriptState(frame);
+            for (Vector<String>::iterator it = m_scriptsToEvaluateOnLoad.begin();
+                  it != m_scriptsToEvaluateOnLoad.end(); ++it) {
+                m_injectedScriptHost->injectScript(*it, scriptState);
+            }
+        }
+    }
+
+    if (!m_inspectorExtensionAPI.isEmpty())
+        m_injectedScriptHost->injectScript(m_inspectorExtensionAPI, mainWorldScriptState(frame));
+}
+
+void InspectorAgent::setSearchingForNode(bool enabled)
+{
+    if (searchingForNodeInPage() == enabled)
+        return;
+    m_state->setBoolean(InspectorAgentState::searchingForNode, enabled);
+    if (!enabled)
+        hideHighlight();
+}
+
+void InspectorAgent::setSearchingForNode(bool enabled, bool* newState)
+{
+    *newState = enabled;
+    setSearchingForNode(enabled);
+}
+
+void InspectorAgent::setFrontend(InspectorFrontend* inspectorFrontend)
+{
+    m_frontend = inspectorFrontend;
+    createFrontendLifetimeAgents();
+
+    m_cssAgent->setDOMAgent(m_domAgent.get());
+    m_consoleAgent->setFrontend(m_frontend);
+
+    // Initialize Web Inspector title.
+    m_frontend->inspectedURLChanged(inspectedURL().string());
+}
+
+void InspectorAgent::disconnectFrontend()
+{
+    if (!m_frontend)
+        return;
+
+    // Destroying agents would change the state, but we don't want that.
+    // Pre-disconnect state will be used to restore inspector agents.
+    m_state->mute();
+
+    m_frontend = 0;
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    // If the window is being closed with the debugger enabled,
+    // remember this state to re-enable debugger on the next window
+    // opening.
+    disableDebugger();
+#endif
+    setSearchingForNode(false);
+
+    hideHighlight();
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    m_profilerAgent->setFrontend(0);
+    m_profilerAgent->stopUserInitiatedProfiling(true);
+#endif
+
+    m_consoleAgent->setFrontend(0);
+
+    releaseFrontendLifetimeAgents();
+    m_userAgentOverride = "";
+}
+
+InspectorResourceAgent* InspectorAgent::resourceAgent()
+{
+    if (!m_resourceAgent && m_frontend)
+        m_resourceAgent = InspectorResourceAgent::create(m_inspectedPage, m_state.get(), m_frontend);
+    return m_resourceAgent.get();
+}
+
+void InspectorAgent::createFrontendLifetimeAgents()
+{
+    m_domAgent = InspectorDOMAgent::create(m_injectedScriptHost.get(), m_frontend);
+    m_runtimeAgent = InspectorRuntimeAgent::create(m_injectedScriptHost.get());
+
+#if ENABLE(DATABASE)
+    m_databaseAgent = InspectorDatabaseAgent::create(&m_databaseResources, m_frontend);
+#endif
+
+#if ENABLE(DOM_STORAGE)
+    m_domStorageAgent = InspectorDOMStorageAgent::create(&m_domStorageResources, m_frontend);
+#endif
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    m_applicationCacheAgent = new InspectorApplicationCacheAgent(m_inspectedPage->mainFrame()->loader()->documentLoader(), m_frontend);
+#endif
+}
+
+void InspectorAgent::releaseFrontendLifetimeAgents()
+{
+    m_resourceAgent.clear();
+    m_runtimeAgent.clear();
+    m_timelineAgent.clear();
+
+#if ENABLE(DATABASE)
+    m_databaseAgent.clear();
+#endif
+
+#if ENABLE(DOM_STORAGE)
+    m_domStorageAgent.clear();
+#endif
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    m_applicationCacheAgent.clear();
+#endif
+
+    // This should be invoked prior to m_domAgent destruction.
+    m_cssAgent->setDOMAgent(0);
+    m_domAgent.clear();
+}
+
+void InspectorAgent::populateScriptObjects()
+{
+    ASSERT(m_frontend);
+    if (!m_frontend)
+        return;
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    if (m_profilerAgent->enabled())
+        m_frontend->profilerWasEnabled();
+#endif
+
+    pushDataCollectedOffline();
+
+    if (m_nodeToFocus)
+        focusNode();
+
+    if (!m_requiredPanel.isEmpty()) {
+        m_frontend->showPanel(m_requiredPanel);
+        m_requiredPanel = "";
+    }
+
+    restoreDebugger(true);
+    restoreProfiler(ProfilerRestoreNoAction);
+
+    // Dispatch pending frontend commands
+    for (Vector<pair<long, String> >::iterator it = m_pendingEvaluateTestCommands.begin(); it != m_pendingEvaluateTestCommands.end(); ++it)
+        m_frontend->evaluateForTestInFrontend((*it).first, (*it).second);
+    m_pendingEvaluateTestCommands.clear();
+}
+
+void InspectorAgent::pushDataCollectedOffline()
+{
+    m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
+
+#if ENABLE(DATABASE)
+    DatabaseResourcesMap::iterator databasesEnd = m_databaseResources.end();
+    for (DatabaseResourcesMap::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
+        it->second->bind(m_frontend);
+#endif
+#if ENABLE(DOM_STORAGE)
+    DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
+        it->second->bind(m_frontend);
+#endif
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
+    WorkersMap::iterator workersEnd = m_workers.end();
+    for (WorkersMap::iterator it = m_workers.begin(); it != workersEnd; ++it) {
+        InspectorWorkerResource* worker = it->second.get();
+        m_frontend->didCreateWorker(worker->id(), worker->url(), worker->isSharedWorker());
+    }
+#endif
+}
+
+void InspectorAgent::restoreDebugger(bool eraseStickyBreakpoints)
+{
+    ASSERT(m_frontend);
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    if (m_state->getBoolean(InspectorAgentState::debuggerEnabled))
+        enableDebugger(eraseStickyBreakpoints);
+#endif
+}
+
+void InspectorAgent::restoreProfiler(ProfilerRestoreAction action)
+{
+    ASSERT(m_frontend);
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    m_profilerAgent->setFrontend(m_frontend);
+    if (m_state->getBoolean(InspectorAgentState::profilerEnabled))
+        enableProfiler();
+    if (action == ProfilerRestoreResetAgent)
+        m_profilerAgent->resetFrontendProfiles();
+#endif
+}
+
+void InspectorAgent::didCommitLoad(DocumentLoader* loader)
+{
+    if (!enabled())
+        return;
+
+    if (m_resourceAgent)
+        m_resourceAgent->didCommitLoad(loader);
+
+    ASSERT(m_inspectedPage);
+
+    if (loader->frame() == m_inspectedPage->mainFrame()) {
+        if (m_frontend)
+            m_frontend->inspectedURLChanged(loader->url().string());
+
+        m_injectedScriptHost->discardInjectedScripts();
+        m_consoleAgent->reset();
+
+        if (m_timelineAgent)
+            m_timelineAgent->didCommitLoad();
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+        if (m_applicationCacheAgent)
+            m_applicationCacheAgent->didCommitLoad(loader);
+#endif
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+        if (m_debuggerAgent) {
+            KURL url = inspectedURLWithoutFragment();
+            m_debuggerAgent->inspectedURLChanged(url);
+            if (m_browserDebuggerAgent)
+                m_browserDebuggerAgent->inspectedURLChanged(url);
+        }
+#endif
+
+#if ENABLE(JAVASCRIPT_DEBUGGER) && USE(JSC)
+        m_profilerAgent->stopUserInitiatedProfiling(true);
+        m_profilerAgent->resetState();
+#endif
+
+        if (m_frontend) {
+            m_frontend->reset();
+            m_domAgent->reset();
+            m_cssAgent->reset();
+        }
+#if ENABLE(WORKERS)
+        m_workers.clear();
+#endif
+#if ENABLE(DATABASE)
+        m_databaseResources.clear();
+#endif
+#if ENABLE(DOM_STORAGE)
+        m_domStorageResources.clear();
+#endif
+
+        if (m_frontend)
+            m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
+    }
+}
+
+void InspectorAgent::domContentLoadedEventFired(DocumentLoader* loader, const KURL& url)
+{
+    if (!enabled() || !isMainResourceLoader(loader, url))
+        return;
+
+    if (m_domAgent)
+        m_domAgent->mainFrameDOMContentLoaded();
+    if (m_timelineAgent)
+        m_timelineAgent->didMarkDOMContentEvent();
+    if (m_frontend)
+        m_frontend->domContentEventFired(currentTime());
+}
+
+void InspectorAgent::loadEventFired(DocumentLoader* loader, const KURL& url)
+{
+    if (!enabled())
+        return;
+
+    if (m_domAgent)
+        m_domAgent->loadEventFired(loader->frame()->document());
+
+    if (!isMainResourceLoader(loader, url))
+        return;
+
+    if (m_timelineAgent)
+        m_timelineAgent->didMarkLoadEvent();
+    if (m_frontend)
+        m_frontend->loadEventFired(currentTime());
+}
+
+bool InspectorAgent::isMainResourceLoader(DocumentLoader* loader, const KURL& requestUrl)
+{
+    return loader->frame() == m_inspectedPage->mainFrame() && requestUrl == loader->requestURL();
+}
+
+void InspectorAgent::setUserAgentOverride(const String& userAgent)
+{
+    m_userAgentOverride = userAgent;
+}
+
+void InspectorAgent::applyUserAgentOverride(String* userAgent) const
+{
+    if (!m_userAgentOverride.isEmpty())
+        *userAgent = m_userAgentOverride;
+}
+
+void InspectorAgent::startTimelineProfiler()
+{
+    if (m_timelineAgent || !enabled() || !m_frontend)
+        return;
+
+    m_timelineAgent = InspectorTimelineAgent::create(m_state.get(), m_frontend);
+}
+
+void InspectorAgent::stopTimelineProfiler()
+{
+    m_timelineAgent.clear();
+}
+
+#if ENABLE(WORKERS)
+class PostWorkerNotificationToFrontendTask : public ScriptExecutionContext::Task {
+public:
+    static PassOwnPtr<PostWorkerNotificationToFrontendTask> create(PassRefPtr<InspectorWorkerResource> worker, InspectorAgent::WorkerAction action)
+    {
+        return new PostWorkerNotificationToFrontendTask(worker, action);
+    }
+
+private:
+    PostWorkerNotificationToFrontendTask(PassRefPtr<InspectorWorkerResource> worker, InspectorAgent::WorkerAction action)
+        : m_worker(worker)
+        , m_action(action)
+    {
+    }
+
+    virtual void performTask(ScriptExecutionContext* scriptContext)
+    {
+        if (scriptContext->isDocument()) {
+            if (InspectorAgent* inspectorAgent = static_cast<Document*>(scriptContext)->page()->inspectorController()->m_inspectorAgent.get())
+                inspectorAgent->postWorkerNotificationToFrontend(*m_worker, m_action);
+        }
+    }
+
+private:
+    RefPtr<InspectorWorkerResource> m_worker;
+    InspectorAgent::WorkerAction m_action;
+};
+
+void InspectorAgent::postWorkerNotificationToFrontend(const InspectorWorkerResource& worker, InspectorAgent::WorkerAction action)
+{
+    if (!m_frontend)
+        return;
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    switch (action) {
+    case InspectorAgent::WorkerCreated:
+        m_frontend->didCreateWorker(worker.id(), worker.url(), worker.isSharedWorker());
+        break;
+    case InspectorAgent::WorkerDestroyed:
+        m_frontend->didDestroyWorker(worker.id());
+        break;
+    }
+#endif
+}
+
+void InspectorAgent::didCreateWorker(intptr_t id, const String& url, bool isSharedWorker)
+{
+    if (!enabled())
+        return;
+
+    RefPtr<InspectorWorkerResource> workerResource(InspectorWorkerResource::create(id, url, isSharedWorker));
+    m_workers.set(id, workerResource);
+    if (m_inspectedPage && m_frontend)
+        m_inspectedPage->mainFrame()->document()->postTask(PostWorkerNotificationToFrontendTask::create(workerResource, InspectorAgent::WorkerCreated));
+}
+
+void InspectorAgent::didDestroyWorker(intptr_t id)
+{
+    if (!enabled())
+        return;
+
+    WorkersMap::iterator workerResource = m_workers.find(id);
+    if (workerResource == m_workers.end())
+        return;
+    if (m_inspectedPage && m_frontend)
+        m_inspectedPage->mainFrame()->document()->postTask(PostWorkerNotificationToFrontendTask::create(workerResource->second, InspectorAgent::WorkerDestroyed));
+    m_workers.remove(workerResource);
+}
+#endif // ENABLE(WORKERS)
+
+#if ENABLE(DATABASE)
+void InspectorAgent::didOpenDatabase(PassRefPtr<Database> database, const String& domain, const String& name, const String& version)
+{
+    if (!enabled())
+        return;
+
+    RefPtr<InspectorDatabaseResource> resource = InspectorDatabaseResource::create(database, domain, name, version);
+
+    m_databaseResources.set(resource->id(), resource);
+
+    // Resources are only bound while visible.
+    if (m_frontend)
+        resource->bind(m_frontend);
+}
+#endif
+
+void InspectorAgent::getCookies(RefPtr<InspectorArray>* cookies, WTF::String* cookiesString)
+{
+    // If we can get raw cookies.
+    ListHashSet<Cookie> rawCookiesList;
+
+    // If we can't get raw cookies - fall back to String representation
+    String stringCookiesList;
+
+    // Return value to getRawCookies should be the same for every call because
+    // the return value is platform/network backend specific, and the call will
+    // always return the same true/false value.
+    bool rawCookiesImplemented = false;
+
+    for (Frame* frame = m_inspectedPage->mainFrame(); frame; frame = frame->tree()->traverseNext(m_inspectedPage->mainFrame())) {
+        Document* document = frame->document();
+        const CachedResourceLoader::DocumentResourceMap& allResources = document->cachedResourceLoader()->allCachedResources();
+        CachedResourceLoader::DocumentResourceMap::const_iterator end = allResources.end();
+        for (CachedResourceLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it) {
+            Vector<Cookie> docCookiesList;
+            rawCookiesImplemented = getRawCookies(document, KURL(ParsedURLString, it->second->url()), docCookiesList);
+
+            if (!rawCookiesImplemented) {
+                // FIXME: We need duplication checking for the String representation of cookies.
+                ExceptionCode ec = 0;
+                stringCookiesList += document->cookie(ec);
+                // Exceptions are thrown by cookie() in sandboxed frames. That won't happen here
+                // because "document" is the document of the main frame of the page.
+                ASSERT(!ec);
+            } else {
+                int cookiesSize = docCookiesList.size();
+                for (int i = 0; i < cookiesSize; i++) {
+                    if (!rawCookiesList.contains(docCookiesList[i]))
+                        rawCookiesList.add(docCookiesList[i]);
+                }
+            }
+        }
+    }
+
+    if (rawCookiesImplemented)
+        *cookies = buildArrayForCookies(rawCookiesList);
+    else
+        *cookiesString = stringCookiesList;
+}
+
+PassRefPtr<InspectorArray> InspectorAgent::buildArrayForCookies(ListHashSet<Cookie>& cookiesList)
+{
+    RefPtr<InspectorArray> cookies = InspectorArray::create();
+
+    ListHashSet<Cookie>::iterator end = cookiesList.end();
+    ListHashSet<Cookie>::iterator it = cookiesList.begin();
+    for (int i = 0; it != end; ++it, i++)
+        cookies->pushObject(buildObjectForCookie(*it));
+
+    return cookies;
+}
+
+PassRefPtr<InspectorObject> InspectorAgent::buildObjectForCookie(const Cookie& cookie)
+{
+    RefPtr<InspectorObject> value = InspectorObject::create();
+    value->setString("name", cookie.name);
+    value->setString("value", cookie.value);
+    value->setString("domain", cookie.domain);
+    value->setString("path", cookie.path);
+    value->setNumber("expires", cookie.expires);
+    value->setNumber("size", (cookie.name.length() + cookie.value.length()));
+    value->setBoolean("httpOnly", cookie.httpOnly);
+    value->setBoolean("secure", cookie.secure);
+    value->setBoolean("session", cookie.session);
+    return value;
+}
+
+void InspectorAgent::deleteCookie(const String& cookieName, const String& domain)
+{
+    for (Frame* frame = m_inspectedPage->mainFrame(); frame; frame = frame->tree()->traverseNext(m_inspectedPage->mainFrame())) {
+        Document* document = frame->document();
+        if (document->url().host() != domain)
+            continue;
+        const CachedResourceLoader::DocumentResourceMap& allResources = document->cachedResourceLoader()->allCachedResources();
+        CachedResourceLoader::DocumentResourceMap::const_iterator end = allResources.end();
+        for (CachedResourceLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it)
+            WebCore::deleteCookie(document, KURL(ParsedURLString, it->second->url()), cookieName);
+    }
+}
+
+#if ENABLE(DOM_STORAGE)
+void InspectorAgent::didUseDOMStorage(StorageArea* storageArea, bool isLocalStorage, Frame* frame)
+{
+    if (!enabled())
+        return;
+
+    DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
+        if (it->second->isSameHostAndType(frame, isLocalStorage))
+            return;
+
+    RefPtr<Storage> domStorage = Storage::create(frame, storageArea);
+    RefPtr<InspectorDOMStorageResource> resource = InspectorDOMStorageResource::create(domStorage.get(), isLocalStorage, frame);
+
+    m_domStorageResources.set(resource->id(), resource);
+
+    // Resources are only bound while visible.
+    if (m_frontend)
+        resource->bind(m_frontend);
+}
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+void InspectorAgent::didCreateWebSocket(unsigned long identifier, const KURL& requestURL, const KURL& documentURL)
+{
+    if (!enabled())
+        return;
+    ASSERT(m_inspectedPage);
+
+    if (m_resourceAgent)
+        m_resourceAgent->didCreateWebSocket(identifier, requestURL);
+    UNUSED_PARAM(documentURL);
+}
+
+void InspectorAgent::willSendWebSocketHandshakeRequest(unsigned long identifier, const WebSocketHandshakeRequest& request)
+{
+    if (m_resourceAgent)
+        m_resourceAgent->willSendWebSocketHandshakeRequest(identifier, request);
+}
+
+void InspectorAgent::didReceiveWebSocketHandshakeResponse(unsigned long identifier, const WebSocketHandshakeResponse& response)
+{
+    if (m_resourceAgent)
+        m_resourceAgent->didReceiveWebSocketHandshakeResponse(identifier, response);
+}
+
+void InspectorAgent::didCloseWebSocket(unsigned long identifier)
+{
+    if (m_resourceAgent)
+        m_resourceAgent->didCloseWebSocket(identifier);
+}
+#endif // ENABLE(WEB_SOCKETS)
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+bool InspectorAgent::isRecordingUserInitiatedProfile() const
+{
+    return m_profilerAgent->isRecordingUserInitiatedProfile();
+}
+
+void InspectorAgent::startUserInitiatedProfiling()
+{
+    if (!enabled())
+        return;
+    m_profilerAgent->startUserInitiatedProfiling();
+    m_state->setBoolean(InspectorAgentState::userInitiatedProfiling, true);
+}
+
+void InspectorAgent::stopUserInitiatedProfiling()
+{
+    if (!enabled())
+        return;
+    m_profilerAgent->stopUserInitiatedProfiling();
+    m_state->setBoolean(InspectorAgentState::userInitiatedProfiling, false);
+    showPanel(profilesPanelName);
+}
+
+bool InspectorAgent::profilerEnabled() const
+{
+    return enabled() && m_profilerAgent->enabled();
+}
+
+void InspectorAgent::enableProfiler()
+{
+    if (profilerEnabled())
+        return;
+    m_state->setBoolean(InspectorAgentState::profilerEnabled, true);
+    m_profilerAgent->enable(false);
+}
+
+void InspectorAgent::disableProfiler()
+{
+    m_state->setBoolean(InspectorAgentState::profilerEnabled, false);
+    m_profilerAgent->disable();
+}
+#endif
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+void InspectorAgent::showAndEnableDebugger()
+{
+    if (!enabled())
+        return;
+
+    if (debuggerEnabled())
+        return;
+
+    if (!m_frontend) {
+        m_state->setBoolean(InspectorAgentState::debuggerEnabled, true);
+        showPanel(scriptsPanelName);
+    } else
+        enableDebugger(true);
+}
+
+void InspectorAgent::enableDebugger(bool eraseStickyBreakpoints)
+{
+    if (debuggerEnabled())
+        return;
+    m_state->setBoolean(InspectorAgentState::debuggerEnabled, true);
+    ASSERT(m_inspectedPage);
+
+    m_debuggerAgent = InspectorDebuggerAgent::create(this, m_frontend, eraseStickyBreakpoints);
+    m_browserDebuggerAgent = InspectorBrowserDebuggerAgent::create(this, eraseStickyBreakpoints);
+
+    m_frontend->debuggerWasEnabled();
+}
+
+void InspectorAgent::disableDebugger()
+{
+    if (!enabled())
+        return;
+    ASSERT(m_inspectedPage);
+    m_debuggerAgent.clear();
+    m_browserDebuggerAgent.clear();
+
+    if (m_frontend) {
+        m_frontend->debuggerWasDisabled();
+        m_state->setBoolean(InspectorAgentState::debuggerEnabled, false);
+    }
+}
+
+void InspectorAgent::resume()
+{
+    if (m_debuggerAgent)
+        m_debuggerAgent->resume();
+}
+#endif
+
+void InspectorAgent::evaluateForTestInFrontend(long callId, const String& script)
+{
+    if (m_frontend)
+        m_frontend->evaluateForTestInFrontend(callId, script);
+    else
+        m_pendingEvaluateTestCommands.append(pair<long, String>(callId, script));
+}
+
+void InspectorAgent::didEvaluateForTestInFrontend(long callId, const String& jsonResult)
+{
+    ScriptState* scriptState = scriptStateFromPage(debuggerWorld(), m_inspectedPage);
+    ScriptObject window;
+    ScriptGlobalObject::get(scriptState, "window", window);
+    ScriptFunctionCall function(window, "didEvaluateForTestInFrontend");
+    function.appendArgument(callId);
+    function.appendArgument(jsonResult);
+    function.call();
+}
+
+static Path quadToPath(const FloatQuad& quad)
+{
+    Path quadPath;
+    quadPath.moveTo(quad.p1());
+    quadPath.addLineTo(quad.p2());
+    quadPath.addLineTo(quad.p3());
+    quadPath.addLineTo(quad.p4());
+    quadPath.closeSubpath();
+    return quadPath;
+}
+
+static void drawOutlinedQuad(GraphicsContext& context, const FloatQuad& quad, const Color& fillColor)
+{
+    static const int outlineThickness = 2;
+    static const Color outlineColor(62, 86, 180, 228);
+
+    Path quadPath = quadToPath(quad);
+
+    // Clip out the quad, then draw with a 2px stroke to get a pixel
+    // of outline (because inflating a quad is hard)
+    {
+        context.save();
+        context.clipOut(quadPath);
+
+        context.setStrokeThickness(outlineThickness);
+        context.setStrokeColor(outlineColor, ColorSpaceDeviceRGB);
+        context.strokePath(quadPath);
+
+        context.restore();
+    }
+
+    // Now do the fill
+    context.setFillColor(fillColor, ColorSpaceDeviceRGB);
+    context.fillPath(quadPath);
+}
+
+static void drawOutlinedQuadWithClip(GraphicsContext& context, const FloatQuad& quad, const FloatQuad& clipQuad, const Color& fillColor)
+{
+    context.save();
+    Path clipQuadPath = quadToPath(clipQuad);
+    context.clipOut(clipQuadPath);
+    drawOutlinedQuad(context, quad, fillColor);
+    context.restore();
+}
+
+static void drawHighlightForBox(GraphicsContext& context, const FloatQuad& contentQuad, const FloatQuad& paddingQuad, const FloatQuad& borderQuad, const FloatQuad& marginQuad)
+{
+    static const Color contentBoxColor(125, 173, 217, 128);
+    static const Color paddingBoxColor(125, 173, 217, 160);
+    static const Color borderBoxColor(125, 173, 217, 192);
+    static const Color marginBoxColor(125, 173, 217, 228);
+
+    if (marginQuad != borderQuad)
+        drawOutlinedQuadWithClip(context, marginQuad, borderQuad, marginBoxColor);
+    if (borderQuad != paddingQuad)
+        drawOutlinedQuadWithClip(context, borderQuad, paddingQuad, borderBoxColor);
+    if (paddingQuad != contentQuad)
+        drawOutlinedQuadWithClip(context, paddingQuad, contentQuad, paddingBoxColor);
+
+    drawOutlinedQuad(context, contentQuad, contentBoxColor);
+}
+
+static void drawHighlightForLineBoxesOrSVGRenderer(GraphicsContext& context, const Vector<FloatQuad>& lineBoxQuads)
+{
+    static const Color lineBoxColor(125, 173, 217, 128);
+
+    for (size_t i = 0; i < lineBoxQuads.size(); ++i)
+        drawOutlinedQuad(context, lineBoxQuads[i], lineBoxColor);
+}
+
+static inline void convertFromFrameToMainFrame(Frame* frame, IntRect& rect)
+{
+    rect = frame->page()->mainFrame()->view()->windowToContents(frame->view()->contentsToWindow(rect));
+}
+
+static inline IntSize frameToMainFrameOffset(Frame* frame)
+{
+    IntPoint mainFramePoint = frame->page()->mainFrame()->view()->windowToContents(frame->view()->contentsToWindow(IntPoint()));
+    return mainFramePoint - IntPoint();
+}
+
+void InspectorAgent::drawNodeHighlight(GraphicsContext& context) const
+{
+    if (!m_highlightedNode)
+        return;
+
+    RenderObject* renderer = m_highlightedNode->renderer();
+    Frame* containingFrame = m_highlightedNode->document()->frame();
+    if (!renderer || !containingFrame)
+        return;
+
+    IntSize mainFrameOffset = frameToMainFrameOffset(containingFrame);
+    IntRect boundingBox = renderer->absoluteBoundingBoxRect(true);
+    boundingBox.move(mainFrameOffset);
+
+    IntRect titleReferenceBox = boundingBox;
+
+    ASSERT(m_inspectedPage);
+
+    FrameView* view = m_inspectedPage->mainFrame()->view();
+    FloatRect overlayRect = view->visibleContentRect();
+    if (!overlayRect.contains(boundingBox) && !boundingBox.contains(enclosingIntRect(overlayRect)))
+        overlayRect = view->visibleContentRect();
+    context.translate(-overlayRect.x(), -overlayRect.y());
+
+    // RenderSVGRoot should be highlighted through the isBox() code path, all other SVG elements should just dump their absoluteQuads().
+#if ENABLE(SVG)
+    bool isSVGRenderer = renderer->node() && renderer->node()->isSVGElement() && !renderer->isSVGRoot();
+#else
+    bool isSVGRenderer = false;
+#endif
+
+    if (renderer->isBox() && !isSVGRenderer) {
+        RenderBox* renderBox = toRenderBox(renderer);
+
+        IntRect contentBox = renderBox->contentBoxRect();
+
+        IntRect paddingBox(contentBox.x() - renderBox->paddingLeft(), contentBox.y() - renderBox->paddingTop(),
+                           contentBox.width() + renderBox->paddingLeft() + renderBox->paddingRight(), contentBox.height() + renderBox->paddingTop() + renderBox->paddingBottom());
+        IntRect borderBox(paddingBox.x() - renderBox->borderLeft(), paddingBox.y() - renderBox->borderTop(),
+                          paddingBox.width() + renderBox->borderLeft() + renderBox->borderRight(), paddingBox.height() + renderBox->borderTop() + renderBox->borderBottom());
+        IntRect marginBox(borderBox.x() - renderBox->marginLeft(), borderBox.y() - renderBox->marginTop(),
+                          borderBox.width() + renderBox->marginLeft() + renderBox->marginRight(), borderBox.height() + renderBox->marginTop() + renderBox->marginBottom());
+
+        titleReferenceBox = marginBox;
+        titleReferenceBox.move(mainFrameOffset);
+        titleReferenceBox.move(boundingBox.x(), boundingBox.y());
+
+        FloatQuad absContentQuad = renderBox->localToAbsoluteQuad(FloatRect(contentBox));
+        FloatQuad absPaddingQuad = renderBox->localToAbsoluteQuad(FloatRect(paddingBox));
+        FloatQuad absBorderQuad = renderBox->localToAbsoluteQuad(FloatRect(borderBox));
+        FloatQuad absMarginQuad = renderBox->localToAbsoluteQuad(FloatRect(marginBox));
+
+        absContentQuad.move(mainFrameOffset);
+        absPaddingQuad.move(mainFrameOffset);
+        absBorderQuad.move(mainFrameOffset);
+        absMarginQuad.move(mainFrameOffset);
+
+        drawHighlightForBox(context, absContentQuad, absPaddingQuad, absBorderQuad, absMarginQuad);
+    } else if (renderer->isRenderInline() || isSVGRenderer) {
+        // FIXME: We should show margins/padding/border for inlines.
+        Vector<FloatQuad> lineBoxQuads;
+        renderer->absoluteQuads(lineBoxQuads);
+        for (unsigned i = 0; i < lineBoxQuads.size(); ++i)
+            lineBoxQuads[i] += mainFrameOffset;
+
+        drawHighlightForLineBoxesOrSVGRenderer(context, lineBoxQuads);
+    }
+
+    // Draw node title if necessary.
+
+    if (!m_highlightedNode->isElementNode())
+        return;
+
+    WebCore::Settings* settings = containingFrame->settings();
+    drawElementTitle(context, titleReferenceBox, overlayRect, settings);
+}
+
+void InspectorAgent::drawElementTitle(GraphicsContext& context, const IntRect& boundingBox, const FloatRect& overlayRect, WebCore::Settings* settings) const
+{
+    static const int rectInflatePx = 4;
+    static const int fontHeightPx = 12;
+    static const int borderWidthPx = 1;
+    static const Color tooltipBackgroundColor(255, 255, 194, 255);
+    static const Color tooltipBorderColor(Color::black);
+    static const Color tooltipFontColor(Color::black);
+
+    Element* element = static_cast<Element*>(m_highlightedNode.get());
+    bool isXHTML = element->document()->isXHTMLDocument();
+    String nodeTitle = isXHTML ? element->nodeName() : element->nodeName().lower();
+    const AtomicString& idValue = element->getIdAttribute();
+    if (!idValue.isNull() && !idValue.isEmpty()) {
+        nodeTitle += "#";
+        nodeTitle += idValue;
+    }
+    if (element->hasClass() && element->isStyledElement()) {
+        const SpaceSplitString& classNamesString = static_cast<StyledElement*>(element)->classNames();
+        size_t classNameCount = classNamesString.size();
+        if (classNameCount) {
+            HashSet<AtomicString> usedClassNames;
+            for (size_t i = 0; i < classNameCount; ++i) {
+                const AtomicString& className = classNamesString[i];
+                if (usedClassNames.contains(className))
+                    continue;
+                usedClassNames.add(className);
+                nodeTitle += ".";
+                nodeTitle += className;
+            }
+        }
+    }
+
+    Element* highlightedElement = m_highlightedNode->isElementNode() ? static_cast<Element*>(m_highlightedNode.get()) : 0;
+    nodeTitle += " [";
+    nodeTitle += String::number(highlightedElement ? highlightedElement->offsetWidth() : boundingBox.width());
+    nodeTitle.append(static_cast<UChar>(0x00D7)); // &times;
+    nodeTitle += String::number(highlightedElement ? highlightedElement->offsetHeight() : boundingBox.height());
+    nodeTitle += "]";
+
+    FontDescription desc;
+    FontFamily family;
+    family.setFamily(settings->fixedFontFamily());
+    desc.setFamily(family);
+    desc.setComputedSize(fontHeightPx);
+    Font font = Font(desc, 0, 0);
+    font.update(0);
+
+    TextRun nodeTitleRun(nodeTitle);
+    IntPoint titleBasePoint = IntPoint(boundingBox.x(), boundingBox.maxY() - 1);
+    titleBasePoint.move(rectInflatePx, rectInflatePx);
+    IntRect titleRect = enclosingIntRect(font.selectionRectForText(nodeTitleRun, titleBasePoint, fontHeightPx));
+    titleRect.inflate(rectInflatePx);
+
+    // The initial offsets needed to compensate for a 1px-thick border stroke (which is not a part of the rectangle).
+    int dx = -borderWidthPx;
+    int dy = borderWidthPx;
+
+    // If the tip sticks beyond the right of overlayRect, right-align the tip with the said boundary.
+    if (titleRect.maxX() > overlayRect.maxX())
+        dx = overlayRect.maxX() - titleRect.maxX();
+
+    // If the tip sticks beyond the left of overlayRect, left-align the tip with the said boundary.
+    if (titleRect.x() + dx < overlayRect.x())
+        dx = overlayRect.x() - titleRect.x() - borderWidthPx;
+
+    // If the tip sticks beyond the bottom of overlayRect, show the tip at top of bounding box.
+    if (titleRect.maxY() > overlayRect.maxY()) {
+        dy = boundingBox.y() - titleRect.maxY() - borderWidthPx;
+        // If the tip still sticks beyond the bottom of overlayRect, bottom-align the tip with the said boundary.
+        if (titleRect.maxY() + dy > overlayRect.maxY())
+            dy = overlayRect.maxY() - titleRect.maxY();
+    }
+
+    // If the tip sticks beyond the top of overlayRect, show the tip at top of overlayRect.
+    if (titleRect.y() + dy < overlayRect.y())
+        dy = overlayRect.y() - titleRect.y() + borderWidthPx;
+
+    titleRect.move(dx, dy);
+    context.setStrokeColor(tooltipBorderColor, ColorSpaceDeviceRGB);
+    context.setStrokeThickness(borderWidthPx);
+    context.setFillColor(tooltipBackgroundColor, ColorSpaceDeviceRGB);
+    context.drawRect(titleRect);
+    context.setFillColor(tooltipFontColor, ColorSpaceDeviceRGB);
+    context.drawText(font, nodeTitleRun, IntPoint(titleRect.x() + rectInflatePx, titleRect.y() + font.fontMetrics().height()));
+}
+
+void InspectorAgent::openInInspectedWindow(const String& url)
+{
+    Frame* mainFrame = m_inspectedPage->mainFrame();
+
+    FrameLoadRequest request(mainFrame->document()->securityOrigin(), ResourceRequest(), "_blank");
+
+    bool created;
+    WindowFeatures windowFeatures;
+    Frame* newFrame = WebCore::createWindow(mainFrame, mainFrame, request, windowFeatures, created);
+    if (!newFrame)
+        return;
+
+    UserGestureIndicator indicator(DefinitelyProcessingUserGesture);
+    newFrame->loader()->setOpener(mainFrame);
+    newFrame->page()->setOpenedByDOM();
+    newFrame->loader()->changeLocation(mainFrame->document()->securityOrigin(), newFrame->loader()->completeURL(url), "", false, false);
+}
+
+void InspectorAgent::addScriptToEvaluateOnLoad(const String& source)
+{
+    m_scriptsToEvaluateOnLoad.append(source);
+}
+
+void InspectorAgent::removeAllScriptsToEvaluateOnLoad()
+{
+    m_scriptsToEvaluateOnLoad.clear();
+}
+
+void InspectorAgent::setInspectorExtensionAPI(const String& source)
+{
+    m_inspectorExtensionAPI = source;
+}
+
+KURL InspectorAgent::inspectedURL() const
+{
+    return m_inspectedPage->mainFrame()->document()->url();
+}
+
+KURL InspectorAgent::inspectedURLWithoutFragment() const
+{
+    KURL url = inspectedURL();
+    url.removeFragmentIdentifier();
+    return url;
+}
+
+void InspectorAgent::reloadPage(bool ignoreCache)
+{
+    m_inspectedPage->mainFrame()->loader()->reload(ignoreCache);
+}
+
+bool InspectorAgent::enabled() const
+{
+    if (!m_inspectedPage)
+        return false;
+    return m_inspectedPage->settings()->developerExtrasEnabled();
+}
+
+void InspectorAgent::showConsole()
+{
+    showPanel(consolePanelName);
+}
+
+void InspectorAgent::showPanel(const String& panel)
+{
+    if (!m_frontend) {
+        m_requiredPanel = panel;
+        return;
+    }
+    m_frontend->showPanel(panel);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorAgent.h b/Source/WebCore/inspector/InspectorAgent.h
new file mode 100644
index 0000000..1f14dd9
--- /dev/null
+++ b/Source/WebCore/inspector/InspectorAgent.h
@@ -0,0 +1,327 @@
+/*
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorAgent_h
+#define InspectorAgent_h
+
+#include "CharacterData.h"
+#include "Console.h"
+#include "Cookie.h"
+#include "Page.h"
+#include "PlatformString.h"
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+#include <wtf/ListHashSet.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+#include <wtf/text/StringHash.h>
+
+namespace WebCore {
+
+class CachedResource;
+class CharacterData;
+class Database;
+class DOMWrapperWorld;
+class Document;
+class DocumentLoader;
+class FloatRect;
+class GraphicsContext;
+class HTTPHeaderMap;
+class HitTestResult;
+class InjectedScript;
+class InjectedScriptHost;
+class InspectorArray;
+class InspectorBrowserDebuggerAgent;
+class InspectorClient;
+class InspectorConsoleAgent;
+class InspectorCSSAgent;
+class InspectorDOMAgent;
+class InspectorDOMStorageAgent;
+class InspectorDOMStorageResource;
+class InspectorDatabaseAgent;
+class InspectorDatabaseResource;
+class InspectorDebuggerAgent;
+class InspectorFrontend;
+class InspectorFrontendClient;
+class InspectorObject;
+class InspectorProfilerAgent;
+class InspectorResourceAgent;
+class InspectorRuntimeAgent;
+class InspectorState;
+class InspectorStorageAgent;
+class InspectorTimelineAgent;
+class InspectorValue;
+class InspectorWorkerResource;
+class IntRect;
+class KURL;
+class Node;
+class Page;
+class ResourceRequest;
+class ResourceResponse;
+class ResourceError;
+class ScriptArguments;
+class ScriptCallStack;
+class ScriptProfile;
+class SharedBuffer;
+class StorageArea;
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+class InspectorApplicationCacheAgent;
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+class WebSocketHandshakeRequest;
+class WebSocketHandshakeResponse;
+#endif
+
+class InspectorAgent {
+    WTF_MAKE_NONCOPYABLE(InspectorAgent);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    InspectorAgent(Page*, InspectorClient*);
+    virtual ~InspectorAgent();
+
+    InspectorClient* inspectorClient() { return m_client; }
+    InjectedScriptHost* injectedScriptHost() { return m_injectedScriptHost.get(); }
+
+    void inspectedPageDestroyed();
+
+    bool enabled() const;
+
+    Page* inspectedPage() const { return m_inspectedPage; }
+    KURL inspectedURL() const;
+    KURL inspectedURLWithoutFragment() const;
+    void reloadPage(bool ignoreCache);
+    void showConsole();
+
+    void restoreInspectorStateFromCookie(const String& inspectorCookie);
+
+    void highlight(Node*);
+    void hideHighlight();
+    void inspect(Node*);
+    void highlightDOMNode(long nodeId);
+    void hideDOMNodeHighlight() { hideHighlight(); }
+
+    void highlightFrame(unsigned long frameId);
+    void hideFrameHighlight() { hideHighlight(); }
+
+    void setFrontend(InspectorFrontend*);
+    InspectorFrontend* frontend() const { return m_frontend; }
+    void disconnectFrontend();
+
+    InspectorResourceAgent* resourceAgent();
+
+    InspectorAgent* inspectorAgent() { return this; }
+    InspectorConsoleAgent* consoleAgent() { return m_consoleAgent.get(); }
+    InspectorCSSAgent* cssAgent() { return m_cssAgent.get(); }
+    InspectorDOMAgent* domAgent() { return m_domAgent.get(); }
+    InjectedScriptHost* injectedScriptAgent() { return m_injectedScriptHost.get(); }
+    InspectorRuntimeAgent* runtimeAgent() { return m_runtimeAgent.get(); }
+    InspectorTimelineAgent* timelineAgent() { return m_timelineAgent.get(); }
+#if ENABLE(DATABASE)
+    InspectorDatabaseAgent* databaseAgent() { return m_databaseAgent.get(); }
+#endif
+#if ENABLE(DOM_STORAGE)
+    InspectorDOMStorageAgent* domStorageAgent() { return m_domStorageAgent.get(); }
+#endif
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    InspectorBrowserDebuggerAgent* browserDebuggerAgent() const { return m_browserDebuggerAgent.get(); }
+    InspectorDebuggerAgent* debuggerAgent() const { return m_debuggerAgent.get(); }
+    InspectorProfilerAgent* profilerAgent() const { return m_profilerAgent.get(); }
+#endif
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    InspectorApplicationCacheAgent* applicationCacheAgent() { return m_applicationCacheAgent.get(); }
+#endif
+
+    bool handleMousePress();
+    bool searchingForNodeInPage() const;
+    void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
+
+    void didClearWindowObjectInWorld(Frame*, DOMWrapperWorld*);
+
+    void didCommitLoad(DocumentLoader*);
+
+    void startTimelineProfiler();
+    void stopTimelineProfiler();
+
+    void getCookies(RefPtr<InspectorArray>* cookies, WTF::String* cookiesString);
+    void deleteCookie(const String& cookieName, const String& domain);
+
+    void domContentLoadedEventFired(DocumentLoader*, const KURL&);
+    void loadEventFired(DocumentLoader*, const KURL&);
+
+#if ENABLE(WORKERS)
+    enum WorkerAction { WorkerCreated, WorkerDestroyed };
+
+    void postWorkerNotificationToFrontend(const InspectorWorkerResource&, WorkerAction);
+    void didCreateWorker(intptr_t, const String& url, bool isSharedWorker);
+    void didDestroyWorker(intptr_t);
+#endif
+
+#if ENABLE(DATABASE)
+    void didOpenDatabase(PassRefPtr<Database>, const String& domain, const String& name, const String& version);
+#endif
+
+#if ENABLE(DOM_STORAGE)
+    void didUseDOMStorage(StorageArea*, bool isLocalStorage, Frame*);
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+    void didCreateWebSocket(unsigned long identifier, const KURL& requestURL, const KURL& documentURL);
+    void willSendWebSocketHandshakeRequest(unsigned long identifier, const WebSocketHandshakeRequest&);
+    void didReceiveWebSocketHandshakeResponse(unsigned long identifier, const WebSocketHandshakeResponse&);
+    void didCloseWebSocket(unsigned long identifier);
+#endif
+
+    bool hasFrontend() const { return m_frontend; }
+
+    void drawNodeHighlight(GraphicsContext&) const;
+    void openInInspectedWindow(const String& url);
+    void drawElementTitle(GraphicsContext&, const IntRect& boundingBox, const FloatRect& overlayRect, WebCore::Settings*) const;
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    bool isRecordingUserInitiatedProfile() const;
+    void startProfiling() { startUserInitiatedProfiling(); }
+    void startUserInitiatedProfiling();
+    void stopProfiling() { stopUserInitiatedProfiling(); }
+    void stopUserInitiatedProfiling();
+    void enableProfiler();
+    void disableProfiler();
+    bool profilerEnabled() const;
+
+    void showAndEnableDebugger();
+    void enableDebugger() { enableDebugger(false); }
+    void enableDebugger(bool eraseStickyBreakpoints);
+    void disableDebugger();
+    bool debuggerEnabled() const { return m_debuggerAgent; }
+    void resume();
+#endif
+
+    // Generic code called from custom implementations.
+    void evaluateForTestInFrontend(long testCallId, const String& script);
+
+    void addScriptToEvaluateOnLoad(const String& source);
+    void removeAllScriptsToEvaluateOnLoad();
+    void setInspectorExtensionAPI(const String& source);
+
+    InspectorState* state() { return m_state.get(); }
+
+    // InspectorAgent API
+    void getInspectorState(RefPtr<InspectorObject>* state);
+    void setMonitoringXHREnabled(bool enabled, bool* newState);
+    void populateScriptObjects();
+    // Following are used from InspectorBackend and internally.
+    void setSearchingForNode(bool enabled, bool* newState);
+    void didEvaluateForTestInFrontend(long callId, const String& jsonResult);
+
+    void setUserAgentOverride(const String& userAgent);
+    void applyUserAgentOverride(String* userAgent) const;
+
+private:
+    void showPanel(const String& panel);
+    void pushDataCollectedOffline();
+    void restoreDebugger(bool eraseStickyBreakpoints);
+    enum ProfilerRestoreAction {
+        ProfilerRestoreNoAction = 0,
+        ProfilerRestoreResetAgent = 1
+    };
+    void restoreProfiler(ProfilerRestoreAction);
+    void unbindAllResources();
+    void setSearchingForNode(bool enabled);
+
+    void releaseFrontendLifetimeAgents();
+    void createFrontendLifetimeAgents();
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    void toggleRecordButton(bool);
+#endif
+
+    PassRefPtr<InspectorObject> buildObjectForCookie(const Cookie&);
+    PassRefPtr<InspectorArray> buildArrayForCookies(ListHashSet<Cookie>&);
+
+    void focusNode();
+    bool isMainResourceLoader(DocumentLoader*, const KURL& requestUrl);
+
+    Page* m_inspectedPage;
+    InspectorClient* m_client;
+    InspectorFrontend* m_frontend;
+    OwnPtr<InspectorCSSAgent> m_cssAgent;
+    OwnPtr<InspectorDOMAgent> m_domAgent;
+
+#if ENABLE(DATABASE)
+    OwnPtr<InspectorDatabaseAgent> m_databaseAgent;
+#endif
+
+#if ENABLE(DOM_STORAGE)
+    OwnPtr<InspectorDOMStorageAgent> m_domStorageAgent;
+#endif
+
+    OwnPtr<InspectorTimelineAgent> m_timelineAgent;
+    OwnPtr<InspectorState> m_state;
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    OwnPtr<InspectorApplicationCacheAgent> m_applicationCacheAgent;
+#endif
+
+    RefPtr<Node> m_highlightedNode;
+    RefPtr<Node> m_nodeToFocus;
+    RefPtr<InspectorResourceAgent> m_resourceAgent;
+    OwnPtr<InspectorRuntimeAgent> m_runtimeAgent;
+
+#if ENABLE(DATABASE)
+    typedef HashMap<int, RefPtr<InspectorDatabaseResource> > DatabaseResourcesMap;
+    DatabaseResourcesMap m_databaseResources;
+#endif
+#if ENABLE(DOM_STORAGE)
+    typedef HashMap<int, RefPtr<InspectorDOMStorageResource> > DOMStorageResourcesMap;
+    DOMStorageResourcesMap m_domStorageResources;
+#endif
+
+    RefPtr<InjectedScriptHost> m_injectedScriptHost;
+    OwnPtr<InspectorConsoleAgent> m_consoleAgent;
+
+    Vector<pair<long, String> > m_pendingEvaluateTestCommands;
+    String m_requiredPanel;
+    Vector<String> m_scriptsToEvaluateOnLoad;
+    String m_inspectorExtensionAPI;
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    OwnPtr<InspectorDebuggerAgent> m_debuggerAgent;
+    OwnPtr<InspectorBrowserDebuggerAgent> m_browserDebuggerAgent;
+    OwnPtr<InspectorProfilerAgent> m_profilerAgent;
+#endif
+    String m_userAgentOverride;
+#if ENABLE(WORKERS)
+    typedef HashMap<intptr_t, RefPtr<InspectorWorkerResource> > WorkersMap;
+
+    WorkersMap m_workers;
+#endif
+};
+
+} // namespace WebCore
+
+#endif // !defined(InspectorAgent_h)
diff --git a/Source/WebCore/inspector/InspectorApplicationCacheAgent.cpp b/Source/WebCore/inspector/InspectorApplicationCacheAgent.cpp
index 1cca6fe..b38bb83 100644
--- a/Source/WebCore/inspector/InspectorApplicationCacheAgent.cpp
+++ b/Source/WebCore/inspector/InspectorApplicationCacheAgent.cpp
@@ -32,7 +32,7 @@
 #include "DocumentLoader.h"
 #include "Frame.h"
 #include "FrameLoader.h"
-#include "InspectorController.h"
+#include "InspectorAgent.h"
 #include "InspectorFrontend.h"
 #include "InspectorValues.h"
 #include "NetworkStateNotifier.h"
@@ -41,12 +41,17 @@
 
 namespace WebCore {
 
-InspectorApplicationCacheAgent::InspectorApplicationCacheAgent(InspectorController* inspectorController, InspectorFrontend* frontend)
-    : m_inspectorController(inspectorController)
+InspectorApplicationCacheAgent::InspectorApplicationCacheAgent(DocumentLoader* documentLoader, InspectorFrontend* frontend)
+    : m_documentLoader(documentLoader)
     , m_frontend(frontend)
 {
 }
 
+void InspectorApplicationCacheAgent::didCommitLoad(DocumentLoader* documentLoader)
+{
+    m_documentLoader = documentLoader;
+}
+
 void InspectorApplicationCacheAgent::updateApplicationCacheStatus(Frame* frame)
 {
     ApplicationCacheHost::Status status = frame->loader()->documentLoader()->applicationCacheHost()->status();
@@ -61,9 +66,8 @@ void InspectorApplicationCacheAgent::networkStateChanged()
 
 void InspectorApplicationCacheAgent::getApplicationCaches(RefPtr<InspectorValue>* applicationCaches)
 {
-    DocumentLoader* documentLoader = m_inspectorController->inspectedPage()->mainFrame()->loader()->documentLoader();
-    if (documentLoader) {
-        ApplicationCacheHost* host = documentLoader->applicationCacheHost();
+    if (m_documentLoader) {
+        ApplicationCacheHost* host = m_documentLoader->applicationCacheHost();
         ApplicationCacheHost::CacheInfo info = host->applicationCacheInfo();
 
         ApplicationCacheHost::ResourceInfoList resources;
diff --git a/Source/WebCore/inspector/InspectorApplicationCacheAgent.h b/Source/WebCore/inspector/InspectorApplicationCacheAgent.h
index ac0acbf..33cee59 100644
--- a/Source/WebCore/inspector/InspectorApplicationCacheAgent.h
+++ b/Source/WebCore/inspector/InspectorApplicationCacheAgent.h
@@ -33,9 +33,10 @@
 
 namespace WebCore {
 
+class DocumentLoader;
 class Frame;
 class InspectorArray;
-class InspectorController;
+class InspectorAgent;
 class InspectorFrontend;
 class InspectorObject;
 class InspectorValue;
@@ -44,9 +45,11 @@ class ResourceResponse;
 class InspectorApplicationCacheAgent {
     WTF_MAKE_NONCOPYABLE(InspectorApplicationCacheAgent); WTF_MAKE_FAST_ALLOCATED;
 public:
-    InspectorApplicationCacheAgent(InspectorController* inspectorController, InspectorFrontend* frontend);
+    InspectorApplicationCacheAgent(DocumentLoader*, InspectorFrontend*);
     ~InspectorApplicationCacheAgent() { }
 
+    void didCommitLoad(DocumentLoader*);
+
     // Backend to Frontend
     void updateApplicationCacheStatus(Frame*);
     void networkStateChanged();
@@ -59,7 +62,7 @@ private:
     PassRefPtr<InspectorArray> buildArrayForApplicationCacheResources(const ApplicationCacheHost::ResourceInfoList&);
     PassRefPtr<InspectorObject> buildObjectForApplicationCacheResource(const ApplicationCacheHost::ResourceInfo&);
 
-    InspectorController* m_inspectorController;
+    DocumentLoader* m_documentLoader;
     InspectorFrontend* m_frontend;
 };
 
diff --git a/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.cpp b/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.cpp
index 023dc49..5fe9937 100644
--- a/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.cpp
@@ -35,7 +35,7 @@
 #if ENABLE(INSPECTOR) && ENABLE(JAVASCRIPT_DEBUGGER)
 
 #include "HTMLElement.h"
-#include "InspectorController.h"
+#include "InspectorAgent.h"
 #include "InspectorDOMAgent.h"
 #include "InspectorDebuggerAgent.h"
 #include "InspectorState.h"
@@ -61,26 +61,41 @@ const int domBreakpointDerivedTypeShift = 16;
 
 namespace WebCore {
 
-InspectorBrowserDebuggerAgent::InspectorBrowserDebuggerAgent(InspectorController* inspectorController)
-    : m_inspectorController(inspectorController)
+namespace BrowserDebuggerAgentState {
+static const char browserBreakpoints[] = "browserBreakpoints";
+}
+
+PassOwnPtr<InspectorBrowserDebuggerAgent> InspectorBrowserDebuggerAgent::create(InspectorAgent* inspectorAgent, bool eraseStickyBreakpoints)
+{
+    return adoptPtr(new InspectorBrowserDebuggerAgent(inspectorAgent, eraseStickyBreakpoints));
+}
+
+InspectorBrowserDebuggerAgent::InspectorBrowserDebuggerAgent(InspectorAgent* inspectorAgent, bool eraseStickyBreakpoints)
+    : m_inspectorAgent(inspectorAgent)
     , m_hasXHRBreakpointWithEmptyURL(false)
 {
+    if (eraseStickyBreakpoints)
+        inspectorAgent->state()->setObject(BrowserDebuggerAgentState::browserBreakpoints, InspectorObject::create());
 }
 
 InspectorBrowserDebuggerAgent::~InspectorBrowserDebuggerAgent()
 {
 }
 
-void InspectorBrowserDebuggerAgent::inspectedURLChanged(const KURL& url)
+void InspectorBrowserDebuggerAgent::setAllBrowserBreakpoints(PassRefPtr<InspectorObject> breakpoints)
+{
+    m_inspectorAgent->state()->setObject(BrowserDebuggerAgentState::browserBreakpoints, breakpoints);
+    inspectedURLChanged(m_inspectorAgent->inspectedURLWithoutFragment());
+}
+
+void InspectorBrowserDebuggerAgent::inspectedURLChanged(const String& url)
 {
     m_eventListenerBreakpoints.clear();
     m_XHRBreakpoints.clear();
     m_hasXHRBreakpointWithEmptyURL = false;
 
-    RefPtr<InspectorObject> allBreakpoints = m_inspectorController->state()->getObject(InspectorState::browserBreakpoints);
-    KURL urlCopy = url;
-    urlCopy.removeFragmentIdentifier();
-    RefPtr<InspectorArray> breakpoints = allBreakpoints->getArray(urlCopy);
+    RefPtr<InspectorObject> allBreakpoints = m_inspectorAgent->state()->getObject(BrowserDebuggerAgentState::browserBreakpoints);
+    RefPtr<InspectorArray> breakpoints = allBreakpoints->getArray(url);
     if (!breakpoints)
         return;
     for (unsigned i = 0; i < breakpoints->length(); ++i)
@@ -89,10 +104,6 @@ void InspectorBrowserDebuggerAgent::inspectedURLChanged(const KURL& url)
 
 void InspectorBrowserDebuggerAgent::restoreStickyBreakpoint(PassRefPtr<InspectorObject> breakpoint)
 {
-    DEFINE_STATIC_LOCAL(String, eventListenerBreakpointType, ("EventListener"));
-    DEFINE_STATIC_LOCAL(String, javaScriptBreakpointType, ("JS"));
-    DEFINE_STATIC_LOCAL(String, xhrBreakpointType, ("XHR"));
-
     if (!breakpoint)
         return;
     String type;
@@ -105,25 +116,14 @@ void InspectorBrowserDebuggerAgent::restoreStickyBreakpoint(PassRefPtr<Inspector
     if (!condition)
         return;
 
-    if (type == eventListenerBreakpointType) {
+    if (type == eventListenerNativeBreakpointType) {
         if (!enabled)
             return;
         String eventName;
         if (!condition->getString("eventName", &eventName))
             return;
         setEventListenerBreakpoint(eventName);
-    } else if (type == javaScriptBreakpointType && m_inspectorController->debuggerAgent()) {
-        String url;
-        if (!condition->getString("url", &url))
-            return;
-        double lineNumber;
-        if (!condition->getNumber("lineNumber", &lineNumber))
-            return;
-        String javaScriptCondition;
-        if (!condition->getString("condition", &javaScriptCondition))
-            return;
-        m_inspectorController->debuggerAgent()->setStickyBreakpoint(url, static_cast<unsigned>(lineNumber), javaScriptCondition, enabled);
-    } else if (type == xhrBreakpointType) {
+    } else if (type == xhrNativeBreakpointType) {
         if (!enabled)
             return;
         String url;
@@ -178,7 +178,7 @@ void InspectorBrowserDebuggerAgent::didRemoveDOMNode(Node* node)
 
 void InspectorBrowserDebuggerAgent::setDOMBreakpoint(long nodeId, long type)
 {
-    Node* node = m_inspectorController->domAgent()->nodeForId(nodeId);
+    Node* node = m_inspectorAgent->domAgent()->nodeForId(nodeId);
     if (!node)
         return;
 
@@ -192,7 +192,7 @@ void InspectorBrowserDebuggerAgent::setDOMBreakpoint(long nodeId, long type)
 
 void InspectorBrowserDebuggerAgent::removeDOMBreakpoint(long nodeId, long type)
 {
-    Node* node = m_inspectorController->domAgent()->nodeForId(nodeId);
+    Node* node = m_inspectorAgent->domAgent()->nodeForId(nodeId);
     if (!node)
         return;
 
@@ -211,7 +211,7 @@ void InspectorBrowserDebuggerAgent::removeDOMBreakpoint(long nodeId, long type)
 
 void InspectorBrowserDebuggerAgent::willInsertDOMNode(Node*, Node* parent)
 {
-    InspectorDebuggerAgent* debuggerAgent = m_inspectorController->debuggerAgent();
+    InspectorDebuggerAgent* debuggerAgent = m_inspectorAgent->debuggerAgent();
     if (!debuggerAgent)
         return;
 
@@ -225,7 +225,7 @@ void InspectorBrowserDebuggerAgent::willInsertDOMNode(Node*, Node* parent)
 
 void InspectorBrowserDebuggerAgent::willRemoveDOMNode(Node* node)
 {
-    InspectorDebuggerAgent* debuggerAgent = m_inspectorController->debuggerAgent();
+    InspectorDebuggerAgent* debuggerAgent = m_inspectorAgent->debuggerAgent();
     if (!debuggerAgent)
         return;
 
@@ -244,7 +244,7 @@ void InspectorBrowserDebuggerAgent::willRemoveDOMNode(Node* node)
 
 void InspectorBrowserDebuggerAgent::willModifyDOMAttr(Element* element)
 {
-    InspectorDebuggerAgent* debuggerAgent = m_inspectorController->debuggerAgent();
+    InspectorDebuggerAgent* debuggerAgent = m_inspectorAgent->debuggerAgent();
     if (!debuggerAgent)
         return;
 
@@ -264,7 +264,7 @@ void InspectorBrowserDebuggerAgent::descriptionForDOMEvent(Node* target, long br
     if ((1 << breakpointType) & inheritableDOMBreakpointTypesMask) {
         // For inheritable breakpoint types, target node isn't always the same as the node that owns a breakpoint.
         // Target node may be unknown to frontend, so we need to push it first.
-        long targetNodeId = m_inspectorController->domAgent()->pushNodePathToFrontend(target);
+        long targetNodeId = m_inspectorAgent->domAgent()->pushNodePathToFrontend(target);
         ASSERT(targetNodeId);
         description->setNumber("targetNodeId", targetNodeId);
 
@@ -281,7 +281,7 @@ void InspectorBrowserDebuggerAgent::descriptionForDOMEvent(Node* target, long br
             description->setBoolean("insertion", insertion);
     }
 
-    long breakpointOwnerNodeId = m_inspectorController->domAgent()->pushNodePathToFrontend(breakpointOwner);
+    long breakpointOwnerNodeId = m_inspectorAgent->domAgent()->pushNodePathToFrontend(breakpointOwner);
     ASSERT(breakpointOwnerNodeId);
     description->setNumber("nodeId", breakpointOwnerNodeId);
     description->setNumber("type", breakpointType);
@@ -314,7 +314,7 @@ void InspectorBrowserDebuggerAgent::updateSubtreeBreakpoints(Node* node, uint32_
 
 void InspectorBrowserDebuggerAgent::pauseOnNativeEventIfNeeded(const String& categoryType, const String& eventName, bool synchronous)
 {
-    InspectorDebuggerAgent* debuggerAgent = m_inspectorController->debuggerAgent();
+    InspectorDebuggerAgent* debuggerAgent = m_inspectorAgent->debuggerAgent();
     if (!debuggerAgent)
         return;
 
@@ -349,7 +349,7 @@ void InspectorBrowserDebuggerAgent::removeXHRBreakpoint(const String& url)
 
 void InspectorBrowserDebuggerAgent::willSendXMLHttpRequest(const String& url)
 {
-    InspectorDebuggerAgent* debuggerAgent = m_inspectorController->debuggerAgent();
+    InspectorDebuggerAgent* debuggerAgent = m_inspectorAgent->debuggerAgent();
     if (!debuggerAgent)
         return;
 
diff --git a/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.h b/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.h
index 0ffa85c..fac54bb 100644
--- a/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.h
+++ b/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.h
@@ -44,22 +44,19 @@
 namespace WebCore {
 
 class Element;
-class InspectorController;
+class InspectorAgent;
 class InspectorObject;
-class KURL;
 class Node;
 
 class InspectorBrowserDebuggerAgent {
     WTF_MAKE_NONCOPYABLE(InspectorBrowserDebuggerAgent);
 public:
-    static PassOwnPtr<InspectorBrowserDebuggerAgent> create(InspectorController* inspectorController)
-    {
-        return adoptPtr(new InspectorBrowserDebuggerAgent(inspectorController));
-    }
+    static PassOwnPtr<InspectorBrowserDebuggerAgent> create(InspectorAgent*, bool eraseStickyBreakpoints);
 
     virtual ~InspectorBrowserDebuggerAgent();
 
-    void inspectedURLChanged(const KURL&);
+    void setAllBrowserBreakpoints(PassRefPtr<InspectorObject>);
+    void inspectedURLChanged(const String& url);
 
     // BrowserDebugger API for InspectorFrontend
     void setXHRBreakpoint(const String& url);
@@ -79,7 +76,7 @@ public:
     void pauseOnNativeEventIfNeeded(const String& categoryType, const String& eventName, bool synchronous);
 
 private:
-    InspectorBrowserDebuggerAgent(InspectorController*);
+    InspectorBrowserDebuggerAgent(InspectorAgent*, bool eraseStickyBreakpoints);
 
     void restoreStickyBreakpoint(PassRefPtr<InspectorObject> breakpoint);
 
@@ -88,7 +85,7 @@ private:
     bool hasBreakpoint(Node*, long type);
     void discardBindings();
 
-    InspectorController* m_inspectorController;
+    InspectorAgent* m_inspectorAgent;
     HashMap<Node*, uint32_t> m_domBreakpoints;
     HashSet<String> m_eventListenerBreakpoints;
     HashSet<String> m_XHRBreakpoints;
diff --git a/Source/WebCore/inspector/InspectorCSSAgent.cpp b/Source/WebCore/inspector/InspectorCSSAgent.cpp
index bacf741..f49f89c 100644
--- a/Source/WebCore/inspector/InspectorCSSAgent.cpp
+++ b/Source/WebCore/inspector/InspectorCSSAgent.cpp
@@ -42,10 +42,10 @@
 #include "InspectorFrontend.h"
 #include "InspectorValues.h"
 #include "Node.h"
+#include "NodeList.h"
 #include "StyleSheetList.h"
 
 #include <wtf/HashSet.h>
-#include <wtf/ListHashSet.h>
 #include <wtf/Vector.h>
 #include <wtf/text/CString.h>
 
@@ -173,7 +173,7 @@ void InspectorCSSAgent::reset()
     m_documentToInspectorStyleSheet.clear();
 }
 
-void InspectorCSSAgent::getStylesForNode2(long nodeId, RefPtr<InspectorValue>* result)
+void InspectorCSSAgent::getStylesForNode(long nodeId, RefPtr<InspectorValue>* result)
 {
     Element* element = elementForId(nodeId);
     if (!element)
@@ -228,7 +228,7 @@ void InspectorCSSAgent::getStylesForNode2(long nodeId, RefPtr<InspectorValue>* r
     *result = resultObject.release();
 }
 
-void InspectorCSSAgent::getInlineStyleForNode2(long nodeId, RefPtr<InspectorValue>* style)
+void InspectorCSSAgent::getInlineStyleForNode(long nodeId, RefPtr<InspectorValue>* style)
 {
     Element* element = elementForId(nodeId);
     if (!element)
@@ -241,7 +241,7 @@ void InspectorCSSAgent::getInlineStyleForNode2(long nodeId, RefPtr<InspectorValu
     *style = styleSheet->buildObjectForStyle(element->style());
 }
 
-void InspectorCSSAgent::getComputedStyleForNode2(long nodeId, RefPtr<InspectorValue>* style)
+void InspectorCSSAgent::getComputedStyleForNode(long nodeId, RefPtr<InspectorValue>* style)
 {
     Element* element = elementForId(nodeId);
     if (!element)
@@ -252,10 +252,10 @@ void InspectorCSSAgent::getComputedStyleForNode2(long nodeId, RefPtr<InspectorVa
     *style = inspectorStyle->buildObjectForStyle();
 }
 
-void InspectorCSSAgent::getAllStyles2(RefPtr<InspectorArray>* styles)
+void InspectorCSSAgent::getAllStyles(RefPtr<InspectorArray>* styles)
 {
-    const ListHashSet<RefPtr<Document> >& documents = m_domAgent->documents();
-    for (ListHashSet<RefPtr<Document> >::const_iterator it = documents.begin(); it != documents.end(); ++it) {
+    Vector<Document*> documents = m_domAgent->documents();
+    for (Vector<Document*>::iterator it = documents.begin(); it != documents.end(); ++it) {
         StyleSheetList* list = (*it)->styleSheets();
         for (unsigned i = 0; i < list->length(); ++i) {
             StyleSheet* styleSheet = list->item(i);
@@ -267,7 +267,7 @@ void InspectorCSSAgent::getAllStyles2(RefPtr<InspectorArray>* styles)
     }
 }
 
-void InspectorCSSAgent::getStyleSheet2(const String& styleSheetId, RefPtr<InspectorValue>* styleSheetObject)
+void InspectorCSSAgent::getStyleSheet(const String& styleSheetId, RefPtr<InspectorValue>* styleSheetObject)
 {
     InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(styleSheetId);
     if (!inspectorStyleSheet)
@@ -276,7 +276,7 @@ void InspectorCSSAgent::getStyleSheet2(const String& styleSheetId, RefPtr<Inspec
     *styleSheetObject = inspectorStyleSheet->buildObjectForStyleSheet();
 }
 
-void InspectorCSSAgent::getStyleSheetText2(const String& styleSheetId, String* url, String* result)
+void InspectorCSSAgent::getStyleSheetText(const String& styleSheetId, String* url, String* result)
 {
     InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(styleSheetId);
     if (!inspectorStyleSheet)
@@ -285,7 +285,7 @@ void InspectorCSSAgent::getStyleSheetText2(const String& styleSheetId, String* u
     inspectorStyleSheet->text(result);
 }
 
-void InspectorCSSAgent::setStyleSheetText2(const String& styleSheetId, const String& text, bool* success)
+void InspectorCSSAgent::setStyleSheetText(const String& styleSheetId, const String& text, bool* success)
 {
     InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(styleSheetId);
     if (!inspectorStyleSheet) {
@@ -298,7 +298,7 @@ void InspectorCSSAgent::setStyleSheetText2(const String& styleSheetId, const Str
         inspectorStyleSheet->reparseStyleSheet(text);
 }
 
-void InspectorCSSAgent::setPropertyText2(const RefPtr<InspectorObject>& fullStyleId, long propertyIndex, const String& text, bool overwrite, RefPtr<InspectorValue>* result)
+void InspectorCSSAgent::setPropertyText(const RefPtr<InspectorObject>& fullStyleId, long propertyIndex, const String& text, bool overwrite, RefPtr<InspectorValue>* result)
 {
     InspectorCSSId compoundId(fullStyleId);
     ASSERT(!compoundId.isEmpty());
@@ -312,7 +312,7 @@ void InspectorCSSAgent::setPropertyText2(const RefPtr<InspectorObject>& fullStyl
         *result = inspectorStyleSheet->buildObjectForStyle(inspectorStyleSheet->styleForId(compoundId));
 }
 
-void InspectorCSSAgent::toggleProperty2(const RefPtr<InspectorObject>& fullStyleId, long propertyIndex, bool disable, RefPtr<InspectorValue>* result)
+void InspectorCSSAgent::toggleProperty(const RefPtr<InspectorObject>& fullStyleId, long propertyIndex, bool disable, RefPtr<InspectorValue>* result)
 {
     InspectorCSSId compoundId(fullStyleId);
     ASSERT(!compoundId.isEmpty());
@@ -326,7 +326,7 @@ void InspectorCSSAgent::toggleProperty2(const RefPtr<InspectorObject>& fullStyle
         *result = inspectorStyleSheet->buildObjectForStyle(inspectorStyleSheet->styleForId(compoundId));
 }
 
-void InspectorCSSAgent::setRuleSelector2(const RefPtr<InspectorObject>& fullRuleId, const String& selector, RefPtr<InspectorValue>* result)
+void InspectorCSSAgent::setRuleSelector(const RefPtr<InspectorObject>& fullRuleId, const String& selector, RefPtr<InspectorValue>* result)
 {
     InspectorCSSId compoundId(fullRuleId);
     ASSERT(!compoundId.isEmpty());
@@ -342,7 +342,7 @@ void InspectorCSSAgent::setRuleSelector2(const RefPtr<InspectorObject>& fullRule
     *result = inspectorStyleSheet->buildObjectForRule(inspectorStyleSheet->ruleForId(compoundId));
 }
 
-void InspectorCSSAgent::addRule2(const long contextNodeId, const String& selector, RefPtr<InspectorValue>* result)
+void InspectorCSSAgent::addRule(const long contextNodeId, const String& selector, RefPtr<InspectorValue>* result)
 {
     Node* node = m_domAgent->nodeForId(contextNodeId);
     if (!node)
diff --git a/Source/WebCore/inspector/InspectorCSSAgent.h b/Source/WebCore/inspector/InspectorCSSAgent.h
index 619f958..12b3f9b 100644
--- a/Source/WebCore/inspector/InspectorCSSAgent.h
+++ b/Source/WebCore/inspector/InspectorCSSAgent.h
@@ -61,17 +61,17 @@ public:
     void setDOMAgent(InspectorDOMAgent* domAgent);
 
     void reset();
-    void getStylesForNode2(long nodeId, RefPtr<InspectorValue>* result);
-    void getInlineStyleForNode2(long nodeId, RefPtr<InspectorValue>* style);
-    void getComputedStyleForNode2(long nodeId, RefPtr<InspectorValue>* style);
-    void getAllStyles2(RefPtr<InspectorArray>* styles);
-    void getStyleSheet2(const String& styleSheetId, RefPtr<InspectorValue>* result);
-    void getStyleSheetText2(const String& styleSheetId, String* url, String* result);
-    void setStyleSheetText2(const String& styleSheetId, const String& text, bool* success);
-    void setPropertyText2(const RefPtr<InspectorObject>& styleId, long propertyIndex, const String& text, bool overwrite, RefPtr<InspectorValue>* result);
-    void toggleProperty2(const RefPtr<InspectorObject>& styleId, long propertyIndex, bool disable, RefPtr<InspectorValue>* result);
-    void setRuleSelector2(const RefPtr<InspectorObject>& ruleId, const String& selector, RefPtr<InspectorValue>* result);
-    void addRule2(const long contextNodeId, const String& selector, RefPtr<InspectorValue>* result);
+    void getStylesForNode(long nodeId, RefPtr<InspectorValue>* result);
+    void getInlineStyleForNode(long nodeId, RefPtr<InspectorValue>* style);
+    void getComputedStyleForNode(long nodeId, RefPtr<InspectorValue>* style);
+    void getAllStyles(RefPtr<InspectorArray>* styles);
+    void getStyleSheet(const String& styleSheetId, RefPtr<InspectorValue>* result);
+    void getStyleSheetText(const String& styleSheetId, String* url, String* result);
+    void setStyleSheetText(const String& styleSheetId, const String& text, bool* success);
+    void setPropertyText(const RefPtr<InspectorObject>& styleId, long propertyIndex, const String& text, bool overwrite, RefPtr<InspectorValue>* result);
+    void toggleProperty(const RefPtr<InspectorObject>& styleId, long propertyIndex, bool disable, RefPtr<InspectorValue>* result);
+    void setRuleSelector(const RefPtr<InspectorObject>& ruleId, const String& selector, RefPtr<InspectorValue>* result);
+    void addRule(const long contextNodeId, const String& selector, RefPtr<InspectorValue>* result);
     void getSupportedCSSProperties(RefPtr<InspectorArray>* result);
     void querySelectorAll(const long nodeId, const String& selector, RefPtr<InspectorArray>* result);
 
diff --git a/Source/WebCore/inspector/InspectorClient.h b/Source/WebCore/inspector/InspectorClient.h
index 3b8007e..d24ce4d 100644
--- a/Source/WebCore/inspector/InspectorClient.h
+++ b/Source/WebCore/inspector/InspectorClient.h
@@ -45,9 +45,6 @@ public:
     virtual void highlight(Node*) = 0;
     virtual void hideHighlight() = 0;
 
-    virtual void populateSetting(const String& key, String* value) = 0;
-    virtual void storeSetting(const String& key, const String& value) = 0;
-
     virtual bool sendMessageToFrontend(const String& message) = 0;
 
     // Navigation can cause some WebKit implementations to change the view / page / inspector controller instance.
diff --git a/Source/WebCore/inspector/InspectorConsoleAgent.cpp b/Source/WebCore/inspector/InspectorConsoleAgent.cpp
index 2c837f3..7d11a7a 100644
--- a/Source/WebCore/inspector/InspectorConsoleAgent.cpp
+++ b/Source/WebCore/inspector/InspectorConsoleAgent.cpp
@@ -30,10 +30,9 @@
 #include "Console.h"
 #include "ConsoleMessage.h"
 #include "InjectedScriptHost.h"
-#include "InspectorController.h"
+#include "InspectorAgent.h"
 #include "InspectorDOMAgent.h"
 #include "InspectorFrontend.h"
-#include "InspectorSettings.h"
 #include "InspectorState.h"
 #include "ResourceError.h"
 #include "ResourceResponse.h"
@@ -50,8 +49,13 @@ namespace WebCore {
 static const unsigned maximumConsoleMessages = 1000;
 static const unsigned expireConsoleMessagesStep = 100;
 
-InspectorConsoleAgent::InspectorConsoleAgent(InspectorController* inspectorController)
-    : m_inspectorController(inspectorController)
+namespace ConsoleAgentState {
+static const char monitoringXHR[] = "monitoringXHR";
+static const char consoleMessagesEnabled[] = "consoleMessagesEnabled";
+}
+
+InspectorConsoleAgent::InspectorConsoleAgent(InspectorAgent* inspectorAgent)
+    : m_inspectorAgent(inspectorAgent)
     , m_frontend(0)
     , m_previousMessage(0)
     , m_expiredConsoleMessageCount(0)
@@ -60,7 +64,7 @@ InspectorConsoleAgent::InspectorConsoleAgent(InspectorController* inspectorContr
 
 InspectorConsoleAgent::~InspectorConsoleAgent()
 {
-    m_inspectorController = 0;
+    m_inspectorAgent = 0;
 }
 
 void InspectorConsoleAgent::setConsoleMessagesEnabled(bool enabled, bool* newState)
@@ -74,8 +78,8 @@ void InspectorConsoleAgent::clearConsoleMessages()
     m_consoleMessages.clear();
     m_expiredConsoleMessageCount = 0;
     m_previousMessage = 0;
-    m_inspectorController->injectedScriptHost()->releaseWrapperObjectGroup(0 /* release the group in all scripts */, "console");
-    if (InspectorDOMAgent* domAgent = m_inspectorController->domAgent())
+    m_inspectorAgent->injectedScriptHost()->releaseWrapperObjectGroup(0 /* release the group in all scripts */, "console");
+    if (InspectorDOMAgent* domAgent = m_inspectorAgent->domAgent())
         domAgent->releaseDanglingNodes();
     if (m_frontend)
         m_frontend->consoleMessagesCleared();
@@ -95,14 +99,14 @@ void InspectorConsoleAgent::setFrontend(InspectorFrontend* frontend)
 
 void InspectorConsoleAgent::addMessageToConsole(MessageSource source, MessageType type, MessageLevel level, const String& message, PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack)
 {
-    if (!m_inspectorController->enabled())
+    if (!m_inspectorAgent->enabled())
         return;
     addConsoleMessage(new ConsoleMessage(source, type, level, message, arguments, callStack));
 }
 
 void InspectorConsoleAgent::addMessageToConsole(MessageSource source, MessageType type, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceID)
 {
-    if (!m_inspectorController->enabled())
+    if (!m_inspectorAgent->enabled())
         return;
     addConsoleMessage(new ConsoleMessage(source, type, level, message, lineNumber, sourceID));
 }
@@ -163,15 +167,15 @@ void InspectorConsoleAgent::count(PassRefPtr<ScriptArguments> arguments, PassRef
 
 void InspectorConsoleAgent::resourceRetrievedByXMLHttpRequest(const String& url, const String& sendURL, unsigned sendLineNumber)
 {
-    if (!m_inspectorController->enabled())
+    if (!m_inspectorAgent->enabled())
         return;
-    if (m_inspectorController->state()->getBoolean(InspectorState::monitoringXHR))
+    if (m_inspectorAgent->state()->getBoolean(ConsoleAgentState::monitoringXHR))
         addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, "XHR finished loading: \"" + url + "\".", sendLineNumber, sendURL);
 }
 
 void InspectorConsoleAgent::didReceiveResponse(unsigned long identifier, const ResourceResponse& response)
 {
-    if (!m_inspectorController->enabled())
+    if (!m_inspectorAgent->enabled())
         return;
 
     if (response.httpStatusCode() >= 400) {
@@ -182,7 +186,7 @@ void InspectorConsoleAgent::didReceiveResponse(unsigned long identifier, const R
 
 void InspectorConsoleAgent::didFailLoading(unsigned long identifier, const ResourceError& error)
 {
-    if (!m_inspectorController->enabled())
+    if (!m_inspectorAgent->enabled())
         return;
 
     String message = "Failed to load resource";
@@ -193,40 +197,36 @@ void InspectorConsoleAgent::didFailLoading(unsigned long identifier, const Resou
 
 void InspectorConsoleAgent::setMonitoringXHREnabled(bool enabled)
 {
-    m_inspectorController->state()->setBoolean(InspectorState::monitoringXHR, enabled);
-    m_inspectorController->settings()->setBoolean(InspectorSettings::MonitoringXHREnabled, enabled);
-    if (m_frontend)
-        m_frontend->monitoringXHRStateChanged(enabled);
+    m_inspectorAgent->state()->setBoolean(ConsoleAgentState::monitoringXHR, enabled);
 }
 
 void InspectorConsoleAgent::setConsoleMessagesEnabled(bool enabled)
 {
-    m_inspectorController->state()->setBoolean(InspectorState::consoleMessagesEnabled, enabled);
+    m_inspectorAgent->state()->setBoolean(ConsoleAgentState::consoleMessagesEnabled, enabled);
     if (!enabled || !m_frontend)
         return;
 
-    m_frontend->monitoringXHRStateChanged(m_inspectorController->state()->getBoolean(InspectorState::monitoringXHR));
     if (m_expiredConsoleMessageCount)
         m_frontend->updateConsoleMessageExpiredCount(m_expiredConsoleMessageCount);
     unsigned messageCount = m_consoleMessages.size();
     for (unsigned i = 0; i < messageCount; ++i)
-        m_consoleMessages[i]->addToFrontend(m_frontend, m_inspectorController->injectedScriptHost());
+        m_consoleMessages[i]->addToFrontend(m_frontend, m_inspectorAgent->injectedScriptHost());
 }
 
 void InspectorConsoleAgent::addConsoleMessage(PassOwnPtr<ConsoleMessage> consoleMessage)
 {
-    ASSERT(m_inspectorController->enabled());
+    ASSERT(m_inspectorAgent->enabled());
     ASSERT_ARG(consoleMessage, consoleMessage);
 
     if (m_previousMessage && m_previousMessage->isEqual(consoleMessage.get())) {
         m_previousMessage->incrementCount();
-        if (m_inspectorController->state()->getBoolean(InspectorState::consoleMessagesEnabled) && m_frontend)
+        if (m_inspectorAgent->state()->getBoolean(ConsoleAgentState::consoleMessagesEnabled) && m_frontend)
             m_previousMessage->updateRepeatCountInConsole(m_frontend);
     } else {
         m_previousMessage = consoleMessage.get();
         m_consoleMessages.append(consoleMessage);
-        if (m_inspectorController->state()->getBoolean(InspectorState::consoleMessagesEnabled) && m_frontend)
-            m_previousMessage->addToFrontend(m_frontend, m_inspectorController->injectedScriptHost());
+        if (m_inspectorAgent->state()->getBoolean(ConsoleAgentState::consoleMessagesEnabled) && m_frontend)
+            m_previousMessage->addToFrontend(m_frontend, m_inspectorAgent->injectedScriptHost());
     }
 
     if (!m_frontend && m_consoleMessages.size() >= maximumConsoleMessages) {
diff --git a/Source/WebCore/inspector/InspectorConsoleAgent.h b/Source/WebCore/inspector/InspectorConsoleAgent.h
index 411f709..10ffb02 100644
--- a/Source/WebCore/inspector/InspectorConsoleAgent.h
+++ b/Source/WebCore/inspector/InspectorConsoleAgent.h
@@ -37,7 +37,7 @@ namespace WebCore {
 #if ENABLE(INSPECTOR)
 
 class ConsoleMessage;
-class InspectorController;
+class InspectorAgent;
 class InspectorFrontend;
 class InspectorState;
 class ResourceError;
@@ -49,7 +49,7 @@ class ScriptProfile;
 class InspectorConsoleAgent {
     WTF_MAKE_NONCOPYABLE(InspectorConsoleAgent);
 public:
-    InspectorConsoleAgent(InspectorController*);
+    InspectorConsoleAgent(InspectorAgent*);
     ~InspectorConsoleAgent();
 
     void setConsoleMessagesEnabled(bool enabled, bool* newState);
@@ -77,7 +77,7 @@ private:
     void setConsoleMessagesEnabled(bool);
     void addConsoleMessage(PassOwnPtr<ConsoleMessage>);
 
-    InspectorController* m_inspectorController;
+    InspectorAgent* m_inspectorAgent;
     InspectorFrontend* m_frontend;
     ConsoleMessage* m_previousMessage;
     Vector<OwnPtr<ConsoleMessage> > m_consoleMessages;
diff --git a/Source/WebCore/inspector/InspectorConsoleInstrumentation.h b/Source/WebCore/inspector/InspectorConsoleInstrumentation.h
new file mode 100644
index 0000000..8326741
--- /dev/null
+++ b/Source/WebCore/inspector/InspectorConsoleInstrumentation.h
@@ -0,0 +1,127 @@
+/*
+* Copyright (C) 2011 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef InspectorConsoleInstrumentation_h
+#define InspectorConsoleInstrumentation_h
+
+#include "InspectorInstrumentation.h"
+#include "ScriptArguments.h"
+#include "ScriptCallStack.h"
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+inline void InspectorInstrumentation::addMessageToConsole(Page* page, MessageSource source, MessageType type, MessageLevel level, const String& message, PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorAgent* inspectorAgent = inspectorAgentForPage(page))
+        addMessageToConsoleImpl(inspectorAgent, source, type, level, message, arguments, callStack);
+#endif
+}
+
+inline void InspectorInstrumentation::addMessageToConsole(Page* page, MessageSource source, MessageType type, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceID)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorAgent* inspectorAgent = inspectorAgentForPage(page))
+        addMessageToConsoleImpl(inspectorAgent, source, type, level, message, lineNumber, sourceID);
+#endif
+}
+
+inline void InspectorInstrumentation::consoleCount(Page* page, PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> stack)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorAgent* inspectorAgent = inspectorAgentForPage(page))
+        consoleCountImpl(inspectorAgent, arguments, stack);
+#endif
+}
+
+inline void InspectorInstrumentation::startConsoleTiming(Page* page, const String& title)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorAgent* inspectorAgent = inspectorAgentForPage(page))
+        startConsoleTimingImpl(inspectorAgent, title);
+#endif
+}
+
+inline void InspectorInstrumentation::stopConsoleTiming(Page* page, const String& title, PassRefPtr<ScriptCallStack> stack)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorAgent* inspectorAgent = inspectorAgentForPage(page))
+        stopConsoleTimingImpl(inspectorAgent, title, stack);
+#endif
+}
+
+inline void InspectorInstrumentation::consoleMarkTimeline(Page* page, PassRefPtr<ScriptArguments> arguments)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForPage(page))
+        consoleMarkTimelineImpl(inspectorAgent, arguments);
+#endif
+}
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+inline void InspectorInstrumentation::addStartProfilingMessageToConsole(Page* page, const String& title, unsigned lineNumber, const String& sourceURL)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorAgent* inspectorAgent = inspectorAgentForPage(page))
+        addStartProfilingMessageToConsoleImpl(inspectorAgent, title, lineNumber, sourceURL);
+#endif
+}
+
+inline void InspectorInstrumentation::addProfile(Page* page, RefPtr<ScriptProfile> profile, PassRefPtr<ScriptCallStack> callStack)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorAgent* inspectorAgent = inspectorAgentForPage(page))
+        addProfileImpl(inspectorAgent, profile, callStack);
+#endif
+}
+
+inline bool InspectorInstrumentation::profilerEnabled(Page* page)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorAgent* inspectorAgent = inspectorAgentForPage(page))
+        return profilerEnabledImpl(inspectorAgent);
+#endif
+    return false;
+}
+
+inline String InspectorInstrumentation::getCurrentUserInitiatedProfileName(Page* page, bool incrementProfileNumber)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorAgent* inspectorAgent = inspectorAgentForPage(page))
+        return InspectorInstrumentation::getCurrentUserInitiatedProfileNameImpl(inspectorAgent, incrementProfileNumber);
+#endif
+    return "";
+}
+#endif
+
+} // namespace WebCore
+
+#endif // !defined(InspectorConsoleInstrumentation_h)
diff --git a/Source/WebCore/inspector/InspectorController.cpp b/Source/WebCore/inspector/InspectorController.cpp
index 8533a5f..426e5f3 100644
--- a/Source/WebCore/inspector/InspectorController.cpp
+++ b/Source/WebCore/inspector/InspectorController.cpp
@@ -1,30 +1,31 @@
 /*
- * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
- * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
+ * modification, are permitted provided that the following conditions are
+ * met:
  *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -32,307 +33,42 @@
 
 #if ENABLE(INSPECTOR)
 
-#include "CachedResource.h"
-#include "CachedResourceLoader.h"
-#include "Chrome.h"
-#include "Cookie.h"
-#include "CookieJar.h"
-#include "DOMWindow.h"
-#include "DOMWrapperWorld.h"
-#include "Document.h"
-#include "DocumentLoader.h"
-#include "Element.h"
-#include "FloatConversion.h"
-#include "FloatQuad.h"
-#include "FloatRect.h"
 #include "Frame.h"
-#include "FrameLoadRequest.h"
-#include "FrameLoader.h"
-#include "FrameTree.h"
-#include "FrameView.h"
 #include "GraphicsContext.h"
-#include "HTMLFrameOwnerElement.h"
-#include "HTTPHeaderMap.h"
-#include "HitTestResult.h"
-#include "InjectedScript.h"
 #include "InjectedScriptHost.h"
+#include "InspectorAgent.h"
 #include "InspectorBackendDispatcher.h"
-#include "InspectorBrowserDebuggerAgent.h"
-#include "InspectorCSSAgent.h"
-#include "InspectorClient.h"
-#include "InspectorConsoleAgent.h"
-#include "InspectorDOMAgent.h"
-#include "InspectorDOMStorageResource.h"
-#include "InspectorDatabaseResource.h"
 #include "InspectorDebuggerAgent.h"
+#include "InspectorClient.h"
 #include "InspectorFrontend.h"
 #include "InspectorFrontendClient.h"
 #include "InspectorInstrumentation.h"
-#include "InspectorProfilerAgent.h"
-#include "InspectorResourceAgent.h"
-#include "InspectorRuntimeAgent.h"
-#include "InspectorSettings.h"
-#include "InspectorState.h"
-#include "InspectorTimelineAgent.h"
-#include "InspectorValues.h"
-#include "InspectorWorkerResource.h"
-#include "IntRect.h"
 #include "Page.h"
-#include "ProgressTracker.h"
-#include "Range.h"
-#include "RenderInline.h"
-#include "ResourceRequest.h"
-#include "ResourceResponse.h"
-#include "ScriptArguments.h"
-#include "ScriptCallStack.h"
-#include "ScriptFunctionCall.h"
 #include "ScriptObject.h"
-#include "ScriptProfile.h"
-#include "ScriptProfiler.h"
-#include "ScriptSourceCode.h"
-#include "ScriptState.h"
-#include "SecurityOrigin.h"
 #include "Settings.h"
-#include "SharedBuffer.h"
-#include "TextEncoding.h"
-#include "TextIterator.h"
-#include "TextRun.h"
-#include "UserGestureIndicator.h"
-#include "WindowFeatures.h"
-#include <wtf/text/StringConcatenate.h>
-#include <wtf/CurrentTime.h>
-#include <wtf/ListHashSet.h>
-#include <wtf/RefCounted.h>
-#include <wtf/StdLibExtras.h>
-#include <wtf/UnusedParam.h>
-
-#if ENABLE(DATABASE)
-#include "Database.h"
-#include "InspectorDatabaseAgent.h"
-#endif
-
-#if ENABLE(DOM_STORAGE)
-#include "InspectorDOMStorageAgent.h"
-#include "Storage.h"
-#include "StorageArea.h"
-#endif
-
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-#include "InspectorApplicationCacheAgent.h"
-#endif
-
-#if ENABLE(FILE_SYSTEM)
-#include "InspectorFileSystemAgent.h"
-#endif
-
-using namespace std;
 
 namespace WebCore {
 
-const char* const InspectorController::ElementsPanel = "elements";
-const char* const InspectorController::ConsolePanel = "console";
-const char* const InspectorController::ScriptsPanel = "scripts";
-const char* const InspectorController::ProfilesPanel = "profiles";
-
-InspectorController::InspectorController(Page* page, InspectorClient* client)
-    : m_inspectedPage(page)
-    , m_client(client)
+InspectorController::InspectorController(Page* page, InspectorClient* inspectorClient)
+    : m_inspectorAgent(new InspectorAgent(page, inspectorClient))
+    , m_inspectorBackendDispatcher(new InspectorBackendDispatcher(m_inspectorAgent.get()))
+    , m_inspectorClient(inspectorClient)
     , m_openingFrontend(false)
-    , m_cssAgent(new InspectorCSSAgent())
-    , m_state(new InspectorState(client))
-    , m_inspectorBackendDispatcher(new InspectorBackendDispatcher(this))
-    , m_injectedScriptHost(InjectedScriptHost::create(this))
-    , m_consoleAgent(new InspectorConsoleAgent(this))
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    , m_attachDebuggerWhenShown(false)
-    , m_profilerAgent(InspectorProfilerAgent::create(this))
-#endif
 {
-    ASSERT_ARG(page, page);
-    ASSERT_ARG(client, client);
 }
 
 InspectorController::~InspectorController()
 {
-    // These should have been cleared in inspectedPageDestroyed().
-    ASSERT(!m_client);
-    ASSERT(!m_inspectedPage);
-    ASSERT(!m_highlightedNode);
-}
-
-void InspectorController::inspectedPageDestroyed()
-{
-    if (m_frontend)
-        m_frontend->disconnectFromBackend();
-
-    hideHighlight();
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    m_debuggerAgent.clear();
-    m_browserDebuggerAgent.clear();
-#endif
-
-    ASSERT(m_inspectedPage);
-    m_inspectedPage = 0;
-
-    releaseFrontendLifetimeAgents();
-    m_injectedScriptHost->disconnectController();
-
-    m_client->inspectorDestroyed();
-    m_client = 0;
-}
-
-bool InspectorController::enabled() const
-{
-    if (!m_inspectedPage)
-        return false;
-    return m_inspectedPage->settings()->developerExtrasEnabled();
-}
-
-bool InspectorController::inspectorStartsAttached()
-{
-    return m_settings->getBoolean(InspectorSettings::InspectorStartsAttached);
-}
-
-void InspectorController::setInspectorStartsAttached(bool attached)
-{
-    m_settings->setBoolean(InspectorSettings::InspectorStartsAttached, attached);
-}
-
-void InspectorController::setInspectorAttachedHeight(long height)
-{
-    m_settings->setLong(InspectorSettings::InspectorAttachedHeight, height);
-}
-
-long InspectorController::inspectorAttachedHeight() const
-{
-    return m_settings->getLong(InspectorSettings::InspectorAttachedHeight);
-}
-
-bool InspectorController::searchingForNodeInPage() const
-{
-    return m_state->getBoolean(InspectorState::searchingForNode);
-}
-
-void InspectorController::restoreInspectorStateFromCookie(const String& inspectorStateCookie)
-{
-    m_state->restoreFromInspectorCookie(inspectorStateCookie);
-
-    if (!m_frontend) {
-        connectFrontend();
-        m_frontend->frontendReused();
-        m_frontend->inspectedURLChanged(inspectedURL().string());
-        m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
-        pushDataCollectedOffline();
-    }
-
-    m_resourceAgent = InspectorResourceAgent::restore(m_inspectedPage, m_state.get(), m_frontend.get());
-
-    if (m_state->getBoolean(InspectorState::timelineProfilerEnabled))
-        startTimelineProfiler();
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    restoreDebugger();
-    restoreProfiler(ProfilerRestoreResetAgent);
-    if (m_state->getBoolean(InspectorState::userInitiatedProfiling))
-        startUserInitiatedProfiling();
-#endif
-}
-
-void InspectorController::inspect(Node* node)
-{
-    if (!enabled())
-        return;
-
-    show();
-
-    if (node->nodeType() != Node::ELEMENT_NODE && node->nodeType() != Node::DOCUMENT_NODE)
-        node = node->parentNode();
-    m_nodeToFocus = node;
-
-    if (!m_frontend)
-        return;
-
-    focusNode();
-}
-
-void InspectorController::focusNode()
-{
-    if (!enabled())
-        return;
-
-    ASSERT(m_frontend);
-    ASSERT(m_nodeToFocus);
-
-    long id = m_domAgent->pushNodePathToFrontend(m_nodeToFocus.get());
-    m_frontend->updateFocusedNode(id);
-    m_nodeToFocus = 0;
-}
-
-void InspectorController::highlight(Node* node)
-{
-    if (!enabled())
-        return;
-    ASSERT_ARG(node, node);
-    m_highlightedNode = node;
-    m_client->highlight(node);
-}
-
-void InspectorController::highlightDOMNode(long nodeId)
-{
-    Node* node = 0;
-    if (m_domAgent && (node = m_domAgent->nodeForId(nodeId)))
-        highlight(node);
-}
-
-void InspectorController::highlightFrame(unsigned long frameId)
-{
-    Frame* mainFrame = m_inspectedPage->mainFrame();
-    for (Frame* frame = mainFrame; frame; frame = frame->tree()->traverseNext(mainFrame)) {
-        if (reinterpret_cast<uintptr_t>(frame) == frameId && frame->ownerElement()) {
-            highlight(frame->ownerElement());
-            return;
-        }
-    }
-}
-
-void InspectorController::hideHighlight()
-{
-    if (!enabled())
-        return;
-    m_highlightedNode = 0;
-    m_client->hideHighlight();
 }
 
-void InspectorController::mouseDidMoveOverElement(const HitTestResult& result, unsigned)
+void InspectorController::setInspectorFrontendClient(PassOwnPtr<InspectorFrontendClient> inspectorFrontendClient)
 {
-    if (!enabled() || !searchingForNodeInPage())
-        return;
-
-    Node* node = result.innerNode();
-    while (node && node->nodeType() == Node::TEXT_NODE)
-        node = node->parentNode();
-    if (node)
-        highlight(node);
-}
-
-bool InspectorController::handleMousePress()
-{
-    if (!enabled() || !searchingForNodeInPage())
-        return false;
-
-    if (m_highlightedNode) {
-        RefPtr<Node> node = m_highlightedNode;
-        setSearchingForNode(false);
-        inspect(node.get());
-    }
-    return true;
+    m_inspectorFrontendClient = inspectorFrontendClient;
 }
 
-void InspectorController::setInspectorFrontendClient(PassOwnPtr<InspectorFrontendClient> client)
+bool InspectorController::hasInspectorFrontendClient() const
 {
-    ASSERT(!m_inspectorFrontendClient);
-    m_inspectorFrontendClient = client;
+    return m_inspectorFrontendClient;
 }
 
 void InspectorController::didClearWindowObjectInWorld(Frame* frame, DOMWrapperWorld* world)
@@ -340,1071 +76,191 @@ void InspectorController::didClearWindowObjectInWorld(Frame* frame, DOMWrapperWo
     if (world != mainThreadNormalWorld())
         return;
 
-    // If the page is supposed to serve as InspectorFrontend notify inspetor frontend
+    // If the page is supposed to serve as InspectorFrontend notify inspector frontend
     // client that it's cleared so that the client can expose inspector bindings.
-    if (m_inspectorFrontendClient && frame == m_inspectedPage->mainFrame())
+    if (m_inspectorFrontendClient && frame == m_inspectorAgent->inspectedPage()->mainFrame())
         m_inspectorFrontendClient->windowObjectCleared();
-
-    if (enabled()) {
-        if (m_frontend && frame == m_inspectedPage->mainFrame())
-            m_injectedScriptHost->discardInjectedScripts();
-        if (m_scriptsToEvaluateOnLoad.size()) {
-            ScriptState* scriptState = mainWorldScriptState(frame);
-            for (Vector<String>::iterator it = m_scriptsToEvaluateOnLoad.begin();
-                 it != m_scriptsToEvaluateOnLoad.end(); ++it) {
-                m_injectedScriptHost->injectScript(*it, scriptState);
-            }
-        }
-    }
-    if (!m_inspectorExtensionAPI.isEmpty())
-        m_injectedScriptHost->injectScript(m_inspectorExtensionAPI, mainWorldScriptState(frame));
 }
 
-void InspectorController::setSearchingForNode(bool enabled)
+void InspectorController::startTimelineProfiler()
 {
-    if (searchingForNodeInPage() == enabled)
-        return;
-    m_state->setBoolean(InspectorState::searchingForNode, enabled);
-    if (!enabled)
-        hideHighlight();
+    m_inspectorAgent->startTimelineProfiler();
 }
 
-void InspectorController::setSearchingForNode(bool enabled, bool* newState)
+void InspectorController::stopTimelineProfiler()
 {
-    *newState = enabled;
-    setSearchingForNode(enabled);
+    m_inspectorAgent->stopTimelineProfiler();
 }
 
 void InspectorController::connectFrontend()
 {
     m_openingFrontend = false;
-    releaseFrontendLifetimeAgents();
-    m_frontend = new InspectorFrontend(m_client);
-    m_domAgent = InspectorDOMAgent::create(m_injectedScriptHost.get(), m_frontend.get());
-    m_runtimeAgent = InspectorRuntimeAgent::create(m_injectedScriptHost.get());
-    m_cssAgent->setDOMAgent(m_domAgent.get());
-
-#if ENABLE(DATABASE)
-    m_databaseAgent = InspectorDatabaseAgent::create(&m_databaseResources, m_frontend.get());
-#endif
-
-#if ENABLE(DOM_STORAGE)
-    m_domStorageAgent = InspectorDOMStorageAgent::create(&m_domStorageResources, m_frontend.get());
-#endif
-
-    if (m_timelineAgent)
-        m_timelineAgent->resetFrontendProxyObject(m_frontend.get());
-
-    m_consoleAgent->setFrontend(m_frontend.get());
-
-    // Initialize Web Inspector title.
-    m_frontend->inspectedURLChanged(inspectedURL().string());
-
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    m_applicationCacheAgent = new InspectorApplicationCacheAgent(this, m_frontend.get());
-#endif
+    m_inspectorFrontend = new InspectorFrontend(m_inspectorClient);
+    m_inspectorAgent->setFrontend(m_inspectorFrontend.get());
 
-#if ENABLE(FILE_SYSTEM)
-    m_fileSystemAgent = InspectorFileSystemAgent::create(this, m_frontend.get());
-#endif
-    
     if (!InspectorInstrumentation::hasFrontends())
         ScriptController::setCaptureCallStackForUncaughtExceptions(true);
     InspectorInstrumentation::frontendCreated();
 }
 
-void InspectorController::show()
-{
-    if (!enabled())
-        return;
-
-    if (m_openingFrontend)
-        return;
-
-    if (m_frontend)
-        m_frontend->bringToFront();
-    else {
-        m_openingFrontend = true;
-        m_client->openInspectorFrontend(this);
-    }
-}
-
-void InspectorController::showPanel(const String& panel)
-{
-    if (!enabled())
-        return;
-
-    show();
-
-    if (!m_frontend) {
-        m_showAfterVisible = panel;
-        return;
-    }
-    m_frontend->showPanel(panel);
-}
-
-void InspectorController::close()
-{
-    if (!m_frontend)
-        return;
-    m_frontend->disconnectFromBackend();
-    disconnectFrontend();
-}
-
 void InspectorController::disconnectFrontend()
 {
-    if (!m_frontend)
+    if (!m_inspectorFrontend)
         return;
 
-    m_frontend.clear();
+    m_inspectorAgent->disconnectFrontend();
+
+    m_inspectorFrontend.clear();
 
     InspectorInstrumentation::frontendDeleted();
     if (!InspectorInstrumentation::hasFrontends())
         ScriptController::setCaptureCallStackForUncaughtExceptions(false);
 
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    // If the window is being closed with the debugger enabled,
-    // remember this state to re-enable debugger on the next window
-    // opening.
-    bool debuggerWasEnabled = debuggerEnabled();
-    disableDebugger();
-    m_attachDebuggerWhenShown = debuggerWasEnabled;
-#endif
-    setSearchingForNode(false);
-    unbindAllResources();
-    stopTimelineProfiler();
-
-    hideHighlight();
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    m_profilerAgent->setFrontend(0);
-    m_profilerAgent->stopUserInitiatedProfiling(true);
-#endif
-    m_consoleAgent->setFrontend(0);
-
-    releaseFrontendLifetimeAgents();
-    m_timelineAgent.clear();
-    m_extraHeaders.clear();
-}
-
-InspectorResourceAgent* InspectorController::resourceAgent()
-{
-    if (!m_resourceAgent && m_frontend)
-        m_resourceAgent = InspectorResourceAgent::create(m_inspectedPage, m_state.get(), m_frontend.get());
-    return m_resourceAgent.get();
-}
-
-void InspectorController::releaseFrontendLifetimeAgents()
-{
-    m_resourceAgent.clear();
-    m_runtimeAgent.clear();
-
-    // This should be invoked prior to m_domAgent destruction.
-    m_cssAgent->setDOMAgent(0);
-
-    // m_domAgent is RefPtr. Remove DOM listeners first to ensure that there are
-    // no references to the DOM agent from the DOM tree.
-    if (m_domAgent)
-        m_domAgent->reset();
-    m_domAgent.clear();
-
-#if ENABLE(DATABASE)
-    if (m_databaseAgent)
-        m_databaseAgent->clearFrontend();
-    m_databaseAgent.clear();
-#endif
-
-#if ENABLE(DOM_STORAGE)
-    m_domStorageAgent.clear();
-#endif
-
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    m_applicationCacheAgent.clear();
-#endif
-
-#if ENABLE(FILE_SYSTEM)
-    if (m_fileSystemAgent)
-        m_fileSystemAgent->stop(); 
-        m_fileSystemAgent.clear();
-#endif
-}
-
-void InspectorController::populateScriptObjects()
-{
-    ASSERT(m_frontend);
-    if (!m_frontend)
-        return;
-
-    if (!m_showAfterVisible.isEmpty()) {
-        showPanel(m_showAfterVisible);
-        m_showAfterVisible = "";
-    }
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (m_profilerAgent->enabled())
-        m_frontend->profilerWasEnabled();
-#endif
-
-    pushDataCollectedOffline();
-
-    if (m_nodeToFocus)
-        focusNode();
-
-    // Dispatch pending frontend commands
-    for (Vector<pair<long, String> >::iterator it = m_pendingEvaluateTestCommands.begin(); it != m_pendingEvaluateTestCommands.end(); ++it)
-        m_frontend->evaluateForTestInFrontend((*it).first, (*it).second);
-    m_pendingEvaluateTestCommands.clear();
-
-    restoreDebugger();
-    restoreProfiler(ProfilerRestoreNoAction);
-}
-
-void InspectorController::pushDataCollectedOffline()
-{
-    m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
-
-#if ENABLE(DATABASE)
-    DatabaseResourcesMap::iterator databasesEnd = m_databaseResources.end();
-    for (DatabaseResourcesMap::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
-        it->second->bind(m_frontend.get());
-#endif
-#if ENABLE(DOM_STORAGE)
-    DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources.end();
-    for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
-        it->second->bind(m_frontend.get());
-#endif
-#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
-    WorkersMap::iterator workersEnd = m_workers.end();
-    for (WorkersMap::iterator it = m_workers.begin(); it != workersEnd; ++it) {
-        InspectorWorkerResource* worker = it->second.get();
-        m_frontend->didCreateWorker(worker->id(), worker->url(), worker->isSharedWorker());
-    }
-#endif
-}
-
-void InspectorController::restoreDebugger()
-{
-    ASSERT(m_frontend);
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (InspectorDebuggerAgent::isDebuggerAlwaysEnabled() || m_attachDebuggerWhenShown || m_settings->getBoolean(InspectorSettings::DebuggerAlwaysEnabled)) {
-        enableDebugger(false);
-        m_attachDebuggerWhenShown = false;
-    }
-#endif
-}
-
-void InspectorController::restoreProfiler(ProfilerRestoreAction action)
-{
-    ASSERT(m_frontend);
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    m_profilerAgent->setFrontend(m_frontend.get());
-    if (!ScriptProfiler::isProfilerAlwaysEnabled() && m_settings->getBoolean(InspectorSettings::ProfilerAlwaysEnabled))
-        enableProfiler();
-    if (action == ProfilerRestoreResetAgent)
-        m_profilerAgent->resetFrontendProfiles();
-#endif
-}
-
-void InspectorController::unbindAllResources()
-{
-#if ENABLE(DATABASE)
-    DatabaseResourcesMap::iterator databasesEnd = m_databaseResources.end();
-    for (DatabaseResourcesMap::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
-        it->second->unbind();
-#endif
-#if ENABLE(DOM_STORAGE)
-    DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources.end();
-    for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
-        it->second->unbind();
-#endif
-    if (m_timelineAgent)
-        m_timelineAgent->reset();
 }
 
-void InspectorController::didCommitLoad(DocumentLoader* loader)
+void InspectorController::show()
 {
     if (!enabled())
         return;
 
-    if (m_resourceAgent)
-        m_resourceAgent->didCommitLoad(loader);
-    
-    ASSERT(m_inspectedPage);
-
-    if (loader->frame() == m_inspectedPage->mainFrame()) {
-        if (m_frontend)
-            m_frontend->inspectedURLChanged(loader->url().string());
-
-        m_injectedScriptHost->discardInjectedScripts();
-        m_consoleAgent->reset();
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-        if (m_debuggerAgent) {
-            m_debuggerAgent->clearForPageNavigation();
-            if (m_browserDebuggerAgent)
-                m_browserDebuggerAgent->inspectedURLChanged(inspectedURL());
-        }
-#endif
-
-#if ENABLE(JAVASCRIPT_DEBUGGER) && USE(JSC)
-        m_profilerAgent->stopUserInitiatedProfiling(true);
-        m_profilerAgent->resetState();
-#endif
-
-        // unbindAllResources should be called before database and DOM storage
-        // resources are cleared so that it has a chance to unbind them.
-        unbindAllResources();
-
-        if (m_frontend) {
-            m_frontend->reset();
-            m_domAgent->reset();
-            m_cssAgent->reset();
-        }
-#if ENABLE(WORKERS)
-        m_workers.clear();
-#endif
-#if ENABLE(DATABASE)
-        m_databaseResources.clear();
-#endif
-#if ENABLE(DOM_STORAGE)
-        m_domStorageResources.clear();
-#endif
-
-        if (m_frontend)
-            m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
-    }
-}
-
-void InspectorController::mainResourceFiredDOMContentEvent(DocumentLoader* loader, const KURL& url)
-{
-    if (!enabled() || !isMainResourceLoader(loader, url))
-        return;
-
-    if (m_timelineAgent)
-        m_timelineAgent->didMarkDOMContentEvent();
-    if (m_frontend)
-        m_frontend->domContentEventFired(currentTime());
-}
-
-void InspectorController::mainResourceFiredLoadEvent(DocumentLoader* loader, const KURL& url)
-{
-    if (!enabled() || !isMainResourceLoader(loader, url))
-        return;
-
-    if (m_timelineAgent)
-        m_timelineAgent->didMarkLoadEvent();
-    if (m_frontend)
-        m_frontend->loadEventFired(currentTime());
-}
-
-bool InspectorController::isMainResourceLoader(DocumentLoader* loader, const KURL& requestUrl)
-{
-    return loader->frame() == m_inspectedPage->mainFrame() && requestUrl == loader->requestURL();
-}
-
-void InspectorController::willSendRequest(ResourceRequest& request)
-{
-    if (!enabled())
+    if (m_openingFrontend)
         return;
 
-    if (m_frontend) {
-        // Only enable load timing and raw headers if front-end is attached, as otherwise we may produce overhead.
-        request.setReportLoadTiming(true);
-        request.setReportRawHeaders(true);
-
-        if (m_extraHeaders) {
-            HTTPHeaderMap::const_iterator end = m_extraHeaders->end();
-            for (HTTPHeaderMap::const_iterator it = m_extraHeaders->begin(); it != end; ++it)
-                request.setHTTPHeaderField(it->first, it->second);
-        }
+    if (m_inspectorFrontend)
+        m_inspectorFrontend->bringToFront();
+    else {
+        m_openingFrontend = true;
+        m_inspectorClient->openInspectorFrontend(this);
     }
 }
 
-void InspectorController::ensureSettingsLoaded()
-{
-    if (m_settings)
-        return;
-    m_settings = new InspectorSettings(m_client);
-    m_state->setBoolean(InspectorState::monitoringXHR, m_settings->getBoolean(InspectorSettings::MonitoringXHREnabled));
-}
-
-void InspectorController::startTimelineProfiler()
+void InspectorController::close()
 {
-    if (!enabled())
-        return;
-
-    if (m_timelineAgent)
+    if (!m_inspectorFrontend)
         return;
-
-    m_timelineAgent = new InspectorTimelineAgent(m_frontend.get());
-    if (m_frontend)
-        m_frontend->timelineProfilerWasStarted();
-
-    m_state->setBoolean(InspectorState::timelineProfilerEnabled, true);
+    m_inspectorFrontend->disconnectFromBackend();
+    disconnectFrontend();
 }
 
-void InspectorController::stopTimelineProfiler()
+void InspectorController::restoreInspectorStateFromCookie(const String& inspectorStateCookie)
 {
-    if (!enabled())
-        return;
-
-    if (!m_timelineAgent)
-        return;
-
-    m_timelineAgent = 0;
-    if (m_frontend)
-        m_frontend->timelineProfilerWasStopped();
-
-    m_state->setBoolean(InspectorState::timelineProfilerEnabled, false);
+    ASSERT(!m_inspectorFrontend);
+    connectFrontend();
+    m_inspectorAgent->restoreInspectorStateFromCookie(inspectorStateCookie);
 }
 
-#if ENABLE(WORKERS)
-class PostWorkerNotificationToFrontendTask : public ScriptExecutionContext::Task {
-public:
-    static PassOwnPtr<PostWorkerNotificationToFrontendTask> create(PassRefPtr<InspectorWorkerResource> worker, InspectorController::WorkerAction action)
-    {
-        return new PostWorkerNotificationToFrontendTask(worker, action);
-    }
-
-private:
-    PostWorkerNotificationToFrontendTask(PassRefPtr<InspectorWorkerResource> worker, InspectorController::WorkerAction action)
-        : m_worker(worker)
-        , m_action(action)
-    {
-    }
-
-    virtual void performTask(ScriptExecutionContext* scriptContext)
-    {
-        if (scriptContext->isDocument()) {
-            if (InspectorController* inspector = static_cast<Document*>(scriptContext)->page()->inspectorController())
-                inspector->postWorkerNotificationToFrontend(*m_worker, m_action);
-        }
-    }
-
-private:
-    RefPtr<InspectorWorkerResource> m_worker;
-    InspectorController::WorkerAction m_action;
-};
-
-void InspectorController::postWorkerNotificationToFrontend(const InspectorWorkerResource& worker, InspectorController::WorkerAction action)
+void InspectorController::evaluateForTestInFrontend(long callId, const String& script)
 {
-    if (!m_frontend)
-        return;
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    switch (action) {
-    case InspectorController::WorkerCreated:
-        m_frontend->didCreateWorker(worker.id(), worker.url(), worker.isSharedWorker());
-        break;
-    case InspectorController::WorkerDestroyed:
-        m_frontend->didDestroyWorker(worker.id());
-        break;
-    }
-#endif
+    m_inspectorAgent->evaluateForTestInFrontend(callId, script);
 }
 
-void InspectorController::didCreateWorker(intptr_t id, const String& url, bool isSharedWorker)
+void InspectorController::drawNodeHighlight(GraphicsContext& context) const
 {
-    if (!enabled())
-        return;
-
-    RefPtr<InspectorWorkerResource> workerResource(InspectorWorkerResource::create(id, url, isSharedWorker));
-    m_workers.set(id, workerResource);
-    if (m_inspectedPage && m_frontend)
-        m_inspectedPage->mainFrame()->document()->postTask(PostWorkerNotificationToFrontendTask::create(workerResource, InspectorController::WorkerCreated));
+    m_inspectorAgent->drawNodeHighlight(context);
 }
 
-void InspectorController::didDestroyWorker(intptr_t id)
+void InspectorController::showConsole()
 {
     if (!enabled())
         return;
-
-    WorkersMap::iterator workerResource = m_workers.find(id);
-    if (workerResource == m_workers.end())
-        return;
-    if (m_inspectedPage && m_frontend)
-        m_inspectedPage->mainFrame()->document()->postTask(PostWorkerNotificationToFrontendTask::create(workerResource->second, InspectorController::WorkerDestroyed));
-    m_workers.remove(workerResource);
+    show();
+    m_inspectorAgent->showConsole();
 }
-#endif // ENABLE(WORKERS)
 
-#if ENABLE(DATABASE)
-void InspectorController::didOpenDatabase(PassRefPtr<Database> database, const String& domain, const String& name, const String& version)
+void InspectorController::inspect(Node* node)
 {
     if (!enabled())
         return;
 
-    RefPtr<InspectorDatabaseResource> resource = InspectorDatabaseResource::create(database, domain, name, version);
-
-    m_databaseResources.set(resource->id(), resource);
-
-    // Resources are only bound while visible.
-    if (m_frontend)
-        resource->bind(m_frontend.get());
-}
-#endif
-
-void InspectorController::getCookies(RefPtr<InspectorArray>* cookies, WTF::String* cookiesString)
-{
-    // If we can get raw cookies.
-    ListHashSet<Cookie> rawCookiesList;
-
-    // If we can't get raw cookies - fall back to String representation
-    String stringCookiesList;
-
-    // Return value to getRawCookies should be the same for every call because
-    // the return value is platform/network backend specific, and the call will
-    // always return the same true/false value.
-    bool rawCookiesImplemented = false;
-
-    for (Frame* frame = m_inspectedPage->mainFrame(); frame; frame = frame->tree()->traverseNext(m_inspectedPage->mainFrame())) {
-        Document* document = frame->document();
-        const CachedResourceLoader::DocumentResourceMap& allResources = document->cachedResourceLoader()->allCachedResources();
-        CachedResourceLoader::DocumentResourceMap::const_iterator end = allResources.end();
-        for (CachedResourceLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it) {
-            Vector<Cookie> docCookiesList;
-            rawCookiesImplemented = getRawCookies(document, KURL(ParsedURLString, it->second->url()), docCookiesList);
-
-            if (!rawCookiesImplemented) {
-                // FIXME: We need duplication checking for the String representation of cookies.
-                ExceptionCode ec = 0;
-                stringCookiesList += document->cookie(ec);
-                // Exceptions are thrown by cookie() in sandboxed frames. That won't happen here
-                // because "document" is the document of the main frame of the page.
-                ASSERT(!ec);
-            } else {
-                int cookiesSize = docCookiesList.size();
-                for (int i = 0; i < cookiesSize; i++) {
-                    if (!rawCookiesList.contains(docCookiesList[i]))
-                        rawCookiesList.add(docCookiesList[i]);
-                }
-            }
-        }
-    }
+    show();
 
-    if (rawCookiesImplemented)
-        *cookies = buildArrayForCookies(rawCookiesList);
-    else
-        *cookiesString = stringCookiesList;
+    m_inspectorAgent->inspect(node);
 }
 
-PassRefPtr<InspectorArray> InspectorController::buildArrayForCookies(ListHashSet<Cookie>& cookiesList)
+bool InspectorController::enabled() const
 {
-    RefPtr<InspectorArray> cookies = InspectorArray::create();
-
-    ListHashSet<Cookie>::iterator end = cookiesList.end();
-    ListHashSet<Cookie>::iterator it = cookiesList.begin();
-    for (int i = 0; it != end; ++it, i++)
-        cookies->pushObject(buildObjectForCookie(*it));
-
-    return cookies;
+    return m_inspectorAgent->enabled();
 }
 
-PassRefPtr<InspectorObject> InspectorController::buildObjectForCookie(const Cookie& cookie)
+Page* InspectorController::inspectedPage() const
 {
-    RefPtr<InspectorObject> value = InspectorObject::create();
-    value->setString("name", cookie.name);
-    value->setString("value", cookie.value);
-    value->setString("domain", cookie.domain);
-    value->setString("path", cookie.path);
-    value->setNumber("expires", cookie.expires);
-    value->setNumber("size", (cookie.name.length() + cookie.value.length()));
-    value->setBoolean("httpOnly", cookie.httpOnly);
-    value->setBoolean("secure", cookie.secure);
-    value->setBoolean("session", cookie.session);
-    return value;
+    return m_inspectorAgent->inspectedPage();
 }
 
-void InspectorController::deleteCookie(const String& cookieName, const String& domain)
+bool InspectorController::timelineProfilerEnabled()
 {
-    for (Frame* frame = m_inspectedPage->mainFrame(); frame; frame = frame->tree()->traverseNext(m_inspectedPage->mainFrame())) {
-        Document* document = frame->document();
-        if (document->url().host() != domain)
-            continue;
-        const CachedResourceLoader::DocumentResourceMap& allResources = document->cachedResourceLoader()->allCachedResources();
-        CachedResourceLoader::DocumentResourceMap::const_iterator end = allResources.end();
-        for (CachedResourceLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it)
-            WebCore::deleteCookie(document, KURL(ParsedURLString, it->second->url()), cookieName);
-    }
+    return m_inspectorAgent->timelineAgent();
 }
 
-#if ENABLE(DOM_STORAGE)
-void InspectorController::didUseDOMStorage(StorageArea* storageArea, bool isLocalStorage, Frame* frame)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+void InspectorController::enableProfiler()
 {
-    if (!enabled())
-        return;
-
-    DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources.end();
-    for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
-        if (it->second->isSameHostAndType(frame, isLocalStorage))
-            return;
-
-    RefPtr<Storage> domStorage = Storage::create(frame, storageArea);
-    RefPtr<InspectorDOMStorageResource> resource = InspectorDOMStorageResource::create(domStorage.get(), isLocalStorage, frame);
-
-    m_domStorageResources.set(resource->id(), resource);
-
-    // Resources are only bound while visible.
-    if (m_frontend)
-        resource->bind(m_frontend.get());
+    m_inspectorAgent->enableProfiler();
 }
-#endif
 
-#if ENABLE(WEB_SOCKETS)
-void InspectorController::didCreateWebSocket(unsigned long identifier, const KURL& requestURL, const KURL& documentURL)
+void InspectorController::disableProfiler()
 {
-    if (!enabled())
-        return;
-    ASSERT(m_inspectedPage);
-
-    if (m_resourceAgent)
-        m_resourceAgent->didCreateWebSocket(identifier, requestURL);
-    UNUSED_PARAM(documentURL);
+    m_inspectorAgent->disableProfiler();
 }
 
-void InspectorController::willSendWebSocketHandshakeRequest(unsigned long identifier, const WebSocketHandshakeRequest& request)
+bool InspectorController::profilerEnabled()
 {
-    if (m_resourceAgent)
-        m_resourceAgent->willSendWebSocketHandshakeRequest(identifier, request);
+    return m_inspectorAgent->profilerEnabled();
 }
 
-void InspectorController::didReceiveWebSocketHandshakeResponse(unsigned long identifier, const WebSocketHandshakeResponse& response)
+bool InspectorController::debuggerEnabled()
 {
-    if (m_resourceAgent)
-        m_resourceAgent->didReceiveWebSocketHandshakeResponse(identifier, response);
+    return m_inspectorAgent->debuggerEnabled();
 }
 
-void InspectorController::didCloseWebSocket(unsigned long identifier)
+void InspectorController::showAndEnableDebugger()
 {
-    if (m_resourceAgent)
-        m_resourceAgent->didCloseWebSocket(identifier);
+    m_inspectorAgent->showAndEnableDebugger();
 }
-#endif // ENABLE(WEB_SOCKETS)
 
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-bool InspectorController::isRecordingUserInitiatedProfile() const
+void InspectorController::disableDebugger()
 {
-    return m_profilerAgent->isRecordingUserInitiatedProfile();
+    m_inspectorAgent->disableDebugger();
 }
 
 void InspectorController::startUserInitiatedProfiling()
 {
-    if (!enabled())
-        return;
-    m_profilerAgent->startUserInitiatedProfiling();
-    m_state->setBoolean(InspectorState::userInitiatedProfiling, true);
+    m_inspectorAgent->startUserInitiatedProfiling();
 }
 
 void InspectorController::stopUserInitiatedProfiling()
 {
-    if (!enabled())
-        return;
-    m_profilerAgent->stopUserInitiatedProfiling();
-    m_state->setBoolean(InspectorState::userInitiatedProfiling, false);
-}
-
-bool InspectorController::profilerEnabled() const
-{
-    return enabled() && m_profilerAgent->enabled();
-}
-
-void InspectorController::enableProfiler(bool always, bool skipRecompile)
-{
-    if (always)
-        m_settings->setBoolean(InspectorSettings::ProfilerAlwaysEnabled, true);
-    m_profilerAgent->enable(skipRecompile);
-}
-
-void InspectorController::disableProfiler(bool always)
-{
-    if (always)
-        m_settings->setBoolean(InspectorSettings::ProfilerAlwaysEnabled, false);
-    m_profilerAgent->disable();
+    m_inspectorAgent->stopUserInitiatedProfiling();
 }
-#endif
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-void InspectorController::showAndEnableDebugger()
-{
-    if (!enabled())
-        return;
 
-    if (debuggerEnabled())
-        return;
-
-    if (!m_frontend) {
-        m_attachDebuggerWhenShown = true;
-        showPanel(ScriptsPanel);
-    } else
-        enableDebugger(false);
-}
-
-void InspectorController::enableDebugger(bool always)
+bool InspectorController::isRecordingUserInitiatedProfile() const
 {
-    ASSERT(!debuggerEnabled());
-    if (always)
-        m_settings->setBoolean(InspectorSettings::DebuggerAlwaysEnabled, true);
-
-    ASSERT(m_inspectedPage);
-
-    m_debuggerAgent = InspectorDebuggerAgent::create(this, m_frontend.get());
-    m_browserDebuggerAgent = InspectorBrowserDebuggerAgent::create(this);
-    m_browserDebuggerAgent->inspectedURLChanged(inspectedURL());
-
-    m_frontend->debuggerWasEnabled();
+    return m_inspectorAgent->isRecordingUserInitiatedProfile();
 }
 
-void InspectorController::disableDebugger(bool always)
+void InspectorController::setInspectorExtensionAPI(const String& source)
 {
-    if (!enabled())
-        return;
-
-    if (always)
-        m_settings->setBoolean(InspectorSettings::DebuggerAlwaysEnabled, false);
-
-    ASSERT(m_inspectedPage);
-
-    m_debuggerAgent.clear();
-    m_browserDebuggerAgent.clear();
-
-    m_attachDebuggerWhenShown = false;
-
-    if (m_frontend)
-        m_frontend->debuggerWasDisabled();
+    m_inspectorAgent->setInspectorExtensionAPI(source);
 }
 
 void InspectorController::resume()
 {
-    if (m_debuggerAgent)
-        m_debuggerAgent->resume();
-}
-
-void InspectorController::setAllBrowserBreakpoints(PassRefPtr<InspectorObject> breakpoints)
-{
-    m_state->setObject(InspectorState::browserBreakpoints, breakpoints);
-}
-#endif
-
-void InspectorController::evaluateForTestInFrontend(long callId, const String& script)
-{
-    if (m_frontend)
-        m_frontend->evaluateForTestInFrontend(callId, script);
-    else
-        m_pendingEvaluateTestCommands.append(pair<long, String>(callId, script));
-}
-
-void InspectorController::didEvaluateForTestInFrontend(long callId, const String& jsonResult)
-{
-    ScriptState* scriptState = scriptStateFromPage(debuggerWorld(), m_inspectedPage);
-    ScriptObject window;
-    ScriptGlobalObject::get(scriptState, "window", window);
-    ScriptFunctionCall function(window, "didEvaluateForTestInFrontend");
-    function.appendArgument(callId);
-    function.appendArgument(jsonResult);
-    function.call();
-}
-
-static Path quadToPath(const FloatQuad& quad)
-{
-    Path quadPath;
-    quadPath.moveTo(quad.p1());
-    quadPath.addLineTo(quad.p2());
-    quadPath.addLineTo(quad.p3());
-    quadPath.addLineTo(quad.p4());
-    quadPath.closeSubpath();
-    return quadPath;
-}
-
-static void drawOutlinedQuad(GraphicsContext& context, const FloatQuad& quad, const Color& fillColor)
-{
-    static const int outlineThickness = 2;
-    static const Color outlineColor(62, 86, 180, 228);
-
-    Path quadPath = quadToPath(quad);
-
-    // Clip out the quad, then draw with a 2px stroke to get a pixel
-    // of outline (because inflating a quad is hard)
-    {
-        context.save();
-        context.clipOut(quadPath);
-
-        context.setStrokeThickness(outlineThickness);
-        context.setStrokeColor(outlineColor, ColorSpaceDeviceRGB);
-        context.strokePath(quadPath);
-
-        context.restore();
-    }
-
-    // Now do the fill
-    context.setFillColor(fillColor, ColorSpaceDeviceRGB);
-    context.fillPath(quadPath);
-}
-
-static void drawOutlinedQuadWithClip(GraphicsContext& context, const FloatQuad& quad, const FloatQuad& clipQuad, const Color& fillColor)
-{
-    context.save();
-    Path clipQuadPath = quadToPath(clipQuad);
-    context.clipOut(clipQuadPath);
-    drawOutlinedQuad(context, quad, fillColor);
-    context.restore();
-}
-
-static void drawHighlightForBox(GraphicsContext& context, const FloatQuad& contentQuad, const FloatQuad& paddingQuad, const FloatQuad& borderQuad, const FloatQuad& marginQuad)
-{
-    static const Color contentBoxColor(125, 173, 217, 128);
-    static const Color paddingBoxColor(125, 173, 217, 160);
-    static const Color borderBoxColor(125, 173, 217, 192);
-    static const Color marginBoxColor(125, 173, 217, 228);
-
-    if (marginQuad != borderQuad)
-        drawOutlinedQuadWithClip(context, marginQuad, borderQuad, marginBoxColor);
-    if (borderQuad != paddingQuad)
-        drawOutlinedQuadWithClip(context, borderQuad, paddingQuad, borderBoxColor);
-    if (paddingQuad != contentQuad)
-        drawOutlinedQuadWithClip(context, paddingQuad, contentQuad, paddingBoxColor);
-
-    drawOutlinedQuad(context, contentQuad, contentBoxColor);
-}
-
-static void drawHighlightForLineBoxesOrSVGRenderer(GraphicsContext& context, const Vector<FloatQuad>& lineBoxQuads)
-{
-    static const Color lineBoxColor(125, 173, 217, 128);
-
-    for (size_t i = 0; i < lineBoxQuads.size(); ++i)
-        drawOutlinedQuad(context, lineBoxQuads[i], lineBoxColor);
+    if (InspectorDebuggerAgent* debuggerAgent = m_inspectorAgent->debuggerAgent())
+        debuggerAgent->resume();
 }
 
-static inline void convertFromFrameToMainFrame(Frame* frame, IntRect& rect)
+void InspectorController::hideHighlight()
 {
-    rect = frame->page()->mainFrame()->view()->windowToContents(frame->view()->contentsToWindow(rect));
+    m_inspectorAgent->hideHighlight();
 }
 
-static inline IntSize frameToMainFrameOffset(Frame* frame)
+void InspectorController::dispatchMessageFromFrontend(const String& message)
 {
-    IntPoint mainFramePoint = frame->page()->mainFrame()->view()->windowToContents(frame->view()->contentsToWindow(IntPoint()));
-    return mainFramePoint - IntPoint();
+    m_inspectorBackendDispatcher->dispatch(message);
 }
 
-void InspectorController::drawNodeHighlight(GraphicsContext& context) const
-{
-    if (!m_highlightedNode)
-        return;
-
-    RenderObject* renderer = m_highlightedNode->renderer();
-    Frame* containingFrame = m_highlightedNode->document()->frame();
-    if (!renderer || !containingFrame)
-        return;
-
-    IntSize mainFrameOffset = frameToMainFrameOffset(containingFrame);
-    IntRect boundingBox = renderer->absoluteBoundingBoxRect(true);
-    boundingBox.move(mainFrameOffset);
-
-    IntRect titleReferenceBox = boundingBox;
-
-    ASSERT(m_inspectedPage);
-
-    FrameView* view = m_inspectedPage->mainFrame()->view();
-    FloatRect overlayRect = view->visibleContentRect();
-    if (!overlayRect.contains(boundingBox) && !boundingBox.contains(enclosingIntRect(overlayRect)))
-        overlayRect = view->visibleContentRect();
-    context.translate(-overlayRect.x(), -overlayRect.y());
-
-    // RenderSVGRoot should be highlighted through the isBox() code path, all other SVG elements should just dump their absoluteQuads().
-#if ENABLE(SVG)
-    bool isSVGRenderer = renderer->node() && renderer->node()->isSVGElement() && !renderer->isSVGRoot();
-#else
-    bool isSVGRenderer = false;
 #endif
 
-    if (renderer->isBox() && !isSVGRenderer) {
-        RenderBox* renderBox = toRenderBox(renderer);
-
-        IntRect contentBox = renderBox->contentBoxRect();
-
-        IntRect paddingBox(contentBox.x() - renderBox->paddingLeft(), contentBox.y() - renderBox->paddingTop(),
-                           contentBox.width() + renderBox->paddingLeft() + renderBox->paddingRight(), contentBox.height() + renderBox->paddingTop() + renderBox->paddingBottom());
-        IntRect borderBox(paddingBox.x() - renderBox->borderLeft(), paddingBox.y() - renderBox->borderTop(),
-                          paddingBox.width() + renderBox->borderLeft() + renderBox->borderRight(), paddingBox.height() + renderBox->borderTop() + renderBox->borderBottom());
-        IntRect marginBox(borderBox.x() - renderBox->marginLeft(), borderBox.y() - renderBox->marginTop(),
-                          borderBox.width() + renderBox->marginLeft() + renderBox->marginRight(), borderBox.height() + renderBox->marginTop() + renderBox->marginBottom());
-
-        titleReferenceBox = marginBox;
-        titleReferenceBox.move(mainFrameOffset);
-        titleReferenceBox.move(boundingBox.x(), boundingBox.y());
-
-        FloatQuad absContentQuad = renderBox->localToAbsoluteQuad(FloatRect(contentBox));
-        FloatQuad absPaddingQuad = renderBox->localToAbsoluteQuad(FloatRect(paddingBox));
-        FloatQuad absBorderQuad = renderBox->localToAbsoluteQuad(FloatRect(borderBox));
-        FloatQuad absMarginQuad = renderBox->localToAbsoluteQuad(FloatRect(marginBox));
-
-        absContentQuad.move(mainFrameOffset);
-        absPaddingQuad.move(mainFrameOffset);
-        absBorderQuad.move(mainFrameOffset);
-        absMarginQuad.move(mainFrameOffset);
-
-        drawHighlightForBox(context, absContentQuad, absPaddingQuad, absBorderQuad, absMarginQuad);
-    } else if (renderer->isRenderInline() || isSVGRenderer) {
-        // FIXME: We should show margins/padding/border for inlines.
-        Vector<FloatQuad> lineBoxQuads;
-        renderer->absoluteQuads(lineBoxQuads);
-        for (unsigned i = 0; i < lineBoxQuads.size(); ++i)
-            lineBoxQuads[i] += mainFrameOffset;
-
-        drawHighlightForLineBoxesOrSVGRenderer(context, lineBoxQuads);
-    }
-
-    // Draw node title if necessary.
-
-    if (!m_highlightedNode->isElementNode())
-        return;
-
-    WebCore::Settings* settings = containingFrame->settings();
-    drawElementTitle(context, titleReferenceBox, overlayRect, settings);
-}
-
-void InspectorController::drawElementTitle(GraphicsContext& context, const IntRect& boundingBox, const FloatRect& overlayRect, WebCore::Settings* settings) const
-{
-    static const int rectInflatePx = 4;
-    static const int fontHeightPx = 12;
-    static const int borderWidthPx = 1;
-    static const Color tooltipBackgroundColor(255, 255, 194, 255);
-    static const Color tooltipBorderColor(Color::black);
-    static const Color tooltipFontColor(Color::black);
-
-    Element* element = static_cast<Element*>(m_highlightedNode.get());
-    bool isXHTML = element->document()->isXHTMLDocument();
-    String nodeTitle = isXHTML ? element->nodeName() : element->nodeName().lower();
-    const AtomicString& idValue = element->getIdAttribute();
-    if (!idValue.isNull() && !idValue.isEmpty()) {
-        nodeTitle += "#";
-        nodeTitle += idValue;
-    }
-    if (element->hasClass() && element->isStyledElement()) {
-        const SpaceSplitString& classNamesString = static_cast<StyledElement*>(element)->classNames();
-        size_t classNameCount = classNamesString.size();
-        if (classNameCount) {
-            HashSet<AtomicString> usedClassNames;
-            for (size_t i = 0; i < classNameCount; ++i) {
-                const AtomicString& className = classNamesString[i];
-                if (usedClassNames.contains(className))
-                    continue;
-                usedClassNames.add(className);
-                nodeTitle += ".";
-                nodeTitle += className;
-            }
-        }
-    }
-
-    Element* highlightedElement = m_highlightedNode->isElementNode() ? static_cast<Element*>(m_highlightedNode.get()) : 0;
-    nodeTitle += " [";
-    nodeTitle += String::number(highlightedElement ? highlightedElement->offsetWidth() : boundingBox.width());
-    nodeTitle.append(static_cast<UChar>(0x00D7)); // &times;
-    nodeTitle += String::number(highlightedElement ? highlightedElement->offsetHeight() : boundingBox.height());
-    nodeTitle += "]";
-
-    FontDescription desc;
-    FontFamily family;
-    family.setFamily(settings->fixedFontFamily());
-    desc.setFamily(family);
-    desc.setComputedSize(fontHeightPx);
-    Font font = Font(desc, 0, 0);
-    font.update(0);
-
-    TextRun nodeTitleRun(nodeTitle);
-    IntPoint titleBasePoint = boundingBox.bottomLeft();
-    titleBasePoint.move(rectInflatePx, rectInflatePx);
-    IntRect titleRect = enclosingIntRect(font.selectionRectForText(nodeTitleRun, titleBasePoint, fontHeightPx));
-    titleRect.inflate(rectInflatePx);
-
-    // The initial offsets needed to compensate for a 1px-thick border stroke (which is not a part of the rectangle).
-    int dx = -borderWidthPx;
-    int dy = borderWidthPx;
-
-    // If the tip sticks beyond the right of overlayRect, right-align the tip with the said boundary.
-    if (titleRect.right() > overlayRect.right())
-        dx = overlayRect.right() - titleRect.right();
-
-    // If the tip sticks beyond the left of overlayRect, left-align the tip with the said boundary.
-    if (titleRect.x() + dx < overlayRect.x())
-        dx = overlayRect.x() - titleRect.x() - borderWidthPx;
-
-    // If the tip sticks beyond the bottom of overlayRect, show the tip at top of bounding box.
-    if (titleRect.bottom() > overlayRect.bottom()) {
-        dy = boundingBox.y() - titleRect.bottom() - borderWidthPx;
-        // If the tip still sticks beyond the bottom of overlayRect, bottom-align the tip with the said boundary.
-        if (titleRect.bottom() + dy > overlayRect.bottom())
-            dy = overlayRect.bottom() - titleRect.bottom();
-    }
-
-    // If the tip sticks beyond the top of overlayRect, show the tip at top of overlayRect.
-    if (titleRect.y() + dy < overlayRect.y())
-        dy = overlayRect.y() - titleRect.y() + borderWidthPx;
-
-    titleRect.move(dx, dy);
-    context.setStrokeColor(tooltipBorderColor, ColorSpaceDeviceRGB);
-    context.setStrokeThickness(borderWidthPx);
-    context.setFillColor(tooltipBackgroundColor, ColorSpaceDeviceRGB);
-    context.drawRect(titleRect);
-    context.setFillColor(tooltipFontColor, ColorSpaceDeviceRGB);
-    context.drawText(font, nodeTitleRun, IntPoint(titleRect.x() + rectInflatePx, titleRect.y() + font.height()));
-}
-
-void InspectorController::openInInspectedWindow(const String& url)
-{
-    Frame* mainFrame = m_inspectedPage->mainFrame();
-
-    FrameLoadRequest request(mainFrame->document()->securityOrigin(), ResourceRequest(), "_blank");
-
-    bool created;
-    WindowFeatures windowFeatures;
-    Frame* newFrame = WebCore::createWindow(mainFrame, mainFrame, request, windowFeatures, created);
-    if (!newFrame)
-        return;
-
-    UserGestureIndicator indicator(DefinitelyProcessingUserGesture);
-    newFrame->loader()->setOpener(mainFrame);
-    newFrame->page()->setOpenedByDOM();
-    newFrame->loader()->changeLocation(mainFrame->document()->securityOrigin(), newFrame->loader()->completeURL(url), "", false, false);
-}
-
-void InspectorController::addScriptToEvaluateOnLoad(const String& source)
-{
-    m_scriptsToEvaluateOnLoad.append(source);
-}
-
-void InspectorController::removeAllScriptsToEvaluateOnLoad()
-{
-    m_scriptsToEvaluateOnLoad.clear();
-}
-
-void InspectorController::setInspectorExtensionAPI(const String& source)
-{
-    m_inspectorExtensionAPI = source;
-}
-
-KURL InspectorController::inspectedURL() const
-{
-    return m_inspectedPage->mainFrame()->loader()->url();
-}
-
-void InspectorController::reloadPage()
-{
-    // FIXME: Why do we set the user gesture indicator here?
-    UserGestureIndicator indicator(DefinitelyProcessingUserGesture);
-    m_inspectedPage->mainFrame()->navigationScheduler()->scheduleRefresh();
-}
-
-void InspectorController::setExtraHeaders(PassRefPtr<InspectorObject> headers)
-{
-    m_extraHeaders = adoptPtr(new HTTPHeaderMap());
-    InspectorObject::const_iterator end = headers->end();
-    for (InspectorObject::const_iterator it = headers->begin(); it != end; ++it) {
-        String value;
-        if (!it->second->asString(&value))
-            continue;
-        m_extraHeaders->add(it->first, value);
-    }
-}
-
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorController.h b/Source/WebCore/inspector/InspectorController.h
index 90a0300..7db024c 100644
--- a/Source/WebCore/inspector/InspectorController.h
+++ b/Source/WebCore/inspector/InspectorController.h
@@ -1,365 +1,115 @@
 /*
- * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
+ * modification, are permitted provided that the following conditions are
+ * met:
  *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef InspectorController_h
 #define InspectorController_h
 
-#include "CharacterData.h"
-#include "Console.h"
-#include "Cookie.h"
-#include "Page.h"
 #include "PlatformString.h"
-#include <wtf/HashMap.h>
-#include <wtf/HashSet.h>
-#include <wtf/ListHashSet.h>
-#include <wtf/RefCounted.h>
+#include <wtf/Forward.h>
+#include <wtf/Noncopyable.h>
 #include <wtf/Vector.h>
-#include <wtf/text/StringHash.h>
 
 namespace WebCore {
 
-class CachedResource;
-class CharacterData;
-class Database;
 class DOMWrapperWorld;
-class Document;
-class DocumentLoader;
-class FloatRect;
+class Frame;
 class GraphicsContext;
-class HTTPHeaderMap;
-class HitTestResult;
-class InjectedScript;
-class InjectedScriptHost;
-class InspectorArray;
+class InspectorAgent;
 class InspectorBackendDispatcher;
-class InspectorBrowserDebuggerAgent;
 class InspectorClient;
-class InspectorConsoleAgent;
-class InspectorCSSAgent;
-class InspectorDOMAgent;
-class InspectorDOMStorageAgent;
-class InspectorDOMStorageResource;
-class InspectorDatabaseAgent;
-class InspectorDatabaseResource;
-class InspectorDebuggerAgent;
 class InspectorFrontend;
 class InspectorFrontendClient;
-class InspectorObject;
-class InspectorProfilerAgent;
-class InspectorResourceAgent;
-class InspectorRuntimeAgent;
-class InspectorSettings;
-class InspectorState;
-class InspectorStorageAgent;
-class InspectorTimelineAgent;
-class InspectorValue;
-class InspectorWorkerResource;
-class IntRect;
-class KURL;
-class Node;
 class Page;
-class ResourceRequest;
-class ResourceResponse;
-class ResourceError;
-class ScriptArguments;
-class ScriptCallStack;
-class ScriptProfile;
-class SharedBuffer;
-class StorageArea;
-
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-class InspectorApplicationCacheAgent;
-#endif
-
-#if ENABLE(FILE_SYSTEM)
-class InspectorFileSystemAgent;
-#endif
-
-#if ENABLE(WEB_SOCKETS)
-class WebSocketHandshakeRequest;
-class WebSocketHandshakeResponse;
-#endif
+class PostWorkerNotificationToFrontendTask;
+class Node;
 
 class InspectorController {
-    WTF_MAKE_NONCOPYABLE(InspectorController); WTF_MAKE_FAST_ALLOCATED;
+    WTF_MAKE_NONCOPYABLE(InspectorController);
+    WTF_MAKE_FAST_ALLOCATED;
 public:
-    static const char* const ConsolePanel;
-    static const char* const ElementsPanel;
-    static const char* const ProfilesPanel;
-    static const char* const ScriptsPanel;
-
     InspectorController(Page*, InspectorClient*);
     ~InspectorController();
 
-    InspectorBackendDispatcher* inspectorBackendDispatcher() { return m_inspectorBackendDispatcher.get(); }
-    InspectorClient* inspectorClient() { return m_client; }
-    InjectedScriptHost* injectedScriptHost() { return m_injectedScriptHost.get(); }
-
-    void inspectedPageDestroyed();
-
     bool enabled() const;
-
-    Page* inspectedPage() const { return m_inspectedPage; }
-    KURL inspectedURL() const;
-    void reloadPage();
-
-    void restoreInspectorStateFromCookie(const String& inspectorCookie);
-
-    void inspect(Node*);
-    void highlight(Node*);
-    void hideHighlight();
-    void highlightDOMNode(long nodeId);
-    void hideDOMNodeHighlight() { hideHighlight(); }
-
-    void highlightFrame(unsigned long frameId);
-    void hideFrameHighlight() { hideHighlight(); }
+    Page* inspectedPage() const;
 
     void show();
-    void showPanel(const String&);
     void close();
 
-    void connectFrontend();
-    void reuseFrontend();
-    void disconnectFrontend();
-    InspectorFrontend* frontend() const { return m_frontend.get(); }
-
-    InspectorResourceAgent* resourceAgent();
-
-    InspectorController* inspectorAgent() { return this; }
-    InspectorConsoleAgent* consoleAgent() { return m_consoleAgent.get(); }
-    InspectorCSSAgent* cssAgent() { return m_cssAgent.get(); }
-    InspectorDOMAgent* domAgent() { return m_domAgent.get(); }
-    InjectedScriptHost* injectedScriptAgent() { return m_injectedScriptHost.get(); }
-    InspectorRuntimeAgent* runtimeAgent() { return m_runtimeAgent.get(); }
-    InspectorTimelineAgent* timelineAgent() { return m_timelineAgent.get(); }
-#if ENABLE(DATABASE)
-    InspectorDatabaseAgent* databaseAgent() { return m_databaseAgent.get(); }
-#endif
-#if ENABLE(DOM_STORAGE)
-    InspectorDOMStorageAgent* domStorageAgent() { return m_domStorageAgent.get(); }
-#endif
-#if ENABLE(FILE_SYSTEM)
-    InspectorFileSystemAgent* fileSystemAgent() { return m_fileSystemAgent.get(); }
-#endif
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    InspectorBrowserDebuggerAgent* browserDebuggerAgent() const { return m_browserDebuggerAgent.get(); }
-    InspectorDebuggerAgent* debuggerAgent() const { return m_debuggerAgent.get(); }
-    InspectorProfilerAgent* profilerAgent() const { return m_profilerAgent.get(); }
-#endif
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    InspectorApplicationCacheAgent* applicationCacheAgent() { return m_applicationCacheAgent.get(); }
-#endif
-
-
-    bool searchingForNodeInPage() const;
-    void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
-    bool handleMousePress();
+    void setInspectorFrontendClient(PassOwnPtr<InspectorFrontendClient>);
+    bool hasInspectorFrontendClient() const;
+    void didClearWindowObjectInWorld(Frame*, DOMWrapperWorld*);
+    void setInspectorExtensionAPI(const String& source);
 
-    void setInspectorFrontendClient(PassOwnPtr<InspectorFrontendClient> client);
-    bool hasInspectorFrontendClient() const { return m_inspectorFrontendClient; }
+    void dispatchMessageFromFrontend(const String& message);
 
-    void didClearWindowObjectInWorld(Frame*, DOMWrapperWorld*);
+    bool hasFrontend() const { return m_inspectorFrontend; }
+    void connectFrontend();
+    void disconnectFrontend();
+    void restoreInspectorStateFromCookie(const String& inspectorCookie);
 
-    void didCommitLoad(DocumentLoader*);
+    void showConsole();
+    void inspect(Node*);
+    void drawNodeHighlight(GraphicsContext&) const;
+    void hideHighlight();
 
-    void setExtraHeaders(PassRefPtr<InspectorObject>);
+    void evaluateForTestInFrontend(long callId, const String& script);
 
     void startTimelineProfiler();
     void stopTimelineProfiler();
-
-    void getCookies(RefPtr<InspectorArray>* cookies, WTF::String* cookiesString);
-    void deleteCookie(const String& cookieName, const String& domain);
-
-    void mainResourceFiredLoadEvent(DocumentLoader*, const KURL&);
-    void mainResourceFiredDOMContentEvent(DocumentLoader*, const KURL&);
-
-#if ENABLE(WORKERS)
-    enum WorkerAction { WorkerCreated, WorkerDestroyed };
-
-    void postWorkerNotificationToFrontend(const InspectorWorkerResource&, WorkerAction);
-    void didCreateWorker(intptr_t, const String& url, bool isSharedWorker);
-    void didDestroyWorker(intptr_t);
-#endif
-
-#if ENABLE(DATABASE)
-    void didOpenDatabase(PassRefPtr<Database>, const String& domain, const String& name, const String& version);
-#endif
-
-#if ENABLE(DOM_STORAGE)
-    void didUseDOMStorage(StorageArea* storageArea, bool isLocalStorage, Frame* frame);
-#endif
-
-#if ENABLE(WEB_SOCKETS)
-    void didCreateWebSocket(unsigned long identifier, const KURL& requestURL, const KURL& documentURL);
-    void willSendWebSocketHandshakeRequest(unsigned long identifier, const WebSocketHandshakeRequest&);
-    void didReceiveWebSocketHandshakeResponse(unsigned long identifier, const WebSocketHandshakeResponse&);
-    void didCloseWebSocket(unsigned long identifier);
-#endif
-
-    bool hasFrontend() const { return m_frontend; }
-
-    void drawNodeHighlight(GraphicsContext&) const;
-    void openInInspectedWindow(const String& url);
-    void drawElementTitle(GraphicsContext&, const IntRect& boundingBox, const FloatRect& overlayRect, WebCore::Settings*) const;
+    bool timelineProfilerEnabled();
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    bool isRecordingUserInitiatedProfile() const;
-    void startProfiling() { startUserInitiatedProfiling(); }
+    bool profilerEnabled();
+    void enableProfiler();
     void startUserInitiatedProfiling();
-    void stopProfiling() { stopUserInitiatedProfiling(); }
+    bool isRecordingUserInitiatedProfile() const;
     void stopUserInitiatedProfiling();
-    void enableProfiler(bool always = false, bool skipRecompile = false);
-    void disableProfiler(bool always = false);
-    bool profilerEnabled() const;
-
+    void disableProfiler();
     void showAndEnableDebugger();
-    void enableDebugger(bool always);
-    void disableDebugger(bool always = false);
-    bool debuggerEnabled() const { return m_debuggerAgent; }
+    bool debuggerEnabled();
+    void disableDebugger();
     void resume();
-
-    void setAllBrowserBreakpoints(PassRefPtr<InspectorObject>);
 #endif
 
-    // Generic code called from custom implementations.
-    void evaluateForTestInFrontend(long testCallId, const String& script);
-
-    void addScriptToEvaluateOnLoad(const String& source);
-    void removeAllScriptsToEvaluateOnLoad();
-    void setInspectorExtensionAPI(const String& source);
-
-    bool inspectorStartsAttached();
-    void setInspectorStartsAttached(bool);
-    void setInspectorAttachedHeight(long height);
-    long inspectorAttachedHeight() const;
-
-    InspectorState* state() { return m_state.get(); }
-    InspectorSettings* settings() { return m_settings.get(); }
-
-    // InspectorAgent API
-    void getInspectorState(RefPtr<InspectorObject>* state);
-    void setMonitoringXHREnabled(bool enabled, bool* newState);
-    void populateScriptObjects();
-    // Following are used from InspectorBackend and internally.
-    void setSearchingForNode(bool enabled, bool* newState);
-    void didEvaluateForTestInFrontend(long callId, const String& jsonResult);
-
-    // InspectorInstrumentation API
-    void ensureSettingsLoaded();
-    void willSendRequest(ResourceRequest&);
-
 private:
-    void pushDataCollectedOffline();
-    void restoreDebugger();
-    enum ProfilerRestoreAction {
-        ProfilerRestoreNoAction = 0,
-        ProfilerRestoreResetAgent = 1
-    };
-    void restoreProfiler(ProfilerRestoreAction action);
-    void unbindAllResources();
-    void setSearchingForNode(bool enabled);
-
-    void releaseFrontendLifetimeAgents();
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    void toggleRecordButton(bool);
-#endif
-
-    PassRefPtr<InspectorObject> buildObjectForCookie(const Cookie&);
-    PassRefPtr<InspectorArray> buildArrayForCookies(ListHashSet<Cookie>&);
-
-    void focusNode();
-    bool isMainResourceLoader(DocumentLoader* loader, const KURL& requestUrl);
+    friend class PostWorkerNotificationToFrontendTask;
 
-    Page* m_inspectedPage;
-    InspectorClient* m_client;
+    OwnPtr<InspectorAgent> m_inspectorAgent;
+    OwnPtr<InspectorBackendDispatcher> m_inspectorBackendDispatcher;
     OwnPtr<InspectorFrontendClient> m_inspectorFrontendClient;
+    OwnPtr<InspectorFrontend> m_inspectorFrontend;
+    InspectorClient* m_inspectorClient;
     bool m_openingFrontend;
-    OwnPtr<InspectorFrontend> m_frontend;
-    OwnPtr<InspectorCSSAgent> m_cssAgent;
-    RefPtr<InspectorDOMAgent> m_domAgent;
-
-#if ENABLE(DATABASE)
-    RefPtr<InspectorDatabaseAgent> m_databaseAgent;
-#endif
-
-#if ENABLE(DOM_STORAGE)
-    RefPtr<InspectorDOMStorageAgent> m_domStorageAgent;
-#endif
-
-    OwnPtr<InspectorTimelineAgent> m_timelineAgent;
-    OwnPtr<InspectorState> m_state;
-    OwnPtr<InspectorSettings> m_settings;
-
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    OwnPtr<InspectorApplicationCacheAgent> m_applicationCacheAgent;
-#endif
-    
-#if ENABLE(FILE_SYSTEM)
-    RefPtr<InspectorFileSystemAgent> m_fileSystemAgent;
-#endif 
-
-    RefPtr<Node> m_nodeToFocus;
-    RefPtr<InspectorResourceAgent> m_resourceAgent;
-    OwnPtr<InspectorRuntimeAgent> m_runtimeAgent;
-
-#if ENABLE(DATABASE)
-    typedef HashMap<int, RefPtr<InspectorDatabaseResource> > DatabaseResourcesMap;
-    DatabaseResourcesMap m_databaseResources;
-#endif
-#if ENABLE(DOM_STORAGE)
-    typedef HashMap<int, RefPtr<InspectorDOMStorageResource> > DOMStorageResourcesMap;
-    DOMStorageResourcesMap m_domStorageResources;
-#endif
-
-    String m_showAfterVisible;
-    RefPtr<Node> m_highlightedNode;
-    OwnPtr<InspectorBackendDispatcher> m_inspectorBackendDispatcher;
-    RefPtr<InjectedScriptHost> m_injectedScriptHost;
-    OwnPtr<InspectorConsoleAgent> m_consoleAgent;
-
-    Vector<pair<long, String> > m_pendingEvaluateTestCommands;
-    Vector<String> m_scriptsToEvaluateOnLoad;
-    String m_inspectorExtensionAPI;
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    bool m_attachDebuggerWhenShown;
-    OwnPtr<InspectorDebuggerAgent> m_debuggerAgent;
-    OwnPtr<InspectorBrowserDebuggerAgent> m_browserDebuggerAgent;
-    OwnPtr<InspectorProfilerAgent> m_profilerAgent;
-#endif
-    OwnPtr<HTTPHeaderMap> m_extraHeaders;
-#if ENABLE(WORKERS)
-    typedef HashMap<intptr_t, RefPtr<InspectorWorkerResource> > WorkersMap;
-
-    WorkersMap m_workers;
-#endif
 };
 
-} // namespace WebCore
+}
 
 #endif // !defined(InspectorController_h)
diff --git a/Source/WebCore/inspector/InspectorDOMAgent.cpp b/Source/WebCore/inspector/InspectorDOMAgent.cpp
index 6e10f09..e222edb 100644
--- a/Source/WebCore/inspector/InspectorDOMAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDOMAgent.cpp
@@ -208,8 +208,7 @@ public:
 }
 
 InspectorDOMAgent::InspectorDOMAgent(InjectedScriptHost* injectedScriptHost, InspectorFrontend* frontend)
-    : EventListener(InspectorDOMAgentType)
-    , m_injectedScriptHost(injectedScriptHost)
+    : m_injectedScriptHost(injectedScriptHost)
     , m_frontend(frontend)
     , m_domListener(0)
     , m_lastNodeId(1)
@@ -222,16 +221,22 @@ InspectorDOMAgent::~InspectorDOMAgent()
     reset();
 }
 
+Vector<Document*> InspectorDOMAgent::documents()
+{
+    Vector<Document*> result;
+    for (Frame* frame = m_document->frame(); frame; frame = frame->tree()->traverseNext()) {
+        Document* document = frame->document();
+        if (!document)
+            continue;
+        result.append(document);
+    }
+    return result;
+}
+
 void InspectorDOMAgent::reset()
 {
     searchCanceled();
     discardBindings();
-
-    ListHashSet<RefPtr<Document> > copy = m_documents;
-    for (ListHashSet<RefPtr<Document> >::iterator it = copy.begin(); it != copy.end(); ++it)
-        stopListening((*it).get());
-
-    ASSERT(!m_documents.size());
 }
 
 void InspectorDOMAgent::setDOMListener(DOMListener* listener)
@@ -241,13 +246,14 @@ void InspectorDOMAgent::setDOMListener(DOMListener* listener)
 
 void InspectorDOMAgent::setDocument(Document* doc)
 {
-    if (doc == mainFrameDocument())
+    if (doc == m_document.get())
         return;
 
     reset();
 
+    m_document = doc;
+
     if (doc) {
-        startListening(doc);
         if (doc->documentElement())
             pushDocumentToFrontend();
     } else
@@ -260,66 +266,6 @@ void InspectorDOMAgent::releaseDanglingNodes()
     m_danglingNodeToIdMaps.clear();
 }
 
-void InspectorDOMAgent::startListeningFrameDocument(Node* frameOwnerNode)
-{
-    ASSERT(frameOwnerNode->isFrameOwnerElement());
-    HTMLFrameOwnerElement* frameOwner = static_cast<HTMLFrameOwnerElement*>(frameOwnerNode);
-    Document* doc = frameOwner->contentDocument();
-    if (doc)
-        startListening(doc);
-}
-
-void InspectorDOMAgent::startListening(Document* doc)
-{
-    if (m_documents.contains(doc))
-        return;
-
-    doc->addEventListener(eventNames().DOMContentLoadedEvent, this, false);
-    doc->addEventListener(eventNames().loadEvent, this, true);
-    m_documents.add(doc);
-}
-
-void InspectorDOMAgent::stopListening(Document* doc)
-{
-    if (!m_documents.contains(doc))
-        return;
-
-    doc->removeEventListener(eventNames().DOMContentLoadedEvent, this, false);
-    doc->removeEventListener(eventNames().loadEvent, this, true);
-    m_documents.remove(doc);
-}
-
-void InspectorDOMAgent::handleEvent(ScriptExecutionContext*, Event* event)
-{
-    AtomicString type = event->type();
-    Node* node = event->target()->toNode();
-
-    if (type == eventNames().DOMContentLoadedEvent) {
-        // Re-push document once it is loaded.
-        discardBindings();
-        pushDocumentToFrontend();
-    } else if (type == eventNames().loadEvent) {
-        long frameOwnerId = m_documentNodeToIdMap.get(node);
-        if (!frameOwnerId)
-            return;
-
-        if (!m_childrenRequested.contains(frameOwnerId)) {
-            // No children are mapped yet -> only notify on changes of hasChildren.
-            m_frontend->childNodeCountUpdated(frameOwnerId, innerChildNodeCount(node));
-        } else {
-            // Re-add frame owner element together with its new children.
-            long parentId = m_documentNodeToIdMap.get(innerParentNode(node));
-            m_frontend->childNodeRemoved(parentId, frameOwnerId);
-            RefPtr<InspectorObject> value = buildObjectForNode(node, 0, &m_documentNodeToIdMap);
-            Node* previousSibling = innerPreviousSibling(node);
-            long prevId = previousSibling ? m_documentNodeToIdMap.get(previousSibling) : 0;
-            m_frontend->childNodeInserted(parentId, prevId, value.release());
-            // Invalidate children requested flag for the element.
-            m_childrenRequested.remove(m_childrenRequested.find(frameOwnerId));
-        }
-    }
-}
-
 long InspectorDOMAgent::bind(Node* node, NodeToIdMap* nodesMap)
 {
     long id = nodesMap->get(node);
@@ -336,7 +282,6 @@ void InspectorDOMAgent::unbind(Node* node, NodeToIdMap* nodesMap)
 {
     if (node->isFrameOwnerElement()) {
         const HTMLFrameOwnerElement* frameOwner = static_cast<const HTMLFrameOwnerElement*>(node);
-        stopListening(frameOwner->contentDocument());
         if (m_domListener)
             m_domListener->didRemoveDocument(frameOwner->contentDocument());
     }
@@ -360,11 +305,10 @@ void InspectorDOMAgent::unbind(Node* node, NodeToIdMap* nodesMap)
 
 bool InspectorDOMAgent::pushDocumentToFrontend()
 {
-    Document* document = mainFrameDocument();
-    if (!document)
+    if (!m_document)
         return false;
-    if (!m_documentNodeToIdMap.contains(document))
-        m_frontend->setDocument(buildObjectForNode(document, 2, &m_documentNodeToIdMap));
+    if (!m_documentNodeToIdMap.contains(m_document))
+        m_frontend->setDocument(buildObjectForNode(m_document.get(), 2, &m_documentNodeToIdMap));
     return true;
 }
 
@@ -537,7 +481,7 @@ void InspectorDOMAgent::getOuterHTML(long nodeId, WTF::String* outerHTML)
     if (!node || !node->isHTMLElement())
         return;
 
-    *outerHTML = static_cast<HTMLElement*>(node)->outerHTML();
+    *outerHTML = toHTMLElement(node)->outerHTML();
 }
 
 void InspectorDOMAgent::setOuterHTML(long nodeId, const String& outerHTML, long* newId)
@@ -552,16 +496,16 @@ void InspectorDOMAgent::setOuterHTML(long nodeId, const String& outerHTML, long*
     Node* previousSibling = node->previousSibling();
     ContainerNode* parentNode = node->parentNode();
 
-    HTMLElement* htmlElement = static_cast<HTMLElement*>(node);
+    HTMLElement* htmlElement = toHTMLElement(node);
     ExceptionCode ec = 0;
     htmlElement->setOuterHTML(outerHTML, ec);
     if (ec)
         return;
 
     if (requiresTotalUpdate) {
-        Document* document = mainFrameDocument();
+        RefPtr<Document> document = m_document;
         reset();
-        setDocument(document);
+        setDocument(document.get());
         *newId = 0;
         return;
     }
@@ -693,10 +637,9 @@ void InspectorDOMAgent::performSearch(const String& whitespaceTrimmedQuery, bool
     searchCanceled();
 
     // Find all frames, iframes and object elements to search their documents.
-    for (Frame* frame = mainFrameDocument()->frame(); frame; frame = frame->tree()->traverseNext()) {
-        Document* document = frame->document();
-        if (!document)
-            continue;
+    Vector<Document*> docs = documents();
+    for (Vector<Document*>::iterator it = docs.begin(); it != docs.end(); ++it) {
+        Document* document = *it;
 
         if (!tagNameQuery.isEmpty() && startTagFound && endTagFound) {
             m_pendingMatchJobs.append(new MatchExactTagNamesJob(document, tagNameQuery));
@@ -891,9 +834,6 @@ PassRefPtr<InspectorArray> InspectorDOMAgent::buildArrayForContainerChildren(Nod
         depth--;
     }
 
-    if (container->isFrameOwnerElement())
-        startListeningFrameDocument(container);
-
     while (child) {
         children->pushObject(buildObjectForNode(child, depth, nodesMap));
         child = innerNextSibling(child);
@@ -974,19 +914,37 @@ bool InspectorDOMAgent::isWhitespace(Node* node)
     return node && node->nodeType() == Node::TEXT_NODE && node->nodeValue().stripWhiteSpace().length() == 0;
 }
 
-Document* InspectorDOMAgent::mainFrameDocument() const
+void InspectorDOMAgent::mainFrameDOMContentLoaded()
 {
-    ListHashSet<RefPtr<Document> >::const_iterator it = m_documents.begin();
-    if (it != m_documents.end())
-        return it->get();
-    return 0;
+    // Re-push document once it is loaded.
+    discardBindings();
+    pushDocumentToFrontend();
 }
 
-bool InspectorDOMAgent::operator==(const EventListener& listener)
+void InspectorDOMAgent::loadEventFired(Document* document)
 {
-    if (const InspectorDOMAgent* inspectorDOMAgentListener = InspectorDOMAgent::cast(&listener))
-        return mainFrameDocument() == inspectorDOMAgentListener->mainFrameDocument();
-    return false;
+    Element* frameOwner = document->ownerElement();
+    if (!frameOwner)
+        return;
+
+    long frameOwnerId = m_documentNodeToIdMap.get(frameOwner);
+    if (!frameOwnerId)
+        return;
+
+    if (!m_childrenRequested.contains(frameOwnerId)) {
+        // No children are mapped yet -> only notify on changes of hasChildren.
+        m_frontend->childNodeCountUpdated(frameOwnerId, innerChildNodeCount(frameOwner));
+    } else {
+        // Re-add frame owner element together with its new children.
+        long parentId = m_documentNodeToIdMap.get(innerParentNode(frameOwner));
+        m_frontend->childNodeRemoved(parentId, frameOwnerId);
+        RefPtr<InspectorObject> value = buildObjectForNode(frameOwner, 0, &m_documentNodeToIdMap);
+        Node* previousSibling = innerPreviousSibling(frameOwner);
+        long prevId = previousSibling ? m_documentNodeToIdMap.get(previousSibling) : 0;
+        m_frontend->childNodeInserted(parentId, prevId, value.release());
+        // Invalidate children requested flag for the element.
+        m_childrenRequested.remove(m_childrenRequested.find(frameOwnerId));
+    }
 }
 
 void InspectorDOMAgent::didInsertDOMNode(Node* node)
@@ -1062,10 +1020,10 @@ void InspectorDOMAgent::characterDataModified(CharacterData* characterData)
 Node* InspectorDOMAgent::nodeForPath(const String& path)
 {
     // The path is of form "1,HTML,2,BODY,1,DIV"
-    Node* node = mainFrameDocument();
-    if (!node)
+    if (!m_document)
         return 0;
 
+    Node* node = m_document.get();
     Vector<String> pathTokens;
     path.split(",", false, pathTokens);
     if (!pathTokens.size())
@@ -1153,7 +1111,7 @@ InjectedScript InspectorDOMAgent::injectedScriptForNodeId(long nodeId)
                 frame = document->frame();
         }
     } else
-        frame = mainFrameDocument()->frame();
+        frame = m_document->frame();
 
     if (frame)
         return m_injectedScriptHost->injectedScriptFor(mainWorldScriptState(frame));
diff --git a/Source/WebCore/inspector/InspectorDOMAgent.h b/Source/WebCore/inspector/InspectorDOMAgent.h
index e4edf5d..4e603da 100644
--- a/Source/WebCore/inspector/InspectorDOMAgent.h
+++ b/Source/WebCore/inspector/InspectorDOMAgent.h
@@ -30,29 +30,22 @@
 #ifndef InspectorDOMAgent_h
 #define InspectorDOMAgent_h
 
-#include "EventListener.h"
-#include "EventTarget.h"
 #include "InjectedScript.h"
 #include "InjectedScriptHost.h"
 #include "InspectorValues.h"
-#include "NodeList.h"
 #include "Timer.h"
 
 #include <wtf/Deque.h>
 #include <wtf/ListHashSet.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
-#include <wtf/PassRefPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
 #include <wtf/text/AtomicString.h>
 
 namespace WebCore {
 class ContainerNode;
-class CSSRule;
-class CSSRuleList;
-class CSSStyleDeclaration;
-class CSSStyleRule;
-class CSSStyleSheet;
 class CharacterData;
 class Document;
 class Element;
@@ -79,7 +72,7 @@ struct EventListenerInfo {
     const EventListenerVector eventListenerVector;
 };
 
-class InspectorDOMAgent : public EventListener {
+class InspectorDOMAgent {
 public:
     struct DOMListener {
         virtual ~DOMListener()
@@ -90,25 +83,17 @@ public:
         virtual void didModifyDOMAttr(Element*) = 0;
     };
 
-    static PassRefPtr<InspectorDOMAgent> create(InjectedScriptHost* injectedScriptHost, InspectorFrontend* frontend)
+    static PassOwnPtr<InspectorDOMAgent> create(InjectedScriptHost* injectedScriptHost, InspectorFrontend* frontend)
     {
-        return adoptRef(new InspectorDOMAgent(injectedScriptHost, frontend));
-    }
-
-    static const InspectorDOMAgent* cast(const EventListener* listener)
-    {
-        return listener->type() == InspectorDOMAgentType
-            ? static_cast<const InspectorDOMAgent*>(listener)
-            : 0;
+        return adoptPtr(new InspectorDOMAgent(injectedScriptHost, frontend));
     }
 
     InspectorDOMAgent(InjectedScriptHost*, InspectorFrontend*);
     ~InspectorDOMAgent();
 
+    Vector<Document*> documents();
     void reset();
 
-    virtual bool operator==(const EventListener& other);
-
     // Methods called from the frontend for DOM nodes inspection.
     void getChildNodes(long nodeId);
     void setAttribute(long elementId, const String& name, const String& value, bool* success);
@@ -131,6 +116,9 @@ public:
     void setDocument(Document*);
     void releaseDanglingNodes();
 
+    void mainFrameDOMContentLoaded();
+    void loadEventFired(Document*);
+
     void didInsertDOMNode(Node*);
     void didRemoveDOMNode(Node*);
     void didModifyDOMAttr(Element*);
@@ -142,7 +130,6 @@ public:
     void pushNodeByPathToFrontend(const String& path, long* nodeId);
     long inspectedNode(unsigned long num);
     void copyNode(long nodeId);
-    const ListHashSet<RefPtr<Document> >& documents() { return m_documents; }
     void setDOMListener(DOMListener*);
 
     String documentURLString(Document*) const;
@@ -157,12 +144,6 @@ public:
     static bool isWhitespace(Node*);
 
 private:
-    void startListeningFrameDocument(Node* frameOwnerNode);
-    void startListening(Document*);
-    void stopListening(Document*);
-
-    virtual void handleEvent(ScriptExecutionContext*, Event*);
-
     // Node-related methods.
     typedef HashMap<RefPtr<Node>, long> NodeToIdMap;
     long bind(Node*, NodeToIdMap*);
@@ -179,8 +160,6 @@ private:
     PassRefPtr<InspectorArray> buildArrayForContainerChildren(Node* container, int depth, NodeToIdMap* nodesMap);
     PassRefPtr<InspectorObject> buildObjectForEventListener(const RegisteredEventListener&, const AtomicString& eventType, Node*);
 
-    Document* mainFrameDocument() const;
-
     void onMatchJobsTimer(Timer<InspectorDOMAgent>*);
     void reportNodesAsSearchResults(ListHashSet<Node*>& resultCollector);
 
@@ -201,7 +180,7 @@ private:
     HashMap<long, NodeToIdMap*> m_idToNodesMap;
     HashSet<long> m_childrenRequested;
     long m_lastNodeId;
-    ListHashSet<RefPtr<Document> > m_documents;
+    RefPtr<Document> m_document;
     Deque<MatchJob*> m_pendingMatchJobs;
     Timer<InspectorDOMAgent> m_matchJobsTimer;
     HashSet<RefPtr<Node> > m_searchResults;
diff --git a/Source/WebCore/inspector/InspectorDOMStorageAgent.cpp b/Source/WebCore/inspector/InspectorDOMStorageAgent.cpp
index 2241a16..0919b64 100644
--- a/Source/WebCore/inspector/InspectorDOMStorageAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDOMStorageAgent.cpp
@@ -48,6 +48,9 @@ namespace WebCore {
 
 InspectorDOMStorageAgent::~InspectorDOMStorageAgent()
 {
+    DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources->end();
+    for (DOMStorageResourcesMap::iterator it = m_domStorageResources->begin(); it != domStorageEnd; ++it)
+        it->second->unbind();
 }
 
 void InspectorDOMStorageAgent::getDOMStorageEntries(long storageId, RefPtr<InspectorArray>* entries)
diff --git a/Source/WebCore/inspector/InspectorDOMStorageAgent.h b/Source/WebCore/inspector/InspectorDOMStorageAgent.h
index f1d4d5c..987c530 100644
--- a/Source/WebCore/inspector/InspectorDOMStorageAgent.h
+++ b/Source/WebCore/inspector/InspectorDOMStorageAgent.h
@@ -30,8 +30,8 @@
 #define InspectorDOMStorageAgent_h
 
 #include "PlatformString.h"
-#include "wtf/HashMap.h"
-#include "wtf/PassRefPtr.h"
+#include <wtf/HashMap.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -40,13 +40,13 @@ class InspectorDOMStorageResource;
 class InspectorFrontend;
 class Storage;
 
-class InspectorDOMStorageAgent : public RefCounted<InspectorDOMStorageAgent> {
+class InspectorDOMStorageAgent {
 public:
     typedef HashMap<int, RefPtr<InspectorDOMStorageResource> > DOMStorageResourcesMap;
 
-    static PassRefPtr<InspectorDOMStorageAgent> create(DOMStorageResourcesMap* domStorageResources, InspectorFrontend* frontend)
+    static PassOwnPtr<InspectorDOMStorageAgent> create(DOMStorageResourcesMap* domStorageResources, InspectorFrontend* frontend)
     {
-        return adoptRef(new InspectorDOMStorageAgent(domStorageResources, frontend));
+        return adoptPtr(new InspectorDOMStorageAgent(domStorageResources, frontend));
     }
 
     virtual ~InspectorDOMStorageAgent();
@@ -59,8 +59,6 @@ public:
     // Called from the injected script.
     void selectDOMStorage(Storage* storage);
 
-    InspectorFrontend* frontend() { return m_frontend; }
-
 private:
     InspectorDOMStorageAgent(DOMStorageResourcesMap*, InspectorFrontend*);
 
diff --git a/Source/WebCore/inspector/InspectorDOMStorageResource.h b/Source/WebCore/inspector/InspectorDOMStorageResource.h
index ee09974..f0975ba 100644
--- a/Source/WebCore/inspector/InspectorDOMStorageResource.h
+++ b/Source/WebCore/inspector/InspectorDOMStorageResource.h
@@ -51,6 +51,7 @@ namespace WebCore {
         {
             return adoptRef(new InspectorDOMStorageResource(domStorage, isLocalStorage, frame));
         }
+
         static const InspectorDOMStorageResource* cast(const EventListener* listener)
         {
             return listener->type() == InspectorDOMStorageResourceType ? static_cast<const InspectorDOMStorageResource*>(listener) : 0;
diff --git a/Source/WebCore/inspector/InspectorDatabaseAgent.cpp b/Source/WebCore/inspector/InspectorDatabaseAgent.cpp
index 36bcab8..221bdf2 100644
--- a/Source/WebCore/inspector/InspectorDatabaseAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDatabaseAgent.cpp
@@ -34,7 +34,7 @@
 
 #include "Database.h"
 #include "ExceptionCode.h"
-#include "InspectorController.h"
+#include "InspectorAgent.h"
 #include "InspectorDatabaseResource.h"
 #include "InspectorFrontend.h"
 #include "InspectorValues.h"
@@ -52,32 +52,48 @@
 
 namespace WebCore {
 
+class InspectorDatabaseAgent::FrontendProvider : public RefCounted<InspectorDatabaseAgent::FrontendProvider> {
+public:
+    static PassRefPtr<FrontendProvider> create(InspectorFrontend* inspectorFrontend)
+    {
+        return adoptRef(new FrontendProvider(inspectorFrontend));
+    }
+
+    virtual ~FrontendProvider() { }
+
+    InspectorFrontend* frontend() { return m_inspectorFrontend; }
+    void clearFrontend() { m_inspectorFrontend = 0; }
+private:
+    FrontendProvider(InspectorFrontend* inspectorFrontend) : m_inspectorFrontend(inspectorFrontend) { }
+    InspectorFrontend* m_inspectorFrontend;
+};
+
 namespace {
 
 long lastTransactionId = 0;
 
-void reportTransactionFailed(InspectorDatabaseAgent* agent, long transactionId, SQLError* error)
+void reportTransactionFailed(InspectorFrontend* frontend, long transactionId, SQLError* error)
 {
-    if (!agent->frontend())
+    if (!frontend)
         return;
     RefPtr<InspectorObject> errorObject = InspectorObject::create();
     errorObject->setString("message", error->message());
     errorObject->setNumber("code", error->code());
-    agent->frontend()->sqlTransactionFailed(transactionId, errorObject);
+    frontend->sqlTransactionFailed(transactionId, errorObject);
 }
 
 class StatementCallback : public SQLStatementCallback {
 public:
-    static PassRefPtr<StatementCallback> create(long transactionId, PassRefPtr<InspectorDatabaseAgent> agent)
+    static PassRefPtr<StatementCallback> create(long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
     {
-        return adoptRef(new StatementCallback(transactionId, agent));
+        return adoptRef(new StatementCallback(transactionId, frontendProvider));
     }
 
     virtual ~StatementCallback() { }
 
     virtual bool handleEvent(SQLTransaction*, SQLResultSet* resultSet)
     {
-        if (!m_agent->frontend())
+        if (!m_frontendProvider->frontend())
             return true;
 
         SQLResultSetRowList* rowList = resultSet->rows();
@@ -97,92 +113,92 @@ public:
                 case SQLValue::NullValue: values->pushValue(InspectorValue::null()); break;
             }
         }
-        m_agent->frontend()->sqlTransactionSucceeded(m_transactionId, columnNames, values);
+        m_frontendProvider->frontend()->sqlTransactionSucceeded(m_transactionId, columnNames, values);
         return true;
     }
 
 private:
-    StatementCallback(long transactionId, PassRefPtr<InspectorDatabaseAgent> agent)
+    StatementCallback(long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
         : m_transactionId(transactionId)
-        , m_agent(agent) { }
+        , m_frontendProvider(frontendProvider) { }
     long m_transactionId;
-    RefPtr<InspectorDatabaseAgent> m_agent;
+    RefPtr<InspectorDatabaseAgent::FrontendProvider> m_frontendProvider;
 };
 
 class StatementErrorCallback : public SQLStatementErrorCallback {
 public:
-    static PassRefPtr<StatementErrorCallback> create(long transactionId, PassRefPtr<InspectorDatabaseAgent> agent)
+    static PassRefPtr<StatementErrorCallback> create(long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
     {
-        return adoptRef(new StatementErrorCallback(transactionId, agent));
+        return adoptRef(new StatementErrorCallback(transactionId, frontendProvider));
     }
 
     virtual ~StatementErrorCallback() { }
 
     virtual bool handleEvent(SQLTransaction*, SQLError* error)
     {
-        reportTransactionFailed(m_agent.get(), m_transactionId, error);
+        reportTransactionFailed(m_frontendProvider->frontend(), m_transactionId, error);
         return true;  
     }
 
 private:
-    StatementErrorCallback(long transactionId, RefPtr<InspectorDatabaseAgent> agent)
+    StatementErrorCallback(long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
         : m_transactionId(transactionId)
-        , m_agent(agent) { }
+        , m_frontendProvider(frontendProvider) { }
     long m_transactionId;
-    RefPtr<InspectorDatabaseAgent> m_agent;
+    RefPtr<InspectorDatabaseAgent::FrontendProvider> m_frontendProvider;
 };
 
 class TransactionCallback : public SQLTransactionCallback {
 public:
-    static PassRefPtr<TransactionCallback> create(const String& sqlStatement, long transactionId, PassRefPtr<InspectorDatabaseAgent> agent)
+    static PassRefPtr<TransactionCallback> create(const String& sqlStatement, long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
     {
-        return adoptRef(new TransactionCallback(sqlStatement, transactionId, agent));
+        return adoptRef(new TransactionCallback(sqlStatement, transactionId, frontendProvider));
     }
 
     virtual ~TransactionCallback() { }
 
     virtual bool handleEvent(SQLTransaction* transaction)
     {
-        if (!m_agent->frontend())
+        if (!m_frontendProvider->frontend())
             return true;
 
         Vector<SQLValue> sqlValues;
-        RefPtr<SQLStatementCallback> callback(StatementCallback::create(m_transactionId, m_agent));
-        RefPtr<SQLStatementErrorCallback> errorCallback(StatementErrorCallback::create(m_transactionId, m_agent));
+        RefPtr<SQLStatementCallback> callback(StatementCallback::create(m_transactionId, m_frontendProvider));
+        RefPtr<SQLStatementErrorCallback> errorCallback(StatementErrorCallback::create(m_transactionId, m_frontendProvider));
         ExceptionCode ec = 0;
         transaction->executeSQL(m_sqlStatement, sqlValues, callback.release(), errorCallback.release(), ec);
         return true;
     }
 private:
-    TransactionCallback(const String& sqlStatement, long transactionId, PassRefPtr<InspectorDatabaseAgent> agent)
+    TransactionCallback(const String& sqlStatement, long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
         : m_sqlStatement(sqlStatement)
         , m_transactionId(transactionId)
-        , m_agent(agent) { }
+        , m_frontendProvider(frontendProvider) { }
     String m_sqlStatement;
     long m_transactionId;
-    RefPtr<InspectorDatabaseAgent> m_agent;
+    RefPtr<InspectorDatabaseAgent::FrontendProvider> m_frontendProvider;
 };
 
 class TransactionErrorCallback : public SQLTransactionErrorCallback {
 public:
-    static PassRefPtr<TransactionErrorCallback> create(long transactionId, PassRefPtr<InspectorDatabaseAgent> agent)
+    static PassRefPtr<TransactionErrorCallback> create(long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
     {
-        return adoptRef(new TransactionErrorCallback(transactionId, agent));
+        return adoptRef(new TransactionErrorCallback(transactionId, frontendProvider));
     }
 
     virtual ~TransactionErrorCallback() { }
 
     virtual bool handleEvent(SQLError* error)
     {
-        reportTransactionFailed(m_agent.get(), m_transactionId, error);
+        reportTransactionFailed(m_frontendProvider->frontend(), m_transactionId, error);
         return true;
     }
 private:
-    TransactionErrorCallback(long transactionId, PassRefPtr<InspectorDatabaseAgent> agent)
+    TransactionErrorCallback(long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
         : m_transactionId(transactionId)
-        , m_agent(agent) { }
+        , m_frontendProvider(frontendProvider) { }
     long m_transactionId;
-    RefPtr<InspectorDatabaseAgent> m_agent;
+    RefPtr<InspectorDatabaseAgent::FrontendProvider> m_frontendProvider;
 };
 
 class TransactionSuccessCallback : public VoidCallback {
@@ -204,6 +220,7 @@ private:
 
 InspectorDatabaseAgent::~InspectorDatabaseAgent()
 {
+    m_frontendProvider->clearFrontend();
 }
 
 void InspectorDatabaseAgent::getDatabaseTableNames(long databaseId, RefPtr<InspectorArray>* names)
@@ -226,8 +243,8 @@ void InspectorDatabaseAgent::executeSQL(long databaseId, const String& query, bo
     }
 
     *transactionId = ++lastTransactionId;
-    RefPtr<SQLTransactionCallback> callback(TransactionCallback::create(query, *transactionId, this));
-    RefPtr<SQLTransactionErrorCallback> errorCallback(TransactionErrorCallback::create(*transactionId, this));
+    RefPtr<SQLTransactionCallback> callback(TransactionCallback::create(query, *transactionId, m_frontendProvider));
+    RefPtr<SQLTransactionErrorCallback> errorCallback(TransactionErrorCallback::create(*transactionId, m_frontendProvider));
     RefPtr<VoidCallback> successCallback(TransactionSuccessCallback::create());
     database->transaction(callback.release(), errorCallback.release(), successCallback.release());
     *success = true;
@@ -243,25 +260,20 @@ Database* InspectorDatabaseAgent::databaseForId(long databaseId)
 
 void InspectorDatabaseAgent::selectDatabase(Database* database)
 {
-    if (!m_frontend)
+    if (!m_frontendProvider->frontend())
         return;
 
     for (DatabaseResourcesMap::iterator it = m_databaseResources->begin(); it != m_databaseResources->end(); ++it) {
         if (it->second->database() == database) {
-            m_frontend->selectDatabase(it->first);
+            m_frontendProvider->frontend()->selectDatabase(it->first);
             break;
         }
     }
 }
 
-void InspectorDatabaseAgent::clearFrontend()
-{
-    m_frontend = 0;
-}
-
 InspectorDatabaseAgent::InspectorDatabaseAgent(DatabaseResourcesMap* databaseResources, InspectorFrontend* frontend)
     : m_databaseResources(databaseResources)
-    , m_frontend(frontend)
+    , m_frontendProvider(FrontendProvider::create(frontend))
 {
 }
 
diff --git a/Source/WebCore/inspector/InspectorDatabaseAgent.h b/Source/WebCore/inspector/InspectorDatabaseAgent.h
index a9e9a5d..4ad3e62 100644
--- a/Source/WebCore/inspector/InspectorDatabaseAgent.h
+++ b/Source/WebCore/inspector/InspectorDatabaseAgent.h
@@ -30,8 +30,8 @@
 #define InspectorDatabaseAgent_h
 
 #include "PlatformString.h"
-#include "wtf/HashMap.h"
-#include "wtf/PassRefPtr.h"
+#include <wtf/HashMap.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -40,13 +40,15 @@ class InspectorArray;
 class InspectorDatabaseResource;
 class InspectorFrontend;
 
-class InspectorDatabaseAgent : public RefCounted<InspectorDatabaseAgent> {
+class InspectorDatabaseAgent {
 public:
+    class FrontendProvider;
+
     typedef HashMap<int, RefPtr<InspectorDatabaseResource> > DatabaseResourcesMap;
 
-    static PassRefPtr<InspectorDatabaseAgent> create(DatabaseResourcesMap* databaseResources, InspectorFrontend* frontend)
+    static PassOwnPtr<InspectorDatabaseAgent> create(DatabaseResourcesMap* databaseResources, InspectorFrontend* frontend)
     {
-        return adoptRef(new InspectorDatabaseAgent(databaseResources, frontend));
+        return adoptPtr(new InspectorDatabaseAgent(databaseResources, frontend));
     }
 
     virtual ~InspectorDatabaseAgent();
@@ -59,14 +61,11 @@ public:
     Database* databaseForId(long databaseId);
     void selectDatabase(Database* database);
 
-    InspectorFrontend* frontend() { return m_frontend; }
-    void clearFrontend();
-
 private:
     InspectorDatabaseAgent(DatabaseResourcesMap*, InspectorFrontend*);
 
     DatabaseResourcesMap* m_databaseResources;
-    InspectorFrontend* m_frontend;
+    RefPtr<FrontendProvider> m_frontendProvider;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorDatabaseInstrumentation.h b/Source/WebCore/inspector/InspectorDatabaseInstrumentation.h
new file mode 100644
index 0000000..0ad1460
--- /dev/null
+++ b/Source/WebCore/inspector/InspectorDatabaseInstrumentation.h
@@ -0,0 +1,52 @@
+/*
+* Copyright (C) 2011 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef InspectorDatabaseInstrumentation_h
+#define InspectorDatabaseInstrumentation_h
+
+#include "Database.h"
+#include "InspectorInstrumentation.h"
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+#if ENABLE(DATABASE)
+inline void InspectorInstrumentation::didOpenDatabase(ScriptExecutionContext* context, PassRefPtr<Database> database, const String& domain, const String& name, const String& version)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorAgent* inspectorAgent = inspectorAgentForContext(context))
+        didOpenDatabaseImpl(inspectorAgent, database, domain, name, version);
+#endif
+}
+#endif
+
+} // namespace WebCore
+
+#endif // !defined(InspectorDatabaseInstrumentation_h)
diff --git a/Source/WebCore/inspector/InspectorDatabaseResource.cpp b/Source/WebCore/inspector/InspectorDatabaseResource.cpp
index ba67818..e2d2f81 100644
--- a/Source/WebCore/inspector/InspectorDatabaseResource.cpp
+++ b/Source/WebCore/inspector/InspectorDatabaseResource.cpp
@@ -51,28 +51,17 @@ InspectorDatabaseResource::InspectorDatabaseResource(PassRefPtr<Database> databa
     , m_domain(domain)
     , m_name(name)
     , m_version(version)
-    , m_scriptObjectCreated(false)
 {
 }
 
 void InspectorDatabaseResource::bind(InspectorFrontend* frontend)
 {
-    if (m_scriptObjectCreated)
-        return;
-
     RefPtr<InspectorObject> jsonObject = InspectorObject::create();
     jsonObject->setNumber("id", m_id);
     jsonObject->setString("domain", m_domain);
     jsonObject->setString("name", m_name);
     jsonObject->setString("version", m_version);
-
     frontend->addDatabase(jsonObject);
-    m_scriptObjectCreated = true;
-}
-
-void InspectorDatabaseResource::unbind()
-{
-    m_scriptObjectCreated = false;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorDatabaseResource.h b/Source/WebCore/inspector/InspectorDatabaseResource.h
index 203995b..24d4f1c 100644
--- a/Source/WebCore/inspector/InspectorDatabaseResource.h
+++ b/Source/WebCore/inspector/InspectorDatabaseResource.h
@@ -46,7 +46,6 @@ public:
     static PassRefPtr<InspectorDatabaseResource> create(PassRefPtr<Database> database, const String& domain, const String& name, const String& version);
 
     void bind(InspectorFrontend* frontend);
-    void unbind();
     Database* database() { return m_database.get(); }
     long id() const { return m_id; }
 private:
@@ -57,7 +56,6 @@ private:
     String m_domain;
     String m_name;
     String m_version;
-    bool m_scriptObjectCreated;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorDebuggerAgent.cpp b/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
index acfbb6e..e8b4ad5 100644
--- a/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
@@ -34,41 +34,44 @@
 #include "InjectedScript.h"
 #include "InjectedScriptHost.h"
 #include "InspectorFrontend.h"
+#include "InspectorState.h"
 #include "InspectorValues.h"
 #include "PlatformString.h"
 #include "ScriptDebugServer.h"
+#include <wtf/text/StringConcatenate.h>
 
 namespace WebCore {
 
-PassOwnPtr<InspectorDebuggerAgent> InspectorDebuggerAgent::create(InspectorController* inspectorController, InspectorFrontend* frontend)
+namespace DebuggerAgentState {
+static const char javaScriptBreakpoints[] = "javaScriptBreakopints";
+};
+
+PassOwnPtr<InspectorDebuggerAgent> InspectorDebuggerAgent::create(InspectorAgent* inspectorAgent, InspectorFrontend* frontend, bool eraseStickyBreakpoints)
 {
-    OwnPtr<InspectorDebuggerAgent> agent = adoptPtr(new InspectorDebuggerAgent(inspectorController, frontend));
+    OwnPtr<InspectorDebuggerAgent> agent = adoptPtr(new InspectorDebuggerAgent(inspectorAgent, frontend, eraseStickyBreakpoints));
     ScriptDebugServer::shared().clearBreakpoints();
     // FIXME(WK44513): breakpoints activated flag should be synchronized between all front-ends
     ScriptDebugServer::shared().setBreakpointsActivated(true);
-    ScriptDebugServer::shared().addListener(agent.get(), inspectorController->inspectedPage());
+    ScriptDebugServer::shared().addListener(agent.get(), inspectorAgent->inspectedPage());
     return agent.release();
 }
 
-InspectorDebuggerAgent::InspectorDebuggerAgent(InspectorController* inspectorController, InspectorFrontend* frontend)
-    : m_inspectorController(inspectorController)
+InspectorDebuggerAgent::InspectorDebuggerAgent(InspectorAgent* inspectorAgent, InspectorFrontend* frontend, bool eraseStickyBreakpoints)
+    : m_inspectorAgent(inspectorAgent)
     , m_frontend(frontend)
     , m_pausedScriptState(0)
     , m_javaScriptPauseScheduled(false)
 {
+    if (eraseStickyBreakpoints)
+        inspectorAgent->state()->setObject(DebuggerAgentState::javaScriptBreakpoints, InspectorObject::create());
 }
 
 InspectorDebuggerAgent::~InspectorDebuggerAgent()
 {
-    ScriptDebugServer::shared().removeListener(this, m_inspectorController->inspectedPage());
+    ScriptDebugServer::shared().removeListener(this, m_inspectorAgent->inspectedPage());
     m_pausedScriptState = 0;
 }
 
-bool InspectorDebuggerAgent::isDebuggerAlwaysEnabled()
-{
-    return ScriptDebugServer::shared().isDebuggerAlwaysEnabled();
-}
-
 void InspectorDebuggerAgent::activateBreakpoints()
 {
     ScriptDebugServer::shared().activateBreakpoints();
@@ -79,37 +82,107 @@ void InspectorDebuggerAgent::deactivateBreakpoints()
     ScriptDebugServer::shared().deactivateBreakpoints();
 }
 
-void InspectorDebuggerAgent::setStickyBreakpoint(const String& url, unsigned lineNumber, const String& condition, bool enabled)
+void InspectorDebuggerAgent::inspectedURLChanged(const String&)
 {
-    HashMap<String, ScriptBreakpoints>::iterator it = m_stickyBreakpoints.find(url);
-    if (it == m_stickyBreakpoints.end())
-        it = m_stickyBreakpoints.set(url, ScriptBreakpoints()).first;
-    it->second.set(lineNumber, Breakpoint(condition, enabled));
+    m_scripts.clear();
+    m_breakpointIdToDebugServerBreakpointIds.clear();
+}
 
-    URLToSourceIDsMap::iterator urlToSourceIDsIterator = m_urlToSourceIDs.find(url);
-    if (urlToSourceIDsIterator == m_urlToSourceIDs.end())
+void InspectorDebuggerAgent::setJavaScriptBreakpoint(const String& url, int lineNumber, int columnNumber, const String& condition, bool enabled, String* outBreakpointId, RefPtr<InspectorArray>* locations)
+{
+    String breakpointId = makeString(url, ":", String::number(lineNumber), ":", String::number(columnNumber));
+    RefPtr<InspectorObject> breakpointsCookie = m_inspectorAgent->state()->getObject(DebuggerAgentState::javaScriptBreakpoints);
+    if (breakpointsCookie->find(breakpointId) != breakpointsCookie->end())
         return;
-    const Vector<String>& sourceIDs = urlToSourceIDsIterator->second;
-    for (size_t i = 0; i < sourceIDs.size(); ++i)
-        restoreBreakpoint(sourceIDs[i], lineNumber, condition, enabled);
+    RefPtr<InspectorObject> breakpointObject = InspectorObject::create();
+    breakpointObject->setString("url", url);
+    breakpointObject->setNumber("lineNumber", lineNumber);
+    breakpointObject->setNumber("columnNumber", columnNumber);
+    breakpointObject->setString("condition", condition);
+    breakpointObject->setBoolean("enabled", enabled);
+    breakpointsCookie->setObject(breakpointId, breakpointObject);
+    m_inspectorAgent->state()->setObject(DebuggerAgentState::javaScriptBreakpoints, breakpointsCookie);
+
+    ScriptBreakpoint breakpoint(lineNumber, columnNumber, condition, enabled);
+    for (ScriptsMap::iterator it = m_scripts.begin(); it != m_scripts.end(); ++it) {
+        if (it->second.url != url)
+            continue;
+        int actualLineNumber = 0, actualColumnNumber = 0;
+        if (!resolveBreakpoint(breakpointId, it->first, breakpoint, &actualLineNumber, &actualColumnNumber))
+            continue;
+        RefPtr<InspectorObject> location = InspectorObject::create();
+        location->setString("sourceID", it->first);
+        location->setNumber("lineNumber", actualLineNumber);
+        location->setNumber("columnNumber", actualColumnNumber);
+        locations->get()->pushObject(location);
+    }
+    *outBreakpointId = breakpointId;
 }
 
-void InspectorDebuggerAgent::setBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition, bool enabled, String* breakpointId, unsigned int* actualLineNumber)
+void InspectorDebuggerAgent::setJavaScriptBreakpointBySourceId(const String& sourceId, int lineNumber, int columnNumber, const String& condition, bool enabled, String* outBreakpointId, int* actualLineNumber, int* actualColumnNumber)
 {
-    *breakpointId = ScriptDebugServer::shared().setBreakpoint(sourceID, lineNumber, condition, enabled, actualLineNumber);
+    String breakpointId = makeString(sourceId, ":", String::number(lineNumber), ":", String::number(columnNumber));
+    if (m_breakpointIdToDebugServerBreakpointIds.find(breakpointId) != m_breakpointIdToDebugServerBreakpointIds.end())
+        return;
+    ScriptBreakpoint breakpoint(lineNumber, columnNumber, condition, enabled);
+    if (!resolveBreakpoint(breakpointId, sourceId, breakpoint, actualLineNumber, actualColumnNumber))
+        return;
+    *outBreakpointId = breakpointId;
 }
 
-void InspectorDebuggerAgent::removeBreakpoint(const String& breakpointId)
+void InspectorDebuggerAgent::removeJavaScriptBreakpoint(const String& breakpointId)
 {
-    ScriptDebugServer::shared().removeBreakpoint(breakpointId);
+    RefPtr<InspectorObject> breakpointsCookie = m_inspectorAgent->state()->getObject(DebuggerAgentState::javaScriptBreakpoints);
+    breakpointsCookie->remove(breakpointId);
+    m_inspectorAgent->state()->setObject(DebuggerAgentState::javaScriptBreakpoints, breakpointsCookie);
+
+    BreakpointIdToDebugServerBreakpointIdsMap::iterator debugServerBreakpointIdsIterator = m_breakpointIdToDebugServerBreakpointIds.find(breakpointId);
+    if (debugServerBreakpointIdsIterator == m_breakpointIdToDebugServerBreakpointIds.end())
+        return;
+    for (size_t i = 0; i < debugServerBreakpointIdsIterator->second.size(); ++i)
+        ScriptDebugServer::shared().removeBreakpoint(debugServerBreakpointIdsIterator->second[i]);
+    m_breakpointIdToDebugServerBreakpointIds.remove(debugServerBreakpointIdsIterator);
 }
 
-void InspectorDebuggerAgent::restoreBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition, bool enabled)
+void InspectorDebuggerAgent::continueToLocation(const String& sourceId, int lineNumber, int columnNumber)
 {
-    unsigned actualLineNumber = 0;
-    String breakpointId = ScriptDebugServer::shared().setBreakpoint(sourceID, lineNumber, condition, enabled, &actualLineNumber);
-    if (!breakpointId.isEmpty())
-        m_frontend->breakpointResolved(breakpointId, sourceID, actualLineNumber, condition, enabled, lineNumber);
+    if (!m_continueToLocationBreakpointId.isEmpty()) {
+        ScriptDebugServer::shared().removeBreakpoint(m_continueToLocationBreakpointId);
+        m_continueToLocationBreakpointId = "";
+    }
+    ScriptBreakpoint breakpoint(lineNumber, columnNumber, "", true);
+    m_continueToLocationBreakpointId = ScriptDebugServer::shared().setBreakpoint(sourceId, breakpoint, &lineNumber, &columnNumber);
+    resume();
+}
+
+bool InspectorDebuggerAgent::resolveBreakpoint(const String& breakpointId, const String& sourceId, const ScriptBreakpoint& breakpoint, int* actualLineNumber, int* actualColumnNumber)
+{
+    ScriptsMap::iterator scriptIterator = m_scripts.find(sourceId);
+    if (scriptIterator == m_scripts.end())
+        return false;
+    Script& script = scriptIterator->second;
+    if (breakpoint.lineNumber < script.lineOffset)
+        return false;
+    if (!script.linesCount) {
+        script.linesCount = 1;
+        for (size_t i = 0; i < script.data.length(); ++i) {
+            if (script.data[i] == '\n')
+                script.linesCount += 1;
+        }
+    }
+    if (breakpoint.lineNumber >= script.lineOffset + script.linesCount)
+        return false;
+
+    String debugServerBreakpointId = ScriptDebugServer::shared().setBreakpoint(sourceId, breakpoint, actualLineNumber, actualColumnNumber);
+    if (debugServerBreakpointId.isEmpty())
+        return false;
+
+    BreakpointIdToDebugServerBreakpointIdsMap::iterator debugServerBreakpointIdsIterator = m_breakpointIdToDebugServerBreakpointIds.find(breakpointId);
+    if (debugServerBreakpointIdsIterator == m_breakpointIdToDebugServerBreakpointIds.end())
+        debugServerBreakpointIdsIterator = m_breakpointIdToDebugServerBreakpointIds.set(breakpointId, Vector<String>()).first;
+    debugServerBreakpointIdsIterator->second.append(debugServerBreakpointId);
+
+    return true;
 }
 
 void InspectorDebuggerAgent::editScriptSource(const String& sourceID, const String& newContent, bool* success, String* result, RefPtr<InspectorValue>* newCallFrames)
@@ -120,7 +193,7 @@ void InspectorDebuggerAgent::editScriptSource(const String& sourceID, const Stri
 
 void InspectorDebuggerAgent::getScriptSource(const String& sourceID, String* scriptSource)
 {
-    *scriptSource = m_scriptIDToContent.get(sourceID);
+    *scriptSource = m_scripts.get(sourceID).data;
 }
 
 void InspectorDebuggerAgent::schedulePauseOnNextStatement(DebuggerEventType type, PassRefPtr<InspectorValue> data)
@@ -173,32 +246,25 @@ void InspectorDebuggerAgent::setPauseOnExceptionsState(long pauseState, long* ne
     *newState = ScriptDebugServer::shared().pauseOnExceptionsState();
 }
 
-void InspectorDebuggerAgent::evaluateOnCallFrame(PassRefPtr<InspectorObject> callFrameId, const String& expression, const String& objectGroup, RefPtr<InspectorValue>* result)
+void InspectorDebuggerAgent::evaluateOnCallFrame(PassRefPtr<InspectorObject> callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result)
 {
-    InjectedScript injectedScript = m_inspectorController->injectedScriptHost()->injectedScriptForObjectId(callFrameId.get());
+    InjectedScript injectedScript = m_inspectorAgent->injectedScriptHost()->injectedScriptForObjectId(callFrameId.get());
     if (!injectedScript.hasNoValue())
-        injectedScript.evaluateOnCallFrame(callFrameId, expression, objectGroup, result);
+        injectedScript.evaluateOnCallFrame(callFrameId, expression, objectGroup, includeCommandLineAPI, result);
 }
 
-void InspectorDebuggerAgent::getCompletionsOnCallFrame(PassRefPtr<InspectorObject> callFrameId, const String& expression, bool includeInspectorCommandLineAPI, RefPtr<InspectorValue>* result)
+void InspectorDebuggerAgent::getCompletionsOnCallFrame(PassRefPtr<InspectorObject> callFrameId, const String& expression, bool includeCommandLineAPI, RefPtr<InspectorValue>* result)
 {
-    InjectedScript injectedScript = m_inspectorController->injectedScriptHost()->injectedScriptForObjectId(callFrameId.get());
+    InjectedScript injectedScript = m_inspectorAgent->injectedScriptHost()->injectedScriptForObjectId(callFrameId.get());
     if (!injectedScript.hasNoValue())
-        injectedScript.getCompletionsOnCallFrame(callFrameId, expression, includeInspectorCommandLineAPI, result);
-}
-
-void InspectorDebuggerAgent::clearForPageNavigation()
-{
-    m_scriptIDToContent.clear();
-    m_urlToSourceIDs.clear();
-    m_stickyBreakpoints.clear();
+        injectedScript.getCompletionsOnCallFrame(callFrameId, expression, includeCommandLineAPI, result);
 }
 
 PassRefPtr<InspectorValue> InspectorDebuggerAgent::currentCallFrames()
 {
     if (!m_pausedScriptState)
         return InspectorValue::null();
-    InjectedScript injectedScript = m_inspectorController->injectedScriptHost()->injectedScriptFor(m_pausedScriptState);
+    InjectedScript injectedScript = m_inspectorAgent->injectedScriptHost()->injectedScriptFor(m_pausedScriptState);
     if (injectedScript.hasNoValue()) {
         ASSERT_NOT_REACHED();
         return InspectorValue::null();
@@ -213,24 +279,26 @@ void InspectorDebuggerAgent::didParseSource(const String& sourceID, const String
     // Don't send script content to the front end until it's really needed.
     m_frontend->parsedScriptSource(sourceID, url, lineOffset, columnOffset, data.length(), worldType);
 
-    m_scriptIDToContent.set(sourceID, data);
+    m_scripts.set(sourceID, Script(url, data, lineOffset, columnOffset));
 
     if (url.isEmpty())
         return;
 
-    URLToSourceIDsMap::iterator urlToSourceIDsIterator = m_urlToSourceIDs.find(url);
-    if (urlToSourceIDsIterator == m_urlToSourceIDs.end())
-        urlToSourceIDsIterator = m_urlToSourceIDs.set(url, Vector<String>()).first;
-    urlToSourceIDsIterator->second.append(sourceID);
-
-    HashMap<String, ScriptBreakpoints>::iterator stickyBreakpointsIterator = m_stickyBreakpoints.find(url);
-    if (stickyBreakpointsIterator == m_stickyBreakpoints.end())
-        return;
-
-    const ScriptBreakpoints& breakpoints = stickyBreakpointsIterator->second;
-    for (ScriptBreakpoints::const_iterator it = breakpoints.begin(); it != breakpoints.end(); ++it) {
-        const Breakpoint& breakpoint = it->second;
-        restoreBreakpoint(sourceID, it->first, breakpoint.first, breakpoint.second);
+    RefPtr<InspectorObject> breakpointsCookie = m_inspectorAgent->state()->getObject(DebuggerAgentState::javaScriptBreakpoints);
+    for (InspectorObject::iterator it = breakpointsCookie->begin(); it != breakpointsCookie->end(); ++it) {
+        RefPtr<InspectorObject> breakpointObject = it->second->asObject();
+        String breakpointURL;
+        breakpointObject->getString("url", &breakpointURL);
+        if (breakpointURL != url)
+            continue;
+        ScriptBreakpoint breakpoint;
+        breakpointObject->getNumber("lineNumber", &breakpoint.lineNumber);
+        breakpointObject->getNumber("columnNumber", &breakpoint.columnNumber);
+        breakpointObject->getString("condition", &breakpoint.condition);
+        breakpointObject->getBoolean("enabled", &breakpoint.enabled);
+        int actualLineNumber = 0, actualColumnNumber = 0;
+        if (resolveBreakpoint(it->first, sourceID, breakpoint, &actualLineNumber, &actualColumnNumber))
+            m_frontend->breakpointResolved(it->first, sourceID, actualLineNumber, actualColumnNumber);
     }
 }
 
@@ -250,6 +318,11 @@ void InspectorDebuggerAgent::didPause(ScriptState* scriptState)
 
     m_frontend->pausedScript(m_breakProgramDetails);
     m_javaScriptPauseScheduled = false;
+
+    if (!m_continueToLocationBreakpointId.isEmpty()) {
+        ScriptDebugServer::shared().removeBreakpoint(m_continueToLocationBreakpointId);
+        m_continueToLocationBreakpointId = "";
+    }
 }
 
 void InspectorDebuggerAgent::didContinue()
diff --git a/Source/WebCore/inspector/InspectorDebuggerAgent.h b/Source/WebCore/inspector/InspectorDebuggerAgent.h
index 4cb9f9c..644557f 100644
--- a/Source/WebCore/inspector/InspectorDebuggerAgent.h
+++ b/Source/WebCore/inspector/InspectorDebuggerAgent.h
@@ -32,6 +32,7 @@
 
 #if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
 #include "InjectedScript.h"
+#include "ScriptBreakpoint.h"
 #include "ScriptDebugListener.h"
 #include "ScriptState.h"
 #include <wtf/Forward.h>
@@ -42,7 +43,7 @@
 
 namespace WebCore {
 class InjectedScriptHost;
-class InspectorController;
+class InspectorAgent;
 class InspectorFrontend;
 class InspectorObject;
 class InspectorValue;
@@ -56,17 +57,20 @@ enum DebuggerEventType {
 class InspectorDebuggerAgent : public ScriptDebugListener {
     WTF_MAKE_NONCOPYABLE(InspectorDebuggerAgent); WTF_MAKE_FAST_ALLOCATED;
 public:
-    static PassOwnPtr<InspectorDebuggerAgent> create(InspectorController*, InspectorFrontend*);
+    static PassOwnPtr<InspectorDebuggerAgent> create(InspectorAgent*, InspectorFrontend*, bool eraseStickyBreakpoints);
     virtual ~InspectorDebuggerAgent();
 
-    static bool isDebuggerAlwaysEnabled();
+    void inspectedURLChanged(const String& url);
 
     // Part of the protocol.
     void activateBreakpoints();
     void deactivateBreakpoints();
-    void setStickyBreakpoint(const String& url, unsigned lineNumber, const String& condition, bool enabled);
-    void setBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition, bool enabled, String* breakpointId, unsigned int* actualLineNumber);
-    void removeBreakpoint(const String& breakpointId);
+
+    void setJavaScriptBreakpoint(const String& url, int lineNumber, int columnNumber, const String& condition, bool enabled, String* breakpointId, RefPtr<InspectorArray>* locations);
+    void setJavaScriptBreakpointBySourceId(const String& sourceId, int lineNumber, int columnNumber, const String& condition, bool enabled, String* breakpointId, int* actualLineNumber, int* actualColumnNumber);
+    void removeJavaScriptBreakpoint(const String& breakpointId);
+    void continueToLocation(const String& sourceId, int lineNumber, int columnNumber);
+
     void editScriptSource(const String& sourceID, const String& newContent, bool* success, String* result, RefPtr<InspectorValue>* newCallFrames);
     void getScriptSource(const String& sourceID, String* scriptSource);
     void schedulePauseOnNextStatement(DebuggerEventType type, PassRefPtr<InspectorValue> data);
@@ -78,13 +82,11 @@ public:
     void stepInto();
     void stepOut();
     void setPauseOnExceptionsState(long pauseState, long* newState);
-    void evaluateOnCallFrame(PassRefPtr<InspectorObject> callFrameId, const String& expression, const String& objectGroup, RefPtr<InspectorValue>* result);
-    void getCompletionsOnCallFrame(PassRefPtr<InspectorObject> callFrameId, const String& expression, bool includeInspectorCommandLineAPI, RefPtr<InspectorValue>* result);
-
-    void clearForPageNavigation();
+    void evaluateOnCallFrame(PassRefPtr<InspectorObject> callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result);
+    void getCompletionsOnCallFrame(PassRefPtr<InspectorObject> callFrameId, const String& expression, bool includeCommandLineAPI, RefPtr<InspectorValue>* result);
 
 private:
-    InspectorDebuggerAgent(InspectorController*, InspectorFrontend*);
+    InspectorDebuggerAgent(InspectorAgent*, InspectorFrontend*, bool eraseStickyBreakpoints);
 
     PassRefPtr<InspectorValue> currentCallFrames();
 
@@ -93,17 +95,42 @@ private:
     virtual void didPause(ScriptState*);
     virtual void didContinue();
 
-    void restoreBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition, bool enabled);
-
-    InspectorController* m_inspectorController;
+    bool resolveBreakpoint(const String& breakpointId, const String& sourceId, const ScriptBreakpoint&, int* actualLineNumber, int* actualColumnNumber);
+
+    class Script {
+    public:
+        Script()
+            : lineOffset(0)
+            , columnOffset(0)
+            , linesCount(0)
+        {
+        }
+
+        Script(const String& url, const String& data, int lineOffset, int columnOffset)
+            : url(url)
+            , data(data)
+            , lineOffset(lineOffset)
+            , columnOffset(columnOffset)
+            , linesCount(0)
+        {
+        }
+
+        String url;
+        String data;
+        int lineOffset;
+        int columnOffset;
+        int linesCount;
+    };
+
+    typedef HashMap<String, Script> ScriptsMap;
+    typedef HashMap<String, Vector<String> > BreakpointIdToDebugServerBreakpointIdsMap;
+
+    InspectorAgent* m_inspectorAgent;
     InspectorFrontend* m_frontend;
     ScriptState* m_pausedScriptState;
-    HashMap<String, String> m_scriptIDToContent;
-    typedef HashMap<String, Vector<String> > URLToSourceIDsMap;
-    URLToSourceIDsMap m_urlToSourceIDs;
-    typedef std::pair<String, bool> Breakpoint;
-    typedef HashMap<unsigned, Breakpoint> ScriptBreakpoints;
-    HashMap<String, ScriptBreakpoints> m_stickyBreakpoints;
+    ScriptsMap m_scripts;
+    BreakpointIdToDebugServerBreakpointIdsMap m_breakpointIdToDebugServerBreakpointIds;
+    String m_continueToLocationBreakpointId;
     RefPtr<InspectorObject> m_breakProgramDetails;
     bool m_javaScriptPauseScheduled;
 };
diff --git a/Source/WebCore/inspector/InspectorFileSystemAgent.cpp b/Source/WebCore/inspector/InspectorFileSystemAgent.cpp
deleted file mode 100644
index 2a0df3c..0000000
--- a/Source/WebCore/inspector/InspectorFileSystemAgent.cpp
+++ /dev/null
@@ -1,171 +0,0 @@
-/*
- * Copyright (C) 2010 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "InspectorFileSystemAgent.h"
-
-#if ENABLE(INSPECTOR) && ENABLE(FILE_SYSTEM)
-
-#include "AsyncFileWriter.h"
-#include "Document.h"
-#include "FileSystem.h"
-#include "FileSystemCallbacks.h"
-#include "Frame.h"
-#include "FrameTree.h"
-#include "InspectorController.h"
-#include "InspectorFrontend.h"
-#include "LocalFileSystem.h"
-#include "NotImplemented.h"
-#include "Page.h"
-#include "RuntimeEnabledFeatures.h"
-
-namespace WebCore {
-
-class InspectorFileSystemAgentCallbacks : public AsyncFileSystemCallbacks {
-public:
-    InspectorFileSystemAgentCallbacks(InspectorFileSystemAgent* agent, AsyncFileSystem::Type type, const String& origin)
-        : m_agent(agent)
-        , m_type(type)
-        , m_origin(origin)
-    { 
-    }
-
-    ~InspectorFileSystemAgentCallbacks()
-    {
-    }
-
-    // FileSystemCallbacks is only used for getting filesystem. All other methods are irrelevant and will not be called.
-    void didSucceed()
-    {
-        ASSERT_NOT_REACHED();
-    }
-
-    void didOpenFileSystem(const String&, PassOwnPtr<AsyncFileSystem> fileSystem)
-    {
-        // Agent will be alive even if InspectorController is destroyed until callback is run.
-        m_agent->didGetFileSystemPath(fileSystem->root(), m_type, m_origin);
-    }
-
-    void didReadMetadata(const FileMetadata&)
-    {
-        ASSERT_NOT_REACHED();
-    }
-
-    void didReadDirectoryEntry(const String&, bool)
-    {
-        ASSERT_NOT_REACHED();
-    }
-
-    void didReadDirectoryEntries(bool)
-    {
-        ASSERT_NOT_REACHED();
-    }
-
-    void didCreateFileWriter(PassOwnPtr<AsyncFileWriter>, long long)
-    {
-        ASSERT_NOT_REACHED();
-    }
-    
-    void didFail(int)
-    {
-        // FIXME: Is it useful to give back the code to Inspector UI?
-        m_agent->didGetFileSystemError(m_type, m_origin);
-    }
-
-private:
-    RefPtr<InspectorFileSystemAgent> m_agent;
-    AsyncFileSystem::Type m_type;
-    String m_origin;
-};
-
-InspectorFileSystemAgent::InspectorFileSystemAgent(InspectorController* inspectorController, InspectorFrontend* frontend)
-    : m_inspectorController(inspectorController)
-    , m_frontend(frontend)
-{
-}
-
-InspectorFileSystemAgent::~InspectorFileSystemAgent() { }
-
-void InspectorFileSystemAgent::stop()
-{
-    m_inspectorController = 0;
-}
-
-#if PLATFORM(CHROMIUM)
-void InspectorFileSystemAgent::revealFolderInOS(const String& path)
-{
-    // FIXME: Remove guard when revealFolderInOS is implemented for non-chromium platforms.
-    WebCore::revealFolderInOS(path);
-}
-#else
-void InspectorFileSystemAgent::revealFolderInOS(const String&)
-{
-    notImplemented();
-}
-#endif
-
-void InspectorFileSystemAgent::getFileSystemPathAsync(unsigned int type, const String& origin)
-{
-    if (!RuntimeEnabledFeatures::fileSystemEnabled()) {
-        m_frontend->didGetFileSystemDisabled();
-        return;
-    }
-
-    AsyncFileSystem::Type asyncFileSystemType = static_cast<AsyncFileSystem::Type>(type);
-    Frame* mainFrame = m_inspectorController->inspectedPage()->mainFrame();
-    for (Frame* frame = mainFrame; frame; frame = frame->tree()->traverseNext()) {
-        Document* document = frame->document();
-        if (document && document->securityOrigin()->toString() == origin) {
-            LocalFileSystem::localFileSystem().readFileSystem(document, asyncFileSystemType, 0, new InspectorFileSystemAgentCallbacks(this, asyncFileSystemType, origin));
-            return;
-        }
-    }
-}
-
-void InspectorFileSystemAgent::didGetFileSystemPath(const String& root, AsyncFileSystem::Type type, const String& origin)
-{
-    // When controller is being destroyed, this is set to 0. Agent can live even after m_inspectorController is destroyed.
-    if (!m_inspectorController)
-        return;
-
-    m_frontend->didGetFileSystemPath(root, static_cast<unsigned int>(type), origin);
-}
-
-void InspectorFileSystemAgent::didGetFileSystemError(AsyncFileSystem::Type type, const String& origin)
-{
-    // When controller is being destroyed, this is set to 0. Agent can live even after m_inspectorController is destroyed.
-    if (!m_inspectorController)
-        return;
-    m_frontend->didGetFileSystemError(static_cast<unsigned int>(type), origin);
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(INSPECTOR) && ENABLE(FILE_SYSTEM)
diff --git a/Source/WebCore/inspector/InspectorFileSystemAgent.h b/Source/WebCore/inspector/InspectorFileSystemAgent.h
deleted file mode 100644
index a85ad0f..0000000
--- a/Source/WebCore/inspector/InspectorFileSystemAgent.h
+++ /dev/null
@@ -1,77 +0,0 @@
-/*
- * Copyright (C) 2010 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef InspectorFileSystemAgent_h
-#define InspectorFileSystemAgent_h
-
-#if ENABLE(INSPECTOR) && ENABLE(FILE_SYSTEM)
-
-#include "AsyncFileSystem.h"
-#include "AsyncFileSystemCallbacks.h"
-#include <wtf/PassRefPtr.h>
-
-namespace WebCore {
-
-class Document;
-class InspectorController;
-class InspectorFrontend;
-class LocalFileSystem;
-
-class InspectorFileSystemAgent : public RefCounted<InspectorFileSystemAgent> {
-public:
-    static PassRefPtr<InspectorFileSystemAgent> create(InspectorController* inspectorController, InspectorFrontend* frontend)
-    {
-        return adoptRef(new InspectorFileSystemAgent(inspectorController, frontend));
-    }
-
-    ~InspectorFileSystemAgent();
-    void stop();
-
-    // From Frontend
-    void getFileSystemPathAsync(unsigned int type, const String& origin);
-    void revealFolderInOS(const String& path);
-
-    // Backend to Frontend
-    void didGetFileSystemPath(const String&, AsyncFileSystem::Type, const String& origin);
-    void didGetFileSystemError(AsyncFileSystem::Type, const String& origin);
-    void didGetFileSystemDisabled();
-
-private:
-    InspectorFileSystemAgent(InspectorController*, InspectorFrontend*);
-    void getFileSystemRoot(AsyncFileSystem::Type);
-
-    InspectorController* m_inspectorController;
-    InspectorFrontend* m_frontend;
-};
-
-} // namespace WebCore
-
-#endif // ENABLE(INSPECTOR) && ENABLE(FILE_SYSTEM)
-#endif // InspectorFileSystemAgent_h
diff --git a/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp b/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp
index 4812b2a..36864f3 100644
--- a/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp
+++ b/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp
@@ -47,14 +47,25 @@
 
 namespace WebCore {
 
+static const char* inspectorAttachedHeightSetting = "inspectorAttachedHeight";
 static const unsigned defaultAttachedHeight = 300;
 static const float minimumAttachedHeight = 250.0f;
 static const float maximumAttachedHeightRatio = 0.75f;
 
-InspectorFrontendClientLocal::InspectorFrontendClientLocal(InspectorController* inspectorController, Page* frontendPage)
+String InspectorFrontendClientLocal::Settings::getProperty(const String&)
+{
+    return String();
+}
+
+void InspectorFrontendClientLocal::Settings::setProperty(const String&, const String&)
+{
+}
+
+InspectorFrontendClientLocal::InspectorFrontendClientLocal(InspectorController* inspectorController, Page* frontendPage, PassOwnPtr<Settings> settings)
     : m_inspectorController(inspectorController)
     , m_frontendPage(frontendPage)
     , m_frontendScriptState(0)
+    , m_settings(settings)
 {
 }
 
@@ -66,7 +77,7 @@ InspectorFrontendClientLocal::~InspectorFrontendClientLocal()
     m_frontendPage = 0;
     m_inspectorController = 0;
 }
-    
+
 void InspectorFrontendClientLocal::windowObjectCleared()
 {
     // FIXME: don't keep reference to the script state
@@ -107,7 +118,7 @@ void InspectorFrontendClientLocal::changeAttachedWindowHeight(unsigned height)
 {
     unsigned totalHeight = m_frontendPage->mainFrame()->view()->visibleHeight() + m_inspectorController->inspectedPage()->mainFrame()->view()->visibleHeight();
     unsigned attachedHeight = constrainedAttachedWindowHeight(height, totalHeight);
-    m_inspectorController->setInspectorAttachedHeight(attachedHeight);
+    m_settings->setProperty(inspectorAttachedHeightSetting, String::number(attachedHeight));
     setAttachedWindowHeight(attachedHeight);
 }
 
@@ -133,9 +144,8 @@ void InspectorFrontendClientLocal::setAttachedWindow(bool attached)
 void InspectorFrontendClientLocal::restoreAttachedWindowHeight()
 {
     unsigned inspectedPageHeight = m_inspectorController->inspectedPage()->mainFrame()->view()->visibleHeight();
-    int attachedHeight = m_inspectorController->inspectorAttachedHeight();
-    bool success = true;
-    unsigned preferredHeight = success ? static_cast<unsigned>(attachedHeight) : defaultAttachedHeight;
+    String value = m_settings->getProperty(inspectorAttachedHeightSetting);
+    unsigned preferredHeight = value.isEmpty() ? defaultAttachedHeight : value.toUInt();
     
     // This call might not go through (if the window starts out detached), but if the window is initially created attached,
     // InspectorController::attachWindow is never called, so we need to make sure to set the attachedWindowHeight.
@@ -151,7 +161,7 @@ unsigned InspectorFrontendClientLocal::constrainedAttachedWindowHeight(unsigned
 
 void InspectorFrontendClientLocal::sendMessageToBackend(const String& message)
 {
-    m_inspectorController->inspectorBackendDispatcher()->dispatch(message);
+    m_inspectorController->dispatchMessageFromFrontend(message);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorFrontendClientLocal.h b/Source/WebCore/inspector/InspectorFrontendClientLocal.h
index 19f6ad1..238a262 100644
--- a/Source/WebCore/inspector/InspectorFrontendClientLocal.h
+++ b/Source/WebCore/inspector/InspectorFrontendClientLocal.h
@@ -33,6 +33,7 @@
 
 #include "InspectorFrontendClient.h"
 #include "ScriptState.h"
+#include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 
 namespace WebCore {
@@ -44,7 +45,15 @@ class Page;
 class InspectorFrontendClientLocal : public InspectorFrontendClient {
     WTF_MAKE_NONCOPYABLE(InspectorFrontendClientLocal); WTF_MAKE_FAST_ALLOCATED;
 public:
-    InspectorFrontendClientLocal(InspectorController*, Page*);
+    class Settings {
+    public:
+        Settings() { }
+        virtual ~Settings() { }
+        virtual String getProperty(const String& name);
+        virtual void setProperty(const String& name, const String& value);
+    };
+
+    InspectorFrontendClientLocal(InspectorController*, Page*, PassOwnPtr<Settings>);
     virtual ~InspectorFrontendClientLocal();
     
     virtual void windowObjectCleared();
@@ -76,6 +85,7 @@ private:
     ScriptState* m_frontendScriptState;
     // TODO(yurys): this ref shouldn't be needed.
     RefPtr<InspectorFrontendHost> m_frontendHost;
+    OwnPtr<InspectorFrontendClientLocal::Settings> m_settings;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorFrontendHost.cpp b/Source/WebCore/inspector/InspectorFrontendHost.cpp
index 342af0f..f2e66bc 100644
--- a/Source/WebCore/inspector/InspectorFrontendHost.cpp
+++ b/Source/WebCore/inspector/InspectorFrontendHost.cpp
@@ -41,6 +41,7 @@
 #include "FrameLoader.h"
 #include "HitTestResult.h"
 #include "HTMLFrameOwnerElement.h"
+#include "InspectorAgent.h"
 #include "InspectorController.h"
 #include "InspectorFrontendClient.h"
 #include "Page.h"
@@ -200,8 +201,8 @@ void InspectorFrontendHost::moveWindowBy(float x, float y) const
 
 void InspectorFrontendHost::setExtensionAPI(const String& script)
 {
-    InspectorController* inspector = m_frontendPage->inspectorController();
-    inspector->setInspectorExtensionAPI(script);
+    ASSERT(m_frontendPage->inspectorController());
+    m_frontendPage->inspectorController()->setInspectorExtensionAPI(script);
 }
 
 String InspectorFrontendHost::localizedStringsURL()
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.cpp b/Source/WebCore/inspector/InspectorInstrumentation.cpp
index 9ae97be..e7bb1eb 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.cpp
+++ b/Source/WebCore/inspector/InspectorInstrumentation.cpp
@@ -38,10 +38,10 @@
 #include "DocumentLoader.h"
 #include "Event.h"
 #include "EventContext.h"
+#include "InspectorAgent.h"
 #include "InspectorApplicationCacheAgent.h"
 #include "InspectorBrowserDebuggerAgent.h"
 #include "InspectorConsoleAgent.h"
-#include "InspectorController.h"
 #include "InspectorDOMAgent.h"
 #include "InspectorDebuggerAgent.h"
 #include "InspectorProfilerAgent.h"
@@ -61,6 +61,12 @@ static const char* const setTimerEventName = "setTimer";
 static const char* const clearTimerEventName = "clearTimer";
 static const char* const timerFiredEventName = "timerFired";
 
+HashMap<Page*, InspectorAgent*>& InspectorInstrumentation::inspectorAgents()
+{
+    static HashMap<Page*, InspectorAgent*>& agents = *new HashMap<Page*, InspectorAgent*>;
+    return agents;
+}
+
 int InspectorInstrumentation::s_frontendCounter = 0;
 
 static bool eventHasListeners(const AtomicString& eventType, DOMWindow* window, Node* node, const Vector<EventContext>& ancestors)
@@ -80,119 +86,119 @@ static bool eventHasListeners(const AtomicString& eventType, DOMWindow* window,
     return false;
 }
 
-void InspectorInstrumentation::didClearWindowObjectInWorldImpl(InspectorController* inspectorController, Frame* frame, DOMWrapperWorld* world)
+void InspectorInstrumentation::didClearWindowObjectInWorldImpl(InspectorAgent* inspectorAgent, Frame* frame, DOMWrapperWorld* world)
 {
-    inspectorController->didClearWindowObjectInWorld(frame, world);
+    inspectorAgent->didClearWindowObjectInWorld(frame, world);
 }
 
-void InspectorInstrumentation::inspectedPageDestroyedImpl(InspectorController* inspectorController)
+void InspectorInstrumentation::inspectedPageDestroyedImpl(InspectorAgent* inspectorAgent)
 {
-    inspectorController->inspectedPageDestroyed();
+    inspectorAgent->inspectedPageDestroyed();
 }
 
-void InspectorInstrumentation::willInsertDOMNodeImpl(InspectorController* inspectorController, Node* node, Node* parent)
+void InspectorInstrumentation::willInsertDOMNodeImpl(InspectorAgent* inspectorAgent, Node* node, Node* parent)
 {
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (InspectorBrowserDebuggerAgent* browserDebuggerAgent = inspectorController->browserDebuggerAgent())
+    if (InspectorBrowserDebuggerAgent* browserDebuggerAgent = inspectorAgent->browserDebuggerAgent())
         browserDebuggerAgent->willInsertDOMNode(node, parent);
 #endif
 }
 
-void InspectorInstrumentation::didInsertDOMNodeImpl(InspectorController* inspectorController, Node* node)
+void InspectorInstrumentation::didInsertDOMNodeImpl(InspectorAgent* inspectorAgent, Node* node)
 {
-    if (InspectorDOMAgent* domAgent = inspectorController->domAgent())
+    if (InspectorDOMAgent* domAgent = inspectorAgent->domAgent())
         domAgent->didInsertDOMNode(node);
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (InspectorBrowserDebuggerAgent* browserDebuggerAgent = inspectorController->browserDebuggerAgent())
+    if (InspectorBrowserDebuggerAgent* browserDebuggerAgent = inspectorAgent->browserDebuggerAgent())
         browserDebuggerAgent->didInsertDOMNode(node);
 #endif
 }
 
-void InspectorInstrumentation::willRemoveDOMNodeImpl(InspectorController* inspectorController, Node* node)
+void InspectorInstrumentation::willRemoveDOMNodeImpl(InspectorAgent* inspectorAgent, Node* node)
 {
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (InspectorBrowserDebuggerAgent* browserDebuggerAgent = inspectorController->browserDebuggerAgent())
+    if (InspectorBrowserDebuggerAgent* browserDebuggerAgent = inspectorAgent->browserDebuggerAgent())
         browserDebuggerAgent->willRemoveDOMNode(node);
 #endif
 }
 
-void InspectorInstrumentation::didRemoveDOMNodeImpl(InspectorController* inspectorController, Node* node)
+void InspectorInstrumentation::didRemoveDOMNodeImpl(InspectorAgent* inspectorAgent, Node* node)
 {
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (InspectorBrowserDebuggerAgent* browserDebuggerAgent = inspectorController->browserDebuggerAgent())
+    if (InspectorBrowserDebuggerAgent* browserDebuggerAgent = inspectorAgent->browserDebuggerAgent())
         browserDebuggerAgent->didRemoveDOMNode(node);
 #endif
-    if (InspectorDOMAgent* domAgent = inspectorController->domAgent())
+    if (InspectorDOMAgent* domAgent = inspectorAgent->domAgent())
         domAgent->didRemoveDOMNode(node);
 }
 
-void InspectorInstrumentation::willModifyDOMAttrImpl(InspectorController* inspectorController, Element* element)
+void InspectorInstrumentation::willModifyDOMAttrImpl(InspectorAgent* inspectorAgent, Element* element)
 {
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (InspectorBrowserDebuggerAgent* browserDebuggerAgent = inspectorController->browserDebuggerAgent())
+    if (InspectorBrowserDebuggerAgent* browserDebuggerAgent = inspectorAgent->browserDebuggerAgent())
         browserDebuggerAgent->willModifyDOMAttr(element);
 #endif
 }
 
-void InspectorInstrumentation::didModifyDOMAttrImpl(InspectorController* inspectorController, Element* element)
+void InspectorInstrumentation::didModifyDOMAttrImpl(InspectorAgent* inspectorAgent, Element* element)
 {
-    if (InspectorDOMAgent* domAgent = inspectorController->domAgent())
+    if (InspectorDOMAgent* domAgent = inspectorAgent->domAgent())
         domAgent->didModifyDOMAttr(element);
 }
 
-void InspectorInstrumentation::mouseDidMoveOverElementImpl(InspectorController* inspectorController, const HitTestResult& result, unsigned modifierFlags)
+void InspectorInstrumentation::mouseDidMoveOverElementImpl(InspectorAgent* inspectorAgent, const HitTestResult& result, unsigned modifierFlags)
 {
-    inspectorController->mouseDidMoveOverElement(result, modifierFlags);
+    inspectorAgent->mouseDidMoveOverElement(result, modifierFlags);
 }
 
-bool InspectorInstrumentation::handleMousePressImpl(InspectorController* inspectorController)
+bool InspectorInstrumentation::handleMousePressImpl(InspectorAgent* inspectorAgent)
 {
-    return inspectorController->handleMousePress();
+    return inspectorAgent->handleMousePress();
 }
 
-void InspectorInstrumentation::characterDataModifiedImpl(InspectorController* inspectorController, CharacterData* characterData)
+void InspectorInstrumentation::characterDataModifiedImpl(InspectorAgent* inspectorAgent, CharacterData* characterData)
 {
-    if (InspectorDOMAgent* domAgent = inspectorController->domAgent())
+    if (InspectorDOMAgent* domAgent = inspectorAgent->domAgent())
         domAgent->characterDataModified(characterData);
 }
 
-void InspectorInstrumentation::willSendXMLHttpRequestImpl(InspectorController* inspectorController, const String& url)
+void InspectorInstrumentation::willSendXMLHttpRequestImpl(InspectorAgent* inspectorAgent, const String& url)
 {
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (InspectorBrowserDebuggerAgent* browserDebuggerAgent = inspectorController->browserDebuggerAgent())
+    if (InspectorBrowserDebuggerAgent* browserDebuggerAgent = inspectorAgent->browserDebuggerAgent())
         browserDebuggerAgent->willSendXMLHttpRequest(url);
 #endif
 }
 
-void InspectorInstrumentation::didScheduleResourceRequestImpl(InspectorController* inspectorController, const String& url)
+void InspectorInstrumentation::didScheduleResourceRequestImpl(InspectorAgent* inspectorAgent, const String& url)
 {
-    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController))
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent))
         timelineAgent->didScheduleResourceRequest(url);
 }
 
-void InspectorInstrumentation::didInstallTimerImpl(InspectorController* inspectorController, int timerId, int timeout, bool singleShot)
+void InspectorInstrumentation::didInstallTimerImpl(InspectorAgent* inspectorAgent, int timerId, int timeout, bool singleShot)
 {
-    pauseOnNativeEventIfNeeded(inspectorController, instrumentationEventCategoryType, setTimerEventName, true);
-    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController))
+    pauseOnNativeEventIfNeeded(inspectorAgent, instrumentationEventCategoryType, setTimerEventName, true);
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent))
         timelineAgent->didInstallTimer(timerId, timeout, singleShot);
 }
 
-void InspectorInstrumentation::didRemoveTimerImpl(InspectorController* inspectorController, int timerId)
+void InspectorInstrumentation::didRemoveTimerImpl(InspectorAgent* inspectorAgent, int timerId)
 {
-    pauseOnNativeEventIfNeeded(inspectorController, instrumentationEventCategoryType, clearTimerEventName, true);
-    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController))
+    pauseOnNativeEventIfNeeded(inspectorAgent, instrumentationEventCategoryType, clearTimerEventName, true);
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent))
         timelineAgent->didRemoveTimer(timerId);
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willCallFunctionImpl(InspectorController* inspectorController, const String& scriptName, int scriptLine)
+InspectorInstrumentationCookie InspectorInstrumentation::willCallFunctionImpl(InspectorAgent* inspectorAgent, const String& scriptName, int scriptLine)
 {
     int timelineAgentId = 0;
-    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent);
     if (timelineAgent) {
         timelineAgent->willCallFunction(scriptName, scriptLine);
         timelineAgentId = timelineAgent->id();
     }
-    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+    return InspectorInstrumentationCookie(inspectorAgent, timelineAgentId);
 }
 
 void InspectorInstrumentation::didCallFunctionImpl(const InspectorInstrumentationCookie& cookie)
@@ -201,15 +207,15 @@ void InspectorInstrumentation::didCallFunctionImpl(const InspectorInstrumentatio
         timelineAgent->didCallFunction();
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willChangeXHRReadyStateImpl(InspectorController* inspectorController, XMLHttpRequest* request)
+InspectorInstrumentationCookie InspectorInstrumentation::willChangeXHRReadyStateImpl(InspectorAgent* inspectorAgent, XMLHttpRequest* request)
 {
     int timelineAgentId = 0;
-    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent);
     if (timelineAgent && request->hasEventListeners(eventNames().readystatechangeEvent)) {
         timelineAgent->willChangeXHRReadyState(request->url().string(), request->readyState());
         timelineAgentId = timelineAgent->id();
     }
-    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+    return InspectorInstrumentationCookie(inspectorAgent, timelineAgentId);
 }
 
 void InspectorInstrumentation::didChangeXHRReadyStateImpl(const InspectorInstrumentationCookie& cookie)
@@ -218,17 +224,17 @@ void InspectorInstrumentation::didChangeXHRReadyStateImpl(const InspectorInstrum
         timelineAgent->didChangeXHRReadyState();
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willDispatchEventImpl(InspectorController* inspectorController, const Event& event, DOMWindow* window, Node* node, const Vector<EventContext>& ancestors)
+InspectorInstrumentationCookie InspectorInstrumentation::willDispatchEventImpl(InspectorAgent* inspectorAgent, const Event& event, DOMWindow* window, Node* node, const Vector<EventContext>& ancestors)
 {
-    pauseOnNativeEventIfNeeded(inspectorController, listenerEventCategoryType, event.type(), false);
+    pauseOnNativeEventIfNeeded(inspectorAgent, listenerEventCategoryType, event.type(), false);
 
     int timelineAgentId = 0;
-    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent);
     if (timelineAgent && eventHasListeners(event.type(), window, node, ancestors)) {
         timelineAgent->willDispatchEvent(event);
         timelineAgentId = timelineAgent->id();
     }
-    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+    return InspectorInstrumentationCookie(inspectorAgent, timelineAgentId);
 }
 
 void InspectorInstrumentation::didDispatchEventImpl(const InspectorInstrumentationCookie& cookie)
@@ -239,17 +245,17 @@ void InspectorInstrumentation::didDispatchEventImpl(const InspectorInstrumentati
         timelineAgent->didDispatchEvent();
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willDispatchEventOnWindowImpl(InspectorController* inspectorController, const Event& event, DOMWindow* window)
+InspectorInstrumentationCookie InspectorInstrumentation::willDispatchEventOnWindowImpl(InspectorAgent* inspectorAgent, const Event& event, DOMWindow* window)
 {
-    pauseOnNativeEventIfNeeded(inspectorController, listenerEventCategoryType, event.type(), false);
+    pauseOnNativeEventIfNeeded(inspectorAgent, listenerEventCategoryType, event.type(), false);
 
     int timelineAgentId = 0;
-    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent);
     if (timelineAgent && window->hasEventListeners(event.type())) {
         timelineAgent->willDispatchEvent(event);
         timelineAgentId = timelineAgent->id();
     }
-    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+    return InspectorInstrumentationCookie(inspectorAgent, timelineAgentId);
 }
 
 void InspectorInstrumentation::didDispatchEventOnWindowImpl(const InspectorInstrumentationCookie& cookie)
@@ -260,15 +266,15 @@ void InspectorInstrumentation::didDispatchEventOnWindowImpl(const InspectorInstr
         timelineAgent->didDispatchEvent();
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willEvaluateScriptImpl(InspectorController* inspectorController, const String& url, int lineNumber)
+InspectorInstrumentationCookie InspectorInstrumentation::willEvaluateScriptImpl(InspectorAgent* inspectorAgent, const String& url, int lineNumber)
 {
     int timelineAgentId = 0;
-    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent);
     if (timelineAgent) {
         timelineAgent->willEvaluateScript(url, lineNumber);
         timelineAgentId = timelineAgent->id();
     }
-    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+    return InspectorInstrumentationCookie(inspectorAgent, timelineAgentId);
 }
 
 void InspectorInstrumentation::didEvaluateScriptImpl(const InspectorInstrumentationCookie& cookie)
@@ -277,17 +283,17 @@ void InspectorInstrumentation::didEvaluateScriptImpl(const InspectorInstrumentat
         timelineAgent->didEvaluateScript();
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willFireTimerImpl(InspectorController* inspectorController, int timerId)
+InspectorInstrumentationCookie InspectorInstrumentation::willFireTimerImpl(InspectorAgent* inspectorAgent, int timerId)
 {
-    pauseOnNativeEventIfNeeded(inspectorController, instrumentationEventCategoryType, timerFiredEventName, false);
+    pauseOnNativeEventIfNeeded(inspectorAgent, instrumentationEventCategoryType, timerFiredEventName, false);
 
     int timelineAgentId = 0;
-    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent);
     if (timelineAgent) {
         timelineAgent->willFireTimer(timerId);
         timelineAgentId = timelineAgent->id();
     }
-    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+    return InspectorInstrumentationCookie(inspectorAgent, timelineAgentId);
 }
 
 void InspectorInstrumentation::didFireTimerImpl(const InspectorInstrumentationCookie& cookie)
@@ -298,15 +304,15 @@ void InspectorInstrumentation::didFireTimerImpl(const InspectorInstrumentationCo
         timelineAgent->didFireTimer();
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willLayoutImpl(InspectorController* inspectorController)
+InspectorInstrumentationCookie InspectorInstrumentation::willLayoutImpl(InspectorAgent* inspectorAgent)
 {
     int timelineAgentId = 0;
-    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent);
     if (timelineAgent) {
         timelineAgent->willLayout();
         timelineAgentId = timelineAgent->id();
     }
-    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+    return InspectorInstrumentationCookie(inspectorAgent, timelineAgentId);
 }
 
 void InspectorInstrumentation::didLayoutImpl(const InspectorInstrumentationCookie& cookie)
@@ -315,15 +321,15 @@ void InspectorInstrumentation::didLayoutImpl(const InspectorInstrumentationCooki
         timelineAgent->didLayout();
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willLoadXHRImpl(InspectorController* inspectorController, XMLHttpRequest* request)
+InspectorInstrumentationCookie InspectorInstrumentation::willLoadXHRImpl(InspectorAgent* inspectorAgent, XMLHttpRequest* request)
 {
     int timelineAgentId = 0;
-    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent);
     if (timelineAgent && request->hasEventListeners(eventNames().loadEvent)) {
         timelineAgent->willLoadXHR(request->url());
         timelineAgentId = timelineAgent->id();
     }
-    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+    return InspectorInstrumentationCookie(inspectorAgent, timelineAgentId);
 }
 
 void InspectorInstrumentation::didLoadXHRImpl(const InspectorInstrumentationCookie& cookie)
@@ -332,15 +338,15 @@ void InspectorInstrumentation::didLoadXHRImpl(const InspectorInstrumentationCook
         timelineAgent->didLoadXHR();
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willPaintImpl(InspectorController* inspectorController, const IntRect& rect)
+InspectorInstrumentationCookie InspectorInstrumentation::willPaintImpl(InspectorAgent* inspectorAgent, const IntRect& rect)
 {
     int timelineAgentId = 0;
-    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent);
     if (timelineAgent) {
         timelineAgent->willPaint(rect);
         timelineAgentId = timelineAgent->id();
     }
-    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+    return InspectorInstrumentationCookie(inspectorAgent, timelineAgentId);
 }
 
 void InspectorInstrumentation::didPaintImpl(const InspectorInstrumentationCookie& cookie)
@@ -349,15 +355,15 @@ void InspectorInstrumentation::didPaintImpl(const InspectorInstrumentationCookie
         timelineAgent->didPaint();
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willRecalculateStyleImpl(InspectorController* inspectorController)
+InspectorInstrumentationCookie InspectorInstrumentation::willRecalculateStyleImpl(InspectorAgent* inspectorAgent)
 {
     int timelineAgentId = 0;
-    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent);
     if (timelineAgent) {
         timelineAgent->willRecalculateStyle();
         timelineAgentId = timelineAgent->id();
     }
-    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+    return InspectorInstrumentationCookie(inspectorAgent, timelineAgentId);
 }
 
 void InspectorInstrumentation::didRecalculateStyleImpl(const InspectorInstrumentationCookie& cookie)
@@ -366,49 +372,51 @@ void InspectorInstrumentation::didRecalculateStyleImpl(const InspectorInstrument
         timelineAgent->didRecalculateStyle();
 }
 
-void InspectorInstrumentation::identifierForInitialRequestImpl(InspectorController* ic, unsigned long identifier, DocumentLoader* loader, const ResourceRequest& request)
+void InspectorInstrumentation::identifierForInitialRequestImpl(InspectorAgent* inspectorAgent, unsigned long identifier, DocumentLoader* loader, const ResourceRequest& request)
 {
-    if (!ic->enabled())
+    if (!inspectorAgent->enabled())
         return;
-    ic->ensureSettingsLoaded();
 
-    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(ic))
+    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
         resourceAgent->identifierForInitialRequest(identifier, request.url(), loader);
 }
 
-void InspectorInstrumentation::willSendRequestImpl(InspectorController* ic, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
+void InspectorInstrumentation::applyUserAgentOverrideImpl(InspectorAgent* inspectorAgent, String* userAgent)
 {
-    ic->willSendRequest(request);
-    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(ic))
+    inspectorAgent->applyUserAgentOverride(userAgent);
+}
+
+void InspectorInstrumentation::willSendRequestImpl(InspectorAgent* inspectorAgent, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
+{
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent))
         timelineAgent->willSendResourceRequest(identifier, request);
-    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(ic))
+    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
         resourceAgent->willSendRequest(identifier, request, redirectResponse);
 }
 
-void InspectorInstrumentation::markResourceAsCachedImpl(InspectorController* ic, unsigned long identifier)
+void InspectorInstrumentation::markResourceAsCachedImpl(InspectorAgent* inspectorAgent, unsigned long identifier)
 {
-    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(ic))
+    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
         resourceAgent->markResourceAsCached(identifier);
 }
 
-void InspectorInstrumentation::didLoadResourceFromMemoryCacheImpl(InspectorController* ic, DocumentLoader* loader, const CachedResource* cachedResource)
+void InspectorInstrumentation::didLoadResourceFromMemoryCacheImpl(InspectorAgent* inspectorAgent, DocumentLoader* loader, const CachedResource* cachedResource)
 {
-    if (!ic->enabled())
+    if (!inspectorAgent->enabled())
         return;
-    ic->ensureSettingsLoaded();
-    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(ic))
+    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
         resourceAgent->didLoadResourceFromMemoryCache(loader, cachedResource);
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willReceiveResourceDataImpl(InspectorController* inspectorController, unsigned long identifier)
+InspectorInstrumentationCookie InspectorInstrumentation::willReceiveResourceDataImpl(InspectorAgent* inspectorAgent, unsigned long identifier)
 {
     int timelineAgentId = 0;
-    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent);
     if (timelineAgent) {
         timelineAgent->willReceiveResourceData(identifier);
         timelineAgentId = timelineAgent->id();
     }
-    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+    return InspectorInstrumentationCookie(inspectorAgent, timelineAgentId);
 }
 
 void InspectorInstrumentation::didReceiveResourceDataImpl(const InspectorInstrumentationCookie& cookie)
@@ -417,93 +425,93 @@ void InspectorInstrumentation::didReceiveResourceDataImpl(const InspectorInstrum
         timelineAgent->didReceiveResourceData();
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willReceiveResourceResponseImpl(InspectorController* inspectorController, unsigned long identifier, const ResourceResponse& response)
+InspectorInstrumentationCookie InspectorInstrumentation::willReceiveResourceResponseImpl(InspectorAgent* inspectorAgent, unsigned long identifier, const ResourceResponse& response)
 {
     int timelineAgentId = 0;
-    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent);
     if (timelineAgent) {
         timelineAgent->willReceiveResourceResponse(identifier, response);
         timelineAgentId = timelineAgent->id();
     }
-    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+    return InspectorInstrumentationCookie(inspectorAgent, timelineAgentId);
 }
 
 void InspectorInstrumentation::didReceiveResourceResponseImpl(const InspectorInstrumentationCookie& cookie, unsigned long identifier, DocumentLoader* loader, const ResourceResponse& response)
 {
-    InspectorController* ic = cookie.first;
-    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(ic))
+    InspectorAgent* inspectorAgent = cookie.first;
+    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
         resourceAgent->didReceiveResponse(identifier, loader, response);
-    ic->consoleAgent()->didReceiveResponse(identifier, response);
+    inspectorAgent->consoleAgent()->didReceiveResponse(identifier, response);
     if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie))
         timelineAgent->didReceiveResourceResponse();
 }
 
-void InspectorInstrumentation::didReceiveContentLengthImpl(InspectorController* ic, unsigned long identifier, int lengthReceived)
+void InspectorInstrumentation::didReceiveContentLengthImpl(InspectorAgent* inspectorAgent, unsigned long identifier, int lengthReceived)
 {
-    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(ic))
+    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
         resourceAgent->didReceiveContentLength(identifier, lengthReceived);
 }
 
-void InspectorInstrumentation::didFinishLoadingImpl(InspectorController* ic, unsigned long identifier, double finishTime)
+void InspectorInstrumentation::didFinishLoadingImpl(InspectorAgent* inspectorAgent, unsigned long identifier, double finishTime)
 {
-    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(ic))
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent))
         timelineAgent->didFinishLoadingResource(identifier, false, finishTime);
-    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(ic))
+    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
         resourceAgent->didFinishLoading(identifier, finishTime);
 }
 
-void InspectorInstrumentation::didFailLoadingImpl(InspectorController* ic, unsigned long identifier, const ResourceError& error)
+void InspectorInstrumentation::didFailLoadingImpl(InspectorAgent* inspectorAgent, unsigned long identifier, const ResourceError& error)
 {
-    ic->consoleAgent()->didFailLoading(identifier, error);
-    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(ic))
+    inspectorAgent->consoleAgent()->didFailLoading(identifier, error);
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent))
         timelineAgent->didFinishLoadingResource(identifier, true, 0);
-    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(ic))
+    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
         resourceAgent->didFailLoading(identifier, error);
 }
 
-void InspectorInstrumentation::resourceRetrievedByXMLHttpRequestImpl(InspectorController* ic, unsigned long identifier, const String& sourceString, const String& url, const String& sendURL, unsigned sendLineNumber)
+void InspectorInstrumentation::resourceRetrievedByXMLHttpRequestImpl(InspectorAgent* inspectorAgent, unsigned long identifier, const String& sourceString, const String& url, const String& sendURL, unsigned sendLineNumber)
 {
-    ic->consoleAgent()->resourceRetrievedByXMLHttpRequest(url, sendURL, sendLineNumber);
-    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(ic))
+    inspectorAgent->consoleAgent()->resourceRetrievedByXMLHttpRequest(url, sendURL, sendLineNumber);
+    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
         resourceAgent->setInitialContent(identifier, sourceString, "XHR");
 }
 
-void InspectorInstrumentation::scriptImportedImpl(InspectorController* ic, unsigned long identifier, const String& sourceString)
+void InspectorInstrumentation::scriptImportedImpl(InspectorAgent* inspectorAgent, unsigned long identifier, const String& sourceString)
 {
-    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(ic))
+    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
         resourceAgent->setInitialContent(identifier, sourceString, "Script");
 }
 
-void InspectorInstrumentation::mainResourceFiredLoadEventImpl(InspectorController* inspectorController, Frame* frame, const KURL& url)
+void InspectorInstrumentation::domContentLoadedEventFiredImpl(InspectorAgent* inspectorAgent, Frame* frame, const KURL& url)
 {
-    inspectorController->mainResourceFiredLoadEvent(frame->loader()->documentLoader(), url);
+    inspectorAgent->domContentLoadedEventFired(frame->loader()->documentLoader(), url);
 }
 
-void InspectorInstrumentation::mainResourceFiredDOMContentEventImpl(InspectorController* inspectorController, Frame* frame, const KURL& url)
+void InspectorInstrumentation::loadEventFiredImpl(InspectorAgent* inspectorAgent, Frame* frame, const KURL& url)
 {
-    inspectorController->mainResourceFiredDOMContentEvent(frame->loader()->documentLoader(), url);
+    inspectorAgent->loadEventFired(frame->loader()->documentLoader(), url);
 }
 
-void InspectorInstrumentation::frameDetachedFromParentImpl(InspectorController* inspectorController, Frame* frame)
+void InspectorInstrumentation::frameDetachedFromParentImpl(InspectorAgent* inspectorAgent, Frame* frame)
 {
-    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorController))
+    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
         resourceAgent->frameDetachedFromParent(frame);
 }
 
-void InspectorInstrumentation::didCommitLoadImpl(InspectorController* inspectorController, DocumentLoader* loader)
+void InspectorInstrumentation::didCommitLoadImpl(InspectorAgent* inspectorAgent, DocumentLoader* loader)
 {
-    inspectorController->didCommitLoad(loader);
+    inspectorAgent->didCommitLoad(loader);
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willWriteHTMLImpl(InspectorController* inspectorController, unsigned int length, unsigned int startLine)
+InspectorInstrumentationCookie InspectorInstrumentation::willWriteHTMLImpl(InspectorAgent* inspectorAgent, unsigned int length, unsigned int startLine)
 {
     int timelineAgentId = 0;
-    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent);
     if (timelineAgent) {
         timelineAgent->willWriteHTML(length, startLine);
         timelineAgentId = timelineAgent->id();
     }
-    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+    return InspectorInstrumentationCookie(inspectorAgent, timelineAgentId);
 }
 
 void InspectorInstrumentation::didWriteHTMLImpl(const InspectorInstrumentationCookie& cookie, unsigned int endLine)
@@ -512,161 +520,154 @@ void InspectorInstrumentation::didWriteHTMLImpl(const InspectorInstrumentationCo
         timelineAgent->didWriteHTML(endLine);
 }
 
-void InspectorInstrumentation::addMessageToConsoleImpl(InspectorController* inspectorController, MessageSource source, MessageType type, MessageLevel level, const String& message, ScriptArguments* arguments, ScriptCallStack* callStack)
+void InspectorInstrumentation::addMessageToConsoleImpl(InspectorAgent* inspectorAgent, MessageSource source, MessageType type, MessageLevel level, const String& message, PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack)
 {
-    inspectorController->consoleAgent()->addMessageToConsole(source, type, level, message, arguments, callStack);
+    inspectorAgent->consoleAgent()->addMessageToConsole(source, type, level, message, arguments, callStack);
 }
 
-void InspectorInstrumentation::addMessageToConsoleImpl(InspectorController* inspectorController, MessageSource source, MessageType type, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceID)
+void InspectorInstrumentation::addMessageToConsoleImpl(InspectorAgent* inspectorAgent, MessageSource source, MessageType type, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceID)
 {
-    inspectorController->consoleAgent()->addMessageToConsole(source, type, level, message, lineNumber, sourceID);
+    inspectorAgent->consoleAgent()->addMessageToConsole(source, type, level, message, lineNumber, sourceID);
 }
 
-void InspectorInstrumentation::consoleCountImpl(InspectorController* inspectorController, ScriptArguments* arguments, ScriptCallStack* stack)
+void InspectorInstrumentation::consoleCountImpl(InspectorAgent* inspectorAgent, PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> stack)
 {
-    inspectorController->consoleAgent()->count(arguments, stack);
+    inspectorAgent->consoleAgent()->count(arguments, stack);
 }
 
-void InspectorInstrumentation::startConsoleTimingImpl(InspectorController* inspectorController, const String& title)
+void InspectorInstrumentation::startConsoleTimingImpl(InspectorAgent* inspectorAgent, const String& title)
 {
-    inspectorController->consoleAgent()->startTiming(title);
+    inspectorAgent->consoleAgent()->startTiming(title);
 }
 
-void InspectorInstrumentation::stopConsoleTimingImpl(InspectorController* inspectorController, const String& title, ScriptCallStack* stack)
+void InspectorInstrumentation::stopConsoleTimingImpl(InspectorAgent* inspectorAgent, const String& title, PassRefPtr<ScriptCallStack> stack)
 {
-    inspectorController->consoleAgent()->stopTiming(title, stack);
+    inspectorAgent->consoleAgent()->stopTiming(title, stack);
 }
 
-void InspectorInstrumentation::consoleMarkTimelineImpl(InspectorController* inspectorController, ScriptArguments* arguments)
+void InspectorInstrumentation::consoleMarkTimelineImpl(InspectorAgent* inspectorAgent, PassRefPtr<ScriptArguments> arguments)
 {
-    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController)) {
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent)) {
         String message;
         arguments->getFirstArgumentAsString(message);
         timelineAgent->didMarkTimeline(message);
-    }
+     }
 }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-void InspectorInstrumentation::addStartProfilingMessageToConsoleImpl(InspectorController* inspectorController, const String& title, unsigned lineNumber, const String& sourceURL)
+void InspectorInstrumentation::addStartProfilingMessageToConsoleImpl(InspectorAgent* inspectorAgent, const String& title, unsigned lineNumber, const String& sourceURL)
 {
-    if (InspectorProfilerAgent* profilerAgent = inspectorController->profilerAgent())
+    if (InspectorProfilerAgent* profilerAgent = inspectorAgent->profilerAgent())
         profilerAgent->addStartProfilingMessageToConsole(title, lineNumber, sourceURL);
 }
 
-void InspectorInstrumentation::addProfileImpl(InspectorController* inspectorController, RefPtr<ScriptProfile> profile, ScriptCallStack* callStack)
+void InspectorInstrumentation::addProfileImpl(InspectorAgent* inspectorAgent, RefPtr<ScriptProfile> profile, PassRefPtr<ScriptCallStack> callStack)
 {
-    if (InspectorProfilerAgent* profilerAgent = inspectorController->profilerAgent()) {
+    if (InspectorProfilerAgent* profilerAgent = inspectorAgent->profilerAgent()) {
         const ScriptCallFrame& lastCaller = callStack->at(0);
         profilerAgent->addProfile(profile, lastCaller.lineNumber(), lastCaller.sourceURL());
     }
 }
 
-bool InspectorInstrumentation::profilerEnabledImpl(InspectorController* inspectorController)
+String InspectorInstrumentation::getCurrentUserInitiatedProfileNameImpl(InspectorAgent* inspectorAgent, bool incrementProfileNumber)
 {
-    if (!inspectorController->enabled())
-        return false;
-
-    InspectorProfilerAgent* profilerAgent = inspectorController->profilerAgent();
-    if (!profilerAgent)
-        return false;
-
-    return profilerAgent->enabled();
+    if (InspectorProfilerAgent* profilerAgent = inspectorAgent->profilerAgent())
+        return profilerAgent->getCurrentUserInitiatedProfileName(incrementProfileNumber);
+    return "";
 }
 
-String InspectorInstrumentation::getCurrentUserInitiatedProfileNameImpl(InspectorController* inspectorController, bool incrementProfileNumber)
+bool InspectorInstrumentation::profilerEnabledImpl(InspectorAgent* inspectorAgent)
 {
-    if (InspectorProfilerAgent* profilerAgent = inspectorController->profilerAgent())
-        return profilerAgent->getCurrentUserInitiatedProfileName(incrementProfileNumber);
-    return "";
+    return inspectorAgent->profilerEnabled();
 }
 #endif
 
 #if ENABLE(DATABASE)
-void InspectorInstrumentation::didOpenDatabaseImpl(InspectorController* inspectorController, Database* database, const String& domain, const String& name, const String& version)
+void InspectorInstrumentation::didOpenDatabaseImpl(InspectorAgent* inspectorAgent, PassRefPtr<Database> database, const String& domain, const String& name, const String& version)
 {
-    inspectorController->didOpenDatabase(database, domain, name, version);
+    inspectorAgent->didOpenDatabase(database, domain, name, version);
 }
 #endif
 
 #if ENABLE(DOM_STORAGE)
-void InspectorInstrumentation::didUseDOMStorageImpl(InspectorController* inspectorController, StorageArea* storageArea, bool isLocalStorage, Frame* frame)
+void InspectorInstrumentation::didUseDOMStorageImpl(InspectorAgent* inspectorAgent, StorageArea* storageArea, bool isLocalStorage, Frame* frame)
 {
-    inspectorController->didUseDOMStorage(storageArea, isLocalStorage, frame);
+    inspectorAgent->didUseDOMStorage(storageArea, isLocalStorage, frame);
 }
 #endif
 
 #if ENABLE(WORKERS)
-void InspectorInstrumentation::didCreateWorkerImpl(InspectorController* inspectorController, intptr_t id, const String& url, bool isSharedWorker)
+void InspectorInstrumentation::didCreateWorkerImpl(InspectorAgent* inspectorAgent, intptr_t id, const String& url, bool isSharedWorker)
 {
-    inspectorController->didCreateWorker(id, url, isSharedWorker);
+    inspectorAgent->didCreateWorker(id, url, isSharedWorker);
 }
 
-void InspectorInstrumentation::didDestroyWorkerImpl(InspectorController* inspectorController, intptr_t id)
+void InspectorInstrumentation::didDestroyWorkerImpl(InspectorAgent* inspectorAgent, intptr_t id)
 {
-    inspectorController->didDestroyWorker(id);
+    inspectorAgent->didDestroyWorker(id);
 }
 #endif
 
 #if ENABLE(WEB_SOCKETS)
-void InspectorInstrumentation::didCreateWebSocketImpl(InspectorController* inspectorController, unsigned long identifier, const KURL& requestURL, const KURL& documentURL)
+void InspectorInstrumentation::didCreateWebSocketImpl(InspectorAgent* inspectorAgent, unsigned long identifier, const KURL& requestURL, const KURL& documentURL)
 {
-    inspectorController->didCreateWebSocket(identifier, requestURL, documentURL);
+    inspectorAgent->didCreateWebSocket(identifier, requestURL, documentURL);
 }
 
-void InspectorInstrumentation::willSendWebSocketHandshakeRequestImpl(InspectorController* inspectorController, unsigned long identifier, const WebSocketHandshakeRequest& request)
+void InspectorInstrumentation::willSendWebSocketHandshakeRequestImpl(InspectorAgent* inspectorAgent, unsigned long identifier, const WebSocketHandshakeRequest& request)
 {
-    inspectorController->willSendWebSocketHandshakeRequest(identifier, request);
+    inspectorAgent->willSendWebSocketHandshakeRequest(identifier, request);
 }
 
-void InspectorInstrumentation::didReceiveWebSocketHandshakeResponseImpl(InspectorController* inspectorController, unsigned long identifier, const WebSocketHandshakeResponse& response)
+void InspectorInstrumentation::didReceiveWebSocketHandshakeResponseImpl(InspectorAgent* inspectorAgent, unsigned long identifier, const WebSocketHandshakeResponse& response)
 {
-    inspectorController->didReceiveWebSocketHandshakeResponse(identifier, response);
+    inspectorAgent->didReceiveWebSocketHandshakeResponse(identifier, response);
 }
 
-void InspectorInstrumentation::didCloseWebSocketImpl(InspectorController* inspectorController, unsigned long identifier)
+void InspectorInstrumentation::didCloseWebSocketImpl(InspectorAgent* inspectorAgent, unsigned long identifier)
 {
-    inspectorController->didCloseWebSocket(identifier);
+    inspectorAgent->didCloseWebSocket(identifier);
 }
 #endif
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-void InspectorInstrumentation::networkStateChangedImpl(InspectorController* ic)
+void InspectorInstrumentation::networkStateChangedImpl(InspectorAgent* inspectorAgent)
 {
-    if (InspectorApplicationCacheAgent* applicationCacheAgent = ic->applicationCacheAgent())
+    if (InspectorApplicationCacheAgent* applicationCacheAgent = inspectorAgent->applicationCacheAgent())
         applicationCacheAgent->networkStateChanged();
 }
 
-void InspectorInstrumentation::updateApplicationCacheStatusImpl(InspectorController* ic, Frame* frame)
+void InspectorInstrumentation::updateApplicationCacheStatusImpl(InspectorAgent* inspectorAgent, Frame* frame)
 {
-    if (InspectorApplicationCacheAgent* applicationCacheAgent = ic->applicationCacheAgent())
+    if (InspectorApplicationCacheAgent* applicationCacheAgent = inspectorAgent->applicationCacheAgent())
         applicationCacheAgent->updateApplicationCacheStatus(frame);
 }
 #endif
 
-bool InspectorInstrumentation::hasFrontend(InspectorController* inspectorController)
+bool InspectorInstrumentation::hasFrontend(InspectorAgent* inspectorAgent)
 {
-    return inspectorController->hasFrontend();
+    return inspectorAgent->hasFrontend();
 }
 
-void InspectorInstrumentation::pauseOnNativeEventIfNeeded(InspectorController* inspectorController, const String& categoryType, const String& eventName, bool synchronous)
+void InspectorInstrumentation::pauseOnNativeEventIfNeeded(InspectorAgent* inspectorAgent, const String& categoryType, const String& eventName, bool synchronous)
 {
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (InspectorBrowserDebuggerAgent* browserDebuggerAgent = inspectorController->browserDebuggerAgent())
+    if (InspectorBrowserDebuggerAgent* browserDebuggerAgent = inspectorAgent->browserDebuggerAgent())
         browserDebuggerAgent->pauseOnNativeEventIfNeeded(categoryType, eventName, synchronous);
 #endif
 }
 
-void InspectorInstrumentation::cancelPauseOnNativeEvent(InspectorController* inspectorController)
+void InspectorInstrumentation::cancelPauseOnNativeEvent(InspectorAgent* inspectorAgent)
 {
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (InspectorDebuggerAgent* debuggerAgent = inspectorController->debuggerAgent())
+    if (InspectorDebuggerAgent* debuggerAgent = inspectorAgent->debuggerAgent())
         debuggerAgent->cancelPauseOnNextStatement();
 #endif
 }
 
-InspectorTimelineAgent* InspectorInstrumentation::retrieveTimelineAgent(InspectorController* inspectorController)
+InspectorTimelineAgent* InspectorInstrumentation::retrieveTimelineAgent(InspectorAgent* inspectorAgent)
 {
-    return inspectorController->timelineAgent();
+    return inspectorAgent->timelineAgent();
 }
 
 InspectorTimelineAgent* InspectorInstrumentation::retrieveTimelineAgent(const InspectorInstrumentationCookie& cookie)
@@ -677,9 +678,9 @@ InspectorTimelineAgent* InspectorInstrumentation::retrieveTimelineAgent(const In
     return 0;
 }
 
-InspectorResourceAgent* InspectorInstrumentation::retrieveResourceAgent(InspectorController* ic)
+InspectorResourceAgent* InspectorInstrumentation::retrieveResourceAgent(InspectorAgent* inspectorAgent)
 {
-    return ic->resourceAgent();
+    return inspectorAgent->resourceAgent();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.h b/Source/WebCore/inspector/InspectorInstrumentation.h
index 7a7ee43..e406e40 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.h
+++ b/Source/WebCore/inspector/InspectorInstrumentation.h
@@ -35,8 +35,7 @@
 #include "Frame.h"
 #include "Page.h"
 #include "ScriptExecutionContext.h"
-
-#include <wtf/PassRefPtr.h>
+#include <wtf/HashMap.h>
 
 namespace WebCore {
 
@@ -48,7 +47,7 @@ class Element;
 class EventContext;
 class DocumentLoader;
 class HitTestResult;
-class InspectorController;
+class InspectorAgent;
 class InspectorResourceAgent;
 class InspectorTimelineAgent;
 class KURL;
@@ -66,7 +65,7 @@ class WebSocketHandshakeRequest;
 class WebSocketHandshakeResponse;
 #endif
 
-typedef pair<InspectorController*, int> InspectorInstrumentationCookie;
+typedef pair<InspectorAgent*, int> InspectorInstrumentationCookie;
 
 class InspectorInstrumentation {
 public:
@@ -109,6 +108,7 @@ public:
     static InspectorInstrumentationCookie willRecalculateStyle(Document*);
     static void didRecalculateStyle(const InspectorInstrumentationCookie&);
 
+    static void applyUserAgentOverride(Frame*, String*);
     static void identifierForInitialRequest(Frame*, unsigned long identifier, DocumentLoader*, const ResourceRequest&);
     static void willSendRequest(Frame*, unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
     static void markResourceAsCached(Page*, unsigned long identifier);
@@ -122,30 +122,30 @@ public:
     static void didFailLoading(Frame*, unsigned long identifier, const ResourceError&);
     static void resourceRetrievedByXMLHttpRequest(ScriptExecutionContext*, unsigned long identifier, const String& sourceString, const String& url, const String& sendURL, unsigned sendLineNumber);
     static void scriptImported(ScriptExecutionContext*, unsigned long identifier, const String& sourceString);
-    static void mainResourceFiredLoadEvent(Frame*, const KURL&);
-    static void mainResourceFiredDOMContentEvent(Frame*, const KURL&);
+    static void domContentLoadedEventFired(Frame*, const KURL&);
+    static void loadEventFired(Frame*, const KURL&);
     static void frameDetachedFromParent(Frame*);
     static void didCommitLoad(Frame*, DocumentLoader*);
 
     static InspectorInstrumentationCookie willWriteHTML(Document*, unsigned int length, unsigned int startLine);
     static void didWriteHTML(const InspectorInstrumentationCookie&, unsigned int endLine);
 
-    static void addMessageToConsole(Page*, MessageSource, MessageType, MessageLevel, const String& message, ScriptArguments*, ScriptCallStack*);
+    static void addMessageToConsole(Page*, MessageSource, MessageType, MessageLevel, const String& message, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
     static void addMessageToConsole(Page*, MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String&);
-    static void consoleCount(Page*, ScriptArguments*, ScriptCallStack*);
+    static void consoleCount(Page*, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
     static void startConsoleTiming(Page*, const String& title);
-    static void stopConsoleTiming(Page*, const String& title, ScriptCallStack*);
-    static void consoleMarkTimeline(Page*, ScriptArguments*);
+    static void stopConsoleTiming(Page*, const String& title, PassRefPtr<ScriptCallStack>);
+    static void consoleMarkTimeline(Page*, PassRefPtr<ScriptArguments>);
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     static void addStartProfilingMessageToConsole(Page*, const String& title, unsigned lineNumber, const String& sourceURL);
-    static void addProfile(Page*, RefPtr<ScriptProfile>, ScriptCallStack*);
-    static bool profilerEnabled(Page*);
+    static void addProfile(Page*, RefPtr<ScriptProfile>, PassRefPtr<ScriptCallStack>);
     static String getCurrentUserInitiatedProfileName(Page*, bool incrementProfileNumber);
+    static bool profilerEnabled(Page*);
 #endif
 
 #if ENABLE(DATABASE)
-    static void didOpenDatabase(ScriptExecutionContext*, Database*, const String& domain, const String& name, const String& version);
+    static void didOpenDatabase(ScriptExecutionContext*, PassRefPtr<Database>, const String& domain, const String& name, const String& version);
 #endif
 
 #if ENABLE(DOM_STORAGE)
@@ -171,129 +171,136 @@ public:
 #endif
 
 #if ENABLE(INSPECTOR)
+    static void bindInspectorAgent(Page* page, InspectorAgent* inspectorAgent) { inspectorAgents().set(page, inspectorAgent); }
+    static void unbindInspectorAgent(Page* page) { inspectorAgents().remove(page); }
     static void frontendCreated() { s_frontendCounter += 1; }
     static void frontendDeleted() { s_frontendCounter -= 1; }
     static bool hasFrontends() { return s_frontendCounter; }
+    static bool hasFrontend(Page*);
 #else
     static bool hasFrontends() { return false; }
+    static bool hasFrontend(Page*) { return false; }
 #endif
 
 private:
 #if ENABLE(INSPECTOR)
-    static void didClearWindowObjectInWorldImpl(InspectorController*, Frame*, DOMWrapperWorld*);
-    static void inspectedPageDestroyedImpl(InspectorController*);
+    static void didClearWindowObjectInWorldImpl(InspectorAgent*, Frame*, DOMWrapperWorld*);
+    static void inspectedPageDestroyedImpl(InspectorAgent*);
 
-    static void willInsertDOMNodeImpl(InspectorController*, Node* node, Node* parent);
-    static void didInsertDOMNodeImpl(InspectorController*, Node*);
-    static void willRemoveDOMNodeImpl(InspectorController*, Node*);
-    static void didRemoveDOMNodeImpl(InspectorController*, Node*);
-    static void willModifyDOMAttrImpl(InspectorController*, Element*);
-    static void didModifyDOMAttrImpl(InspectorController*, Element*);
-    static void characterDataModifiedImpl(InspectorController*, CharacterData*);
+    static void willInsertDOMNodeImpl(InspectorAgent*, Node* node, Node* parent);
+    static void didInsertDOMNodeImpl(InspectorAgent*, Node*);
+    static void willRemoveDOMNodeImpl(InspectorAgent*, Node*);
+    static void didRemoveDOMNodeImpl(InspectorAgent*, Node*);
+    static void willModifyDOMAttrImpl(InspectorAgent*, Element*);
+    static void didModifyDOMAttrImpl(InspectorAgent*, Element*);
+    static void characterDataModifiedImpl(InspectorAgent*, CharacterData*);
 
-    static void mouseDidMoveOverElementImpl(InspectorController*, const HitTestResult&, unsigned modifierFlags);
-    static bool handleMousePressImpl(InspectorController*);
+    static void mouseDidMoveOverElementImpl(InspectorAgent*, const HitTestResult&, unsigned modifierFlags);
+    static bool handleMousePressImpl(InspectorAgent*);
 
-    static void willSendXMLHttpRequestImpl(InspectorController*, const String& url);
-    static void didScheduleResourceRequestImpl(InspectorController*, const String& url);
-    static void didInstallTimerImpl(InspectorController*, int timerId, int timeout, bool singleShot);
-    static void didRemoveTimerImpl(InspectorController*, int timerId);
+    static void willSendXMLHttpRequestImpl(InspectorAgent*, const String& url);
+    static void didScheduleResourceRequestImpl(InspectorAgent*, const String& url);
+    static void didInstallTimerImpl(InspectorAgent*, int timerId, int timeout, bool singleShot);
+    static void didRemoveTimerImpl(InspectorAgent*, int timerId);
 
-    static InspectorInstrumentationCookie willCallFunctionImpl(InspectorController*, const String& scriptName, int scriptLine);
+    static InspectorInstrumentationCookie willCallFunctionImpl(InspectorAgent*, const String& scriptName, int scriptLine);
     static void didCallFunctionImpl(const InspectorInstrumentationCookie&);
-    static InspectorInstrumentationCookie willChangeXHRReadyStateImpl(InspectorController*, XMLHttpRequest* request);
+    static InspectorInstrumentationCookie willChangeXHRReadyStateImpl(InspectorAgent*, XMLHttpRequest* request);
     static void didChangeXHRReadyStateImpl(const InspectorInstrumentationCookie&);
-    static InspectorInstrumentationCookie willDispatchEventImpl(InspectorController*, const Event& event, DOMWindow* window, Node* node, const Vector<EventContext>& ancestors);
+    static InspectorInstrumentationCookie willDispatchEventImpl(InspectorAgent*, const Event& event, DOMWindow* window, Node* node, const Vector<EventContext>& ancestors);
     static void didDispatchEventImpl(const InspectorInstrumentationCookie&);
-    static InspectorInstrumentationCookie willDispatchEventOnWindowImpl(InspectorController*, const Event& event, DOMWindow* window);
+    static InspectorInstrumentationCookie willDispatchEventOnWindowImpl(InspectorAgent*, const Event& event, DOMWindow* window);
     static void didDispatchEventOnWindowImpl(const InspectorInstrumentationCookie&);
-    static InspectorInstrumentationCookie willEvaluateScriptImpl(InspectorController*, const String& url, int lineNumber);
+    static InspectorInstrumentationCookie willEvaluateScriptImpl(InspectorAgent*, const String& url, int lineNumber);
     static void didEvaluateScriptImpl(const InspectorInstrumentationCookie&);
-    static InspectorInstrumentationCookie willFireTimerImpl(InspectorController*, int timerId);
+    static InspectorInstrumentationCookie willFireTimerImpl(InspectorAgent*, int timerId);
     static void didFireTimerImpl(const InspectorInstrumentationCookie&);
-    static InspectorInstrumentationCookie willLayoutImpl(InspectorController*);
+    static InspectorInstrumentationCookie willLayoutImpl(InspectorAgent*);
     static void didLayoutImpl(const InspectorInstrumentationCookie&);
-    static InspectorInstrumentationCookie willLoadXHRImpl(InspectorController*, XMLHttpRequest* request);
+    static InspectorInstrumentationCookie willLoadXHRImpl(InspectorAgent*, XMLHttpRequest* request);
     static void didLoadXHRImpl(const InspectorInstrumentationCookie&);
-    static InspectorInstrumentationCookie willPaintImpl(InspectorController*, const IntRect& rect);
+    static InspectorInstrumentationCookie willPaintImpl(InspectorAgent*, const IntRect& rect);
     static void didPaintImpl(const InspectorInstrumentationCookie&);
-    static InspectorInstrumentationCookie willRecalculateStyleImpl(InspectorController*);
+    static InspectorInstrumentationCookie willRecalculateStyleImpl(InspectorAgent*);
     static void didRecalculateStyleImpl(const InspectorInstrumentationCookie&);
-    static void identifierForInitialRequestImpl(InspectorController*, unsigned long identifier, DocumentLoader*, const ResourceRequest&);
-    static void willSendRequestImpl(InspectorController*, unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
-    static void markResourceAsCachedImpl(InspectorController*, unsigned long identifier);
-    static void didLoadResourceFromMemoryCacheImpl(InspectorController*, DocumentLoader*, const CachedResource*);
-    static InspectorInstrumentationCookie willReceiveResourceDataImpl(InspectorController*, unsigned long identifier);
+
+    static void applyUserAgentOverrideImpl(InspectorAgent*, String*);
+    static void identifierForInitialRequestImpl(InspectorAgent*, unsigned long identifier, DocumentLoader*, const ResourceRequest&);
+    static void willSendRequestImpl(InspectorAgent*, unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
+    static void markResourceAsCachedImpl(InspectorAgent*, unsigned long identifier);
+    static void didLoadResourceFromMemoryCacheImpl(InspectorAgent*, DocumentLoader*, const CachedResource*);
+    static InspectorInstrumentationCookie willReceiveResourceDataImpl(InspectorAgent*, unsigned long identifier);
     static void didReceiveResourceDataImpl(const InspectorInstrumentationCookie&);
-    static InspectorInstrumentationCookie willReceiveResourceResponseImpl(InspectorController*, unsigned long identifier, const ResourceResponse&);
+    static InspectorInstrumentationCookie willReceiveResourceResponseImpl(InspectorAgent*, unsigned long identifier, const ResourceResponse&);
     static void didReceiveResourceResponseImpl(const InspectorInstrumentationCookie&, unsigned long identifier, DocumentLoader*, const ResourceResponse&);
-    static void didReceiveContentLengthImpl(InspectorController*, unsigned long identifier, int lengthReceived);
-    static void didFinishLoadingImpl(InspectorController*, unsigned long identifier, double finishTime);
-    static void didFailLoadingImpl(InspectorController*, unsigned long identifier, const ResourceError&);
-    static void resourceRetrievedByXMLHttpRequestImpl(InspectorController*, unsigned long identifier, const String& sourceString, const String& url, const String& sendURL, unsigned sendLineNumber);
-    static void scriptImportedImpl(InspectorController*, unsigned long identifier, const String& sourceString);
-    static void mainResourceFiredLoadEventImpl(InspectorController*, Frame*, const KURL&);
-    static void mainResourceFiredDOMContentEventImpl(InspectorController*, Frame*, const KURL&);
-    static void frameDetachedFromParentImpl(InspectorController*, Frame*);
-    static void didCommitLoadImpl(InspectorController*, DocumentLoader*);
-
-    static InspectorInstrumentationCookie willWriteHTMLImpl(InspectorController*, unsigned int length, unsigned int startLine);
+    static void didReceiveContentLengthImpl(InspectorAgent*, unsigned long identifier, int lengthReceived);
+    static void didFinishLoadingImpl(InspectorAgent*, unsigned long identifier, double finishTime);
+    static void didFailLoadingImpl(InspectorAgent*, unsigned long identifier, const ResourceError&);
+    static void resourceRetrievedByXMLHttpRequestImpl(InspectorAgent*, unsigned long identifier, const String& sourceString, const String& url, const String& sendURL, unsigned sendLineNumber);
+    static void scriptImportedImpl(InspectorAgent*, unsigned long identifier, const String& sourceString);
+    static void domContentLoadedEventFiredImpl(InspectorAgent*, Frame*, const KURL&);
+    static void loadEventFiredImpl(InspectorAgent*, Frame*, const KURL&);
+    static void frameDetachedFromParentImpl(InspectorAgent*, Frame*);
+    static void didCommitLoadImpl(InspectorAgent*, DocumentLoader*);
+
+    static InspectorInstrumentationCookie willWriteHTMLImpl(InspectorAgent*, unsigned int length, unsigned int startLine);
     static void didWriteHTMLImpl(const InspectorInstrumentationCookie&, unsigned int endLine);
 
-    static void addMessageToConsoleImpl(InspectorController*, MessageSource, MessageType, MessageLevel, const String& message, ScriptArguments*, ScriptCallStack*);
-    static void addMessageToConsoleImpl(InspectorController*, MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceID);
-    static void consoleCountImpl(InspectorController*, ScriptArguments*, ScriptCallStack*);
-    static void startConsoleTimingImpl(InspectorController*, const String& title);
-    static void stopConsoleTimingImpl(InspectorController*, const String& title, ScriptCallStack*);
-    static void consoleMarkTimelineImpl(InspectorController*, ScriptArguments*);
+    static void addMessageToConsoleImpl(InspectorAgent*, MessageSource, MessageType, MessageLevel, const String& message, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
+    static void addMessageToConsoleImpl(InspectorAgent*, MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceID);
+    static void consoleCountImpl(InspectorAgent*, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
+    static void startConsoleTimingImpl(InspectorAgent*, const String& title);
+    static void stopConsoleTimingImpl(InspectorAgent*, const String& title, PassRefPtr<ScriptCallStack>);
+    static void consoleMarkTimelineImpl(InspectorAgent*, PassRefPtr<ScriptArguments>);
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    static void addStartProfilingMessageToConsoleImpl(InspectorController*, const String& title, unsigned lineNumber, const String& sourceURL);
-    static void addProfileImpl(InspectorController*, RefPtr<ScriptProfile>, ScriptCallStack*);
-    static bool profilerEnabledImpl(InspectorController*);
-    static String getCurrentUserInitiatedProfileNameImpl(InspectorController*, bool incrementProfileNumber);
+    static void addStartProfilingMessageToConsoleImpl(InspectorAgent*, const String& title, unsigned lineNumber, const String& sourceURL);
+    static void addProfileImpl(InspectorAgent*, RefPtr<ScriptProfile>, PassRefPtr<ScriptCallStack>);
+    static String getCurrentUserInitiatedProfileNameImpl(InspectorAgent*, bool incrementProfileNumber);
+    static bool profilerEnabledImpl(InspectorAgent*);
 #endif
 
 #if ENABLE(DATABASE)
-    static void didOpenDatabaseImpl(InspectorController*, Database*, const String& domain, const String& name, const String& version);
+    static void didOpenDatabaseImpl(InspectorAgent*, PassRefPtr<Database>, const String& domain, const String& name, const String& version);
 #endif
 
 #if ENABLE(DOM_STORAGE)
-    static void didUseDOMStorageImpl(InspectorController*, StorageArea*, bool isLocalStorage, Frame*);
+    static void didUseDOMStorageImpl(InspectorAgent*, StorageArea*, bool isLocalStorage, Frame*);
 #endif
 
 #if ENABLE(WORKERS)
-    static void didCreateWorkerImpl(InspectorController*, intptr_t id, const String& url, bool isSharedWorker);
-    static void didDestroyWorkerImpl(InspectorController*, intptr_t id);
+    static void didCreateWorkerImpl(InspectorAgent*, intptr_t id, const String& url, bool isSharedWorker);
+    static void didDestroyWorkerImpl(InspectorAgent*, intptr_t id);
 #endif
 
 #if ENABLE(WEB_SOCKETS)
-    static void didCreateWebSocketImpl(InspectorController*, unsigned long identifier, const KURL& requestURL, const KURL& documentURL);
-    static void willSendWebSocketHandshakeRequestImpl(InspectorController*, unsigned long identifier, const WebSocketHandshakeRequest&);
-    static void didReceiveWebSocketHandshakeResponseImpl(InspectorController*, unsigned long identifier, const WebSocketHandshakeResponse&);
-    static void didCloseWebSocketImpl(InspectorController*, unsigned long identifier);
+    static void didCreateWebSocketImpl(InspectorAgent*, unsigned long identifier, const KURL& requestURL, const KURL& documentURL);
+    static void willSendWebSocketHandshakeRequestImpl(InspectorAgent*, unsigned long identifier, const WebSocketHandshakeRequest&);
+    static void didReceiveWebSocketHandshakeResponseImpl(InspectorAgent*, unsigned long identifier, const WebSocketHandshakeResponse&);
+    static void didCloseWebSocketImpl(InspectorAgent*, unsigned long identifier);
 #endif
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    static void networkStateChangedImpl(InspectorController*);
-    static void updateApplicationCacheStatusImpl(InspectorController*, Frame*);
-#endif
-
-    static InspectorController* inspectorControllerForFrame(Frame*);
-    static InspectorController* inspectorControllerForContext(ScriptExecutionContext*);
-    static InspectorController* inspectorControllerForPage(Page*);
-    static InspectorController* inspectorControllerWithFrontendForContext(ScriptExecutionContext*);
-    static InspectorController* inspectorControllerWithFrontendForDocument(Document*);
-    static InspectorController* inspectorControllerWithFrontendForFrame(Frame*);
-    static InspectorController* inspectorControllerWithFrontendForPage(Page*);
-
-    static bool hasFrontend(InspectorController*);
-    static void pauseOnNativeEventIfNeeded(InspectorController*, const String& categoryType, const String& eventName, bool synchronous);
-    static void cancelPauseOnNativeEvent(InspectorController*);
-    static InspectorTimelineAgent* retrieveTimelineAgent(InspectorController*);
+    static void networkStateChangedImpl(InspectorAgent*);
+    static void updateApplicationCacheStatusImpl(InspectorAgent*, Frame*);
+#endif
+
+    static InspectorAgent* inspectorAgentForFrame(Frame*);
+    static InspectorAgent* inspectorAgentForContext(ScriptExecutionContext*);
+    static InspectorAgent* inspectorAgentForPage(Page*);
+    static InspectorAgent* inspectorAgentWithFrontendForContext(ScriptExecutionContext*);
+    static InspectorAgent* inspectorAgentWithFrontendForDocument(Document*);
+    static InspectorAgent* inspectorAgentWithFrontendForFrame(Frame*);
+    static InspectorAgent* inspectorAgentWithFrontendForPage(Page*);
+
+    static bool hasFrontend(InspectorAgent*);
+    static void pauseOnNativeEventIfNeeded(InspectorAgent*, const String& categoryType, const String& eventName, bool synchronous);
+    static void cancelPauseOnNativeEvent(InspectorAgent*);
+    static InspectorTimelineAgent* retrieveTimelineAgent(InspectorAgent*);
     static InspectorTimelineAgent* retrieveTimelineAgent(const InspectorInstrumentationCookie&);
-    static InspectorResourceAgent* retrieveResourceAgent(InspectorController*);
+    static InspectorResourceAgent* retrieveResourceAgent(InspectorAgent*);
 
+    static HashMap<Page*, InspectorAgent*>& inspectorAgents();
     static int s_frontendCounter;
 #endif
 };
@@ -301,41 +308,41 @@ private:
 inline void InspectorInstrumentation::didClearWindowObjectInWorld(Frame* frame, DOMWrapperWorld* world)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerForFrame(frame))
-        didClearWindowObjectInWorldImpl(inspectorController, frame, world);
+    if (InspectorAgent* inspectorAgent = inspectorAgentForFrame(frame))
+        didClearWindowObjectInWorldImpl(inspectorAgent, frame, world);
 #endif
 }
 
 inline void InspectorInstrumentation::inspectedPageDestroyed(Page* page)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerForPage(page))
-        inspectedPageDestroyedImpl(inspectorController);
+    if (InspectorAgent* inspectorAgent = inspectorAgentForPage(page))
+        inspectedPageDestroyedImpl(inspectorAgent);
 #endif
 }
 
 inline void InspectorInstrumentation::willInsertDOMNode(Document* document, Node* node, Node* parent)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForDocument(document))
-        willInsertDOMNodeImpl(inspectorController, node, parent);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForDocument(document))
+        willInsertDOMNodeImpl(inspectorAgent, node, parent);
 #endif
 }
 
 inline void InspectorInstrumentation::didInsertDOMNode(Document* document, Node* node)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForDocument(document))
-        didInsertDOMNodeImpl(inspectorController, node);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForDocument(document))
+        didInsertDOMNodeImpl(inspectorAgent, node);
 #endif
 }
 
 inline void InspectorInstrumentation::willRemoveDOMNode(Document* document, Node* node)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForDocument(document)) {
-        willRemoveDOMNodeImpl(inspectorController, node);
-        didRemoveDOMNodeImpl(inspectorController, node);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForDocument(document)) {
+        willRemoveDOMNodeImpl(inspectorAgent, node);
+        didRemoveDOMNodeImpl(inspectorAgent, node);
     }
 #endif
 }
@@ -343,32 +350,32 @@ inline void InspectorInstrumentation::willRemoveDOMNode(Document* document, Node
 inline void InspectorInstrumentation::willModifyDOMAttr(Document* document, Element* element)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForDocument(document))
-        willModifyDOMAttrImpl(inspectorController, element);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForDocument(document))
+        willModifyDOMAttrImpl(inspectorAgent, element);
 #endif
 }
 
 inline void InspectorInstrumentation::didModifyDOMAttr(Document* document, Element* element)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForDocument(document))
-        didModifyDOMAttrImpl(inspectorController, element);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForDocument(document))
+        didModifyDOMAttrImpl(inspectorAgent, element);
 #endif
 }
 
 inline void InspectorInstrumentation::mouseDidMoveOverElement(Page* page, const HitTestResult& result, unsigned modifierFlags)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForPage(page))
-        mouseDidMoveOverElementImpl(inspectorController, result, modifierFlags);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForPage(page))
+        mouseDidMoveOverElementImpl(inspectorAgent, result, modifierFlags);
 #endif
 }
 
 inline bool InspectorInstrumentation::handleMousePress(Page* page)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForPage(page))
-        return handleMousePressImpl(inspectorController);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForPage(page))
+        return handleMousePressImpl(inspectorAgent);
 #endif
     return false;
 }
@@ -376,40 +383,40 @@ inline bool InspectorInstrumentation::handleMousePress(Page* page)
 inline void InspectorInstrumentation::characterDataModified(Document* document, CharacterData* characterData)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForDocument(document))
-        characterDataModifiedImpl(inspectorController, characterData);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForDocument(document))
+        characterDataModifiedImpl(inspectorAgent, characterData);
 #endif
 }
 
 inline void InspectorInstrumentation::willSendXMLHttpRequest(ScriptExecutionContext* context, const String& url)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForContext(context))
-        willSendXMLHttpRequestImpl(inspectorController, url);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForContext(context))
+        willSendXMLHttpRequestImpl(inspectorAgent, url);
 #endif
 }
 
 inline void InspectorInstrumentation::didScheduleResourceRequest(Document* document, const String& url)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForDocument(document))
-        didScheduleResourceRequestImpl(inspectorController, url);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForDocument(document))
+        didScheduleResourceRequestImpl(inspectorAgent, url);
 #endif
 }
 
 inline void InspectorInstrumentation::didInstallTimer(ScriptExecutionContext* context, int timerId, int timeout, bool singleShot)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForContext(context))
-        didInstallTimerImpl(inspectorController, timerId, timeout, singleShot);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForContext(context))
+        didInstallTimerImpl(inspectorAgent, timerId, timeout, singleShot);
 #endif
 }
 
 inline void InspectorInstrumentation::didRemoveTimer(ScriptExecutionContext* context, int timerId)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForContext(context))
-        didRemoveTimerImpl(inspectorController, timerId);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForContext(context))
+        didRemoveTimerImpl(inspectorAgent, timerId);
 #endif
 }
 
@@ -417,8 +424,8 @@ inline void InspectorInstrumentation::didRemoveTimer(ScriptExecutionContext* con
 inline InspectorInstrumentationCookie InspectorInstrumentation::willCallFunction(Frame* frame, const String& scriptName, int scriptLine)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForFrame(frame))
-        return willCallFunctionImpl(inspectorController, scriptName, scriptLine);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
+        return willCallFunctionImpl(inspectorAgent, scriptName, scriptLine);
 #endif
     return InspectorInstrumentationCookie();
 }
@@ -434,8 +441,8 @@ inline void InspectorInstrumentation::didCallFunction(const InspectorInstrumenta
 inline InspectorInstrumentationCookie InspectorInstrumentation::willChangeXHRReadyState(ScriptExecutionContext* context, XMLHttpRequest* request)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForContext(context))
-        return willChangeXHRReadyStateImpl(inspectorController, request);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForContext(context))
+        return willChangeXHRReadyStateImpl(inspectorAgent, request);
 #endif
     return InspectorInstrumentationCookie();
 }
@@ -451,8 +458,8 @@ inline void InspectorInstrumentation::didChangeXHRReadyState(const InspectorInst
 inline InspectorInstrumentationCookie InspectorInstrumentation::willDispatchEvent(Document* document, const Event& event, DOMWindow* window, Node* node, const Vector<EventContext>& ancestors)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForDocument(document))
-        return willDispatchEventImpl(inspectorController, event, window, node, ancestors);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForDocument(document))
+        return willDispatchEventImpl(inspectorAgent, event, window, node, ancestors);
 #endif
     return InspectorInstrumentationCookie();
 }
@@ -468,8 +475,8 @@ inline void InspectorInstrumentation::didDispatchEvent(const InspectorInstrument
 inline InspectorInstrumentationCookie InspectorInstrumentation::willDispatchEventOnWindow(Frame* frame, const Event& event, DOMWindow* window)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForFrame(frame))
-        return willDispatchEventOnWindowImpl(inspectorController, event, window);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
+        return willDispatchEventOnWindowImpl(inspectorAgent, event, window);
 #endif
     return InspectorInstrumentationCookie();
 }
@@ -485,8 +492,8 @@ inline void InspectorInstrumentation::didDispatchEventOnWindow(const InspectorIn
 inline InspectorInstrumentationCookie InspectorInstrumentation::willEvaluateScript(Frame* frame, const String& url, int lineNumber)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForFrame(frame))
-        return willEvaluateScriptImpl(inspectorController, url, lineNumber);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
+        return willEvaluateScriptImpl(inspectorAgent, url, lineNumber);
 #endif
     return InspectorInstrumentationCookie();
 }
@@ -502,8 +509,8 @@ inline void InspectorInstrumentation::didEvaluateScript(const InspectorInstrumen
 inline InspectorInstrumentationCookie InspectorInstrumentation::willFireTimer(ScriptExecutionContext* context, int timerId)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForContext(context))
-        return willFireTimerImpl(inspectorController, timerId);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForContext(context))
+        return willFireTimerImpl(inspectorAgent, timerId);
 #endif
     return InspectorInstrumentationCookie();
 }
@@ -519,8 +526,8 @@ inline void InspectorInstrumentation::didFireTimer(const InspectorInstrumentatio
 inline InspectorInstrumentationCookie InspectorInstrumentation::willLayout(Frame* frame)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForFrame(frame))
-        return willLayoutImpl(inspectorController);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
+        return willLayoutImpl(inspectorAgent);
 #endif
     return InspectorInstrumentationCookie();
 }
@@ -536,8 +543,8 @@ inline void InspectorInstrumentation::didLayout(const InspectorInstrumentationCo
 inline InspectorInstrumentationCookie InspectorInstrumentation::willLoadXHR(ScriptExecutionContext* context, XMLHttpRequest* request)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForContext(context))
-        return willLoadXHRImpl(inspectorController, request);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForContext(context))
+        return willLoadXHRImpl(inspectorAgent, request);
 #endif
     return InspectorInstrumentationCookie();
 }
@@ -553,8 +560,8 @@ inline void InspectorInstrumentation::didLoadXHR(const InspectorInstrumentationC
 inline InspectorInstrumentationCookie InspectorInstrumentation::willPaint(Frame* frame, const IntRect& rect)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForFrame(frame))
-        return willPaintImpl(inspectorController, rect);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
+        return willPaintImpl(inspectorAgent, rect);
 #endif
     return InspectorInstrumentationCookie();
 }
@@ -570,8 +577,8 @@ inline void InspectorInstrumentation::didPaint(const InspectorInstrumentationCoo
 inline InspectorInstrumentationCookie InspectorInstrumentation::willRecalculateStyle(Document* document)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForDocument(document))
-        return willRecalculateStyleImpl(inspectorController);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForDocument(document))
+        return willRecalculateStyleImpl(inspectorAgent);
 #endif
     return InspectorInstrumentationCookie();
 }
@@ -590,15 +597,23 @@ inline void InspectorInstrumentation::identifierForInitialRequest(Frame* frame,
     // This notification should be procecessed even in cases there is no frontend.
     if (!frame)
         return;
-    if (InspectorController* ic = inspectorControllerForPage(frame->page()))
+    if (InspectorAgent* ic = inspectorAgentForPage(frame->page()))
         identifierForInitialRequestImpl(ic, identifier, loader, request);
 #endif
 }
 
+inline void InspectorInstrumentation::applyUserAgentOverride(Frame* frame, String* userAgent)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
+        applyUserAgentOverrideImpl(inspectorAgent, userAgent);
+#endif
+}
+
 inline void InspectorInstrumentation::willSendRequest(Frame* frame, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* ic = inspectorControllerWithFrontendForFrame(frame))
+    if (InspectorAgent* ic = inspectorAgentWithFrontendForFrame(frame))
         willSendRequestImpl(ic, identifier, request, redirectResponse);
 #endif
 }
@@ -606,22 +621,22 @@ inline void InspectorInstrumentation::willSendRequest(Frame* frame, unsigned lon
 inline void InspectorInstrumentation::markResourceAsCached(Page* page, unsigned long identifier)
 {
 #if ENABLE(INSPECTOR)
-    markResourceAsCachedImpl(inspectorControllerForPage(page), identifier); 
+    markResourceAsCachedImpl(inspectorAgentForPage(page), identifier); 
 #endif
 }
 
 inline void InspectorInstrumentation::didLoadResourceFromMemoryCache(Page* page, DocumentLoader* loader, const CachedResource* resource)
 {
 #if ENABLE(INSPECTOR)
-    didLoadResourceFromMemoryCacheImpl(inspectorControllerForPage(page), loader, resource);
+    didLoadResourceFromMemoryCacheImpl(inspectorAgentForPage(page), loader, resource);
 #endif
 }
 
 inline InspectorInstrumentationCookie InspectorInstrumentation::willReceiveResourceData(Frame* frame, unsigned long identifier)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForFrame(frame))
-        return willReceiveResourceDataImpl(inspectorController, identifier);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
+        return willReceiveResourceDataImpl(inspectorAgent, identifier);
 #endif
     return InspectorInstrumentationCookie();
 }
@@ -637,8 +652,8 @@ inline void InspectorInstrumentation::didReceiveResourceData(const InspectorInst
 inline InspectorInstrumentationCookie InspectorInstrumentation::willReceiveResourceResponse(Frame* frame, unsigned long identifier, const ResourceResponse& response)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForFrame(frame))
-        return willReceiveResourceResponseImpl(inspectorController, identifier, response);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
+        return willReceiveResourceResponseImpl(inspectorAgent, identifier, response);
 #endif
     return InspectorInstrumentationCookie();
 }
@@ -654,80 +669,80 @@ inline void InspectorInstrumentation::didReceiveResourceResponse(const Inspector
 inline void InspectorInstrumentation::didReceiveContentLength(Frame* frame, unsigned long identifier, int lengthReceived)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForFrame(frame))
-        didReceiveContentLengthImpl(inspectorController, identifier, lengthReceived);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
+        didReceiveContentLengthImpl(inspectorAgent, identifier, lengthReceived);
 #endif
 }
 
 inline void InspectorInstrumentation::didFinishLoading(Frame* frame, unsigned long identifier, double finishTime)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForFrame(frame))
-        didFinishLoadingImpl(inspectorController, identifier, finishTime);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
+        didFinishLoadingImpl(inspectorAgent, identifier, finishTime);
 #endif
 }
 
 inline void InspectorInstrumentation::didFailLoading(Frame* frame, unsigned long identifier, const ResourceError& error)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForFrame(frame))
-        didFailLoadingImpl(inspectorController, identifier, error);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
+        didFailLoadingImpl(inspectorAgent, identifier, error);
 #endif
 }
 
 inline void InspectorInstrumentation::resourceRetrievedByXMLHttpRequest(ScriptExecutionContext* context, unsigned long identifier, const String& sourceString, const String& url, const String& sendURL, unsigned sendLineNumber)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerForContext(context))
-        resourceRetrievedByXMLHttpRequestImpl(inspectorController, identifier, sourceString, url, sendURL, sendLineNumber);
+    if (InspectorAgent* inspectorAgent = inspectorAgentForContext(context))
+        resourceRetrievedByXMLHttpRequestImpl(inspectorAgent, identifier, sourceString, url, sendURL, sendLineNumber);
 #endif
 }
 
 inline void InspectorInstrumentation::scriptImported(ScriptExecutionContext* context, unsigned long identifier, const String& sourceString)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerForContext(context))
-        scriptImportedImpl(inspectorController, identifier, sourceString);
+    if (InspectorAgent* inspectorAgent = inspectorAgentForContext(context))
+        scriptImportedImpl(inspectorAgent, identifier, sourceString);
 #endif
 }
 
-inline void InspectorInstrumentation::mainResourceFiredLoadEvent(Frame* frame, const KURL& url)
+inline void InspectorInstrumentation::domContentLoadedEventFired(Frame* frame, const KURL& url)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForFrame(frame))
-        mainResourceFiredLoadEventImpl(inspectorController, frame, url);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
+        domContentLoadedEventFiredImpl(inspectorAgent, frame, url);
 #endif
 }
 
-inline void InspectorInstrumentation::mainResourceFiredDOMContentEvent(Frame* frame, const KURL& url)
+inline void InspectorInstrumentation::loadEventFired(Frame* frame, const KURL& url)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForFrame(frame))
-        mainResourceFiredDOMContentEventImpl(inspectorController, frame, url);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
+        loadEventFiredImpl(inspectorAgent, frame, url);
 #endif
 }
 
 inline void InspectorInstrumentation::frameDetachedFromParent(Frame* frame)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForFrame(frame))
-        frameDetachedFromParentImpl(inspectorController, frame);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
+        frameDetachedFromParentImpl(inspectorAgent, frame);
 #endif
 }
 
 inline void InspectorInstrumentation::didCommitLoad(Frame* frame, DocumentLoader* loader)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerForFrame(frame))
-        didCommitLoadImpl(inspectorController, loader);
+    if (InspectorAgent* inspectorAgent = inspectorAgentForFrame(frame))
+        didCommitLoadImpl(inspectorAgent, loader);
 #endif
 }
 
 inline InspectorInstrumentationCookie InspectorInstrumentation::willWriteHTML(Document* document, unsigned int length, unsigned int startLine)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForDocument(document))
-        return willWriteHTMLImpl(inspectorController, length, startLine);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForDocument(document))
+        return willWriteHTMLImpl(inspectorAgent, length, startLine);
 #endif
     return InspectorInstrumentationCookie();
 }
@@ -740,22 +755,12 @@ inline void InspectorInstrumentation::didWriteHTML(const InspectorInstrumentatio
 #endif
 }
 
-#if ENABLE(DATABASE)
-inline void InspectorInstrumentation::didOpenDatabase(ScriptExecutionContext* context, Database* database, const String& domain, const String& name, const String& version)
-{
-#if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerForContext(context))
-        didOpenDatabaseImpl(inspectorController, database, domain, name, version);
-#endif
-}
-#endif
-
 #if ENABLE(DOM_STORAGE)
 inline void InspectorInstrumentation::didUseDOMStorage(Page* page, StorageArea* storageArea, bool isLocalStorage, Frame* frame)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerForPage(page))
-        didUseDOMStorageImpl(inspectorController, storageArea, isLocalStorage, frame);
+    if (InspectorAgent* inspectorAgent = inspectorAgentForPage(page))
+        didUseDOMStorageImpl(inspectorAgent, storageArea, isLocalStorage, frame);
 #endif
 }
 #endif
@@ -764,16 +769,16 @@ inline void InspectorInstrumentation::didUseDOMStorage(Page* page, StorageArea*
 inline void InspectorInstrumentation::didCreateWorker(ScriptExecutionContext* context, intptr_t id, const String& url, bool isSharedWorker)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForContext(context))
-        didCreateWorkerImpl(inspectorController, id, url, isSharedWorker);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForContext(context))
+        didCreateWorkerImpl(inspectorAgent, id, url, isSharedWorker);
 #endif
 }
 
 inline void InspectorInstrumentation::didDestroyWorker(ScriptExecutionContext* context, intptr_t id)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForContext(context))
-        didDestroyWorkerImpl(inspectorController, id);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForContext(context))
+        didDestroyWorkerImpl(inspectorAgent, id);
 #endif
 }
 #endif
@@ -783,32 +788,32 @@ inline void InspectorInstrumentation::didDestroyWorker(ScriptExecutionContext* c
 inline void InspectorInstrumentation::didCreateWebSocket(ScriptExecutionContext* context, unsigned long identifier, const KURL& requestURL, const KURL& documentURL)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForContext(context))
-        didCreateWebSocketImpl(inspectorController, identifier, requestURL, documentURL);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForContext(context))
+        didCreateWebSocketImpl(inspectorAgent, identifier, requestURL, documentURL);
 #endif
 }
 
 inline void InspectorInstrumentation::willSendWebSocketHandshakeRequest(ScriptExecutionContext* context, unsigned long identifier, const WebSocketHandshakeRequest& request)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForContext(context))
-        willSendWebSocketHandshakeRequestImpl(inspectorController, identifier, request);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForContext(context))
+        willSendWebSocketHandshakeRequestImpl(inspectorAgent, identifier, request);
 #endif
 }
 
 inline void InspectorInstrumentation::didReceiveWebSocketHandshakeResponse(ScriptExecutionContext* context, unsigned long identifier, const WebSocketHandshakeResponse& response)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForContext(context))
-        didReceiveWebSocketHandshakeResponseImpl(inspectorController, identifier, response);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForContext(context))
+        didReceiveWebSocketHandshakeResponseImpl(inspectorAgent, identifier, response);
 #endif
 }
 
 inline void InspectorInstrumentation::didCloseWebSocket(ScriptExecutionContext* context, unsigned long identifier)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForContext(context))
-        didCloseWebSocketImpl(inspectorController, identifier);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForContext(context))
+        didCloseWebSocketImpl(inspectorAgent, identifier);
 #endif
 }
 #endif
@@ -816,8 +821,8 @@ inline void InspectorInstrumentation::didCloseWebSocket(ScriptExecutionContext*
 inline void InspectorInstrumentation::networkStateChanged(Page* page)
 {
 #if ENABLE(INSPECTOR) && ENABLE(OFFLINE_WEB_APPLICATIONS)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForPage(page))
-        networkStateChangedImpl(inspectorController);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForPage(page))
+        networkStateChangedImpl(inspectorAgent);
 #endif
 }
 
@@ -825,145 +830,69 @@ inline void InspectorInstrumentation::networkStateChanged(Page* page)
 inline void InspectorInstrumentation::updateApplicationCacheStatus(Frame* frame)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForFrame(frame))
-        updateApplicationCacheStatusImpl(inspectorController, frame);
+    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
+        updateApplicationCacheStatusImpl(inspectorAgent, frame);
 #endif
 }
 #endif
 
-inline void InspectorInstrumentation::addMessageToConsole(Page* page, MessageSource source, MessageType type, MessageLevel level, const String& message, ScriptArguments* arguments, ScriptCallStack* callStack)
-{
-#if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerForPage(page))
-        addMessageToConsoleImpl(inspectorController, source, type, level, message, arguments, callStack);
-#endif
-}
-
-inline void InspectorInstrumentation::addMessageToConsole(Page* page, MessageSource source, MessageType type, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceID)
-{
 #if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerForPage(page))
-        addMessageToConsoleImpl(inspectorController, source, type, level, message, lineNumber, sourceID);
-#endif
-}
-
-inline void InspectorInstrumentation::consoleCount(Page* page, ScriptArguments* arguments, ScriptCallStack* stack)
+inline bool InspectorInstrumentation::hasFrontend(Page* page)
 {
-#if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerForPage(page))
-        consoleCountImpl(inspectorController, arguments, stack);
-#endif
+    return inspectorAgentWithFrontendForPage(page);
 }
-
-inline void InspectorInstrumentation::startConsoleTiming(Page* page, const String& title)
-{
-#if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerForPage(page))
-        startConsoleTimingImpl(inspectorController, title);
 #endif
-}
 
-inline void InspectorInstrumentation::stopConsoleTiming(Page* page, const String& title, ScriptCallStack* stack)
-{
-#if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerForPage(page))
-        stopConsoleTimingImpl(inspectorController, title, stack);
-#endif
-}
-
-inline void InspectorInstrumentation::consoleMarkTimeline(Page* page, ScriptArguments* arguments)
-{
-#if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerWithFrontendForPage(page))
-        consoleMarkTimelineImpl(inspectorController, arguments);
-#endif
-}
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-inline void InspectorInstrumentation::addStartProfilingMessageToConsole(Page* page, const String& title, unsigned lineNumber, const String& sourceURL)
-{
-#if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerForPage(page))
-        addStartProfilingMessageToConsoleImpl(inspectorController, title, lineNumber, sourceURL);
-#endif
-}
-
-inline void InspectorInstrumentation::addProfile(Page* page, RefPtr<ScriptProfile> profile, ScriptCallStack* callStack)
-{
-#if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerForPage(page))
-        addProfileImpl(inspectorController, profile, callStack);
-#endif
-}
-
-inline bool InspectorInstrumentation::profilerEnabled(Page* page)
-{
-#if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerForPage(page))
-        return profilerEnabledImpl(inspectorController);
-#endif
-    return false;
-}
-
-inline String InspectorInstrumentation::getCurrentUserInitiatedProfileName(Page* page, bool incrementProfileNumber)
-{
-#if ENABLE(INSPECTOR)
-    if (InspectorController* inspectorController = inspectorControllerForPage(page))
-        return InspectorInstrumentation::getCurrentUserInitiatedProfileNameImpl(inspectorController, incrementProfileNumber);
-#endif
-    return "";
-}
-#endif
 
 #if ENABLE(INSPECTOR)
-inline InspectorController* InspectorInstrumentation::inspectorControllerForContext(ScriptExecutionContext* context)
+inline InspectorAgent* InspectorInstrumentation::inspectorAgentForContext(ScriptExecutionContext* context)
 {
     if (context && context->isDocument())
-        return inspectorControllerForPage(static_cast<Document*>(context)->page());
+        return inspectorAgentForPage(static_cast<Document*>(context)->page());
     return 0;
 }
 
-inline InspectorController* InspectorInstrumentation::inspectorControllerForFrame(Frame* frame)
+inline InspectorAgent* InspectorInstrumentation::inspectorAgentForFrame(Frame* frame)
 {
     if (frame)
-        return inspectorControllerForPage(frame->page());
+        return inspectorAgentForPage(frame->page());
     return 0;
 }
 
-inline InspectorController* InspectorInstrumentation::inspectorControllerForPage(Page* page)
+inline InspectorAgent* InspectorInstrumentation::inspectorAgentForPage(Page* page)
 {
     if (!page)
         return 0;
-    return page->inspectorController();
+    return inspectorAgents().get(page);
 }
 
-inline InspectorController* InspectorInstrumentation::inspectorControllerWithFrontendForContext(ScriptExecutionContext* context)
+inline InspectorAgent* InspectorInstrumentation::inspectorAgentWithFrontendForContext(ScriptExecutionContext* context)
 {
     if (hasFrontends() && context && context->isDocument())
-        return inspectorControllerWithFrontendForPage(static_cast<Document*>(context)->page());
+        return inspectorAgentWithFrontendForPage(static_cast<Document*>(context)->page());
     return 0;
 }
 
-inline InspectorController* InspectorInstrumentation::inspectorControllerWithFrontendForDocument(Document* document)
+inline InspectorAgent* InspectorInstrumentation::inspectorAgentWithFrontendForDocument(Document* document)
 {
     if (hasFrontends() && document)
-        return inspectorControllerWithFrontendForPage(document->page());
+        return inspectorAgentWithFrontendForPage(document->page());
     return 0;
 }
 
-inline InspectorController* InspectorInstrumentation::inspectorControllerWithFrontendForFrame(Frame* frame)
+inline InspectorAgent* InspectorInstrumentation::inspectorAgentWithFrontendForFrame(Frame* frame)
 {
     if (hasFrontends() && frame)
-        return inspectorControllerWithFrontendForPage(frame->page());
+        return inspectorAgentWithFrontendForPage(frame->page());
     return 0;
 }
 
-inline InspectorController* InspectorInstrumentation::inspectorControllerWithFrontendForPage(Page* page)
+inline InspectorAgent* InspectorInstrumentation::inspectorAgentWithFrontendForPage(Page* page)
 {
     if (page) {
-        if (InspectorController* inspectorController = inspectorControllerForPage(page)) {
-            if (hasFrontend(inspectorController))
-                return inspectorController;
+        if (InspectorAgent* inspectorAgent = inspectorAgentForPage(page)) {
+            if (hasFrontend(inspectorAgent))
+                return inspectorAgent;
         }
     }
     return 0;
diff --git a/Source/WebCore/inspector/InspectorProfilerAgent.cpp b/Source/WebCore/inspector/InspectorProfilerAgent.cpp
index 8c4f28f..550febf 100644
--- a/Source/WebCore/inspector/InspectorProfilerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorProfilerAgent.cpp
@@ -33,8 +33,8 @@
 #if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
 
 #include "Console.h"
+#include "InspectorAgent.h"
 #include "InspectorConsoleAgent.h"
-#include "InspectorController.h"
 #include "InspectorFrontend.h"
 #include "InspectorValues.h"
 #include "KURL.h"
@@ -56,16 +56,16 @@ static const char* const UserInitiatedProfileName = "org.webkit.profiles.user-in
 static const char* const CPUProfileType = "CPU";
 static const char* const HeapProfileType = "HEAP";
 
-PassOwnPtr<InspectorProfilerAgent> InspectorProfilerAgent::create(InspectorController* inspectorController)
+PassOwnPtr<InspectorProfilerAgent> InspectorProfilerAgent::create(InspectorAgent* inspectorAgent)
 {
-    OwnPtr<InspectorProfilerAgent> agent = adoptPtr(new InspectorProfilerAgent(inspectorController));
+    OwnPtr<InspectorProfilerAgent> agent = adoptPtr(new InspectorProfilerAgent(inspectorAgent));
     return agent.release();
 }
 
-InspectorProfilerAgent::InspectorProfilerAgent(InspectorController* inspectorController)
-    : m_inspectorController(inspectorController)
+InspectorProfilerAgent::InspectorProfilerAgent(InspectorAgent* inspectorAgent)
+    : m_inspectorAgent(inspectorAgent)
     , m_frontend(0)
-    , m_enabled(ScriptProfiler::isProfilerAlwaysEnabled())
+    , m_enabled(false)
     , m_recordingUserInitiatedProfile(false)
     , m_currentUserInitiatedProfileNumber(-1)
     , m_nextUserInitiatedProfileNumber(1)
@@ -93,7 +93,7 @@ void InspectorProfilerAgent::addProfileFinishedMessageToConsole(PassRefPtr<Scrip
     RefPtr<ScriptProfile> profile = prpProfile;
     String title = profile->title();
     String message = makeString("Profile \"webkit-profile://", CPUProfileType, '/', encodeWithURLEscapeSequences(title), '#', String::number(profile->uid()), "\" finished.");
-    m_inspectorController->consoleAgent()->addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lineNumber, sourceURL);
+    m_inspectorAgent->consoleAgent()->addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lineNumber, sourceURL);
 }
 
 void InspectorProfilerAgent::addStartProfilingMessageToConsole(const String& title, unsigned lineNumber, const String& sourceURL)
@@ -101,7 +101,7 @@ void InspectorProfilerAgent::addStartProfilingMessageToConsole(const String& tit
     if (!m_frontend)
         return;
     String message = makeString("Profile \"webkit-profile://", CPUProfileType, '/', encodeWithURLEscapeSequences(title), "#0\" started.");
-    m_inspectorController->consoleAgent()->addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lineNumber, sourceURL);
+    m_inspectorAgent->consoleAgent()->addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lineNumber, sourceURL);
 }
 
 PassRefPtr<InspectorObject> InspectorProfilerAgent::createProfileHeader(const ScriptProfile& profile)
@@ -220,7 +220,9 @@ void InspectorProfilerAgent::resetState()
 
 void InspectorProfilerAgent::resetFrontendProfiles()
 {
-    if (m_frontend && m_profiles.begin() == m_profiles.end())
+    if (m_frontend
+        && m_profiles.begin() == m_profiles.end()
+        && m_snapshots.begin() == m_snapshots.end())
         m_frontend->resetProfiles();
 }
 
@@ -229,13 +231,13 @@ void InspectorProfilerAgent::startUserInitiatedProfiling()
     if (m_recordingUserInitiatedProfile)
         return;
     if (!enabled()) {
-        enable(false);
+        enable(true);
         ScriptDebugServer::shared().recompileAllJSFunctions();
     }
     m_recordingUserInitiatedProfile = true;
     String title = getCurrentUserInitiatedProfileName(true);
 #if USE(JSC)
-    JSC::ExecState* scriptState = toJSDOMWindow(m_inspectorController->inspectedPage()->mainFrame(), debuggerWorld())->globalExec();
+    JSC::ExecState* scriptState = toJSDOMWindow(m_inspectorAgent->inspectedPage()->mainFrame(), debuggerWorld())->globalExec();
 #else
     ScriptState* scriptState = 0;
 #endif
@@ -251,7 +253,7 @@ void InspectorProfilerAgent::stopUserInitiatedProfiling(bool ignoreProfile)
     m_recordingUserInitiatedProfile = false;
     String title = getCurrentUserInitiatedProfileName();
 #if USE(JSC)
-    JSC::ExecState* scriptState = toJSDOMWindow(m_inspectorController->inspectedPage()->mainFrame(), debuggerWorld())->globalExec();
+    JSC::ExecState* scriptState = toJSDOMWindow(m_inspectorAgent->inspectedPage()->mainFrame(), debuggerWorld())->globalExec();
 #else
     // Use null script state to avoid filtering by context security token.
     // All functions from all iframes should be visible from Inspector UI.
@@ -267,12 +269,37 @@ void InspectorProfilerAgent::stopUserInitiatedProfiling(bool ignoreProfile)
     toggleRecordButton(false);
 }
 
-void InspectorProfilerAgent::takeHeapSnapshot()
+namespace {
+
+class HeapSnapshotProgress: public ScriptProfiler::HeapSnapshotProgress {
+public:
+    explicit HeapSnapshotProgress(InspectorFrontend* frontend)
+        : m_frontend(frontend) { }
+    void Start(int totalWork)
+    {
+        m_totalWork = totalWork;
+    }
+    void Worked(int workDone)
+    {
+        if (m_frontend)
+            m_frontend->reportHeapSnapshotProgress(workDone, m_totalWork);
+    }
+    void Done() { }
+    bool isCanceled() { return false; }
+private:
+    InspectorFrontend* m_frontend;
+    int m_totalWork;
+};
+
+};
+
+void InspectorProfilerAgent::takeHeapSnapshot(bool detailed)
 {
     String title = makeString(UserInitiatedProfileName, '.', String::number(m_nextUserInitiatedHeapSnapshotNumber));
     ++m_nextUserInitiatedHeapSnapshotNumber;
 
-    RefPtr<ScriptHeapSnapshot> snapshot = ScriptProfiler::takeHeapSnapshot(title);
+    HeapSnapshotProgress progress(m_frontend);
+    RefPtr<ScriptHeapSnapshot> snapshot = ScriptProfiler::takeHeapSnapshot(title, detailed ? &progress : 0);
     if (snapshot) {
         m_snapshots.add(snapshot->uid(), snapshot);
         if (m_frontend)
diff --git a/Source/WebCore/inspector/InspectorProfilerAgent.h b/Source/WebCore/inspector/InspectorProfilerAgent.h
index 436ae51..93637f5 100644
--- a/Source/WebCore/inspector/InspectorProfilerAgent.h
+++ b/Source/WebCore/inspector/InspectorProfilerAgent.h
@@ -41,7 +41,7 @@
 namespace WebCore {
 
 class InspectorArray;
-class InspectorController;
+class InspectorAgent;
 class InspectorFrontend;
 class InspectorObject;
 class ScriptHeapSnapshot;
@@ -50,7 +50,7 @@ class ScriptProfile;
 class InspectorProfilerAgent {
     WTF_MAKE_NONCOPYABLE(InspectorProfilerAgent); WTF_MAKE_FAST_ALLOCATED;
 public:
-    static PassOwnPtr<InspectorProfilerAgent> create(InspectorController*);
+    static PassOwnPtr<InspectorProfilerAgent> create(InspectorAgent*);
     virtual ~InspectorProfilerAgent();
 
     void addProfile(PassRefPtr<ScriptProfile> prpProfile, unsigned lineNumber, const String& sourceURL);
@@ -70,18 +70,18 @@ public:
     void setFrontend(InspectorFrontend* frontend) { m_frontend = frontend; }
     void startUserInitiatedProfiling();
     void stopUserInitiatedProfiling(bool ignoreProfile = false);
-    void takeHeapSnapshot();
+    void takeHeapSnapshot(bool detailed);
     void toggleRecordButton(bool isProfiling);
 
 private:
     typedef HashMap<unsigned int, RefPtr<ScriptProfile> > ProfilesMap;
     typedef HashMap<unsigned int, RefPtr<ScriptHeapSnapshot> > HeapSnapshotsMap;
 
-    InspectorProfilerAgent(InspectorController*);
+    InspectorProfilerAgent(InspectorAgent*);
     PassRefPtr<InspectorObject> createProfileHeader(const ScriptProfile& profile);
     PassRefPtr<InspectorObject> createSnapshotHeader(const ScriptHeapSnapshot& snapshot);
 
-    InspectorController* m_inspectorController;
+    InspectorAgent* m_inspectorAgent;
     InspectorFrontend* m_frontend;
     bool m_enabled;
     bool m_recordingUserInitiatedProfile;
diff --git a/Source/WebCore/inspector/InspectorResourceAgent.cpp b/Source/WebCore/inspector/InspectorResourceAgent.cpp
index 029c79d..38d9e32 100644
--- a/Source/WebCore/inspector/InspectorResourceAgent.cpp
+++ b/Source/WebCore/inspector/InspectorResourceAgent.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -67,9 +67,14 @@
 
 namespace WebCore {
 
+namespace ResourceAgentState {
+static const char resourceAgentEnabled[] = "resourceAgentEnabled";
+static const char extraRequestHeaders[] = "extraRequestHeaders";
+}
+
 PassRefPtr<InspectorResourceAgent> InspectorResourceAgent::restore(Page* page, InspectorState* state, InspectorFrontend* frontend)
 {
-    if (state->getBoolean(InspectorState::resourceAgentEnabled))
+    if (state->getBoolean(ResourceAgentState::resourceAgentEnabled))
         return create(page, state, frontend);
     return 0;
 }
@@ -95,7 +100,6 @@ bool InspectorResourceAgent::resourceContent(Frame* frame, const KURL& url, Stri
 
 bool InspectorResourceAgent::resourceContentBase64(Frame* frame, const KURL& url, String* result)
 {
-    Vector<char> out;
     String textEncodingName;
     RefPtr<SharedBuffer> data = InspectorResourceAgent::resourceData(frame, url, &textEncodingName);
     if (!data) {
@@ -103,8 +107,7 @@ bool InspectorResourceAgent::resourceContentBase64(Frame* frame, const KURL& url
         return false;
     }
 
-    base64Encode(data->buffer(), out);
-    *result = String(out.data(), out.size());
+    *result = base64Encode(data->buffer());
     return true;
 }
 
@@ -121,6 +124,10 @@ PassRefPtr<SharedBuffer> InspectorResourceAgent::resourceData(Frame* frame, cons
     if (!cachedResource)
         return 0;
 
+    // Zero-sized resources don't have data at all -- so fake the empty buffer, insted of indicating error by returning 0.
+    if (!cachedResource->encodedSize())
+        return SharedBuffer::create();
+
     if (cachedResource->isPurgeable()) {
         // If the resource is purgeable then make it unpurgeable to get
         // get its data. This might fail, in which case we return an
@@ -289,7 +296,7 @@ static void populateObjectWithFrameResources(Frame* frame, PassRefPtr<InspectorO
 
 InspectorResourceAgent::~InspectorResourceAgent()
 {
-    m_state->setBoolean(InspectorState::resourceAgentEnabled, false);
+    m_state->setBoolean(ResourceAgentState::resourceAgentEnabled, false);
 }
 
 void InspectorResourceAgent::identifierForInitialRequest(unsigned long identifier, const KURL& url, DocumentLoader* loader)
@@ -304,8 +311,28 @@ void InspectorResourceAgent::identifierForInitialRequest(unsigned long identifie
     m_frontend->identifierForInitialRequest(identifier, url.string(), loaderObject, callStackValue);
 }
 
+void InspectorResourceAgent::setExtraHeaders(PassRefPtr<InspectorObject> headers)
+{
+    m_state->setObject(ResourceAgentState::extraRequestHeaders, headers);
+}
+
+
 void InspectorResourceAgent::willSendRequest(unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
 {
+    RefPtr<InspectorObject> headers = m_state->getObject(ResourceAgentState::extraRequestHeaders);
+
+    if (headers) {
+        InspectorObject::const_iterator end = headers->end();
+        for (InspectorObject::const_iterator it = headers->begin(); it != end; ++it) {
+            String value;
+            if (it->second->asString(&value))
+                request.setHTTPHeaderField(it->first, value);
+        }
+    }
+
+    request.setReportLoadTiming(true);
+    request.setReportRawHeaders(true);
+
     m_frontend->willSendRequest(identifier, currentTime(), buildObjectForResourceRequest(request), buildObjectForResourceResponse(redirectResponse));
 }
 
@@ -318,23 +345,27 @@ void InspectorResourceAgent::didReceiveResponse(unsigned long identifier, Docume
 {
     RefPtr<InspectorObject> resourceResponse = buildObjectForResourceResponse(response);
     String type = "Other";
-    if (loader) {
-        if (equalIgnoringFragmentIdentifier(response.url(), loader->frameLoader()->iconURL()))
-            type = "Image";
-        else {
-            CachedResource* cachedResource = InspectorResourceAgent::cachedResource(loader->frame(), response.url());
-            if (cachedResource)
-                type = cachedResourceTypeString(*cachedResource);
-
-            if (equalIgnoringFragmentIdentifier(response.url(), loader->url()) && type == "Other")
-                type = "Document";
+    long cachedResourceSize = 0;
 
+    if (loader) {
+        CachedResource* cachedResource = InspectorResourceAgent::cachedResource(loader->frame(), response.url());
+        if (cachedResource) {
+            type = cachedResourceTypeString(*cachedResource);
+            cachedResourceSize = cachedResource->encodedSize();
             // Use mime type from cached resource in case the one in response is empty.
-            if (response.mimeType().isEmpty() && cachedResource)
+            if (response.mimeType().isEmpty())
                 resourceResponse->setString("mimeType", cachedResource->response().mimeType());
         }
+        if (equalIgnoringFragmentIdentifier(response.url(), loader->frameLoader()->iconURL()))
+            type = "Image";
+        else if (equalIgnoringFragmentIdentifier(response.url(), loader->url()) && type == "Other")
+            type = "Document";
     }
     m_frontend->didReceiveResponse(identifier, currentTime(), type, resourceResponse);
+    // If we revalidated the resource and got Not modified, send content length following didReceiveResponse
+    // as there will be no calls to didReceiveContentLength from the network stack.
+    if (cachedResourceSize && response.httpStatusCode() == 304)
+        didReceiveContentLength(identifier, cachedResourceSize);
 }
 
 void InspectorResourceAgent::didReceiveContentLength(unsigned long identifier, int lengthReceived)
@@ -376,7 +407,7 @@ static PassRefPtr<InspectorObject> buildObjectForFrame(Frame* frame)
             name = frame->ownerElement()->getAttribute(HTMLNames::idAttr);
         frameObject->setString("name", name);
     }
-    frameObject->setString("url", frame->loader()->url().string());
+    frameObject->setString("url", frame->document()->url().string());
     return frameObject;
 }
 
@@ -472,17 +503,17 @@ void InspectorResourceAgent::cachedResources(RefPtr<InspectorObject>* object)
     *object = buildObjectForFrameTree(m_page->mainFrame(), true);
 }
 
-void InspectorResourceAgent::resourceContent(unsigned long id, const String& url, bool base64Encode, String* content)
+void InspectorResourceAgent::resourceContent(unsigned long frameId, const String& url, bool base64Encode, bool* success, String* content)
 {
-    for (Frame* frame = m_page->mainFrame(); frame; frame = frame->tree()->traverseNext(m_page->mainFrame())) {
-        if (frameId(frame) != id)
-            continue;
-        if (base64Encode)
-            InspectorResourceAgent::resourceContentBase64(frame, KURL(ParsedURLString, url), content);
-        else
-            InspectorResourceAgent::resourceContent(frame, KURL(ParsedURLString, url), content);
-        break;
+    Frame* frame = frameForId(frameId);
+    if (!frame) {
+        *success = false;
+        return;
     }
+    if (base64Encode)
+        *success = InspectorResourceAgent::resourceContentBase64(frame, KURL(ParsedURLString, url), content);
+    else
+        *success = InspectorResourceAgent::resourceContent(frame, KURL(ParsedURLString, url), content);
 }
 
 InspectorResourceAgent::InspectorResourceAgent(Page* page, InspectorState* state, InspectorFrontend* frontend)
@@ -490,7 +521,7 @@ InspectorResourceAgent::InspectorResourceAgent(Page* page, InspectorState* state
     , m_state(state)
     , m_frontend(frontend)
 {
-    m_state->setBoolean(InspectorState::resourceAgentEnabled, true);
+    m_state->setBoolean(ResourceAgentState::resourceAgentEnabled, true);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorResourceAgent.h b/Source/WebCore/inspector/InspectorResourceAgent.h
index 6c2df24..fb24b70 100644
--- a/Source/WebCore/inspector/InspectorResourceAgent.h
+++ b/Source/WebCore/inspector/InspectorResourceAgent.h
@@ -103,7 +103,8 @@ public:
 
     // Called from frontend 
     void cachedResources(RefPtr<InspectorObject>*);
-    void resourceContent(unsigned long frameID, const String& url, bool base64Encode, String* content);
+    void resourceContent(unsigned long frameId, const String& url, bool base64Encode, bool* resourceFound, String* content);
+    void setExtraHeaders(PassRefPtr<InspectorObject>);
 
 private:
     InspectorResourceAgent(Page* page, InspectorState*, InspectorFrontend* frontend);
diff --git a/Source/WebCore/inspector/InspectorRuntimeAgent.cpp b/Source/WebCore/inspector/InspectorRuntimeAgent.cpp
index 0502437..7938afd 100644
--- a/Source/WebCore/inspector/InspectorRuntimeAgent.cpp
+++ b/Source/WebCore/inspector/InspectorRuntimeAgent.cpp
@@ -45,18 +45,18 @@ InspectorRuntimeAgent::InspectorRuntimeAgent(InjectedScriptHost* injectedScriptH
 
 InspectorRuntimeAgent::~InspectorRuntimeAgent() { }
 
-void InspectorRuntimeAgent::evaluate(const String& expression, const String& objectGroup, RefPtr<InspectorValue>* result)
+void InspectorRuntimeAgent::evaluate(const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result)
 {
     InjectedScript injectedScript = m_injectedScriptHost->injectedScriptForMainFrame();
     if (!injectedScript.hasNoValue())
-        injectedScript.evaluate(expression, objectGroup, result);
+        injectedScript.evaluate(expression, objectGroup, includeCommandLineAPI, result);
 }
 
-void InspectorRuntimeAgent::getCompletions(const String& expression, bool includeInspectorCommandLineAPI, RefPtr<InspectorValue>* result)
+void InspectorRuntimeAgent::getCompletions(const String& expression, bool includeCommandLineAPI, RefPtr<InspectorValue>* result)
 {
     InjectedScript injectedScript = m_injectedScriptHost->injectedScriptForMainFrame();
     if (!injectedScript.hasNoValue())
-        injectedScript.getCompletions(expression, includeInspectorCommandLineAPI, result);
+        injectedScript.getCompletions(expression, includeCommandLineAPI, result);
 }
 
 void InspectorRuntimeAgent::getProperties(PassRefPtr<InspectorObject> objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorValue>* result)
diff --git a/Source/WebCore/inspector/InspectorRuntimeAgent.h b/Source/WebCore/inspector/InspectorRuntimeAgent.h
index 3ac2eed..9fb2716 100644
--- a/Source/WebCore/inspector/InspectorRuntimeAgent.h
+++ b/Source/WebCore/inspector/InspectorRuntimeAgent.h
@@ -57,8 +57,8 @@ public:
     ~InspectorRuntimeAgent();
 
     // Part of the protocol.
-    void evaluate(const String& expression, const String& objectGroup, RefPtr<InspectorValue>* result);
-    void getCompletions(const String& expression, bool includeInspectorCommandLineAPI, RefPtr<InspectorValue>* result);
+    void evaluate(const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result);
+    void getCompletions(const String& expression, bool includeCommandLineAPI, RefPtr<InspectorValue>* result);
     void getProperties(PassRefPtr<InspectorObject> objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorValue>* result);
     void setPropertyValue(PassRefPtr<InspectorObject> objectId, const String& propertyName, const String& expression, RefPtr<InspectorValue>* result);
     void releaseWrapperObjectGroup(long injectedScriptId, const String& objectGroup);
diff --git a/Source/WebCore/inspector/InspectorSettings.cpp b/Source/WebCore/inspector/InspectorSettings.cpp
deleted file mode 100644
index 3ebc3ab..0000000
--- a/Source/WebCore/inspector/InspectorSettings.cpp
+++ /dev/null
@@ -1,95 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#include "config.h"
-#include "InspectorSettings.h"
-
-#if ENABLE(INSPECTOR)
-
-#include "InspectorClient.h"
-
-namespace WebCore {
-
-const char* InspectorSettings::MonitoringXHREnabled = "xhrMonitor";
-const char* InspectorSettings::ProfilerAlwaysEnabled = "profilerEnabled";
-const char* InspectorSettings::DebuggerAlwaysEnabled = "debuggerEnabled";
-const char* InspectorSettings::InspectorStartsAttached = "inspectorStartsAttached";
-const char* InspectorSettings::InspectorAttachedHeight = "inspectorAttachedHeight";
-
-InspectorSettings::InspectorSettings(InspectorClient* client)
-    : m_client(client)
-{
-    registerBoolean(MonitoringXHREnabled, false);
-    registerBoolean(ProfilerAlwaysEnabled, false);
-    registerBoolean(DebuggerAlwaysEnabled, false);
-    registerBoolean(InspectorStartsAttached, true);
-    registerLong(InspectorAttachedHeight, 300);
-}
-
-bool InspectorSettings::getBoolean(const String& name)
-{
-    String value;
-    m_client->populateSetting(name, &value);
-    if (value.isEmpty())
-        value = m_defaultValues.get(name);
-    return value == "true";
-}
-
-void InspectorSettings::setBoolean(const String& name, bool value)
-{
-    m_client->storeSetting(name, value ? "true" : "false");
-}
-
-long InspectorSettings::getLong(const String& name)
-{
-    String value;
-    m_client->populateSetting(name, &value);
-    if (value.isEmpty())
-        value = m_defaultValues.get(name);
-    return value.toInt();
-}
-
-void InspectorSettings::setLong(const String& name, long value)
-{
-    m_client->storeSetting(name, String::number(value));
-}
-
-void InspectorSettings::registerBoolean(const String& name, bool defaultValue)
-{
-    m_defaultValues.set(name, defaultValue ? "true" : "false");
-}
-
-void InspectorSettings::registerLong(const String& name, long defaultValue)
-{
-    m_defaultValues.set(name, String::number(defaultValue));
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorState.cpp b/Source/WebCore/inspector/InspectorState.cpp
index dba9e4d..290ffc2 100644
--- a/Source/WebCore/inspector/InspectorState.cpp
+++ b/Source/WebCore/inspector/InspectorState.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -37,121 +37,75 @@ namespace WebCore {
 
 InspectorState::InspectorState(InspectorClient* client)
     : m_client(client)
+    , m_properties(InspectorObject::create())
+    , m_isOnMute(false)
 {
-    // Pure reload state
-    registerBoolean(userInitiatedProfiling, false);
-    registerBoolean(timelineProfilerEnabled, false);
-    registerBoolean(searchingForNode, false);
-    registerObject(browserBreakpoints);
-    registerBoolean(consoleMessagesEnabled, false);
-    registerBoolean(monitoringXHR, false);
-    registerBoolean(resourceAgentEnabled, false);
 }
 
-void InspectorState::restoreFromInspectorCookie(const String& json)
+InspectorState::InspectorState(InspectorClient* client, const String& json)
+    : m_client(client)
+    , m_properties(InspectorObject::create())
+    , m_isOnMute(false)
 {
     RefPtr<InspectorValue> jsonValue = InspectorValue::parseJSON(json);
-    if (!jsonValue)
-        return;
-
-    RefPtr<InspectorObject> jsonObject = jsonValue->asObject();
-    if (!jsonObject)
-        return;
+    if (jsonValue)
+        m_properties = jsonValue->asObject();
+    if (!m_properties)
+        m_properties = InspectorObject::create();
+}
 
-    for (InspectorObject::iterator i = jsonObject->begin(); i != jsonObject->end(); ++i) {
-        InspectorPropertyId id = (InspectorPropertyId)i->first.toInt();
-        ASSERT(id > 0 && id < lastPropertyId);
-        PropertyMap::iterator j = m_properties.find(id);
-        ASSERT(j != m_properties.end());
-        ASSERT(j->second.m_value->type() == i->second->type());
-        j->second.m_value = i->second;
-    }
+void InspectorState::mute()
+{
+    m_isOnMute = true;
 }
 
 void InspectorState::updateCookie()
 {
-    RefPtr<InspectorObject> cookieObject = InspectorObject::create();
-    for (PropertyMap::iterator i = m_properties.begin(); i != m_properties.end(); ++i)
-        cookieObject->setValue(String::number(i->first), i->second.m_value);
-    m_client->updateInspectorStateCookie(cookieObject->toJSONString());
+    if (!m_isOnMute)
+        m_client->updateInspectorStateCookie(m_properties->toJSONString());
 }
 
-void InspectorState::setValue(InspectorPropertyId id, PassRefPtr<InspectorValue> value)
+void InspectorState::setValue(const String& propertyName, PassRefPtr<InspectorValue> value)
 {
-    PropertyMap::iterator i = m_properties.find(id);
-    ASSERT(i != m_properties.end());
-    i->second.m_value = value;
+    m_properties->setValue(propertyName, value);
     updateCookie();
 }
 
-bool InspectorState::getBoolean(InspectorPropertyId id)
+bool InspectorState::getBoolean(const String& propertyName)
 {
-    PropertyMap::iterator i = m_properties.find(id);
-    ASSERT(i != m_properties.end());
+    InspectorObject::iterator it = m_properties->find(propertyName);
     bool value = false;
-    i->second.m_value->asBoolean(&value);
+    if (it != m_properties->end())
+        it->second->asBoolean(&value);
     return value;
 }
 
-String InspectorState::getString(InspectorPropertyId id)
+String InspectorState::getString(const String& propertyName)
 {
-    PropertyMap::iterator i = m_properties.find(id);
-    ASSERT(i != m_properties.end());
+    InspectorObject::iterator it = m_properties->find(propertyName);
     String value;
-    i->second.m_value->asString(&value);
+    if (it != m_properties->end())
+        it->second->asString(&value);
     return value;
 }
 
-long InspectorState::getLong(InspectorPropertyId id)
+long InspectorState::getLong(const String& propertyName)
 {
-    PropertyMap::iterator i = m_properties.find(id);
-    ASSERT(i != m_properties.end());
+    InspectorObject::iterator it = m_properties->find(propertyName);
     long value = 0;
-    i->second.m_value->asNumber(&value);
+    if (it != m_properties->end())
+        it->second->asNumber(&value);
     return value;
 }
 
-PassRefPtr<InspectorObject> InspectorState::getObject(InspectorPropertyId id)
+PassRefPtr<InspectorObject> InspectorState::getObject(const String& propertyName)
 {
-    PropertyMap::iterator i = m_properties.find(id);
-    ASSERT(i != m_properties.end());
-    return i->second.m_value->asObject();
-}
-
-void InspectorState::setObject(InspectorPropertyId id, PassRefPtr<InspectorObject> value)
-{
-    PropertyMap::iterator i = m_properties.find(id);
-    ASSERT(i != m_properties.end());
-    Property& property = i->second;
-    property.m_value = value;
-    updateCookie();
-}
-
-void InspectorState::registerBoolean(InspectorPropertyId propertyId, bool value)
-{
-    m_properties.set(propertyId, Property::create(InspectorBasicValue::create(value)));
-}
-
-void InspectorState::registerString(InspectorPropertyId propertyId, const String& value)
-{
-    m_properties.set(propertyId, Property::create(InspectorString::create(value)));
-}
-
-void InspectorState::registerLong(InspectorPropertyId propertyId, long value)
-{
-    m_properties.set(propertyId, Property::create(InspectorBasicValue::create((double)value)));
-}
-
-void InspectorState::registerObject(InspectorPropertyId propertyId)
-{
-    m_properties.set(propertyId, Property::create(InspectorObject::create()));
-}
-
-InspectorState::Property InspectorState::Property::create(PassRefPtr<InspectorValue> value)
-{
-    Property property;
-    property.m_value = value;
-    return property;
+    InspectorObject::iterator it = m_properties->find(propertyName);
+    if (it == m_properties->end()) {
+        m_properties->setObject(propertyName, InspectorObject::create());
+        it = m_properties->find(propertyName);
+    }
+    return it->second->asObject();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorState.h b/Source/WebCore/inspector/InspectorState.h
index 6e12673..3a9c3ed 100644
--- a/Source/WebCore/inspector/InspectorState.h
+++ b/Source/WebCore/inspector/InspectorState.h
@@ -1,29 +1,31 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
+ * modification, are permitted provided that the following conditions are
+ * met:
  *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
  *
- * THIS SOFTWARE IS PROVIDED BY GOOGLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef InspectorState_h
@@ -43,48 +45,29 @@ class InspectorClient;
 
 class InspectorState {
 public:
-    enum InspectorPropertyId {
-        monitoringXHR = 1,
-        timelineProfilerEnabled,
-        searchingForNode,
-        consoleMessagesEnabled,
-        userInitiatedProfiling,
-        browserBreakpoints,
-        resourceAgentEnabled,
-        lastPropertyId
-    };
+    InspectorState(InspectorClient*);
+    InspectorState(InspectorClient*, const String& jsonString);
+    virtual ~InspectorState() {}
 
-    InspectorState(InspectorClient* client);
+    void mute();
 
-    void restoreFromInspectorCookie(const String& jsonString);
+    bool getBoolean(const String& propertyName);
+    String getString(const String& propertyName);
+    long getLong(const String& propertyName);
+    PassRefPtr<InspectorObject> getObject(const String& propertyName);
 
-    bool getBoolean(InspectorPropertyId);
-    String getString(InspectorPropertyId);
-    long getLong(InspectorPropertyId);
-    PassRefPtr<InspectorObject> getObject(InspectorPropertyId);
-
-    void setBoolean(InspectorPropertyId propertyId, bool value) { setValue(propertyId, InspectorBasicValue::create(value)); }
-    void setString(InspectorPropertyId propertyId, const String& value) { setValue(propertyId, InspectorString::create(value)); }
-    void setLong(InspectorPropertyId propertyId, long value) { setValue(propertyId, InspectorBasicValue::create((double)value)); }
-    void setObject(InspectorPropertyId, PassRefPtr<InspectorObject> value);
+    void setBoolean(const String& propertyName, bool value) { setValue(propertyName, InspectorBasicValue::create(value)); }
+    void setString(const String& propertyName, const String& value) { setValue(propertyName, InspectorString::create(value)); }
+    void setLong(const String& propertyName, long value) { setValue(propertyName, InspectorBasicValue::create((double)value)); }
+    void setObject(const String& propertyName, PassRefPtr<InspectorObject> value) { setValue(propertyName, value); }
 
 private:
     void updateCookie();
-    void setValue(InspectorPropertyId, PassRefPtr<InspectorValue>);
-
-    struct Property {
-        static Property create(PassRefPtr<InspectorValue> value);
-        RefPtr<InspectorValue> m_value;
-    };
-    typedef HashMap<long, Property> PropertyMap;
-    PropertyMap m_properties;
-
-    void registerBoolean(InspectorPropertyId, bool value);
-    void registerString(InspectorPropertyId, const String& value);
-    void registerLong(InspectorPropertyId, long value);
-    void registerObject(InspectorPropertyId);
+    void setValue(const String& propertyName, PassRefPtr<InspectorValue>);
 
     InspectorClient* m_client;
+    RefPtr<InspectorObject> m_properties;
+    bool m_isOnMute;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorTimelineAgent.cpp b/Source/WebCore/inspector/InspectorTimelineAgent.cpp
index 081a5f0..dd0a119 100644
--- a/Source/WebCore/inspector/InspectorTimelineAgent.cpp
+++ b/Source/WebCore/inspector/InspectorTimelineAgent.cpp
@@ -35,6 +35,7 @@
 
 #include "Event.h"
 #include "InspectorFrontend.h"
+#include "InspectorState.h"
 #include "IntRect.h"
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
@@ -44,14 +45,17 @@
 
 namespace WebCore {
 
+namespace TimelineAgentState {
+static const char timelineAgentEnabled[] = "timelineAgentEnabled";
+}
+
 int InspectorTimelineAgent::s_id = 0;
 
-InspectorTimelineAgent::InspectorTimelineAgent(InspectorFrontend* frontend)
-    : m_frontend(frontend)
-    , m_id(++s_id)
+PassOwnPtr<InspectorTimelineAgent> InspectorTimelineAgent::restore(InspectorState* state, InspectorFrontend* frontend)
 {
-    ScriptGCEvent::addEventListener(this);
-    ASSERT(m_frontend);
+    if (state->getBoolean(TimelineAgentState::timelineAgentEnabled))
+        return create(state, frontend);
+    return 0;
 }
 
 void InspectorTimelineAgent::pushGCEventRecords()
@@ -76,7 +80,9 @@ void InspectorTimelineAgent::didGC(double startTime, double endTime, size_t coll
 
 InspectorTimelineAgent::~InspectorTimelineAgent()
 {
+    m_frontend->timelineProfilerWasStopped();
     ScriptGCEvent::removeEventListener(this);
+    m_state->setBoolean(TimelineAgentState::timelineAgentEnabled, false);
 }
 
 void InspectorTimelineAgent::willCallFunction(const String& scriptName, int scriptLine)
@@ -272,15 +278,15 @@ void InspectorTimelineAgent::didMarkLoadEvent()
     addRecordToTimeline(record.release(), MarkLoadEventType);
 }
 
-void InspectorTimelineAgent::reset()
+void InspectorTimelineAgent::didCommitLoad()
 {
     m_recordStack.clear();
 }
 
-void InspectorTimelineAgent::resetFrontendProxyObject(InspectorFrontend* frontend)
+void InspectorTimelineAgent::setFrontend(InspectorFrontend* frontend)
 {
     ASSERT(frontend);
-    reset();
+    m_recordStack.clear();
     m_frontend = frontend;
 }
 
@@ -301,7 +307,8 @@ void InspectorTimelineAgent::setHeapSizeStatistic(InspectorObject* record)
 {
     size_t usedHeapSize = 0;
     size_t totalHeapSize = 0;
-    ScriptGCEvent::getHeapSize(usedHeapSize, totalHeapSize);
+    size_t heapSizeLimit = 0;
+    ScriptGCEvent::getHeapSize(usedHeapSize, totalHeapSize, heapSizeLimit);
     record->setNumber("usedHeapSize", usedHeapSize);
     record->setNumber("totalHeapSize", totalHeapSize);
 }
@@ -322,6 +329,16 @@ void InspectorTimelineAgent::didCompleteCurrentRecord(TimelineRecordType type)
     }
 }
 
+InspectorTimelineAgent::InspectorTimelineAgent(InspectorState* state, InspectorFrontend* frontend)
+    : m_state(state)
+    , m_frontend(frontend)
+    , m_id(++s_id)
+{
+    ScriptGCEvent::addEventListener(this);
+    m_frontend->timelineProfilerWasStarted();
+    m_state->setBoolean(TimelineAgentState::timelineAgentEnabled, true);
+}
+
 void InspectorTimelineAgent::pushCurrentRecord(PassRefPtr<InspectorObject> data, TimelineRecordType type)
 {
     pushGCEventRecords();
diff --git a/Source/WebCore/inspector/InspectorTimelineAgent.h b/Source/WebCore/inspector/InspectorTimelineAgent.h
index cae5aad..36c2df2 100644
--- a/Source/WebCore/inspector/InspectorTimelineAgent.h
+++ b/Source/WebCore/inspector/InspectorTimelineAgent.h
@@ -36,11 +36,13 @@
 #include "InspectorValues.h"
 #include "ScriptGCEvent.h"
 #include "ScriptGCEventListener.h"
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
 class Event;
 class InspectorFrontend;
+class InspectorState;
 class IntRect;
 class ResourceRequest;
 class ResourceResponse;
@@ -71,15 +73,21 @@ enum TimelineRecordType {
 };
 
 class InspectorTimelineAgent : ScriptGCEventListener {
-    WTF_MAKE_NONCOPYABLE(InspectorTimelineAgent); WTF_MAKE_FAST_ALLOCATED;
+    WTF_MAKE_NONCOPYABLE(InspectorTimelineAgent);
 public:
-    InspectorTimelineAgent(InspectorFrontend* frontend);
+    static PassOwnPtr<InspectorTimelineAgent> create(InspectorState* state, InspectorFrontend* frontend)
+    {
+        return adoptPtr(new InspectorTimelineAgent(state, frontend));
+    }
+
+    static PassOwnPtr<InspectorTimelineAgent> restore(InspectorState*, InspectorFrontend*);
+
     ~InspectorTimelineAgent();
 
     int id() const { return m_id; }
 
-    void reset();
-    void resetFrontendProxyObject(InspectorFrontend*);
+    void didCommitLoad();
+    void setFrontend(InspectorFrontend*);
 
     // Methods called from WebCore.
     void willCallFunction(const String& scriptName, int scriptLine);
@@ -141,6 +149,8 @@ private:
         TimelineRecordType type;
     };
         
+    InspectorTimelineAgent(InspectorState*, InspectorFrontend*);
+
     void pushCurrentRecord(PassRefPtr<InspectorObject>, TimelineRecordType);
     void setHeapSizeStatistic(InspectorObject* record);
         
@@ -150,6 +160,7 @@ private:
 
     void pushGCEventRecords();
 
+    InspectorState* m_state;
     InspectorFrontend* m_frontend;
 
     Vector<TimelineRecordEntry> m_recordStack;
diff --git a/Source/WebCore/inspector/InspectorValues.cpp b/Source/WebCore/inspector/InspectorValues.cpp
index d1b8093..09d1258 100644
--- a/Source/WebCore/inspector/InspectorValues.cpp
+++ b/Source/WebCore/inspector/InspectorValues.cpp
@@ -491,6 +491,11 @@ bool InspectorValue::asNumber(long*) const
     return false;
 }
 
+bool InspectorValue::asNumber(int*) const
+{
+    return false;
+}
+
 bool InspectorValue::asNumber(unsigned long*) const
 {
     return false;
@@ -581,6 +586,14 @@ bool InspectorBasicValue::asNumber(long* output) const
     return true;
 }
 
+bool InspectorBasicValue::asNumber(int* output) const
+{
+    if (type() != TypeNumber)
+        return false;
+    *output = static_cast<int>(m_doubleValue);
+    return true;
+}
+
 bool InspectorBasicValue::asNumber(unsigned long* output) const
 {
     if (type() != TypeNumber)
@@ -647,22 +660,6 @@ bool InspectorObject::getBoolean(const String& name, bool* output) const
     return value->asBoolean(output);
 }
 
-bool InspectorObject::getNumber(const String& name, long* output) const
-{
-    RefPtr<InspectorValue> value = get(name);
-    if (!value)
-        return false;
-    return value->asNumber(output);
-}
-
-bool InspectorObject::getNumber(const String& name, double* output) const
-{
-    RefPtr<InspectorValue> value = get(name);
-    if (!value)
-        return false;
-    return value->asNumber(output);
-}
-
 bool InspectorObject::getString(const String& name, String* output) const
 {
     RefPtr<InspectorValue> value = get(name);
@@ -695,6 +692,17 @@ PassRefPtr<InspectorValue> InspectorObject::get(const String& name) const
     return it->second;
 }
 
+void InspectorObject::remove(const String& name)
+{
+    m_data.remove(name);
+    for (size_t i = 0; i < m_order.size(); ++i) {
+        if (m_order[i] == name) {
+            m_order.remove(i);
+            break;
+        }
+    }
+}
+
 void InspectorObject::writeJSON(Vector<UChar>* output) const
 {
     output->append('{');
diff --git a/Source/WebCore/inspector/InspectorValues.h b/Source/WebCore/inspector/InspectorValues.h
index 843f369..835c982 100644
--- a/Source/WebCore/inspector/InspectorValues.h
+++ b/Source/WebCore/inspector/InspectorValues.h
@@ -72,6 +72,7 @@ public:
     virtual bool asBoolean(bool* output) const;
     virtual bool asNumber(double* output) const;
     virtual bool asNumber(long* output) const;
+    virtual bool asNumber(int* output) const;
     virtual bool asNumber(unsigned long* output) const;
     virtual bool asNumber(unsigned int* output) const;
     virtual bool asString(String* output) const;
@@ -114,6 +115,7 @@ public:
     virtual bool asBoolean(bool* output) const;
     virtual bool asNumber(double* output) const;
     virtual bool asNumber(long* output) const;
+    virtual bool asNumber(int* output) const;
     virtual bool asNumber(unsigned long* output) const;
     virtual bool asNumber(unsigned int* output) const;
 
@@ -178,15 +180,23 @@ public:
     void setObject(const String& name, PassRefPtr<InspectorObject>);
     void setArray(const String& name, PassRefPtr<InspectorArray>);
 
+    iterator find(const String& name);
     const_iterator find(const String& name) const;
     bool getBoolean(const String& name, bool* output) const;
-    bool getNumber(const String& name, long* output) const;
-    bool getNumber(const String& name, double* output) const;
+    template<class T> bool getNumber(const String& name, T* output) const
+    {
+        RefPtr<InspectorValue> value = get(name);
+        if (!value)
+            return false;
+        return value->asNumber(output);
+    }
     bool getString(const String& name, String* output) const;
     PassRefPtr<InspectorObject> getObject(const String& name) const;
     PassRefPtr<InspectorArray> getArray(const String& name) const;
     PassRefPtr<InspectorValue> get(const String& name) const;
 
+    void remove(const String& name);
+
     virtual void writeJSON(Vector<UChar>* output) const;
 
     iterator begin() { return m_data.begin(); }
@@ -228,6 +238,11 @@ private:
     Vector<RefPtr<InspectorValue> > m_data;
 };
 
+inline InspectorObject::iterator InspectorObject::find(const String& name)
+{
+    return m_data.find(name);
+}
+
 inline InspectorObject::const_iterator InspectorObject::find(const String& name) const
 {
     return m_data.find(name);
diff --git a/Source/WebCore/inspector/ScriptBreakpoint.cpp b/Source/WebCore/inspector/ScriptBreakpoint.cpp
deleted file mode 100644
index b7205a7..0000000
--- a/Source/WebCore/inspector/ScriptBreakpoint.cpp
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Copyright (C) 2010 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "ScriptBreakpoint.h"
-
-#if ENABLE(INSPECTOR)
-
-#include "InspectorValues.h"
-
-namespace WebCore {
-
-void ScriptBreakpoint::sourceBreakpointsFromInspectorObject(PassRefPtr<InspectorObject> breakpoints, SourceBreakpoints* sourceBreakpoints)
-{
-    for (InspectorObject::iterator it = breakpoints->begin(); it != breakpoints->end(); ++it) {
-        bool ok;
-        int lineNumber = it->first.toInt(&ok);
-        if (!ok)
-            continue;
-        RefPtr<InspectorObject> breakpoint = it->second->asObject();
-        if (!breakpoint)
-            continue;
-        bool enabled;
-        RefPtr<InspectorValue> enabledValue = breakpoint->get("enabled");
-        if (!enabledValue || !enabledValue->asBoolean(&enabled))
-            continue;
-        String condition;
-        RefPtr<InspectorValue> conditionValue = breakpoint->get("condition");
-        if (!conditionValue || !conditionValue->asString(&condition))
-            continue;
-        sourceBreakpoints->set(lineNumber, ScriptBreakpoint(enabled, condition));
-    }
-}
-
-PassRefPtr<InspectorObject> ScriptBreakpoint::inspectorObjectFromSourceBreakpoints(const SourceBreakpoints& sourceBreakpoints)
-{
-    RefPtr<InspectorObject> breakpoints = InspectorObject::create();
-    for (SourceBreakpoints::const_iterator it = sourceBreakpoints.begin(); it != sourceBreakpoints.end(); ++it) {
-        RefPtr<InspectorObject> breakpoint = InspectorObject::create();
-        breakpoint->setBoolean("enabled", it->second.enabled);
-        breakpoint->setString("condition", it->second.condition);
-        breakpoints->setObject(String::number(it->first), breakpoint);
-    }
-    return breakpoints.release();
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/ScriptBreakpoint.h b/Source/WebCore/inspector/ScriptBreakpoint.h
index d8ac762..4917aef 100644
--- a/Source/WebCore/inspector/ScriptBreakpoint.h
+++ b/Source/WebCore/inspector/ScriptBreakpoint.h
@@ -31,33 +31,26 @@
 #define ScriptBreakpoint_h
 
 #include "PlatformString.h"
-#include <wtf/HashMap.h>
 
 namespace WebCore {
 
-class InspectorObject;
-struct ScriptBreakpoint;
-
-typedef HashMap<int, ScriptBreakpoint> SourceBreakpoints;
-
 struct ScriptBreakpoint {
-    ScriptBreakpoint(bool enabled, const String& condition)
-        : enabled(enabled)
-        , condition(condition)
+    ScriptBreakpoint()
     {
     }
 
-    ScriptBreakpoint()
+    ScriptBreakpoint(int lineNumber, int columnNumber, const String& condition, bool enabled)
+        : lineNumber(lineNumber)
+        , columnNumber(columnNumber)
+        , condition(condition)
+        , enabled(enabled)
     {
     }
 
-    bool enabled;
+    int lineNumber;
+    int columnNumber;
     String condition;
-
-#if ENABLE(INSPECTOR)
-    static void sourceBreakpointsFromInspectorObject(PassRefPtr<InspectorObject>, SourceBreakpoints*);
-    static PassRefPtr<InspectorObject> inspectorObjectFromSourceBreakpoints(const SourceBreakpoints&);
-#endif
+    bool enabled;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/front-end/ApplicationCacheItemsView.js b/Source/WebCore/inspector/front-end/ApplicationCacheItemsView.js
index e7aa188..b345749 100644
--- a/Source/WebCore/inspector/front-end/ApplicationCacheItemsView.js
+++ b/Source/WebCore/inspector/front-end/ApplicationCacheItemsView.js
@@ -136,7 +136,7 @@ WebInspector.ApplicationCacheItemsView.prototype = {
 
     _update: function()
     {
-        WebInspector.ApplicationCache.getApplicationCachesAsync(this._updateCallback.bind(this));
+        WebInspector.ApplicationCacheDispatcher.getApplicationCachesAsync(this._updateCallback.bind(this));
     },
 
     _updateCallback: function(applicationCaches)
diff --git a/Source/WebCore/inspector/front-end/AuditRules.js b/Source/WebCore/inspector/front-end/AuditRules.js
index c2bbcbb..c122ba4 100644
--- a/Source/WebCore/inspector/front-end/AuditRules.js
+++ b/Source/WebCore/inspector/front-end/AuditRules.js
@@ -326,7 +326,7 @@ WebInspector.AuditRules.UnusedCssRule.prototype = {
                     if (!unusedRules.length)
                         continue;
 
-                    var resource = WebInspector.resourceTreeModel.resourceForURL(styleSheet.sourceURL);
+                    var resource = WebInspector.resourceForURL(styleSheet.sourceURL);
                     var isInlineBlock = resource && resource.type == WebInspector.Resource.Type.Document;
                     var url = !isInlineBlock ? WebInspector.AuditRuleResult.linkifyDisplayName(styleSheet.sourceURL) : String.sprintf("Inline block #%d", ++inlineBlockOrdinal);
                     var pctUnused = Math.round(100 * unusedStylesheetSize / stylesheetSize);
@@ -383,7 +383,7 @@ WebInspector.AuditRules.UnusedCssRule.prototype = {
                 WebInspector.CSSStyleSheet.createForId(styleSheetIds[i], styleSheetCallback.bind(null, styleSheets, i == styleSheetIds.length - 1 ? evalCallback : null));
         }
 
-        InspectorBackend.getAllStyles2(allStylesCallback);
+        InspectorBackend.getAllStyles(allStylesCallback);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/AuditsPanel.js b/Source/WebCore/inspector/front-end/AuditsPanel.js
index f3cbfa7..47c0b30 100644
--- a/Source/WebCore/inspector/front-end/AuditsPanel.js
+++ b/Source/WebCore/inspector/front-end/AuditsPanel.js
@@ -192,7 +192,7 @@ WebInspector.AuditsPanel.prototype = {
     _reloadResources: function(callback)
     {
         this._pageReloadCallback = callback;
-        InspectorBackend.reloadPage();
+        InspectorBackend.reloadPage(false);
     },
 
     _didMainResourceLoad: function()
diff --git a/Source/WebCore/inspector/front-end/Breakpoint.js b/Source/WebCore/inspector/front-end/Breakpoint.js
index aa600a7..ebc6029 100644
--- a/Source/WebCore/inspector/front-end/Breakpoint.js
+++ b/Source/WebCore/inspector/front-end/Breakpoint.js
@@ -29,47 +29,21 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.Breakpoint = function(debuggerModel, breakpointId, sourceID, url, line, enabled, condition)
+WebInspector.Breakpoint = function(id, url, sourceID, lineNumber, columnNumber, condition, enabled)
 {
-    this.id = breakpointId;
+    this.id = id;
     this.url = url;
-    this.line = line;
     this.sourceID = sourceID;
-    this._enabled = enabled;
-    this._condition = condition || "";
-    this._debuggerModel = debuggerModel;
+    this.lineNumber = lineNumber;
+    this.columnNumber = columnNumber;
+    this.condition = condition;
+    this.enabled = enabled;
+    this.locations = [];
 }
 
 WebInspector.Breakpoint.prototype = {
-    get enabled()
+    addLocation: function(sourceID, lineNumber, columnNumber)
     {
-        return this._enabled;
-    },
-
-    set enabled(enabled)
-    {
-        if (this._enabled === enabled)
-            return;
-        this.remove();
-        WebInspector.debuggerModel.setBreakpoint(this.sourceID, this.line, enabled, this.condition);
-    },
-
-    get condition()
-    {
-        return this._condition;
-    },
-
-    get data()
-    {
-        return { id: this.id, url: this.url, sourceID: this.sourceID, lineNumber: this.line, condition: this.condition };
-    },
-
-    remove: function()
-    {
-        this._debuggerModel.removeBreakpoint(this.id);
-        this.removeAllListeners();
-        delete this._debuggerModel;
+        this.locations.push({ sourceID: sourceID, lineNumber: lineNumber, columnNumber: columnNumber });
     }
 }
-
-WebInspector.Breakpoint.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/BreakpointManager.js b/Source/WebCore/inspector/front-end/BreakpointManager.js
index d943d5b..94345d5 100644
--- a/Source/WebCore/inspector/front-end/BreakpointManager.js
+++ b/Source/WebCore/inspector/front-end/BreakpointManager.js
@@ -34,22 +34,17 @@ WebInspector.BreakpointManager = function()
     var breakpoints = WebInspector.settings.findSettingForAllProjects("nativeBreakpoints");
     for (var projectId in breakpoints)
         this._stickyBreakpoints[projectId] = this._validateBreakpoints(breakpoints[projectId]);
-    InspectorBackend.setAllBrowserBreakpoints(this._stickyBreakpoints);
 
     this._breakpoints = {};
     this._domBreakpointsRestored = false;
-    this._scriptBreakpoints = {};
 
     WebInspector.settings.addEventListener(WebInspector.Settings.Events.ProjectChanged, this._projectChanged, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointAdded, this._scriptBreakpointAdded, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointRemoved, this._scriptBreakpointRemoved, this);
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerPaused, this._debuggerPaused, this);
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerResumed, this._debuggerResumed, this);
 }
 
 WebInspector.BreakpointManager.BreakpointTypes = {
     DOM: "DOM",
-    JS: "JS",
     EventListener: "EventListener",
     XHR: "XHR"
 }
@@ -104,38 +99,6 @@ WebInspector.BreakpointManager.prototype = {
         this.dispatchEventToListeners(WebInspector.BreakpointManager.Events.EventListenerBreakpointAdded, breakpoint.view);
     },
 
-    _createJavaScriptBreakpoint: function(url, lineNumber, condition, enabled, restored)
-    {
-        var breakpointId = this._createJavaScriptBreakpointId(url, lineNumber);
-        if (breakpointId in this._breakpoints)
-            return;
-
-        var breakpoint = new WebInspector.JavaScriptBreakpoint(url, lineNumber, condition);
-        this._setBreakpoint(breakpointId, breakpoint, enabled, restored);
-    },
-
-    _scriptBreakpointAdded: function(event)
-    {
-        var scriptBreakpoint = event.data;
-
-        if (!scriptBreakpoint.url)
-            return;
-
-        if (!scriptBreakpoint.restored)
-            this._createJavaScriptBreakpoint(scriptBreakpoint.url, scriptBreakpoint.originalLineNumber, scriptBreakpoint.condition, scriptBreakpoint.enabled, false);
-        var breakpointId = this._createJavaScriptBreakpointId(scriptBreakpoint.url, scriptBreakpoint.originalLineNumber);
-        this._scriptBreakpoints[scriptBreakpoint.id] = breakpointId;
-    },
-
-    _scriptBreakpointRemoved: function(event)
-    {
-        var scriptBreakpointId = event.data;
-        var breakpointId = this._scriptBreakpoints[scriptBreakpointId];
-        delete this._scriptBreakpoints[scriptBreakpointId];
-        if (breakpointId in this._breakpoints)
-            this._removeBreakpoint(breakpointId);
-    },
-
     createXHRBreakpoint: function(url)
     {
         this._createXHRBreakpoint(url, true, false);
@@ -232,7 +195,6 @@ WebInspector.BreakpointManager.prototype = {
     {
         this._breakpoints = {};
         this._domBreakpointsRestored = false;
-        this._scriptBreakpoints = {};
         this.dispatchEventToListeners(WebInspector.BreakpointManager.Events.ProjectChanged);
 
         var breakpoints = this._stickyBreakpoints[WebInspector.settings.projectId] || [];
@@ -240,11 +202,14 @@ WebInspector.BreakpointManager.prototype = {
             var breakpoint = breakpoints[i];
             if (breakpoint.type === WebInspector.BreakpointManager.BreakpointTypes.EventListener)
                 this._createEventListenerBreakpoint(breakpoint.condition.eventName, breakpoint.enabled, true);
-            else if (breakpoint.type === WebInspector.BreakpointManager.BreakpointTypes.JS)
-                this._createJavaScriptBreakpoint(breakpoint.condition.url, breakpoint.condition.lineNumber, breakpoint.condition.condition, breakpoint.enabled, true);
             else if (breakpoint.type === WebInspector.BreakpointManager.BreakpointTypes.XHR)
                 this._createXHRBreakpoint(breakpoint.condition.url, breakpoint.enabled, true);
         }
+
+        if (!this._breakpointsPushedToFrontend) {
+            InspectorBackend.setAllBrowserBreakpoints(this._stickyBreakpoints);
+            this._breakpointsPushedToFrontend = true;
+        }
     },
 
     restoreDOMBreakpoints: function()
@@ -324,15 +289,12 @@ WebInspector.BreakpointManager.prototype = {
                 if (typeof condition.eventName !== "string")
                     continue;
                 id += condition.eventName;
-            } else if (breakpoint.type === WebInspector.BreakpointManager.BreakpointTypes.JS) {
-                if (typeof condition.url !== "string" || typeof condition.lineNumber !== "number" || typeof condition.condition !== "string")
-                    continue;
-                id += condition.url + ":" + condition.lineNumber;
             } else if (breakpoint.type === WebInspector.BreakpointManager.BreakpointTypes.XHR) {
                 if (typeof condition.url !== "string")
                     continue;
                 id += condition.url;
-            }
+            } else
+                continue;
             if (id in breakpointsSet)
                 continue;
             breakpointsSet[id] = true;
@@ -346,11 +308,6 @@ WebInspector.BreakpointManager.prototype = {
         return "dom:" + nodeId + ":" + type;
     },
 
-    _createJavaScriptBreakpointId: function(url, lineNumber)
-    {
-        return "js:" + url + ":" + lineNumber;
-    },
-
     _createEventListenerBreakpointId: function(eventName)
     {
         return "eventListner:" + eventName;
@@ -389,29 +346,6 @@ WebInspector.DOMBreakpoint.prototype = {
     }
 }
 
-WebInspector.JavaScriptBreakpoint = function(url, lineNumber, condition)
-{
-    this._url = url;
-    this._lineNumber = lineNumber;
-    this._condition = condition;
-}
-
-WebInspector.JavaScriptBreakpoint.prototype = {
-    _enable: function()
-    {
-    },
-
-    _disable: function()
-    {
-    },
-
-    _serializeToJSON: function()
-    {
-        var type = WebInspector.BreakpointManager.BreakpointTypes.JS;
-        return { type: type, condition: { url: this._url, lineNumber: this._lineNumber, condition: this._condition } };
-    }
-}
-
 WebInspector.EventListenerBreakpoint = function(eventName)
 {
     this._eventName = eventName;
diff --git a/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js b/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js
index b237ca2..0a47bf8 100644
--- a/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js
@@ -40,6 +40,8 @@ WebInspector.JavaScriptBreakpointsSidebarPane = function(title)
 
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointAdded, this._breakpointAdded, this);
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointRemoved, this._breakpointRemoved, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointResolved, this._breakpointResolved, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.ParsedScriptSource, this._parsedScriptSource, this);
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerPaused, this._debuggerPaused, this);
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerResumed, this._debuggerResumed, this);
     WebInspector.breakpointManager.addEventListener(WebInspector.BreakpointManager.Events.ProjectChanged, this._projectChanged, this);
@@ -50,7 +52,9 @@ WebInspector.JavaScriptBreakpointsSidebarPane.prototype = {
     {
         var breakpoint = event.data;
         var breakpointId = breakpoint.id;
-        var data = breakpoint.data;
+
+        if (breakpoint.url && !WebInspector.debuggerModel.scriptsForURL(breakpoint.url).length)
+            return;
 
         var element = document.createElement("li");
 
@@ -64,7 +68,7 @@ WebInspector.JavaScriptBreakpointsSidebarPane.prototype = {
         var label = document.createElement("span");
         element.appendChild(label);
 
-        element._data = data;
+        element._data = breakpoint;
         var currentElement = this.listElement.firstChild;
         while (currentElement) {
             if (currentElement._data && this._compareBreakpoints(currentElement._data, element._data) > 0)
@@ -75,10 +79,9 @@ WebInspector.JavaScriptBreakpointsSidebarPane.prototype = {
 
         element.addEventListener("contextmenu", this._contextMenuEventFired.bind(this, breakpointId), true);
 
-        this._setupBreakpointElement(data, element);
+        this._setupBreakpointElement(breakpoint, element);
 
         var breakpointItem = {};
-        breakpointItem.data = data;
         breakpointItem.element = element;
         breakpointItem.checkbox = checkbox;
         this._items[breakpointId] = breakpointItem;
@@ -97,6 +100,23 @@ WebInspector.JavaScriptBreakpointsSidebarPane.prototype = {
         }
     },
 
+    _breakpointResolved: function(event)
+    {
+        var breakpoint = event.data;
+        this._breakpointRemoved({ data: breakpoint.id });
+        this._breakpointAdded({ data: breakpoint });
+    },
+
+    _parsedScriptSource: function(event)
+    {
+        var url = event.data.sourceURL;
+        var breakpoints = WebInspector.debuggerModel.breakpoints;
+        for (var id in breakpoints) {
+            if (!(id in this._items))
+                this._breakpointAdded({ data: breakpoints[id] });
+        }
+    },
+
     _breakpointEnableChanged: function(enabled, event)
     {
         var breakpointId = event.data;
@@ -107,7 +127,8 @@ WebInspector.JavaScriptBreakpointsSidebarPane.prototype = {
 
     _breakpointItemCheckboxClicked: function(breakpointId, event)
     {
-        this._setBreakpointEnabled(breakpointId, event.target.checked);
+        var breakpoint = WebInspector.debuggerModel.breakpointForId(breakpointId);
+        WebInspector.debuggerModel.updateBreakpoint(breakpointId, breakpoint.condition, event.target.checked);
 
         // Breakpoint element may have it's own click handler.
         event.stopPropagation();
@@ -186,23 +207,32 @@ WebInspector.JavaScriptBreakpointsSidebarPane.prototype = {
 
     _setupBreakpointElement: function(data, element)
     {
+        var sourceID;
+        var lineNumber = data.lineNumber;
+        if (data.locations.length) {
+            sourceID = data.locations[0].sourceID;
+            lineNumber = data.locations[0].lineNumber;
+        }
+
         var displayName = data.url ? WebInspector.displayNameForURL(data.url) : WebInspector.UIString("(program)");
-        var labelElement = document.createTextNode(displayName + ":" + data.lineNumber);
+        var labelElement = document.createTextNode(displayName + ":" + (lineNumber + 1));
         element.appendChild(labelElement);
 
         var sourceTextElement = document.createElement("div");
         sourceTextElement.className = "source-text monospace";
         element.appendChild(sourceTextElement);
 
-        function didGetSourceLine(text)
-        {
-            sourceTextElement.textContent = text;
+        if (sourceID) {
+            function didGetSourceLine(text)
+            {
+                sourceTextElement.textContent = text;
+            }
+            var script = WebInspector.debuggerModel.scriptForSourceID(sourceID);
+            script.sourceLine(lineNumber, didGetSourceLine.bind(this));
         }
-        var script = WebInspector.debuggerModel.scriptForSourceID(data.sourceID);
-        script.sourceLine(data.lineNumber, didGetSourceLine.bind(this));
 
         element.addStyleClass("cursor-pointer");
-        var clickHandler = WebInspector.panels.scripts.showSourceLine.bind(WebInspector.panels.scripts, data.url, data.lineNumber);
+        var clickHandler = WebInspector.panels.scripts.showSourceLine.bind(WebInspector.panels.scripts, data.url, lineNumber + 1);
         element.addEventListener("click", clickHandler, false);
     },
 
@@ -214,13 +244,6 @@ WebInspector.JavaScriptBreakpointsSidebarPane.prototype = {
             return breakpoint.id;
    },
 
-    _setBreakpointEnabled: function(breakpointId, enabled)
-    {
-        var breakpoint = WebInspector.debuggerModel.breakpointForId(breakpointId);
-        WebInspector.debuggerModel.removeBreakpoint(breakpointId);
-        WebInspector.debuggerModel.setBreakpoint(breakpoint.sourceID, breakpoint.line, enabled, breakpoint.condition);
-    },
-
     _removeBreakpoint: function(breakpointId)
     {
         WebInspector.debuggerModel.removeBreakpoint(breakpointId);
diff --git a/Source/WebCore/inspector/front-end/CSSCompletions.js b/Source/WebCore/inspector/front-end/CSSCompletions.js
index f60c297..ba3aca2 100644
--- a/Source/WebCore/inspector/front-end/CSSCompletions.js
+++ b/Source/WebCore/inspector/front-end/CSSCompletions.js
@@ -30,10 +30,11 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.CSSCompletions = function(values)
+WebInspector.CSSCompletions = function(values, acceptEmptyPrefix)
 {
     this._values = values.slice();
     this._values.sort();
+    this._acceptEmptyPrefix = acceptEmptyPrefix;
 }
 
 WebInspector.CSSCompletions.prototype = {
@@ -57,10 +58,10 @@ WebInspector.CSSCompletions.prototype = {
 
     _firstIndexOfPrefix: function(prefix)
     {
-        if (!prefix)
-            return -1;
         if (!this._values.length)
             return -1;
+        if (!prefix)
+            return this._acceptEmptyPrefix ? 0 : -1;
 
         var maxIndex = this._values.length - 1;
         var minIndex = 0;
diff --git a/Source/WebCore/inspector/front-end/CSSKeywordCompletions.js b/Source/WebCore/inspector/front-end/CSSKeywordCompletions.js
index ac62aff..de2072a 100755
--- a/Source/WebCore/inspector/front-end/CSSKeywordCompletions.js
+++ b/Source/WebCore/inspector/front-end/CSSKeywordCompletions.js
@@ -38,7 +38,7 @@ WebInspector.CSSKeywordCompletions = {
             acceptedKeywords = acceptedKeywords.concat(WebInspector.CSSKeywordCompletions._colors);
         if (propertyName in WebInspector.StylesSidebarPane.InheritedProperties)
             acceptedKeywords.push("inherit");
-        return new WebInspector.CSSCompletions(acceptedKeywords);
+        return new WebInspector.CSSCompletions(acceptedKeywords, true);
     }
 };
 
diff --git a/Source/WebCore/inspector/front-end/CSSStyleModel.js b/Source/WebCore/inspector/front-end/CSSStyleModel.js
index 4f20660..69bd7a9 100644
--- a/Source/WebCore/inspector/front-end/CSSStyleModel.js
+++ b/Source/WebCore/inspector/front-end/CSSStyleModel.js
@@ -83,7 +83,7 @@ WebInspector.CSSStyleModel.prototype = {
                 userCallback(result);
         }
 
-        InspectorBackend.getStylesForNode2(nodeId, callback.bind(null, userCallback));
+        InspectorBackend.getStylesForNode(nodeId, callback.bind(null, userCallback));
     },
 
     getComputedStyleAsync: function(nodeId, userCallback)
@@ -96,7 +96,7 @@ WebInspector.CSSStyleModel.prototype = {
                 userCallback(WebInspector.CSSStyleDeclaration.parsePayload(stylePayload));
         }
 
-        InspectorBackend.getComputedStyleForNode2(nodeId, callback.bind(null, userCallback));
+        InspectorBackend.getComputedStyleForNode(nodeId, callback.bind(null, userCallback));
     },
 
     getInlineStyleAsync: function(nodeId, userCallback)
@@ -109,7 +109,7 @@ WebInspector.CSSStyleModel.prototype = {
                 userCallback(WebInspector.CSSStyleDeclaration.parsePayload(stylePayload));
         }
 
-        InspectorBackend.getInlineStyleForNode2(nodeId, callback.bind(null, userCallback));
+        InspectorBackend.getInlineStyleForNode(nodeId, callback.bind(null, userCallback));
     },
 
     setRuleSelector: function(ruleId, nodeId, newSelector, successCallback, failureCallback)
@@ -130,7 +130,7 @@ WebInspector.CSSStyleModel.prototype = {
                 InspectorBackend.querySelectorAll(nodeId, newSelector, checkAffectsCallback.bind(this, nodeId, successCallback, rulePayload));
         }
 
-        InspectorBackend.setRuleSelector2(ruleId, newSelector, callback.bind(this, nodeId, successCallback, failureCallback));
+        InspectorBackend.setRuleSelector(ruleId, newSelector, callback.bind(this, nodeId, successCallback, failureCallback));
     },
 
     addRule: function(nodeId, selector, successCallback, failureCallback)
@@ -152,7 +152,7 @@ WebInspector.CSSStyleModel.prototype = {
                 InspectorBackend.querySelectorAll(nodeId, selector, checkAffectsCallback.bind(this, nodeId, successCallback, rulePayload));
         }
 
-        InspectorBackend.addRule2(nodeId, selector, callback.bind(this, successCallback, failureCallback, selector));
+        InspectorBackend.addRule(nodeId, selector, callback.bind(this, successCallback, failureCallback, selector));
     },
 
     _styleSheetChanged: function(styleSheetId, majorChange)
@@ -162,11 +162,11 @@ WebInspector.CSSStyleModel.prototype = {
 
         function callback(href, content)
         {
-            var resource = WebInspector.resourceTreeModel.resourceForURL(href);
+            var resource = WebInspector.resourceForURL(href);
             if (resource && resource.type === WebInspector.Resource.Type.Stylesheet)
                 resource.setContent(content, this._onRevert.bind(this, styleSheetId));
         }
-        InspectorBackend.getStyleSheetText2(styleSheetId, callback.bind(this));
+        InspectorBackend.getStyleSheetText(styleSheetId, callback.bind(this));
     },
 
     _onRevert: function(styleSheetId, contentToRevertTo)
@@ -176,7 +176,7 @@ WebInspector.CSSStyleModel.prototype = {
             this._styleSheetChanged(styleSheetId, true);
             this.dispatchEventToListeners("stylesheet changed");
         }
-        InspectorBackend.setStyleSheetText2(styleSheetId, contentToRevertTo, callback.bind(this));
+        InspectorBackend.setStyleSheetText(styleSheetId, contentToRevertTo, callback.bind(this));
     }
 }
 
@@ -348,7 +348,7 @@ WebInspector.CSSStyleDeclaration.prototype = {
             }
         }
 
-        InspectorBackend.setPropertyText2(this.id, index, name + ": " + value + ";", false, callback.bind(null, userCallback));
+        InspectorBackend.setPropertyText(this.id, index, name + ": " + value + ";", false, callback.bind(null, userCallback));
     },
 
     appendProperty: function(name, value, userCallback)
@@ -488,7 +488,7 @@ WebInspector.CSSProperty.prototype = {
             throw "No ownerStyle for property";
 
         // An index past all the properties adds a new property to the style.
-        InspectorBackend.setPropertyText2(this.ownerStyle.id, this.index, propertyText, this.index < this.ownerStyle.pastLastSourcePropertyIndex(), callback.bind(this));
+        InspectorBackend.setPropertyText(this.ownerStyle.id, this.index, propertyText, this.index < this.ownerStyle.pastLastSourcePropertyIndex(), callback.bind(this));
     },
 
     setValue: function(newValue, userCallback)
@@ -517,7 +517,7 @@ WebInspector.CSSProperty.prototype = {
             }
         }
 
-        InspectorBackend.toggleProperty2(this.ownerStyle.id, this.index, disabled, callback.bind(this));
+        InspectorBackend.toggleProperty(this.ownerStyle.id, this.index, disabled, callback.bind(this));
     }
 }
 
@@ -548,7 +548,7 @@ WebInspector.CSSStyleSheet.createForId = function(styleSheetId, userCallback)
         else
             userCallback(new WebInspector.CSSStyleSheet(styleSheetPayload));
     }
-    InspectorBackend.getStyleSheet2(styleSheetId, callback.bind(this));
+    InspectorBackend.getStyleSheet(styleSheetId, callback.bind(this));
 }
 
 WebInspector.CSSStyleSheet.prototype = {
@@ -569,6 +569,6 @@ WebInspector.CSSStyleSheet.prototype = {
             }
         }
 
-        InspectorBackend.setStyleSheetText2(this.id, newText, callback.bind(this));
+        InspectorBackend.setStyleSheetText(this.id, newText, callback.bind(this));
     }
 }
diff --git a/Source/WebCore/inspector/front-end/ChangesView.js b/Source/WebCore/inspector/front-end/ChangesView.js
deleted file mode 100644
index 5ab6942..0000000
--- a/Source/WebCore/inspector/front-end/ChangesView.js
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
- * Copyright (C) 2009 Joseph Pecoraro
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer. 
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution. 
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission. 
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-WebInspector.ChangesView = function(drawer)
-{
-    WebInspector.View.call(this);
-    this.element.innerHTML = "<div style=\"bottom:25%;color:rgb(192,192,192);font-size:12px;height:65px;left:0px;margin:auto;position:absolute;right:0px;text-align:center;top:0px;\"><h1>Not Implemented Yet</h1></div>";
-
-    this.drawer = drawer;
-
-    this.clearButton = document.createElement("button");
-    this.clearButton.id = "clear-changes-status-bar-item";
-    this.clearButton.title = WebInspector.UIString("Clear changes log.");
-    this.clearButton.className = "status-bar-item clear-status-bar-item";
-    this.clearButton.addEventListener("click", this._clearButtonClicked.bind(this), false);
-
-    this.toggleChangesButton = document.getElementById("changes-status-bar-item");
-    this.toggleChangesButton.title = WebInspector.UIString("Show changes view.");
-    this.toggleChangesButton.addEventListener("click", this._toggleChangesButtonClicked.bind(this), false);
-    var anchoredStatusBar = document.getElementById("anchored-status-bar-items");
-    anchoredStatusBar.appendChild(this.toggleChangesButton);
-}
-
-WebInspector.ChangesView.prototype = {
-    _clearButtonClicked: function()
-    {
-        // Not Implemented Yet
-    },
-
-    _toggleChangesButtonClicked: function()
-    {
-        this.drawer.visibleView = this;
-    },
-
-    attach: function(mainElement, statusBarElement)
-    {
-        mainElement.appendChild(this.element);
-        statusBarElement.appendChild(this.clearButton);
-    },
-
-    show: function()
-    {
-        this.toggleChangesButton.addStyleClass("toggled-on");
-        this.toggleChangesButton.title = WebInspector.UIString("Hide changes view.");
-    },
-
-    hide: function()
-    {
-        this.toggleChangesButton.removeStyleClass("toggled-on");
-        this.toggleChangesButton.title = WebInspector.UIString("Show changes view.");
-    }
-}
-
-WebInspector.ChangesView.prototype.__proto__ = WebInspector.View.prototype;
diff --git a/Source/WebCore/inspector/front-end/ConsoleView.js b/Source/WebCore/inspector/front-end/ConsoleView.js
index bd08e60..35d1ebf 100644
--- a/Source/WebCore/inspector/front-end/ConsoleView.js
+++ b/Source/WebCore/inspector/front-end/ConsoleView.js
@@ -89,7 +89,7 @@ WebInspector.ConsoleView = function(drawer)
     this.filter(this.allElement, false);
     this._registerShortcuts();
 
-    this.messagesElement.addEventListener("contextmenu", this._handleContextMenuEvent.bind(this), true);
+    this.messagesElement.addEventListener("contextmenu", this._handleContextMenuEvent.bind(this), false);
 
     this._customFormatters = {
         "object": this._formatobject,
@@ -150,11 +150,6 @@ WebInspector.ConsoleView.prototype = {
             {
                 console.clearMessages();
             },
-
-            monitoringXHRStateChanged: function(enabled)
-            {
-                console._monitoringXHREnabled = enabled;
-            }
         }
         InspectorBackend.registerDomainDispatcher("Console", dispatcher);
     },
@@ -278,6 +273,7 @@ WebInspector.ConsoleView.prototype = {
         if (msg instanceof WebInspector.ConsoleMessage && !(msg instanceof WebInspector.ConsoleCommandResult)) {
             this._incrementErrorWarningCount(msg);
             WebInspector.resourceTreeModel.addConsoleMessage(msg);
+            WebInspector.panels.scripts.addConsoleMessage(msg);
             this.commandSincePreviousMessage = false;
             this.previousMessage = msg;
         } else if (msg instanceof WebInspector.ConsoleCommand) {
@@ -326,6 +322,7 @@ WebInspector.ConsoleView.prototype = {
     clearMessages: function()
     {
         WebInspector.resourceTreeModel.clearConsoleMessages();
+        WebInspector.panels.scripts.clearConsoleMessages();
 
         this.messages = [];
 
@@ -359,12 +356,12 @@ WebInspector.ConsoleView.prototype = {
         var reportCompletions = this._reportCompletions.bind(this, bestMatchOnly, completionsReadyCallback, dotNotation, bracketNotation, prefix);
         // Collect comma separated object properties for the completion.
 
-        var includeInspectorCommandLineAPI = (!dotNotation && !bracketNotation);
+        var includeCommandLineAPI = (!dotNotation && !bracketNotation);
         var injectedScriptAccess;
         if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused)
-            InspectorBackend.getCompletionsOnCallFrame(WebInspector.panels.scripts.selectedCallFrameId(), expressionString, includeInspectorCommandLineAPI, reportCompletions);
+            InspectorBackend.getCompletionsOnCallFrame(WebInspector.panels.scripts.selectedCallFrameId(), expressionString, includeCommandLineAPI, reportCompletions);
         else
-            InspectorBackend.getCompletions(expressionString, includeInspectorCommandLineAPI, reportCompletions);
+            InspectorBackend.getCompletions(expressionString, includeCommandLineAPI, reportCompletions);
     },
 
     _reportCompletions: function(bestMatchOnly, completionsReadyCallback, dotNotation, bracketNotation, prefix, result, isException) {
@@ -418,9 +415,12 @@ WebInspector.ConsoleView.prototype = {
             return;
         }
 
-        var itemAction = InspectorBackend.setMonitoringXHREnabled.bind(InspectorBackend, !this._monitoringXHREnabled);
+        var itemAction = function () {
+            WebInspector.settings.monitoringXHREnabled = !WebInspector.settings.monitoringXHREnabled;
+            InspectorBackend.setMonitoringXHREnabled(WebInspector.settings.monitoringXHREnabled);
+        }.bind(this);
         var contextMenu = new WebInspector.ContextMenu();
-        contextMenu.appendCheckboxItem(WebInspector.UIString("XMLHttpRequest logging"), itemAction, this._monitoringXHREnabled);
+        contextMenu.appendCheckboxItem(WebInspector.UIString("XMLHttpRequest logging"), itemAction, WebInspector.settings.monitoringXHREnabled)
         contextMenu.appendItem(WebInspector.UIString("Clear Console"), this.requestClearMessages.bind(this));
         contextMenu.show(event);
     },
@@ -510,17 +510,13 @@ WebInspector.ConsoleView.prototype = {
         }
     },
 
-    evalInInspectedWindow: function(expression, objectGroup, callback)
+    evalInInspectedWindow: function(expression, objectGroup, includeCommandLineAPI, callback)
     {
         if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused) {
-            WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false, objectGroup, callback);
+            WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false, objectGroup, includeCommandLineAPI, callback);
             return;
         }
-        this.doEvalInWindow(expression, objectGroup, callback);
-    },
 
-    doEvalInWindow: function(expression, objectGroup, callback)
-    {
         if (!expression) {
             // There is no expression, so the completion should happen against global properties.
             expression = "this";
@@ -530,7 +526,7 @@ WebInspector.ConsoleView.prototype = {
         {
             callback(WebInspector.RemoteObject.fromPayload(result));
         }
-        InspectorBackend.evaluate(expression, objectGroup, evalCallback);
+        InspectorBackend.evaluate(expression, objectGroup, includeCommandLineAPI, evalCallback);
     },
 
     _enterKeyPressed: function(event)
@@ -561,7 +557,7 @@ WebInspector.ConsoleView.prototype = {
 
             self.addMessage(new WebInspector.ConsoleCommandResult(result, commandMessage));
         }
-        this.evalInInspectedWindow(str, "console", printResult);
+        this.evalInInspectedWindow(str, "console", true, printResult);
     },
 
     _format: function(output, forceObjectFormat)
diff --git a/Source/WebCore/inspector/front-end/ContextMenu.js b/Source/WebCore/inspector/front-end/ContextMenu.js
index 47045a2..58810fb 100644
--- a/Source/WebCore/inspector/front-end/ContextMenu.js
+++ b/Source/WebCore/inspector/front-end/ContextMenu.js
@@ -44,6 +44,7 @@ WebInspector.ContextMenu.prototype = {
             WebInspector._contextMenu = this;
             InspectorFrontendHost.showContextMenu(event, this._items);
         }
+        event.stopPropagation();
     },
 
     appendItem: function(label, handler, disabled)
diff --git a/Source/WebCore/inspector/front-end/DOMAgent.js b/Source/WebCore/inspector/front-end/DOMAgent.js
index e4fc7ad..3645bb9 100644
--- a/Source/WebCore/inspector/front-end/DOMAgent.js
+++ b/Source/WebCore/inspector/front-end/DOMAgent.js
@@ -502,19 +502,19 @@ WebInspector.ApplicationCacheDispatcher = function()
 {
 }
 
-WebInspector.ApplicationCacheDispatcher.prototype = {
-    getApplicationCachesAsync: function(callback)
+WebInspector.ApplicationCacheDispatcher.getApplicationCachesAsync = function(callback)
+{
+    function mycallback(applicationCaches)
     {
-        function mycallback(applicationCaches)
-        {
-            // FIXME: Currently, this list only returns a single application cache.
-            if (applicationCaches)
-                callback(applicationCaches);
-        }
-    
-        InspectorBackend.getApplicationCaches(mycallback);
-    },
-        
+        // FIXME: Currently, this list only returns a single application cache.
+        if (applicationCaches)
+            callback(applicationCaches);
+    }
+
+    InspectorBackend.getApplicationCaches(mycallback);
+}
+
+WebInspector.ApplicationCacheDispatcher.prototype = {
     updateApplicationCacheStatus: function(status)
     {
         WebInspector.panels.resources.updateApplicationCacheStatus(status);
diff --git a/Source/WebCore/inspector/front-end/DataGrid.js b/Source/WebCore/inspector/front-end/DataGrid.js
index 5831d1e..45f0b55 100644
--- a/Source/WebCore/inspector/front-end/DataGrid.js
+++ b/Source/WebCore/inspector/front-end/DataGrid.js
@@ -493,6 +493,11 @@ WebInspector.DataGrid.prototype = {
         this._columnWidthsInitialized = false;
     },
 
+    get scrollContainer()
+    {
+        return this._scrollContainer;        
+    },
+
     isScrolledToLastRow: function()
     {
         return this._scrollContainer.isScrolledToBottom();
diff --git a/Source/WebCore/inspector/front-end/DebuggerModel.js b/Source/WebCore/inspector/front-end/DebuggerModel.js
index 717486c..1bf1e47 100644
--- a/Source/WebCore/inspector/front-end/DebuggerModel.js
+++ b/Source/WebCore/inspector/front-end/DebuggerModel.js
@@ -33,7 +33,6 @@ WebInspector.DebuggerModel = function()
     this._paused = false;
     this._callFrames = [];
     this._breakpoints = {};
-    this._sourceIDAndLineToBreakpointId = {};
     this._scripts = {};
 
     InspectorBackend.registerDomainDispatcher("Debugger", new WebInspector.DebuggerDispatcher(this));
@@ -46,64 +45,116 @@ WebInspector.DebuggerModel.Events = {
     FailedToParseScriptSource: "failed-to-parse-script-source",
     ScriptSourceChanged: "script-source-changed",
     BreakpointAdded: "breakpoint-added",
-    BreakpointRemoved: "breakpoint-removed"
+    BreakpointRemoved: "breakpoint-removed",
+    BreakpointResolved: "breakpoint-resolved"
 }
 
 WebInspector.DebuggerModel.prototype = {
+    enableDebugger: function()
+    {
+        InspectorBackend.enableDebugger();
+        if (this._breakpointsPushedToBackend)
+            return;
+        var breakpoints = WebInspector.settings.breakpoints;
+        for (var i = 0; i < breakpoints.length; ++i) {
+            var breakpoint = breakpoints[i];
+            if (typeof breakpoint.url !== "string" || typeof breakpoint.lineNumber !== "number" || typeof breakpoint.columnNumber !== "number" ||
+                typeof breakpoint.condition !== "string" || typeof breakpoint.enabled !== "boolean")
+                continue;
+            this.setBreakpoint(breakpoint.url, breakpoint.lineNumber, breakpoint.columnNumber, breakpoint.condition, breakpoint.enabled);
+        }
+        this._breakpointsPushedToBackend = true;
+    },
+
+    disableDebugger: function()
+    {
+        InspectorBackend.disableDebugger();
+    },
+
     continueToLine: function(sourceID, lineNumber)
     {
-        function didSetBreakpoint(breakpointId, actualLineNumber)
+        InspectorBackend.continueToLocation(sourceID, lineNumber, 0);
+    },
+
+    setBreakpoint: function(url, lineNumber, columnNumber, condition, enabled)
+    {
+        function didSetBreakpoint(breakpointsPushedToBackend, breakpointId, locations)
         {
             if (!breakpointId)
                 return;
-            if (this.findBreakpoint(sourceID, actualLineNumber)) {
-                InspectorBackend.removeBreakpoint(breakpointId);
-                return;
-            }
-            if ("_continueToLineBreakpointId" in this)
-                InspectorBackend.removeBreakpoint(this._continueToLineBreakpointId);
-            this._continueToLineBreakpointId = breakpointId;
+            var breakpoint = new WebInspector.Breakpoint(breakpointId, url, "", lineNumber, columnNumber, condition, enabled);
+            breakpoint.locations = locations;
+            this._breakpoints[breakpointId] = breakpoint;
+            if (breakpointsPushedToBackend)
+                this._saveBreakpoints();
+            this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.BreakpointAdded, breakpoint);
         }
-        InspectorBackend.setBreakpoint(sourceID, lineNumber, "", true, didSetBreakpoint.bind(this));
-        if (this._paused)
-            InspectorBackend.resume();
+        InspectorBackend.setJavaScriptBreakpoint(url, lineNumber, columnNumber, condition, enabled, didSetBreakpoint.bind(this, this._breakpointsPushedToBackend));
     },
 
-    setBreakpoint: function(sourceID, lineNumber, enabled, condition)
+    setBreakpointBySourceId: function(sourceID, lineNumber, columnNumber, condition, enabled)
     {
-        function didSetBreakpoint(breakpointId, actualLineNumber)
+        function didSetBreakpoint(breakpointId, actualLineNumber, actualColumnNumber)
         {
-            if (breakpointId)
-                this._breakpointSetOnBackend(breakpointId, sourceID, actualLineNumber, condition, enabled, lineNumber, false);
+            if (!breakpointId)
+                return;
+            var breakpoint = new WebInspector.Breakpoint(breakpointId, "", sourceID, lineNumber, columnNumber, condition, enabled);
+            breakpoint.addLocation(sourceID, actualLineNumber, actualColumnNumber);
+            this._breakpoints[breakpointId] = breakpoint;
+            this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.BreakpointAdded, breakpoint);
         }
-        InspectorBackend.setBreakpoint(sourceID, lineNumber, condition, enabled, didSetBreakpoint.bind(this));
+        InspectorBackend.setJavaScriptBreakpointBySourceId(sourceID, lineNumber, columnNumber, condition, enabled, didSetBreakpoint.bind(this));
     },
 
     removeBreakpoint: function(breakpointId)
     {
-        InspectorBackend.removeBreakpoint(breakpointId);
+        InspectorBackend.removeJavaScriptBreakpoint(breakpointId);
         var breakpoint = this._breakpoints[breakpointId];
         delete this._breakpoints[breakpointId];
-        delete this._sourceIDAndLineToBreakpointId[this._encodeSourceIDAndLine(breakpoint.sourceID, breakpoint.line)];
+        this._saveBreakpoints();
         this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.BreakpointRemoved, breakpointId);
-        breakpoint.dispatchEventToListeners("removed");
     },
 
-    _breakpointSetOnBackend: function(breakpointId, sourceID, lineNumber, condition, enabled, originalLineNumber, restored)
+    updateBreakpoint: function(breakpointId, condition, enabled)
     {
-        var sourceIDAndLine = this._encodeSourceIDAndLine(sourceID, lineNumber);
-        if (sourceIDAndLine in this._sourceIDAndLineToBreakpointId) {
-            InspectorBackend.removeBreakpoint(breakpointId);
+        var breakpoint = this._breakpoints[breakpointId];
+        this.removeBreakpoint(breakpointId);
+        if (breakpoint.url)
+            this.setBreakpoint(breakpoint.url, breakpoint.lineNumber, breakpoint.columnNumber, condition, enabled);
+        else
+            this.setBreakpointBySourceId(breakpoint.sourceID, breakpoint.lineNumber, breakpoint.columnNumber, condition, enabled);
+    },
+
+    _breakpointResolved: function(breakpointId, sourceID, lineNumber, columnNumber)
+    {
+        var breakpoint = this._breakpoints[breakpointId];
+        if (!breakpoint)
             return;
+        breakpoint.addLocation(sourceID, lineNumber, columnNumber);
+        this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.BreakpointResolved, breakpoint);
+    },
+
+    _saveBreakpoints: function()
+    {
+        var serializedBreakpoints = [];
+        for (var id in this._breakpoints) {
+            var breakpoint = this._breakpoints[id];
+            if (!breakpoint.url)
+                continue;
+            var serializedBreakpoint = {};
+            serializedBreakpoint.url = breakpoint.url;
+            serializedBreakpoint.lineNumber = breakpoint.lineNumber;
+            serializedBreakpoint.columnNumber = breakpoint.columnNumber;
+            serializedBreakpoint.condition = breakpoint.condition;
+            serializedBreakpoint.enabled = breakpoint.enabled;
+            serializedBreakpoints.push(serializedBreakpoint);
         }
+        WebInspector.settings.breakpoints = serializedBreakpoints;
+    },
 
-        var url = this._scripts[sourceID].sourceURL;
-        var breakpoint = new WebInspector.Breakpoint(this, breakpointId, sourceID, url, lineNumber, enabled, condition);
-        breakpoint.restored = restored;
-        breakpoint.originalLineNumber = originalLineNumber;
-        this._breakpoints[breakpointId] = breakpoint;
-        this._sourceIDAndLineToBreakpointId[sourceIDAndLine] = breakpointId;
-        this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.BreakpointAdded, breakpoint);
+    get breakpoints()
+    {
+        return this._breakpoints;
     },
 
     breakpointForId: function(breakpointId)
@@ -124,23 +175,26 @@ WebInspector.DebuggerModel.prototype = {
 
     findBreakpoint: function(sourceID, lineNumber)
     {
-        var sourceIDAndLine = this._encodeSourceIDAndLine(sourceID, lineNumber);
-        var breakpointId = this._sourceIDAndLineToBreakpointId[sourceIDAndLine];
-        return this._breakpoints[breakpointId];
-    },
-
-    _encodeSourceIDAndLine: function(sourceID, lineNumber)
-    {
-        return sourceID + ":" + lineNumber;
+        for (var id in this._breakpoints) {
+            var locations = this._breakpoints[id].locations;
+            for (var i = 0; i < locations.length; ++i) {
+                if (locations[i].sourceID == sourceID && locations[i].lineNumber + 1 === lineNumber)
+                    return this._breakpoints[id];
+            }
+        }
     },
 
     reset: function()
     {
         this._paused = false;
         this._callFrames = [];
-        this._breakpoints = {};
-        delete this._oneTimeBreakpoint;
-        this._sourceIDAndLineToBreakpointId = {};
+        for (var id in this._breakpoints) {
+            var breakpoint = this._breakpoints[id];
+            if (!breakpoint.url)
+                this.removeBreakpoint(id);
+            else
+                breakpoint.locations = [];
+        }
         this._scripts = {};
     },
 
@@ -189,10 +243,15 @@ WebInspector.DebuggerModel.prototype = {
         var diff = Array.diff(oldSource.split("\n"), script.source.split("\n"));
         for (var id in this._breakpoints) {
             var breakpoint = this._breakpoints[id];
-            if (breakpoint.sourceID !== sourceID)
-                continue;
-            breakpoint.remove();
-            var lineNumber = breakpoint.line - 1;
+            if (breakpoint.url) {
+                if (breakpoint.url !== script.sourceURL)
+                    continue;
+            } else {
+                if (breakpoint.sourceID !== sourceID)
+                    continue;
+            }
+            this.removeBreakpoint(breakpoint.id);
+            var lineNumber = breakpoint.lineNumber;
             var newLineNumber = diff.left[lineNumber].row;
             if (newLineNumber === undefined) {
                 for (var i = lineNumber - 1; i >= 0; --i) {
@@ -207,8 +266,12 @@ WebInspector.DebuggerModel.prototype = {
                     break;
                 }
             }
-            if (newLineNumber !== undefined)
-                this.setBreakpoint(sourceID, newLineNumber + 1, breakpoint.enabled, breakpoint.condition);
+            if (newLineNumber === undefined)
+                continue;
+            if (breakpoint.url)
+                this.setBreakpoint(breakpoint.url, newLineNumber, breakpoint.columnNumber, breakpoint.condition, breakpoint.enabled);
+            else
+                this.setBreakpointBySourceId(sourceID, newLineNumber, breakpoint.columnNumber, breakpoint.condition, breakpoint.enabled);
         }
 
         this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.ScriptSourceChanged, { sourceID: sourceID, oldSource: oldSource });
@@ -223,10 +286,6 @@ WebInspector.DebuggerModel.prototype = {
     {
         this._paused = true;
         this._callFrames = details.callFrames;
-        if ("_continueToLineBreakpointId" in this) {
-            InspectorBackend.removeBreakpoint(this._continueToLineBreakpointId);
-            delete this._continueToLineBreakpointId;
-        }
         this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.DebuggerPaused, details);
     },
 
@@ -241,7 +300,7 @@ WebInspector.DebuggerModel.prototype = {
     {
         var script = new WebInspector.Script(sourceID, sourceURL, "", lineOffset, columnOffset, length, undefined, undefined, scriptWorldType);
         this._scripts[sourceID] = script;
-        this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.ParsedScriptSource, sourceID);
+        this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.ParsedScriptSource, script);
     },
 
     _failedToParseScriptSource: function(sourceURL, source, startingLine, errorLine, errorMessage)
@@ -295,9 +354,9 @@ WebInspector.DebuggerDispatcher.prototype = {
         this._debuggerModel._failedToParseScriptSource(sourceURL, source, startingLine, errorLine, errorMessage);
     },
 
-    breakpointResolved: function(breakpointId, sourceID, lineNumber, condition, enabled, originalLineNumber)
+    breakpointResolved: function(breakpointId, sourceID, lineNumber, columnNumber)
     {
-        this._debuggerModel._breakpointSetOnBackend(breakpointId, sourceID, lineNumber, condition, enabled, originalLineNumber, true);
+        this._debuggerModel._breakpointResolved(breakpointId, sourceID, lineNumber, columnNumber);
     },
 
     didCreateWorker: function()
diff --git a/Source/WebCore/inspector/front-end/DetailedHeapshotView.js b/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
new file mode 100644
index 0000000..5291bf2
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.DetailedHeapshotView = function(parent, profile)
+{
+    WebInspector.View.call(this);
+
+    this.element.addStyleClass("heap-snapshot-view");
+
+    this.parent = parent;
+    this.profile = profile;
+}
+
+WebInspector.DetailedHeapshotView.prototype = {
+    get profile()
+    {
+        return this._profile;
+    },
+
+    set profile(profile)
+    {
+        this._profile = profile;
+    }
+};
+
+WebInspector.DetailedHeapshotView.prototype.__proto__ = WebInspector.View.prototype;
+
+WebInspector.DetailedHeapshotProfileType = function()
+{
+    WebInspector.ProfileType.call(this, WebInspector.HeapSnapshotProfileType.TypeId, WebInspector.UIString("HEAP SNAPSHOTS"));
+}
+
+WebInspector.DetailedHeapshotProfileType.prototype = {
+    get buttonTooltip()
+    {
+        return WebInspector.UIString("Take heap snapshot.");
+    },
+
+    get buttonStyle()
+    {
+        return "heap-snapshot-status-bar-item status-bar-item";
+    },
+
+    buttonClicked: function()
+    {
+        WebInspector.panels.profiles.takeHeapSnapshot(true);
+    },
+
+    get welcomeMessage()
+    {
+        return WebInspector.UIString("Get a heap snapshot by pressing the %s button on the status bar.");
+    },
+
+    createSidebarTreeElementForProfile: function(profile)
+    {
+        return new WebInspector.ProfileSidebarTreeElement(profile, WebInspector.UIString("Snapshot %d"), "heap-snapshot-sidebar-tree-item");
+    },
+
+    createView: function(profile)
+    {
+        return new WebInspector.DetailedHeapshotView(WebInspector.panels.profiles, profile);
+    }
+}
+
+WebInspector.DetailedHeapshotProfileType.prototype.__proto__ = WebInspector.ProfileType.prototype;
diff --git a/Source/WebCore/inspector/front-end/Drawer.js b/Source/WebCore/inspector/front-end/Drawer.js
index 3f827fb..4861c90 100644
--- a/Source/WebCore/inspector/front-end/Drawer.js
+++ b/Source/WebCore/inspector/front-end/Drawer.js
@@ -35,11 +35,11 @@ WebInspector.Drawer = function()
     this.state = WebInspector.Drawer.State.Hidden;
     this.fullPanel = false;
 
-    this.mainElement = document.getElementById("main");
-    this.toolbarElement = document.getElementById("toolbar");
-    this.mainStatusBar = document.getElementById("main-status-bar");
-    this.mainStatusBar.addEventListener("mousedown", this._startStatusBarDragging.bind(this), true);
-    this.viewStatusBar = document.getElementById("other-drawer-status-bar-items");
+    this._mainElement = document.getElementById("main");
+    this._toolbarElement = document.getElementById("toolbar");
+    this._mainStatusBar = document.getElementById("main-status-bar");
+    this._mainStatusBar.addEventListener("mousedown", this._startStatusBarDragging.bind(this), true);
+    this._viewStatusBar = document.getElementById("other-drawer-status-bar-items");
     this._counters = document.getElementById("counters");
     this._drawerStatusBar = document.getElementById("drawer-status-bar");
 }
@@ -67,8 +67,8 @@ WebInspector.Drawer.prototype = {
 
         if (x && !firstTime) {
             this._safelyRemoveChildren();
-            this.viewStatusBar.removeChildren(); // optimize this? call old.detach()
-            x.attach(this.element, this.viewStatusBar);
+            this._viewStatusBar.removeChildren(); // optimize this? call old.detach()
+            x.attach(this.element, this._viewStatusBar);
             x.show();
             this.visible = true;
         }
@@ -77,7 +77,7 @@ WebInspector.Drawer.prototype = {
     get savedHeight()
     {
         var height = this._savedHeight || this.element.offsetHeight;
-        return Number.constrain(height, Preferences.minConsoleHeight, window.innerHeight - this.mainElement.totalOffsetTop - Preferences.minConsoleHeight);
+        return Number.constrain(height, Preferences.minConsoleHeight, window.innerHeight - this._mainElement.totalOffsetTop - Preferences.minConsoleHeight);
     },
 
     showView: function(view)
@@ -101,16 +101,15 @@ WebInspector.Drawer.prototype = {
         document.body.addStyleClass("drawer-visible");
 
         var anchoredItems = document.getElementById("anchored-status-bar-items");
-        var height = (this.fullPanel ? window.innerHeight - this.toolbarElement.offsetHeight : this.savedHeight);
+        var height = (this.fullPanel ? window.innerHeight - this._toolbarElement.offsetHeight : this.savedHeight);
         var animations = [
             {element: this.element, end: {height: height}},
-            {element: document.getElementById("main"), end: {bottom: height}},
-            {element: document.getElementById("main-status-bar"), start: {"padding-left": anchoredItems.offsetWidth - 1}, end: {"padding-left": 0}},
-            {element: document.getElementById("other-drawer-status-bar-items"), start: {opacity: 0}, end: {opacity: 1}}
+            {element: this._mainElement, end: {bottom: height}},
+            {element: this._mainStatusBar, start: {"padding-left": anchoredItems.offsetWidth - 1}, end: {"padding-left": 0}},
+            {element: this._viewStatusBar, start: {opacity: 0}, end: {opacity: 1}}
         ];
 
-        var drawerStatusBar = document.getElementById("drawer-status-bar");
-        drawerStatusBar.insertBefore(anchoredItems, drawerStatusBar.firstChild);
+        this._drawerStatusBar.insertBefore(anchoredItems, this._drawerStatusBar.firstChild);
 
         if (this._currentPanelCounters) {
             var oldRight = this._drawerStatusBar.clientWidth - (this._counters.offsetLeft + this._currentPanelCounters.offsetWidth);
@@ -118,7 +117,7 @@ WebInspector.Drawer.prototype = {
             var rightPadding = (oldRight - newRight);
             animations.push({element: this._currentPanelCounters, start: {"padding-right": rightPadding}, end: {"padding-right": 0}});
             this._currentPanelCounters.parentNode.removeChild(this._currentPanelCounters);
-            this.mainStatusBar.appendChild(this._currentPanelCounters);
+            this._mainStatusBar.appendChild(this._currentPanelCounters);
         }
 
         function animationFinished()
@@ -128,13 +127,13 @@ WebInspector.Drawer.prototype = {
             if (this.visibleView.afterShow)
                 this.visibleView.afterShow();
             delete this._animating;
-            delete this._currentAnimationInterval;
+            delete this._currentAnimation;
             this.state = (this.fullPanel ? WebInspector.Drawer.State.Full : WebInspector.Drawer.State.Variable);
             if (this._currentPanelCounters)
                 this._currentPanelCounters.removeAttribute("style");
         }
 
-        this._currentAnimationInterval = WebInspector.animateStyle(animations, this._animationDuration(), animationFinished.bind(this));
+        this._currentAnimation = WebInspector.animateStyle(animations, this._animationDuration(), animationFinished.bind(this));
     },
 
     hide: function()
@@ -159,21 +158,21 @@ WebInspector.Drawer.prototype = {
 
         // Temporarily set properties and classes to mimic the post-animation values so panels
         // like Elements in their updateStatusBarItems call will size things to fit the final location.
-        this.mainStatusBar.style.setProperty("padding-left", (anchoredItems.offsetWidth - 1) + "px");
+        this._mainStatusBar.style.setProperty("padding-left", (anchoredItems.offsetWidth - 1) + "px");
         document.body.removeStyleClass("drawer-visible");
         if ("updateStatusBarItems" in WebInspector.currentPanel)
             WebInspector.currentPanel.updateStatusBarItems();
         document.body.addStyleClass("drawer-visible");
 
         var animations = [
-            {element: document.getElementById("main"), end: {bottom: 0}},
-            {element: document.getElementById("main-status-bar"), start: {"padding-left": 0}, end: {"padding-left": anchoredItems.offsetWidth - 1}},
-            {element: document.getElementById("other-drawer-status-bar-items"), start: {opacity: 1}, end: {opacity: 0}}
+            {element: this._mainElement, end: {bottom: 0}},
+            {element: this._mainStatusBar, start: {"padding-left": 0}, end: {"padding-left": anchoredItems.offsetWidth - 1}},
+            {element: this._viewStatusBar, start: {opacity: 1}, end: {opacity: 0}}
         ];
 
         if (this._currentPanelCounters) {
             var newRight = this._drawerStatusBar.clientWidth - this._counters.offsetLeft;
-            var oldRight = this.mainStatusBar.clientWidth - (this._currentPanelCounters.offsetLeft + this._currentPanelCounters.offsetWidth);
+            var oldRight = this._mainStatusBar.clientWidth - (this._currentPanelCounters.offsetLeft + this._currentPanelCounters.offsetWidth);
             var rightPadding = (newRight - oldRight);
             animations.push({element: this._currentPanelCounters, start: {"padding-right": 0}, end: {"padding-right": rightPadding}});
         }
@@ -181,9 +180,8 @@ WebInspector.Drawer.prototype = {
         function animationFinished()
         {
             WebInspector.currentPanel.resize();
-            var mainStatusBar = document.getElementById("main-status-bar");
-            mainStatusBar.insertBefore(anchoredItems, mainStatusBar.firstChild);
-            mainStatusBar.style.removeProperty("padding-left");
+            this._mainStatusBar.insertBefore(anchoredItems, this._mainStatusBar.firstChild);
+            this._mainStatusBar.style.removeProperty("padding-left");
 
             if (this._currentPanelCounters) {
                 this._currentPanelCounters.setAttribute("style", null);
@@ -193,11 +191,11 @@ WebInspector.Drawer.prototype = {
 
             document.body.removeStyleClass("drawer-visible");
             delete this._animating;
-            delete this._currentAnimationInterval;
+            delete this._currentAnimation;
             this.state = WebInspector.Drawer.State.Hidden;
         }
 
-        this._currentAnimationInterval = WebInspector.animateStyle(animations, this._animationDuration(), animationFinished.bind(this));
+        this._currentAnimation = WebInspector.animateStyle(animations, this._animationDuration(), animationFinished.bind(this));
     },
 
     resize: function()
@@ -206,14 +204,13 @@ WebInspector.Drawer.prototype = {
             return;
 
         var height;
-        var mainElement = document.getElementById("main");
         if (this.state === WebInspector.Drawer.State.Variable) {
             height = parseInt(this.element.style.height);
-            height = Number.constrain(height, Preferences.minConsoleHeight, window.innerHeight - mainElement.totalOffsetTop - Preferences.minConsoleHeight);
+            height = Number.constrain(height, Preferences.minConsoleHeight, window.innerHeight - this._mainElement.totalOffsetTop - Preferences.minConsoleHeight);
         } else
-            height = window.innerHeight - this.toolbarElement.offsetHeight;
+            height = window.innerHeight - this._toolbarElement.offsetHeight;
 
-        mainElement.style.bottom = height + "px";
+        this._mainElement.style.bottom = height + "px";
         this.element.style.height = height + "px";
     },
 
@@ -224,7 +221,7 @@ WebInspector.Drawer.prototype = {
         
         if (this.visible) {
             this._savedHeight = this.element.offsetHeight;
-            var height = window.innerHeight - this.toolbarElement.offsetHeight;
+            var height = window.innerHeight - this._toolbarElement.offsetHeight;
             this._animateDrawerHeight(height, WebInspector.Drawer.State.Full);
         }
     },
@@ -249,6 +246,12 @@ WebInspector.Drawer.prototype = {
         this.fullPanel = false;
     },
 
+    immediatelyFinishAnimation: function()
+    {
+        if (this._currentAnimation)
+            this._currentAnimation.forceComplete();
+    },
+
     set currentPanelCounters(x)
     {
         if (!x) {
@@ -260,7 +263,7 @@ WebInspector.Drawer.prototype = {
 
         this._currentPanelCounters = x;
         if (this.visible)
-            this.mainStatusBar.appendChild(x);
+            this._mainStatusBar.appendChild(x);
         else
             this._counters.insertBefore(x, this._counters.firstChild);
     },
@@ -268,9 +271,10 @@ WebInspector.Drawer.prototype = {
     _cancelAnimationIfNeeded: function()
     {
         if (this._animating) {
-            clearInterval(this._currentAnimationInterval);
+            if (this._currentAnimation)
+                this._currentAnimation.cancel();
             delete this._animating;
-            delete this._currentAnimationInterval;
+            delete this._currentAnimation;
         }
     },
 
@@ -279,17 +283,17 @@ WebInspector.Drawer.prototype = {
         this._animating = true;
         var animations = [
             {element: this.element, end: {height: height}},
-            {element: document.getElementById("main"), end: {bottom: height}}
+            {element: this._mainElement, end: {bottom: height}}
         ];
 
         function animationFinished()
         {
             delete this._animating;
-            delete this._currentAnimationInterval;
+            delete this._currentAnimation;
             this.state = finalState;
         }
 
-        this._currentAnimationInterval = WebInspector.animateStyle(animations, this._animationDuration(), animationFinished.bind(this));
+        this._currentAnimation = WebInspector.animateStyle(animations, this._animationDuration(), animationFinished.bind(this));
     },
 
     _animationDuration: function()
@@ -316,10 +320,10 @@ WebInspector.Drawer.prototype = {
 
     _startStatusBarDragging: function(event)
     {
-        if (!this.visible || event.target !== this.mainStatusBar)
+        if (!this.visible || event.target !== this._mainStatusBar)
             return;
 
-        WebInspector.elementDragStart(this.mainStatusBar, this._statusBarDragging.bind(this), this._endStatusBarDragging.bind(this), event, "row-resize");
+        WebInspector.elementDragStart(this._mainStatusBar, this._statusBarDragging.bind(this), this._endStatusBarDragging.bind(this), event, "row-resize");
 
         this._statusBarDragOffset = event.pageY - this.element.totalOffsetTop;
 
@@ -328,11 +332,10 @@ WebInspector.Drawer.prototype = {
 
     _statusBarDragging: function(event)
     {
-        var mainElement = document.getElementById("main");
         var height = window.innerHeight - event.pageY + this._statusBarDragOffset;
-        height = Number.constrain(height, Preferences.minConsoleHeight, window.innerHeight - mainElement.totalOffsetTop - Preferences.minConsoleHeight);
+        height = Number.constrain(height, Preferences.minConsoleHeight, window.innerHeight - this._mainElement.totalOffsetTop - Preferences.minConsoleHeight);
 
-        mainElement.style.bottom = height + "px";
+        this._mainElement.style.bottom = height + "px";
         this.element.style.height = height + "px";
 
         event.preventDefault();
diff --git a/Source/WebCore/inspector/front-end/ElementsPanel.js b/Source/WebCore/inspector/front-end/ElementsPanel.js
index 9299479..e6af93c 100644
--- a/Source/WebCore/inspector/front-end/ElementsPanel.js
+++ b/Source/WebCore/inspector/front-end/ElementsPanel.js
@@ -255,13 +255,20 @@ WebInspector.ElementsPanel.prototype = {
             return false;
 
         // Add resource-related actions.
-        // Keep these consistent with those added in WebInspector.StylesSidebarPane.prototype._populateHrefContextMenu().
-        contextMenu.appendItem(WebInspector.UIString("Open Link in New Window"), WebInspector.openResource.bind(null, resourceURL, false));
+        contextMenu.appendItem(WebInspector.openLinkExternallyLabel(), WebInspector.openResource.bind(null, resourceURL, false));
         if (WebInspector.resourceForURL(resourceURL))
             contextMenu.appendItem(WebInspector.UIString("Open Link in Resources Panel"), WebInspector.openResource.bind(null, resourceURL, true));
         return true;
     },
 
+    switchToAndFocus: function(node)
+    {
+        // Reset search restore.
+        WebInspector.cancelSearch();
+        WebInspector.currentPanel = this;
+        this.focusedDOMNode = node;
+    },
+
     _updateMatchesCount: function()
     {
         WebInspector.updateSearchMatchesCount(this._searchResults.length, this);
diff --git a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
index 722c028..56c3e75 100644
--- a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -268,8 +268,7 @@ WebInspector.ElementsTreeOutline.prototype = {
         if (this.showInElementsPanelEnabled) {
             function focusElement()
             {
-                WebInspector.currentPanel = WebInspector.panels.elements;
-                WebInspector.panels.elements.focusedDOMNode = listItem.treeElement.representedObject;
+                WebInspector.panels.elements.switchToAndFocus(listItem.treeElement.representedObject);
             }
             contextMenu.appendItem(WebInspector.UIString("Reveal in Elements Panel"), focusElement.bind(this));
         } else {
diff --git a/Source/WebCore/inspector/front-end/ExtensionAPI.js b/Source/WebCore/inspector/front-end/ExtensionAPI.js
index b10452d..6a11d62 100644
--- a/Source/WebCore/inspector/front-end/ExtensionAPI.js
+++ b/Source/WebCore/inspector/front-end/ExtensionAPI.js
@@ -387,9 +387,9 @@ function InspectedWindow()
 }
 
 InspectedWindow.prototype = {
-    reload: function()
+    reload: function(userAgent)
     {
-        return extensionServer.sendRequest({ command: "reload" });
+        return extensionServer.sendRequest({ command: "reload", userAgent: userAgent });
     },
 
     eval: function(expression, callback)
diff --git a/Source/WebCore/inspector/front-end/ExtensionAPISchema.json b/Source/WebCore/inspector/front-end/ExtensionAPISchema.json
new file mode 100755
index 0000000..28084ba
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/ExtensionAPISchema.json
@@ -0,0 +1,513 @@
+[
+  {
+    "namespace": "experimental.webInspector.inspectedWindow",
+    "description": "Provides access to the window being inspected.",
+    "functions": [
+      {
+        "name": "eval",
+        "type": "function",
+        "description": "Evaluates a JavaScript expression in the context of inspected page (NOTE: the expression must evaluate to a JSON-compliant object, otherwise the exception is thrown)",
+        "parameters": [
+          {
+            "name": "expression",
+            "type": "string",
+            "description": "An expression to evaluate."
+          },
+          {
+            "name": "callback",
+            "type": "function",
+            "description": "A function called when evaluation completes.",
+            "parameters": [
+              {
+                "name": "result",
+                "type": "object",
+                "description": "The result of evaluation"
+              },
+              {
+                "name": "isException",
+                "type": "boolean",
+                "description": "Set if an exception was caught while evaluating the expression"
+              }
+            ]
+          }
+        ]
+      }
+    ],
+    "events": [
+      {
+        "name": "onDOMContentLoaded",
+        "type": "function",
+        "description": "Fired after DOMContentLoaded event on inspected page is fired."
+      },
+      {
+        "name": "onLoaded",
+        "type": "function",
+        "description": "Fired after load event on inspected page is fired."
+      },
+      {
+        "name": "onNavigated",
+        "type": "function",
+        "description": "Fired when navigation occurs in the window being inspected."
+      }
+    ]
+  },
+  {
+    "namespace": "experimental.webInspector.panels",
+    "types": [
+      {
+        "id": "PanelWithSidebars",
+        "type": "object",
+        "isInstanceOf": "Panel",
+        "description": "A panel within Web Inspector UI that has sidebars.",
+        "functions": [
+          {
+            "name": "createSidebarPane",
+            "type": "function",
+            "description": "Creates a pane within panel's sidebar.",
+            "parameters": [
+              {
+                "name": "title",
+                "type": "string",
+                "description": "A text that is displayed in sidebar caption."
+              },
+              {
+                "name": "url",
+                "type": "string",
+                "description": "An URL of the page that represents the sidebar."
+              },
+              {
+                "name": "callback",
+                "type": "function",
+                "description": "A callback invoked when sidebar is created",
+                "parameters": [
+                  {
+                    "name": "result",
+                    "description": "An ExtensionSidebarPane object for created sidebar pane",
+                    "$ref": "ExtensionSidebarPane"
+                  }
+                ]
+              }
+            ]
+          },
+          {
+            "name": "createWatchExpressionSidebarPane",
+            "type": "function",
+            "description": "Creates a pane with an object property tree (similar to a watch sidebar pane).",
+            "parameters": [
+              {
+                "name": "title",
+                "type": "string",
+                "description": "A text that is displayed in sidebar caption."
+              },
+              {
+                "name": "callback",
+                "type": "function",
+                "description": "A callback invoked when sidebar is created",
+                "parameters": [
+                  {
+                    "name": "result",
+                    "description": "A WatchExpressionSidebarPane object for created sidebar pane",
+                    "$ref": "WatchExpressionSidebarPane"
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "ElementsPanel",
+        "type": "object",
+        "isInstanceOf": "PanelWithSidebars",
+        "description": "Represents Elements panel",
+        "events": [
+          {
+            "name": "onSelectionChanged",
+            "description": "Fired when an objects is selected in the panel."
+          }
+        ]
+      },
+      {
+        "id": "ExtensionPanel",
+        "type": "object",
+        "isInstanceOf": "Panel",
+        "description": "Represents a panel created by extension",
+        "events": [
+          {
+            "name": "onSearch",
+            "description": "Fired upon a search action (start of a new search, search result navigation or search being canceled).",
+            "parameters": [
+              {
+                "name": "action",
+                "type": "string",
+                "description": "Type of search action being performed."
+              },
+              {
+                "name": "queryString",
+                "type": "string",
+                "optional": true,
+                "description": "Query string (only for 'performSearch')"
+              }
+            ]
+          }
+       	]
+      },
+      {
+        "id": "ExtensionSidebarPane",
+        "type": "object",
+        "description": "A sidebar created by the extension.",
+        "functions": [
+          {
+            "name": "setHeight",
+            "type": "function",
+            "description": "Sets the height of the sidebar.",
+            "parameters": [
+              {
+                "name": "height",
+                "type": "string",
+                "description": "A CSS-like size specification, e.g. '10px' or '12pt'"
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "WatchExpressionSidebarPane",
+        "type": "object",
+        "description": "A sidebar created by the extension.",
+        "functions": [
+          {
+            "name": "setHeight",
+            "type": "function",
+            "description": "Sets the height of the sidebar.",
+            "parameters": [
+              {
+                "name": "height",
+                "type": "string",
+                "description": "A CSS-like size specification, e.g. '10px' or '12pt'"
+              }
+            ]
+          },
+          {
+            "name": "setExpression",
+            "type": "function",
+            "description": "Sets an expression that is evaluated within the inspected page. The result is displayed in the sidebar pane.",
+            "parameters": [
+              {
+                "name": "expression",
+                "type": "string",
+                "description": "An expression to be evaluated in context of the inspected page. JavaScript objects and DOM nodes are displayed in an expandable tree similar to the console/watch."
+              },
+              {
+                "name": "rootTitle",
+                "type": "string",
+                "optional": true,
+                "description": "An optional title for the root of the expression tree."
+              }
+            ]
+          },
+          {
+            "name": "setObject",
+            "type": "function",
+            "description": "Sets a JSON-compliant object to be displayed in the sidebar pane.",
+            "parameters": [
+              {
+                "name": "jsonObject",
+                "type": "string",
+                "description": "An object to be displayed in context of the inspected page. Evaluated in the context of the caller (API client)."
+              },
+              {
+                "name": "rootTitle",
+                "type": "string",
+                "optional": true,
+                "description": "An optional title for the root of the expression tree."
+              }
+            ]
+          }
+        ]
+      }
+    ],
+    "properties": {
+      "scripts": {
+        "$ref": "ScriptsPanel",
+        "description": "Scripts panel"
+      }
+    },
+    "functions": [
+      {
+        "name": "create",
+        "type": "function",
+        "description": "Creates an extension panel.",
+        "parameters": [
+          {
+            "name": "title",
+            "type": "string",
+            "description": "Title that is displayed under the extension icon in the toolbar."
+          },
+          {
+            "name": "iconURL",
+            "type": "string",
+            "description": "An URL of the toolbar icon."
+          },
+          {
+            "name": "pageURL",
+            "type": "string",
+            "description": "An URL of the page that represents this panel."
+          }
+        ],
+        "returns" : {
+          "$ref": "ExtensionPanel",
+          "description": "A panel that was created."
+        }
+      }
+    ]
+  },
+  {
+    "namespace": "experimental.webInspector.resources",
+    "types": [
+      {
+        "id": "Resource",
+        "type": "object",
+        "description": "Represents a resource (document, script, image etc). See HAR Specification for reference.",
+        "functions": [
+          {
+            "name": "getContent",
+            "type": "function",
+            "description": "Returns resource content.",
+            "parameters": [
+              {
+                "name": "callback",
+                "type": "function",
+                "description": "A function that is called upon request completion.",
+                "parameters": [
+                  {
+                    "name": "content",
+                    "type": "string",
+                    "description": "Resource content (potentially encoded)."
+                  },
+                  {
+                    "name": "encoding",
+                    "type": "string",
+                    "description": "Empty if content is not encoded, encoding name otherwise. Currently, only base64 supported."
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      }
+    ],
+    "functions": [
+      {
+        "name": "getHAR",
+        "type": "function",
+        "description": "Returns HAR archive that contains all known resource objects.",
+        "parameters": [
+          {
+            "name": "callback",
+            "type": "function",
+            "description": "A function that is called upon request completion.",
+            "parameters": [
+              {
+                "name": "har",
+                "type": "object",
+                "description": "A HAR archieve. See HAR specification for details."
+              }
+            ]
+          }
+        ]
+      }
+    ],
+    "events": [
+      {
+        "name": "onFinished",
+        "type": "function",
+        "description": "Fired when a resource request is finished and all resource data are available.",
+        "parameters": [
+          { "name": "resource", "$ref": "Resource" }
+        ]
+      }
+    ]
+  },
+  {
+    "namespace": "experimental.webInspector.audits",
+    "functions": [
+      {
+        "name": "addCategory",
+        "type": "function",
+        "description": "Adds an audit category.",
+        "parameters": [
+          { "name": "displayName", "type": "string", "description": "A display name for the category" },
+          { "name": "resultCount", "type": "number", "description": "The expected number of audit results in the category." }
+        ],
+        "returns": {
+          "$ref": "AuditCategory"
+        }
+      }
+    ],
+    "types": [
+      {
+        "id": "AuditCategory",
+        "type": "object",
+        "description": "A set of audit rules",
+        "events": [
+          {
+            "name": "onAuditStarted",
+            "type": "function",
+            "description": "Fired when the audit is started, if the category is enabled -- the extension is expected to begin executing audit rules.",
+            "parameters": [
+              { "name": "results", "$ref": "AuditResults" }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "FormattedValue",
+        "type": "object",
+        "description": "A value returned from one of the formatters (an URL, code snippet etc), to be passed to createResult or addChild"
+      },
+      {
+        "id": "AuditResults",
+        "type": "object",
+        "description": "A collection of audit results for current run of the audit category",
+        "functions": [
+          {
+            "name": "addResult",
+            "type": "function",
+            "parameters": [
+              {
+                "name": "displayName",
+                "type": "string",
+                "description": "A concise, high-level description of audit rule result"
+              },
+              {
+                "name": "description",
+                "type": "string",
+                "description": "A detailed description of what the displayName means"
+              },
+              {
+                "name": "severity",
+                "$ref": "AuditResultSeverety"
+              },
+              {
+                "name": "details",
+                "$ref": "AuditResultNode",
+                "optional": true,
+                "description": "A subtree that appears under added result that may provide additional details on the violations found"
+              }
+            ]
+          },
+          {
+            "name": "createResult",
+            "type": "function",
+            "description": "Creates a result node that may be user as details parameters to addResult",
+            "parameters": [
+              {
+                "name": "content ...",
+                "choices": [
+                  { "type": "string" },
+                  { "$ref": "FormattedValue" }
+                ],
+                "description": "Either string or formatted values returned by one of AuditResult formatters (url, snippet etc)"
+              }
+            ],
+            "returns": {
+              "$ref": "AuditResultNode"
+            }
+          },
+          {
+            "name": "done",
+            "type": "function",
+            "description": "Signals the WebInspector Audits panel that the run of this category is over. Normally the run completes automatically when a number of added top-level results is equal to that declared when AuditCategory was created."
+          },
+          {
+            "name": "url",
+            "type": "function",
+            "description": "Render passed value as an URL in the Audits panel",
+            "parameters": [
+              { "name": "href", "type": "string", "description": "An URL that will appear as href value on resulting link" },
+              { "name": "displayText", "type": "string", "description": "A text that will appear to user", "optional": true }
+            ],
+            "returns": { "$ref": "FormattedValue" }
+          },
+          {
+            "name": "snippet",
+            "type": "function",
+            "description": "Render passed text as a code snippet in the Audits panel",
+            "parameters": [
+              { "name": "text", "type": "string", "description": "Snippet text" }
+            ],
+            "returns": { "$ref": "FormattedValue" }
+          }
+        ],
+        "properties": {
+          "Severity": {
+            "$ref": "AuditResultSeverity",
+            "description": "A class that contains possible values for audit result severities."
+          },
+          "text": {
+            "type": "string",
+            "description": "The contents of the node."
+          },
+          "children": {
+            "optional": true,
+            "type": "array",
+            "items": { "$ref": "AuditResultNode" },
+            "description": "Children of this node."
+          },
+          "expanded": {
+            "optional": "true",
+            "type": "boolean",
+            "description": "Whether the node is expanded by default."
+          }
+        }
+      },
+      {
+        "id": "AuditResultNode",
+        "type": "object",
+        "description": "A node in the audit result trees. Displays some content and optionally has children node",
+        "functions": [
+          {
+            "name": "addChild",
+            "description": "Adds another child node to this node",
+            "parameters": [
+              {
+                "name": "content ...",
+                "choices": [
+                  { "type": "string" },
+                  { "$ref": "FormattedValue" }
+                ],
+                "description": "Either string or formatted values returned by one of AuditResult formatters (url, snippet etc)"
+              }
+            ],
+            "returns": {
+              "$ref": "AuditResultNode"
+            }
+          }
+        ],
+        "properties": {
+          "expanded": {
+            "type": "boolean",
+            "description": "If set, the subtree will always be expanded"
+          }
+        }
+      },
+      {
+        "id": "AuditResultSeverity",
+        "type": "object",
+        "properties": {
+          "Info": {
+            "type": "string"
+          },
+          "Warning": {
+            "type": "string"
+          },
+          "Severe": {
+            "type": "string"
+          }
+        }
+      }
+    ]
+  }
+]
+
diff --git a/Source/WebCore/inspector/front-end/ExtensionPanel.js b/Source/WebCore/inspector/front-end/ExtensionPanel.js
index fb98350..144d55d 100644
--- a/Source/WebCore/inspector/front-end/ExtensionPanel.js
+++ b/Source/WebCore/inspector/front-end/ExtensionPanel.js
@@ -95,7 +95,7 @@ WebInspector.ExtensionWatchSidebarPane.prototype = {
 
     setExpression: function(expression, title)
     {
-        InspectorBackend.evaluate(expression, "extension-watch", this._onEvaluate.bind(this, title));
+        InspectorBackend.evaluate(expression, "extension-watch", false, this._onEvaluate.bind(this, title));
     },
 
     _onEvaluate: function(title, result)
diff --git a/Source/WebCore/inspector/front-end/ExtensionServer.js b/Source/WebCore/inspector/front-end/ExtensionServer.js
index 0924106..7d33b73 100644
--- a/Source/WebCore/inspector/front-end/ExtensionServer.js
+++ b/Source/WebCore/inspector/front-end/ExtensionServer.js
@@ -252,9 +252,12 @@ WebInspector.ExtensionServer.prototype = {
         WebInspector.log(message.message);
     },
 
-    _onReload: function()
+    _onReload: function(message)
     {
-        InspectorBackend.reloadPage();
+        if (typeof message.userAgent === "string")
+            InspectorBackend.setUserAgentOverride(message.userAgent);
+
+        InspectorBackend.reloadPage(false);
         return this._status.OK();
     },
 
@@ -269,10 +272,8 @@ WebInspector.ExtensionServer.prototype = {
             result.value = resultObject.description;
             this._dispatchCallback(message.requestId, port, result);
         }
-        var evalExpression = "JSON.stringify(eval('" +
-            "with (window.console._commandLineAPI) with (window) {' + unescape('" + escape(message.expression) +
-            "') + '}'));";
-        InspectorBackend.evaluate(evalExpression, "none", callback.bind(this));
+        var evalExpression = "JSON.stringify(eval(unescape('" + escape(message.expression) + "')));";
+        InspectorBackend.evaluate(evalExpression, "none", true, callback.bind(this));
     },
 
     _onRevealAndSelect: function(message)
diff --git a/Source/WebCore/inspector/front-end/FileSystemView.js b/Source/WebCore/inspector/front-end/FileSystemView.js
deleted file mode 100644
index 56f21a4..0000000
--- a/Source/WebCore/inspector/front-end/FileSystemView.js
+++ /dev/null
@@ -1,211 +0,0 @@
-/*
- * Copyright (C) 2010 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-WebInspector.FileSystemDispatcher = function()
-{
-}
-
-// Keep in sync with Type in AsyncFileSystem.h
-WebInspector.FileSystemDispatcher.TEMPORARY = 0;
-WebInspector.FileSystemDispatcher.PERSISTENT = 1;
-
-WebInspector.FileSystemDispatcher.prototype = {
-    getFileSystemPathsAsync: function(origin)
-    {
-        InspectorBackend.getFileSystemPathAsync(WebInspector.FileSystemDispatcher.PERSISTENT, origin);
-        InspectorBackend.getFileSystemPathAsync(WebInspector.FileSystemDispatcher.TEMPORARY, origin);
-    },
-
-    didGetFileSystemPath: function(root, type, origin)
-    {
-        WebInspector.panels.resources.updateFileSystemPath(root, type, origin);
-    },
-
-    didGetFileSystemError: function(type, origin)
-    {
-        WebInspector.panels.resources.updateFileSystemError(type, origin);
-    },
-
-    didGetFileSystemDisabled: function()
-    {
-        WebInspector.panels.resources.setFileSystemDisabled();
-    }
-}
-
-InspectorBackend.registerDomainDispatcher("FileSystem", new WebInspector.FileSystemDispatcher());
-
-WebInspector.FileSystemView = function(treeElement, fileSystemOrigin)
-{
-    WebInspector.View.call(this);
-
-    this.element.addStyleClass("resource-view");
-    this._treeElement = treeElement;
-    this._origin = fileSystemOrigin;
-    this._tabbedPane = new WebInspector.TabbedPane(this.element);
-
-    this._persistentFileSystemElement = document.createElement("div");
-    this._persistentFileSystemElement.className = "resource-view-headers";
-    this._tabbedPane.appendTab("persistent", WebInspector.UIString("Persistent File System"), this._persistentFileSystemElement, this._selectFileSystemTab.bind(this, true));
-
-    this._tempFileSystemElement = document.createElement("div");
-    this._tempFileSystemElement.className = "resource-view-headers";
-    this._tabbedPane.appendTab("temp", WebInspector.UIString("Temporary File System"), this._tempFileSystemElement, this.selectTemporaryFileSystemTab.bind(this, true));
-
-    this._temporaryRoot = "";
-    this._persistentRoot = "";
-    this._isFileSystemDisabled = false;
-    this._persistentRootError = false;
-    this._temporaryRootError = false;
-    this.fileSystemVisible = true;
-    this._selectFileSystemTab();
-    this.refreshFileSystem();
-}
-
-WebInspector.FileSystemView.prototype = {
-    show: function(parentElement)
-    {
-        WebInspector.View.prototype.show.call(this, parentElement);
-        this._update();
-    },
-
-    set fileSystemVisible(x)
-    {
-        if (x === this._fileSystemVisible)
-            return;
-        this._fileSystemVisible = x;
-        if (x)
-            this.element.addStyleClass("headers-visible");
-        else
-            this.element.removeStyleClass("headers-visible"); 
-        this._selectFileSystemTab();
-    },
-
-    _update: function()
-    {
-        this._selectFileSystemTab();
-        WebInspector.FileSystem.getFileSystemPathsAsync(this._origin);
-    },
-
-    updateFileSystemPath: function(root, type, origin)
-    {
-        if (origin == this._origin && type == WebInspector.FileSystem.PERSISTENT) {
-            this._persistentRoot = root;
-            this._persistentRootError = false;
-        }
-        
-        if (origin == this._origin && type == WebInspector.FileSystem.TEMPORARY) {
-            this._temporaryRoot = root;
-            this._temporaryRootErrorError = false;
-        }
-
-        this.refreshFileSystem();
-    },
-    
-    updateFileSystemError: function(type, origin)
-    {
-        if (type == WebInspector.FileSystem.PERSISTENT)
-            this._persistentRootError = true;
-        
-        if (type == WebInspector.FileSystem.TEMPORARY)
-            this._temporaryRootError = true;
-
-        this.refreshFileSystem();
-    },
-    
-    setFileSystemDisabled: function()
-    {
-        this._isFileSystemDisabled = true;
-        this.refreshFileSystem();
-    },
-    _selectFileSystemTab: function()
-    {
-        this._tabbedPane.selectTab("persistent");
-    },
-    
-    selectTemporaryFileSystemTab: function()
-    {
-        this._tabbedPane.selectTab("temp");
-    },
-
-    _revealPersistentFolderInOS: function()
-    {
-        InspectorBackend.revealFolderInOS(this._persistentRoot);
-    },
-    
-    _revealTemporaryFolderInOS: function()
-    {
-        InspectorBackend.revealFolderInOS(this._temporaryRoot);
-    },
-    
-    _createTextAndButton: function(fileSystemElement, rootPathText, type, isError)
-    {
-        fileSystemElement.removeChildren();
-        var rootPath = WebInspector.UIString("File System root path not available.");
-        if (this._isFileSystemDisabled)
-            rootPath = WebInspector.UIString("File System is disabled.");
-        else if (isError)
-            rootPath = WebInspector.UIString("Error in fetching root path for file system.");
-        else if (rootPathText)
-            rootPath = rootPathText;
-
-        var rootTextNode = document.createTextNode("Root: " + rootPath.escapeHTML());
-        var rootSystemElement = document.createElement("div");
-        rootSystemElement.className = "header-value source-code";
-        rootSystemElement.appendChild(rootTextNode);
-        fileSystemElement.appendChild(rootSystemElement);
-            
-        if (!isError && rootPathText) {
-            // Append Browse button iff root path is available and it is not an error.
-            var contentElement = document.createElement("div");
-            contentElement.className = "panel-enabler-view-content";
-            fileSystemElement.appendChild(contentElement);
-            var choicesForm = document.createElement("form");
-            contentElement.appendChild(choicesForm);
-            var enableButton = document.createElement("button");
-            enableButton.setAttribute("type", "button");
-            enableButton.textContent = WebInspector.UIString("Reveal folder in OS");
-            // FIXME: Bind this directly to InspectorBackend.
-            if (type == WebInspector.FileSystem.PERSISTENT)
-                enableButton.addEventListener("click", this._revealPersistentFolderInOS.bind(this), false);
-            if (type == WebInspector.FileSystem.TEMPORARY)
-                enableButton.addEventListener("click", this._revealTemporaryFolderInOS.bind(this), false);
-            choicesForm.appendChild(enableButton);
-            fileSystemElement.appendChild(contentElement);
-        }
-    },
-    
-    refreshFileSystem: function()
-    {
-        this._createTextAndButton(this._persistentFileSystemElement, this._persistentRoot, WebInspector.FileSystem.PERSISTENT, this._persistentRootError);
-        this._createTextAndButton(this._tempFileSystemElement, this._temporaryRoot, WebInspector.FileSystem.TEMPORARY, this._temporaryRootError);
-    }, 
-}
-
-WebInspector.FileSystemView.prototype.__proto__ = WebInspector.View.prototype;
diff --git a/Source/WebCore/inspector/front-end/GoToLineDialog.js b/Source/WebCore/inspector/front-end/GoToLineDialog.js
index c96344c..f246159 100644
--- a/Source/WebCore/inspector/front-end/GoToLineDialog.js
+++ b/Source/WebCore/inspector/front-end/GoToLineDialog.js
@@ -45,7 +45,7 @@ WebInspector.GoToLineDialog = function(view)
     this._input = dialogWindow.createChild("input");
     this._input.setAttribute("type", "text");
     this._input.setAttribute("size", 6);
-    var linesCount = view.sourceFrame.textModel.linesCount;
+    var linesCount = view.textModel.linesCount;
     if (linesCount)
         this._input.setAttribute("title", WebInspector.UIString("1 - %d", linesCount));
     var blurHandler = this._onBlur.bind(this);
@@ -120,7 +120,7 @@ WebInspector.GoToLineDialog.prototype = {
         var value = this._input.value;
         var lineNumber = parseInt(value, 10);
         if (!isNaN(lineNumber) && lineNumber > 0) {
-            lineNumber = Math.min(lineNumber, this._view.sourceFrame.textModel.linesCount);
+            lineNumber = Math.min(lineNumber, this._view.textModel.linesCount);
             this._view.highlightLine(lineNumber);
         }
     }
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshot.js b/Source/WebCore/inspector/front-end/HeapSnapshot.js
new file mode 100644
index 0000000..ef450af
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/HeapSnapshot.js
@@ -0,0 +1,909 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.HeapSnapshotArraySlice = function(snapshot, arrayName, start, end)
+{
+    // Note: we don't reference snapshot contents directly to avoid
+    // holding references to big chunks of data.
+    this._snapshot = snapshot;
+    this._arrayName = arrayName;
+    this._start = start;
+    this.length = end - start;
+}
+
+WebInspector.HeapSnapshotArraySlice.prototype = {
+    item: function(index)
+    {
+        return this._snapshot[this._arrayName][this._start + index];
+    }
+}
+
+WebInspector.HeapSnapshotEdge = function(snapshot, edges, edgeIndex)
+{
+    this._snapshot = snapshot;
+    this._edges = edges;
+    this.edgeIndex = edgeIndex || 0;
+}
+
+WebInspector.HeapSnapshotEdge.prototype = {
+    clone: function()
+    {
+        return new WebInspector.HeapSnapshotEdge(this._snapshot, this._edges, this.edgeIndex);
+    },
+
+    get hasStringName()
+    {
+        if (!this.isShortcut)
+            return this._hasStringName;
+        return isNaN(parseInt(this._name, 10));
+    },
+
+    get isElement()
+    {
+        return this._type() === this._snapshot._edgeElementType;
+    },
+
+    get isHidden()
+    {
+        return this._type() === this._snapshot._edgeHiddenType;
+    },
+
+    get isInternal()
+    {
+        return this._type() === this._snapshot._edgeInternalType;
+    },
+
+    get isShortcut()
+    {
+        return this._type() === this._snapshot._edgeShortcutType;
+    },
+
+    get name()
+    {
+        if (!this.isShortcut)
+            return this._name;
+        var numName = parseInt(this._name, 10);
+        return isNaN(numName) ? this._name : numName;
+    },
+
+    get node()
+    {
+        return new WebInspector.HeapSnapshotNode(this._snapshot, this.nodeIndex);
+    },
+
+    get nodeIndex()
+    {
+        return this._edges.item(this.edgeIndex + this._snapshot._edgeToNodeOffset);
+    },
+
+    get rawEdges()
+    {
+        return this._edges;
+    },
+
+    toString: function()
+    {
+        switch (this.type) {
+        case "context": return "->" + this.name;
+        case "element": return "[" + this.name + "]";
+        case "property":
+            return this.name.indexOf(" ") === -1 ? "." + this.name : "[\"" + this.name + "\"]";
+        case "shortcut":
+            var name = this.name;
+            if (typeof name === "string")
+                return this.name.indexOf(" ") === -1 ? "." + this.name : "[\"" + this.name + "\"]";
+            else
+                return "[" + this.name + "]";
+        case "internal":
+        case "hidden":
+            return "{" + this.name + "}";
+        };
+        return "?" + this.name + "?";
+    },
+
+    get type()
+    {
+        return this._snapshot._edgeTypes[this._type()];
+    },
+
+    get _hasStringName()
+    {
+        return !this.isElement && !this.isHidden;
+    },
+
+    get _name()
+    {
+        return this._hasStringName ? this._snapshot._strings[this._nameOrIndex] : this._nameOrIndex;
+    },
+
+    get _nameOrIndex()
+    {
+        return this._edges.item(this.edgeIndex + this._snapshot._edgeNameOffset);
+    },
+
+    _type: function()
+    {
+        return this._edges.item(this.edgeIndex + this._snapshot._edgeTypeOffset);
+    }
+};
+
+WebInspector.HeapSnapshotEdgeIterator = function(edge)
+{
+    this.edge = edge;
+}
+
+WebInspector.HeapSnapshotEdgeIterator.prototype = {
+    first: function()
+    {
+        this.edge.edgeIndex = 0;
+    },
+
+    hasNext: function()
+    {
+        return this.edge.edgeIndex < this.edge._edges.length;
+    },
+
+    get index()
+    {
+        return this.edge.edgeIndex;
+    },
+
+    set index(newIndex)
+    {
+        this.edge.edgeIndex = newIndex;
+    },
+
+    get item()
+    {
+        return this.edge;
+    },
+
+    next: function()
+    {
+        this.edge.edgeIndex += this.edge._snapshot._edgeFieldsCount;
+    }
+};
+
+WebInspector.HeapSnapshotNode = function(snapshot, nodeIndex)
+{
+    this._snapshot = snapshot;
+    this._firstNodeIndex = nodeIndex;
+    this.nodeIndex = nodeIndex;
+}
+
+WebInspector.HeapSnapshotNode.prototype = {
+    get className()
+    {
+        switch (this.type) {
+        case "hidden":
+            return WebInspector.UIString("(system)");
+        case "object":
+            return this.name;
+        case "code":
+            return WebInspector.UIString("(compiled code)");
+        default:
+            return "(" + this.type + ")";
+        }
+    },
+
+    dominatorIndex: function()
+    {
+        return this._nodes[this.nodeIndex + this._snapshot._dominatorOffset];
+    },
+
+    get edges()
+    {
+        return new WebInspector.HeapSnapshotEdgeIterator(new WebInspector.HeapSnapshotEdge(this._snapshot, this.rawEdges));
+    },
+
+    get edgesCount()
+    {
+        return this._nodes[this.nodeIndex + this._snapshot._edgesCountOffset];
+    },
+
+    get id()
+    {
+        return this._nodes[this.nodeIndex + this._snapshot._nodeIdOffset];
+    },
+
+    get instancesCount()
+    {
+        return this._nodes[this.nodeIndex + this._snapshot._nodeInstancesCountOffset];
+    },
+
+    get isHidden()
+    {
+        return this._type() === this._snapshot._nodeHiddenType;
+    },
+
+    get isRoot()
+    {
+        return this.nodeIndex === this._snapshot._rootNodeIndex;
+    },
+
+    get name()
+    {
+        return this._snapshot._strings[this._name()];
+    },
+
+    get rawEdges()
+    {
+        var firstEdgeIndex = this._firstEdgeIndex();
+        return new WebInspector.HeapSnapshotArraySlice(this._snapshot, "_nodes", firstEdgeIndex, firstEdgeIndex + this.edgesCount * this._snapshot._edgeFieldsCount);
+    },
+
+    get retainedSize()
+    {
+        return this._nodes[this.nodeIndex + this._snapshot._nodeRetainedSizeOffset];
+    },
+
+    get retainers()
+    {
+        return new WebInspector.HeapSnapshotEdgeIterator(new WebInspector.HeapSnapshotEdge(this._snapshot, this._snapshot.retainers(this)));
+    },
+
+    get selfSize()
+    {
+        return this._nodes[this.nodeIndex + this._snapshot._nodeSelfSizeOffset];
+    },
+
+    get type()
+    {
+        return this._snapshot._nodeTypes[this._type()];
+    },
+
+    _name: function()
+    {
+        return this._nodes[this.nodeIndex + this._snapshot._nodeNameOffset];
+    },
+
+    get _nodes()
+    {
+        return this._snapshot._nodes;
+    },
+
+    _firstEdgeIndex: function()
+    {
+        return this.nodeIndex + this._snapshot._firstEdgeOffset;
+    },
+
+    get _nextNodeIndex()
+    {
+        return this._firstEdgeIndex() + this.edgesCount * this._snapshot._edgeFieldsCount;
+    },
+
+    _type: function()
+    {
+        return this._nodes[this.nodeIndex + this._snapshot._nodeTypeOffset];
+    }
+};
+
+WebInspector.HeapSnapshotNodeIterator = function(node)
+{
+    this.node = node;
+}
+
+WebInspector.HeapSnapshotNodeIterator.prototype = {
+    first: function()
+    {
+        this.node.nodeIndex = this.node._firstNodeIndex;
+    },
+
+    hasNext: function()
+    {
+        return this.node.nodeIndex < this.node._nodes.length;
+    },
+
+    get index()
+    {
+        return this.node.nodeIndex;
+    },
+
+    set index(newIndex)
+    {
+        this.node.nodeIndex = newIndex;
+    },
+
+    get item()
+    {
+        return this.node;
+    },
+
+    next: function()
+    {
+        this.node.nodeIndex = this.node._nextNodeIndex;
+    }
+}
+
+WebInspector.HeapSnapshot = function(profile)
+{
+    this._nodes = profile.nodes;
+    this._strings = profile.strings;
+
+    this._init();
+}
+
+WebInspector.HeapSnapshot.prototype = {
+    _init: function()
+    {
+        this._metaNodeIndex = 0;
+        this._rootNodeIndex = 1;
+        var meta = this._nodes[this._metaNodeIndex];
+        this._nodeTypeOffset = meta.fields.indexOf("type");
+        this._nodeNameOffset = meta.fields.indexOf("name");
+        this._nodeIdOffset = meta.fields.indexOf("id");
+        this._nodeInstancesCountOffset = this._nodeIdOffset;
+        this._nodeSelfSizeOffset = meta.fields.indexOf("self_size");
+        this._nodeRetainedSizeOffset = meta.fields.indexOf("retained_size");
+        this._dominatorOffset = meta.fields.indexOf("dominator");
+        this._edgesCountOffset = meta.fields.indexOf("children_count");
+        this._firstEdgeOffset = meta.fields.indexOf("children");
+        this._nodeTypes = meta.types[this._nodeTypeOffset];
+        this._nodeHiddenType = this._nodeTypes.indexOf("hidden");
+        var edgesMeta = meta.types[this._firstEdgeOffset];
+        this._edgeFieldsCount = edgesMeta.fields.length;
+        this._edgeTypeOffset = edgesMeta.fields.indexOf("type");
+        this._edgeNameOffset = edgesMeta.fields.indexOf("name_or_index");
+        this._edgeToNodeOffset = edgesMeta.fields.indexOf("to_node");
+        this._edgeTypes = edgesMeta.types[this._edgeTypeOffset];
+        this._edgeElementType = this._edgeTypes.indexOf("element");
+        this._edgeHiddenType = this._edgeTypes.indexOf("hidden");
+        this._edgeInternalType = this._edgeTypes.indexOf("internal");
+        this._edgeShortcutType = this._edgeTypes.indexOf("shortcut");
+    },
+
+    dispose: function()
+    {
+        delete this._nodes;
+        delete this._strings;
+        if (this._idsMap)
+            delete this._idsMap;
+        if (this._retainers) {
+            delete this._retainers;
+            delete this._nodesToRetainers;
+        }
+        if (this._aggregates) {
+            delete this._aggregates;
+            this._aggregatesWithIndexes = false;
+        }
+    },
+
+    get allNodes()
+    {
+        return new WebInspector.HeapSnapshotNodeIterator(this.rootNode);
+    },
+
+    get nodesCount()
+    {
+        if (this._nodesCount)
+            return this._nodesCount;
+
+        this._nodesCount = 0;
+        for (var iter = this.allNodes; iter.hasNext(); iter.next())
+            ++this._nodesCount;
+        return this._nodesCount;
+    },
+
+    restore: function(profile)
+    {
+        this._nodes = profile.nodes;
+        this._strings = profile.strings;
+    },
+
+    get rootNode()
+    {
+        return new WebInspector.HeapSnapshotNode(this, this._rootNodeIndex);
+    },
+
+    get totalSize()
+    {
+        return this.rootNode.retainedSize;
+    },
+
+    get idsMap()
+    {
+        if (this._idsMap)
+            return this._idsMap;
+
+        this._idsMap = [];
+        for (var iter = this.allNodes; iter.hasNext(); iter.next()) {
+            this._idsMap[iter.node.id] = true;
+        }
+        return this._idsMap;
+    },
+
+    retainers: function(node)
+    {
+        if (!this._retainers)
+            this._buildRetainers();
+
+        var retIndexFrom = this._nodesToRetainers[node.nodeIndex];
+        var retIndexTo = this._nodesToRetainers[node._nextNodeIndex];
+        return new WebInspector.HeapSnapshotArraySlice(this, "_retainers", retIndexFrom, retIndexTo);
+    },
+
+    aggregates: function(withNodeIndexes)
+    {
+        if (!this._aggregates)
+            this._buildAggregates();
+        if (withNodeIndexes && !this._aggregatesWithIndexes)
+            this._buildAggregatesIndexes();
+        return this._aggregates;
+    },
+
+    _buildRetainers: function()
+    {
+        this._nodesToRetainers = [];
+        for (var nodesIter = this.allNodes; nodesIter.hasNext(); nodesIter.next()) {
+            var node = nodesIter.node;
+            if (!(node.nodeIndex in this._nodesToRetainers))
+                this._nodesToRetainers[node.nodeIndex] = 0;
+            for (var edgesIter = node.edges; edgesIter.hasNext(); edgesIter.next()) {
+                var edge = edgesIter.edge;
+                var nodeIndex = edge.nodeIndex;
+                if (!(nodeIndex in this._nodesToRetainers))
+                    this._nodesToRetainers[nodeIndex] = 0;
+                this._nodesToRetainers[nodeIndex] += this._edgeFieldsCount;
+            }
+        }
+        nodesIter = this.allNodes;
+        var node = nodesIter.node;
+        var prevIndex = this._nodesToRetainers[node.nodeIndex] = 0;
+        var prevRetsCount = this._nodesToRetainers[node.nodeIndex];
+        nodesIter.next();
+        for (; nodesIter.hasNext(); nodesIter.next()) {
+            node = nodesIter.node;
+            var savedRefsCount = this._nodesToRetainers[node.nodeIndex];
+            this._nodesToRetainers[node.nodeIndex] = prevIndex + prevRetsCount;
+            prevIndex = this._nodesToRetainers[node.nodeIndex];
+            prevRetsCount = savedRefsCount;
+        }
+        this._retainers = new Array(prevIndex + prevRetsCount);
+        this._nodesToRetainers[this._nodes.length] = this._retainers.length;
+        for (nodesIter = this.allNodes; nodesIter.hasNext(); nodesIter.next()) {
+            node = nodesIter.node;
+            var retsCount = this._nodesToRetainers[node._nextNodeIndex] - this._nodesToRetainers[node.nodeIndex];
+            if (retsCount > 0) {
+                this._retainers[this._nodesToRetainers[node.nodeIndex]] = retsCount;
+            }
+        }
+        for (nodesIter = this.allNodes; nodesIter.hasNext(); nodesIter.next()) {
+            node = nodesIter.node;
+            for (var edgesIter = node.edges; edgesIter.hasNext(); edgesIter.next()) {
+                var edge = edgesIter.edge;
+                var nodeIndex = edge.nodeIndex;
+                var retIndex = this._nodesToRetainers[nodeIndex];
+                this._retainers[retIndex] -= this._edgeFieldsCount;
+                var idx = retIndex + this._retainers[retIndex];
+                this._retainers[idx + this._edgeTypeOffset] = edge._type();
+                this._retainers[idx + this._edgeNameOffset] = edge._nameOrIndex;
+                this._retainers[idx + this._edgeToNodeOffset] = node.nodeIndex;
+            }
+        }
+    },
+
+    _buildAggregates: function()
+    {
+        this._aggregates = {};
+        for (var iter = this.allNodes; iter.hasNext(); iter.next()) {
+            var node = iter.node;
+            var className = node.className;
+            var nameMatters = node.type === "object";
+            if (node.selfSize === 0)
+                continue;
+            if (!(className in this._aggregates))
+                this._aggregates[className] = { count: 0, self: 0, maxRet: 0, type: node.type, name: nameMatters ? node.name : null, idxs: [] };
+            var clss = this._aggregates[className];
+            ++clss.count;
+            clss.self += node.selfSize;
+            if (node.retainedSize > clss.maxRet)
+                clss.maxRet = node.retainedSize;
+        }
+    },
+
+    _buildAggregatesIndexes: function()
+    {
+        for (var iter = this.allNodes; iter.hasNext(); iter.next()) {
+            var node = iter.node;
+            var className = node.className;
+            var clss = this._aggregates[className];
+            if (clss)
+                clss.idxs.push(node.nodeIndex);
+        }
+
+        var nodeA = new WebInspector.HeapSnapshotNode(this);
+        var nodeB = new WebInspector.HeapSnapshotNode(this);
+        for (var clss in this._aggregates)
+            this._aggregates[clss].idxs.sort(
+                function(idxA, idxB) {
+                    nodeA.nodeIndex = idxA;
+                    nodeB.nodeIndex = idxB;
+                    return nodeA.id < nodeB.id ? -1 : 1;
+                });
+
+        this._aggregatesWithIndexes = true;
+    }
+};
+
+WebInspector.HeapSnapshotFilteredOrderedIterator = function(snapshot, iterator, filter)
+{
+    this._snapshot = snapshot;
+    this._filter = filter;
+    this._iterator = iterator;
+    this._iterationOrder = null;
+    this._position = 0;
+    this._lastComparator = null;
+}
+
+WebInspector.HeapSnapshotFilteredOrderedIterator.prototype = {
+    _createIterationOrder: function()
+    {
+        this._iterationOrder = [];
+        var iterator = this._iterator;
+        if (!this._filter) {
+            for (iterator.first(); iterator.hasNext(); iterator.next())
+                this._iterationOrder.push(iterator.index);
+        } else {
+            for (iterator.first(); iterator.hasNext(); iterator.next()) {
+                if (this._filter(iterator.item))
+                    this._iterationOrder.push(iterator.index);
+            }
+        }
+    },
+
+    first: function()
+    {
+        this._position = 0;
+    },
+
+    hasNext: function()
+    {
+        return this._position < this._iterationOrder.length;
+    },
+
+    get isEmpty()
+    {
+        if (this._iterationOrder)
+            return !this._iterationOrder.length;
+        var iterator = this._iterator;
+        if (!this._filter) {
+            iterator.first();
+            return !iterator.hasNext();
+        }
+        for (iterator.first(); iterator.hasNext(); iterator.next())
+            if (this._filter(iterator.item)) return false;
+        return true;
+    },
+
+    get item()
+    {
+        this._iterator.index = this._iterationOrder[this._position];
+        return this._iterator.item;
+    },
+
+    get lastComparator()
+    {
+        return this._lastComparator;
+    },
+
+    get length()
+    {
+        if (!this._iterationOrder)
+            this._createIterationOrder();
+        return this._iterationOrder.length;
+    },
+
+    next: function()
+    {
+        ++this._position;
+    }
+}
+
+WebInspector.HeapSnapshotFilteredOrderedIterator.prototype.createComparator = function(fieldNames)
+{
+    return {fieldName1:fieldNames[0], ascending1:fieldNames[1], fieldName2:fieldNames[2], ascending2:fieldNames[3]};
+}
+
+WebInspector.HeapSnapshotEdgesProvider = function(snapshot, rawEdges, filter)
+{
+    WebInspector.HeapSnapshotFilteredOrderedIterator.call(this, snapshot, new WebInspector.HeapSnapshotEdgeIterator(new WebInspector.HeapSnapshotEdge(snapshot, rawEdges)), filter);
+}
+
+WebInspector.HeapSnapshotEdgesProvider.prototype = {
+    sort: function(comparator)
+    {
+        if (this._lastComparator === comparator)
+            return false;
+        this._lastComparator = comparator;
+        var fieldName1 = comparator.fieldName1;
+        var fieldName2 = comparator.fieldName2;
+        var ascending1 = comparator.ascending1;
+        var ascending2 = comparator.ascending2;
+
+        var edgeA = this._iterator.item.clone();
+        var edgeB = edgeA.clone();
+        var nodeA = new WebInspector.HeapSnapshotNode(this._snapshot);
+        var nodeB = new WebInspector.HeapSnapshotNode(this._snapshot);
+
+        function sortByEdgeFieldName(ascending, indexA, indexB)
+        {
+            edgeA.edgeIndex = indexA;
+            edgeB.edgeIndex = indexB;
+            if (edgeB.name === "__proto__") return -1;
+            if (edgeA.name === "__proto__") return 1;
+            var result =
+                edgeA.hasStringName === edgeB.hasStringName ?
+                (edgeA.name < edgeB.name ? -1 : (edgeA.name > edgeB.name ? 1 : 0)) :
+                (edgeA.hasStringName ? -1 : 1);
+            return ascending ? result : -result;
+        }
+
+        function sortByNodeField(fieldName, ascending, indexA, indexB)
+        {
+            edgeA.edgeIndex = indexA;
+            edgeB.edgeIndex = indexB;
+            nodeA.nodeIndex = edgeA.nodeIndex;
+            nodeB.nodeIndex = edgeB.nodeIndex;
+            var valueA = nodeA[fieldName];
+            var valueB = nodeB[fieldName];
+            var result = valueA < valueB ? -1 : (valueA > valueB ? 1 : 0);
+            return ascending ? result : -result;
+        }
+
+        if (!this._iterationOrder)
+            this._createIterationOrder();
+
+        function sortByEdgeAndNode(indexA, indexB) {
+            var result = sortByEdgeFieldName(ascending1, indexA, indexB);
+            if (result === 0)
+                result = sortByNodeField(fieldName2, ascending2, indexA, indexB);
+            return result;
+        }
+
+        function sortByNodeAndEdge(indexA, indexB) {
+            var result = sortByNodeField(fieldName1, ascending1, indexA, indexB);
+            if (result === 0)
+                result = sortByEdgeFieldName(ascending2, indexA, indexB);
+            return result;
+        }
+
+        function sortByNodeAndNode(indexA, indexB) {
+            var result = sortByNodeField(fieldName1, ascending1, indexA, indexB);
+            if (result === 0)
+                result = sortByNodeField(fieldName2, ascending2, indexA, indexB);
+            return result;
+        }
+
+        if (fieldName1 === "!edgeName")
+            this._iterationOrder.sort(sortByEdgeAndNode);
+        else if (fieldName2 === "!edgeName")
+            this._iterationOrder.sort(sortByNodeAndEdge);
+        else
+            this._iterationOrder.sort(sortByNodeAndNode);
+        return true;
+    }
+};
+
+WebInspector.HeapSnapshotEdgesProvider.prototype.__proto__ = WebInspector.HeapSnapshotFilteredOrderedIterator.prototype;
+
+WebInspector.HeapSnapshotNodesProvider = function(snapshot, nodes, filter)
+{
+    WebInspector.HeapSnapshotFilteredOrderedIterator.call(this, snapshot, nodes, filter);
+}
+
+WebInspector.HeapSnapshotNodesProvider.prototype = {
+    sort: function(comparator)
+    {
+        if (this._lastComparator === comparator)
+            return false;
+        this._lastComparator = comparator;
+        var fieldName1 = comparator.fieldName1;
+        var fieldName2 = comparator.fieldName2;
+        var ascending1 = comparator.ascending1;
+        var ascending2 = comparator.ascending2;
+
+        var nodeA = new WebInspector.HeapSnapshotNode(this._snapshot);
+        var nodeB = new WebInspector.HeapSnapshotNode(this._snapshot);
+
+        function sortByNodeField(fieldName, ascending, indexA, indexB)
+        {
+            nodeA.nodeIndex = indexA;
+            nodeB.nodeIndex = indexB;
+            var valueA = nodeA[fieldName];
+            var valueB = nodeB[fieldName];
+            var result = valueA < valueB ? -1 : (valueA > valueB ? 1 : 0);
+            return ascending ? result : -result;
+        }
+
+        if (!this._iterationOrder)
+            this._createIterationOrder();
+
+        function sortByComparator(indexA, indexB) {
+            var result = sortByNodeField(fieldName1, ascending1, indexA, indexB);
+            if (result === 0)
+                result = sortByNodeField(fieldName2, ascending2, indexA, indexB);
+            return result;
+        }
+
+        this._iterationOrder.sort(sortByComparator);
+        return true;
+    }
+};
+
+WebInspector.HeapSnapshotNodesProvider.prototype.__proto__ = WebInspector.HeapSnapshotFilteredOrderedIterator.prototype;
+
+WebInspector.HeapSnapshotPathFinder = function(snapshot, targetNodeIndex)
+{
+    this._snapshot = snapshot;
+    this._maxLength = 1;
+    this._lengthLimit = 15;
+    this._targetNodeIndex = targetNodeIndex;
+    this._currentPath = null;
+    this._skipHidden = !WebInspector.DetailedHeapshotView.prototype.showHiddenData;
+    this._rootChildren = this._fillRootChildren();
+}
+
+WebInspector.HeapSnapshotPathFinder.prototype = {
+    findNext: function()
+    {
+        for (var i = 0; i < 100000; ++i) {
+            if (!this._buildNextPath()) {
+                if (++this._maxLength >= this._lengthLimit)
+                    return null;
+                this._currentPath = null;
+                if (!this._buildNextPath())
+                    return null;
+            }
+            if (this._isPathFound())
+                return {path:this._pathToString(this._currentPath), len:this._currentPath.length};
+        }
+
+        return false;
+    },
+
+    _fillRootChildren: function()
+    {
+        var result = [];
+        for (var iter = this._snapshot.rootNode.edges; iter.hasNext(); iter.next())
+            result[iter.edge.nodeIndex] = true;
+        return result;
+    },
+
+    _appendToCurrentPath: function(iter)
+    {
+        this._currentPath._cache[this._lastEdge.nodeIndex] = true;
+        this._currentPath.push(iter);
+    },
+
+    _removeLastFromCurrentPath: function()
+    {
+        this._currentPath.pop();
+        delete this._currentPath._cache[this._lastEdge.nodeIndex];
+    },
+
+    _hasInPath: function(nodeIndex)
+    {
+        return this._targetNodeIndex === nodeIndex
+            || !!this._currentPath._cache[nodeIndex];
+    },
+
+    _isPathFound: function()
+    {
+        return this._currentPath.length === this._maxLength
+            && this._lastEdge.nodeIndex in this._rootChildren;
+    },
+
+    get _lastEdgeIter()
+    {
+        return this._currentPath[this._currentPath.length - 1];
+    },
+
+    get _lastEdge()
+    {
+        return this._lastEdgeIter.edge;
+    },
+
+    _skipEdge: function(edge)
+    {
+        return (this._skipHidden && (edge.isHidden || edge.node.isHidden))
+            || this._hasInPath(edge.nodeIndex);
+    },
+
+    _nextEdgeIter: function()
+    {
+        var iter = this._lastEdgeIter;
+        while (this._skipEdge(iter.edge) && iter.hasNext())
+            iter.next();
+        return iter;
+    },
+
+    _buildNextPath: function()
+    {
+        if (this._currentPath !== null) {
+            var iter = this._lastEdgeIter;
+            while (true) {
+                iter.next();
+                if (iter.hasNext())
+                    return true;
+                while (true) {
+                    if (this._currentPath.length > 1) {
+                        this._removeLastFromCurrentPath();
+                        iter = this._lastEdgeIter;
+                        iter.next();
+                        iter = this._nextEdgeIter();
+                        if (iter.hasNext()) {
+                            while (this._currentPath.length < this._maxLength) {
+                                iter = this._nextEdgeIter();
+                                if (iter.hasNext())
+                                    this._appendToCurrentPath(iter.edge.node.retainers);
+                                else
+                                    return true;
+                            }
+                            return true;
+                        }
+                    } else
+                        return false;
+                }
+            }
+        } else {
+            var node = new WebInspector.HeapSnapshotNode(this._snapshot, this._targetNodeIndex);
+            this._currentPath = [node.retainers];
+            this._currentPath._cache = {};
+            while (this._currentPath.length < this._maxLength) {
+                var iter = this._nextEdgeIter();
+                if (iter.hasNext())
+                    this._appendToCurrentPath(iter.edge.node.retainers);
+                else
+                    break;
+            }
+            return true;
+        }
+    },
+
+    _nodeToString: function(node)
+    {
+        if (node.id === 1)
+            return node.name;
+        else
+            return node.name + "@" + node.id;
+    },
+
+    _pathToString: function(path)
+    {
+        if (!path)
+            return "";
+        var sPath = [];
+        for (var j = 0; j < path.length; ++j)
+            sPath.push(path[j].edge.toString());
+        sPath.push(this._nodeToString(path[path.length - 1].edge.node));
+        sPath.reverse();
+        return sPath.join("");
+    }
+};
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshotView.js b/Source/WebCore/inspector/front-end/HeapSnapshotView.js
index f349361..44b95c3 100644
--- a/Source/WebCore/inspector/front-end/HeapSnapshotView.js
+++ b/Source/WebCore/inspector/front-end/HeapSnapshotView.js
@@ -27,154 +27,6 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
-WebInspector.HeapSnapshotEdgesIterator = function(snapshot, edges)
-{
-    this._snapshot = snapshot;
-    this._edges = edges;
-    this._edgeIndex = 0;
-}
-
-WebInspector.HeapSnapshotEdgesIterator.prototype = {
-    get done()
-    {
-        return this._edgeIndex >= this._edges.length;
-    },
-
-    get isElement()
-    {
-        return this._getType() === this._snapshot._edgeElementType;
-    },
-
-    get isHidden()
-    {
-        return this._getType() === this._snapshot._edgeHiddenType;
-    },
-
-    get name()
-    {
-        return this.isElement || this.isHidden ? this._getNameOrIndex() : this._snapshot._strings[this._getNameOrIndex()];
-    },
-
-    next: function()
-    {
-        this._edgeIndex += this._snapshot._edgeFieldsCount;
-    },
-
-    get node()
-    {
-        return new WebInspector.HeapSnapshotNodeWrapper(this._snapshot, this.nodeIndex);
-    },
-
-    get nodeIndex()
-    {
-        return this._edges[this._edgeIndex + this._snapshot._edgeToNodeOffset];
-    },
-
-    _getNameOrIndex: function()
-    {
-        return this._edges[this._edgeIndex + this._snapshot._edgeNameOffset];
-    },
-
-    _getType: function()
-    {
-        return this._edges[this._edgeIndex + this._snapshot._edgeTypeOffset];
-    }
-};
-
-WebInspector.HeapSnapshotNodeWrapper = function(snapshot, nodeIndex)
-{
-    this._snapshot = snapshot;
-    this._nodes = snapshot._nodes;
-    this._nodeIndex = nodeIndex;
-}
-
-WebInspector.HeapSnapshotNodeWrapper.prototype = {
-    get edges()
-    {
-        return new WebInspector.HeapSnapshotEdgesIterator(this._snapshot, this._getEdges());
-    },
-
-    get edgesCount()
-    {
-        return this._nodes[this._nodeIndex + this._snapshot._edgesCountOffset];
-    },
-
-    get instancesCount()
-    {
-        return this._nodes[this._nodeIndex + this._snapshot._nodeInstancesCountOffset];
-    },
-
-    get isHidden()
-    {
-        return this._getType() === this._snapshot._nodeHiddenType;
-    },
-
-    get name()
-    {
-        return this._snapshot._strings[this._getName()];
-    },
-
-    get selfSize()
-    {
-        return this._nodes[this._nodeIndex + this._snapshot._nodeSelfSizeOffset]; 
-    },
-
-    _getName: function()
-    {
-        return this._nodes[this._nodeIndex + this._snapshot._nodeNameOffset]; 
-    },
-
-    _getEdges: function()
-    {
-        var firstEdgeIndex = this._nodeIndex + this._snapshot._firstEdgeOffset;
-        return this._nodes.slice(firstEdgeIndex, firstEdgeIndex + this.edgesCount * this._snapshot._edgeFieldsCount);
-    },
-
-    _getType: function()
-    {
-        return this._nodes[this._nodeIndex + this._snapshot._nodeTypeOffset];
-    }
-};
-
-WebInspector.HeapSnapshot = function(profile)
-{
-    this._profile = profile;
-    this._nodes = profile.nodes;
-    this._strings = profile.strings;
-
-    this._init();
-}
-
-WebInspector.HeapSnapshot.prototype = {
-    _init: function()
-    {
-        this._metaNodeIndex = 0;
-        this._rootNodeIndex = 1;
-        var meta = this._nodes[this._metaNodeIndex];
-        this._nodeTypeOffset = meta.fields.indexOf("type");
-        this._nodeNameOffset = meta.fields.indexOf("name");
-        this._nodeIdOffset = meta.fields.indexOf("id");
-        this._nodeInstancesCountOffset = this._nodeIdOffset;
-        this._nodeSelfSizeOffset = meta.fields.indexOf("self_size");
-        this._edgesCountOffset = meta.fields.indexOf("children_count");
-        this._firstEdgeOffset = meta.fields.indexOf("children");
-        this._nodeTypes = meta.types[this._nodeTypeOffset];
-        this._nodeHiddenType = this._nodeTypes.indexOf("hidden");
-        var edgesMeta = meta.types[this._firstEdgeOffset];
-        this._edgeFieldsCount = edgesMeta.fields.length;
-        this._edgeTypeOffset = edgesMeta.fields.indexOf("type");
-        this._edgeNameOffset = edgesMeta.fields.indexOf("name_or_index");
-        this._edgeToNodeOffset = edgesMeta.fields.indexOf("to_node");
-        this._edgeTypes = edgesMeta.types[this._edgeTypeOffset];
-        this._edgeElementType = this._edgeTypes.indexOf("element");
-        this._edgeHiddenType = this._edgeTypes.indexOf("hidden");
-    },
-
-    get rootEdges()
-    {
-        return (new WebInspector.HeapSnapshotNodeWrapper(this, this._rootNodeIndex)).edges;
-    }
-};
 
 WebInspector.HeapSnapshotView = function(parent, profile)
 {
@@ -246,7 +98,7 @@ WebInspector.HeapSnapshotView = function(parent, profile)
 
     function profileCallback(profile)
     {
-        var list = this._getProfiles();
+        var list = this._profiles();
         var profileIndex;
         for (var i = 0; i < list.length; ++i)
             if (list[i].uid === profile.uid) {
@@ -440,7 +292,7 @@ WebInspector.HeapSnapshotView.prototype = {
 
     _changeBase: function()
     {
-        if (this.baseSnapshot.uid === this._getProfiles()[this.baseSelectElement.selectedIndex].uid)
+        if (this.baseSnapshot.uid === this._profiles()[this.baseSelectElement.selectedIndex].uid)
             return;
 
         this._resetDataGridList(resetCompleted.bind(this));
@@ -468,7 +320,7 @@ WebInspector.HeapSnapshotView.prototype = {
         return this._snapshotDataGridList;
     },
 
-    _getProfiles: function()
+    _profiles: function()
     {
         return WebInspector.panels.profiles.getProfiles(WebInspector.HeapSnapshotProfileType.TypeId);
     },
@@ -530,17 +382,20 @@ WebInspector.HeapSnapshotView.prototype = {
     {
         var snapshot = new WebInspector.HeapSnapshot(loadedSnapshot);
         var result = {lowlevels: {}, entries: {}, children: {}};
-        for (var rootEdges = snapshot.rootEdges; !rootEdges.done; rootEdges.next()) {
-            var node = rootEdges.node;
+        var rootEdgesIter = snapshot.rootNode.edges;
+        for (var iter = rootEdgesIter; iter.hasNext(); iter.next()) {
+            var node = iter.edge.node;
             if (node.isHidden)
                 result.lowlevels[node.name] = {count: node.instancesCount, size: node.selfSize, type: node.name};
             else if (node.instancesCount)
                 result.entries[node.name] = {constructorName: node.name, count: node.instancesCount, size: node.selfSize};
             else {
                 var entry = {constructorName: node.name};
-                for (var edges = node.edges; !edges.done; edges.next())
-                    entry[edges.nodeIndex] = {constructorName: edges.node.name, count: edges.name};
-                result.children[rootEdges.nodeIndex] = entry;
+                for (var innerIter = node.edges; innerIter.hasNext(); innerIter.next()) {
+                    var edge = innerIter.edge;
+                    entry[edge.nodeIndex] = {constructorName: edge.node.name, count: edge.name};
+                }
+                result.children[rootEdgesIter.edge.nodeIndex] = entry;
             }
         }
         return result;
@@ -581,7 +436,7 @@ WebInspector.HeapSnapshotView.prototype = {
 
     _resetDataGridList: function(callback)
     {
-        this._loadProfile(this._getProfiles()[this.baseSelectElement.selectedIndex], profileLoaded.bind(this));
+        this._loadProfile(this._profiles()[this.baseSelectElement.selectedIndex], profileLoaded.bind(this));
 
         function profileLoaded(profile)
         {
@@ -601,10 +456,10 @@ WebInspector.HeapSnapshotView.prototype = {
         var sortColumnIdentifier = this.dataGrid.sortColumnIdentifier;
         var sortProperty = {
             cons: ["constructorName", null],
-            count: ["count", null],
-            size: ["size", "count"],
-            countDelta: this.showCountDeltaAsPercent ? ["countDeltaPercent", null] : ["countDelta", null],
-            sizeDelta: this.showSizeDeltaAsPercent ? ["sizeDeltaPercent", "countDeltaPercent"] : ["sizeDelta", "sizeDeltaPercent"]
+            count: ["count", "constructorName"],
+            size: ["size", "constructorName"],
+            countDelta: [this.showCountDeltaAsPercent ? "countDeltaPercent" : "countDelta", "constructorName"],
+            sizeDelta: [this.showSizeDeltaAsPercent ? "sizeDeltaPercent" : "sizeDelta", "constructorName"]
         }[sortColumnIdentifier];
 
         this.snapshotDataGridList.sort(WebInspector.HeapSnapshotDataGridList.propertyComparator(sortProperty[0], sortProperty[1], sortAscending));
@@ -614,7 +469,7 @@ WebInspector.HeapSnapshotView.prototype = {
 
     _updateBaseOptions: function()
     {
-        var list = this._getProfiles();
+        var list = this._profiles();
         // We're assuming that snapshots can only be added.
         if (this.baseSelectElement.length === list.length)
             return;
@@ -1046,10 +901,17 @@ WebInspector.HeapSnapshotDataGridList.propertyComparator = function(property, pr
     if (!comparator) {
         comparator = function(lhs, rhs) {
             var l = lhs[property], r = rhs[property];
-            if ((l === null || r === null) && property2 !== null)
-                l = lhs[property2], r = rhs[property2];
-            var result = l < r ? -1 : (l > r ? 1 : 0);
-            return isAscending ? result : -result;
+            var result = 0;
+            if (l !== null && r !== null) {
+                result = l < r ? -1 : (l > r ? 1 : 0);
+            }
+            if (result !== 0 || property2 === null) {
+                return isAscending ? result : -result;
+            } else {
+                l = lhs[property2];
+                r = rhs[property2];
+                return l < r ? -1 : (l > r ? 1 : 0);
+            }
         };
         this.propertyComparators[(isAscending ? 1 : 0)][propertyHash] = comparator;
     }
@@ -1148,7 +1010,7 @@ WebInspector.HeapSnapshotProfileType.prototype = {
 
     buttonClicked: function()
     {
-        InspectorBackend.takeHeapSnapshot();
+        InspectorBackend.takeHeapSnapshot(false);
     },
 
     get welcomeMessage()
diff --git a/Source/WebCore/inspector/front-end/NetworkManager.js b/Source/WebCore/inspector/front-end/NetworkManager.js
index ed4309e..da043fe 100644
--- a/Source/WebCore/inspector/front-end/NetworkManager.js
+++ b/Source/WebCore/inspector/front-end/NetworkManager.js
@@ -31,86 +31,114 @@
 WebInspector.NetworkManager = function(resourceTreeModel)
 {
     WebInspector.Object.call(this);
-
-    this._inflightResources = {};
     this._resourceTreeModel = resourceTreeModel;
-    this._lastIdentifierForCachedResource = 0;
-    InspectorBackend.registerDomainDispatcher("Network", this);
+    this._dispatcher = new WebInspector.NetworkDispatcher(resourceTreeModel, this);
+    InspectorBackend.cachedResources(this._processCachedResources.bind(this));
 }
 
-WebInspector.NetworkManager.requestContent = function(resource, base64Encode, callback)
-{
-    InspectorBackend.resourceContent(resource.loader.frameId, resource.url, base64Encode, callback);
-}
-
-WebInspector.NetworkManager.updateResourceWithRequest = function(resource, request)
-{
-    resource.requestMethod = request.httpMethod;
-    resource.requestHeaders = request.httpHeaderFields;
-    resource.requestFormData = request.requestFormData;
+WebInspector.NetworkManager.EventTypes = {
+    ResourceStarted: "ResourceStarted",
+    ResourceUpdated: "ResourceUpdated",
+    ResourceFinished: "ResourceFinished",
+    MainResourceCommitLoad: "MainResourceCommitLoad"
 }
 
-WebInspector.NetworkManager.updateResourceWithResponse = function(resource, response)
-{
-    if (resource.isNull)
-        return;
+WebInspector.NetworkManager.prototype = {
+    reset: function()
+    {
+        WebInspector.panels.network.clear();
+        this._resourceTreeModel.reset();
+        InspectorBackend.cachedResources(this._processCachedResources.bind(this));
+    },
 
-    resource.mimeType = response.mimeType;
-    resource.expectedContentLength = response.expectedContentLength;
-    resource.textEncodingName = response.textEncodingName;
-    resource.suggestedFilename = response.suggestedFilename;
-    resource.statusCode = response.httpStatusCode;
-    resource.statusText = response.httpStatusText;
+    requestContent: function(resource, base64Encode, callback)
+    {
+        function callbackWrapper(success, content)
+        {
+            callback(success ? content : null);
+        }
+        InspectorBackend.resourceContent(resource.loader.frameId, resource.url, base64Encode, callbackWrapper);
+    },
 
-    resource.responseHeaders = response.httpHeaderFields;
-    resource.connectionReused = response.connectionReused;
-    resource.connectionID = response.connectionID;
+    _processCachedResources: function(mainFramePayload)
+    {
+        var mainResource = this._dispatcher._addFramesRecursively(mainFramePayload);
+        WebInspector.mainResource = mainResource;
+        mainResource.isMainResource = true;
+    },
 
-    if (response.wasCached)
-        resource.cached = true;
-    else
-        resource.timing = response.timing;
-
-    if (response.loadInfo) {
-        if (response.loadInfo.httpStatusCode)
-            resource.statusCode = response.loadInfo.httpStatusCode;
-        if (response.loadInfo.httpStatusText)
-            resource.statusText = response.loadInfo.httpStatusText;
-        resource.requestHeaders = response.loadInfo.requestHeaders;
-        resource.responseHeaders = response.loadInfo.responseHeaders;
+    inflightResourceForURL: function(url)
+    {
+        return this._dispatcher._inflightResourcesByURL[url];
     }
 }
 
-WebInspector.NetworkManager.updateResourceWithCachedResource = function(resource, cachedResource)
+WebInspector.NetworkManager.prototype.__proto__ = WebInspector.Object.prototype;
+
+WebInspector.NetworkDispatcher = function(resourceTreeModel, manager)
 {
-    resource.type = WebInspector.Resource.Type[cachedResource.type];
-    resource.resourceSize = cachedResource.encodedSize;
-    WebInspector.NetworkManager.updateResourceWithResponse(resource, cachedResource.response);
+    this._manager = manager;
+    this._inflightResourcesById = {};
+    this._inflightResourcesByURL = {};
+    this._resourceTreeModel = resourceTreeModel;
+    this._lastIdentifierForCachedResource = 0;
+    InspectorBackend.registerDomainDispatcher("Network", this);
 }
 
-WebInspector.NetworkManager.EventTypes = {
-    ResourceStarted: "ResourceStarted",
-    ResourceUpdated: "ResourceUpdated",
-    ResourceFinished: "ResourceFinished",
-    MainResourceCommitLoad: "MainResourceCommitLoad"
-}
+WebInspector.NetworkDispatcher.prototype = {
+    _updateResourceWithRequest: function(resource, request)
+    {
+        resource.requestMethod = request.httpMethod;
+        resource.requestHeaders = request.httpHeaderFields;
+        resource.requestFormData = request.requestFormData;
+    },
 
-WebInspector.NetworkManager.prototype = {
-    reset: function()
+    _updateResourceWithResponse: function(resource, response)
     {
-        WebInspector.panels.network.clear();
-        WebInspector.panels.resources.clear();
-        this._resourceTreeModel.reloadCachedResources();
+        if (resource.isNull)
+            return;
+
+        resource.mimeType = response.mimeType;
+        resource.expectedContentLength = response.expectedContentLength;
+        resource.textEncodingName = response.textEncodingName;
+        resource.suggestedFilename = response.suggestedFilename;
+        resource.statusCode = response.httpStatusCode;
+        resource.statusText = response.httpStatusText;
+
+        resource.responseHeaders = response.httpHeaderFields;
+        resource.connectionReused = response.connectionReused;
+        resource.connectionID = response.connectionID;
+
+        if (response.wasCached)
+            resource.cached = true;
+        else
+            resource.timing = response.timing;
+
+        if (response.loadInfo) {
+            if (response.loadInfo.httpStatusCode)
+                resource.statusCode = response.loadInfo.httpStatusCode;
+            if (response.loadInfo.httpStatusText)
+                resource.statusText = response.loadInfo.httpStatusText;
+            resource.requestHeaders = response.loadInfo.requestHeaders;
+            resource.responseHeaders = response.loadInfo.responseHeaders;
+        }
+    },
+
+    _updateResourceWithCachedResource: function(resource, cachedResource)
+    {
+        resource.type = WebInspector.Resource.Type[cachedResource.type];
+        resource.resourceSize = cachedResource.encodedSize;
+        this._updateResourceWithResponse(resource, cachedResource.response);
     },
 
     identifierForInitialRequest: function(identifier, url, loader, callStack)
     {
-        this._startResource(this._resourceTreeModel.createResource(identifier, url, loader, callStack));
+        this._startResource(this._createResource(identifier, url, loader, callStack));
     },
 
     willSendRequest: function(identifier, time, request, redirectResponse)
     {
-        var resource = this._inflightResources[identifier];
+        var resource = this._inflightResourcesById[identifier];
         if (!resource)
             return;
 
@@ -122,7 +150,7 @@ WebInspector.NetworkManager.prototype = {
             resource = this._appendRedirect(resource.identifier, time, request.url);
         }
 
-        WebInspector.NetworkManager.updateResourceWithRequest(resource, request);
+        this._updateResourceWithRequest(resource, request);
         resource.startTime = time;
 
         if (isRedirect)
@@ -133,7 +161,7 @@ WebInspector.NetworkManager.prototype = {
 
     markResourceAsCached: function(identifier)
     {
-        var resource = this._inflightResources[identifier];
+        var resource = this._inflightResourcesById[identifier];
         if (!resource)
             return;
 
@@ -143,14 +171,14 @@ WebInspector.NetworkManager.prototype = {
 
     didReceiveResponse: function(identifier, time, resourceType, response)
     {
-        var resource = this._inflightResources[identifier];
+        var resource = this._inflightResourcesById[identifier];
         if (!resource)
             return;
 
         resource.responseReceivedTime = time;
         resource.type = WebInspector.Resource.Type[resourceType];
 
-        WebInspector.NetworkManager.updateResourceWithResponse(resource, response);
+        this._updateResourceWithResponse(resource, response);
 
         this._updateResource(resource);
         this._resourceTreeModel.addResourceToFrame(resource.loader.frameId, resource);
@@ -158,7 +186,7 @@ WebInspector.NetworkManager.prototype = {
 
     didReceiveContentLength: function(identifier, time, lengthReceived)
     {
-        var resource = this._inflightResources[identifier];
+        var resource = this._inflightResourcesById[identifier];
         if (!resource)
             return;
 
@@ -170,7 +198,7 @@ WebInspector.NetworkManager.prototype = {
 
     didFinishLoading: function(identifier, finishTime)
     {
-        var resource = this._inflightResources[identifier];
+        var resource = this._inflightResourcesById[identifier];
         if (!resource)
             return;
 
@@ -179,7 +207,7 @@ WebInspector.NetworkManager.prototype = {
 
     didFailLoading: function(identifier, time, localizedDescription)
     {
-        var resource = this._inflightResources[identifier];
+        var resource = this._inflightResourcesById[identifier];
         if (!resource)
             return;
 
@@ -190,8 +218,8 @@ WebInspector.NetworkManager.prototype = {
 
     didLoadResourceFromMemoryCache: function(time, cachedResource)
     {
-        var resource = this._resourceTreeModel.createResource("cached:" + ++this._lastIdentifierForCachedResource, cachedResource.url, cachedResource.loader);
-        WebInspector.NetworkManager.updateResourceWithCachedResource(resource, cachedResource);
+        var resource = this._createResource("cached:" + ++this._lastIdentifierForCachedResource, cachedResource.url, cachedResource.loader);
+        this._updateResourceWithCachedResource(resource, cachedResource);
         resource.cached = true;
         resource.requestMethod = "GET";
         this._startResource(resource);
@@ -224,21 +252,21 @@ WebInspector.NetworkManager.prototype = {
             if (mainResource) {
                 WebInspector.mainResource = mainResource;
                 mainResource.isMainResource = true;
-                this.dispatchEventToListeners(WebInspector.NetworkManager.EventTypes.MainResourceCommitLoad, mainResource);
+                this._dispatchEventToListeners(WebInspector.NetworkManager.EventTypes.MainResourceCommitLoad, mainResource);
             }
         }
     },
 
     didCreateWebSocket: function(identifier, requestURL)
     {
-        var resource = this._resourceTreeModel.createResource(identifier, requestURL);
+        var resource = this._createResource(identifier, requestURL);
         resource.type = WebInspector.Resource.Type.WebSocket;
         this._startResource(resource);
     },
 
     willSendWebSocketHandshakeRequest: function(identifier, time, request)
     {
-        var resource = this._inflightResources[identifier];
+        var resource = this._inflightResourcesById[identifier];
         if (!resource)
             return;
 
@@ -252,7 +280,7 @@ WebInspector.NetworkManager.prototype = {
 
     didReceiveWebSocketHandshakeResponse: function(identifier, time, response)
     {
-        var resource = this._inflightResources[identifier];
+        var resource = this._inflightResourcesById[identifier];
         if (!resource)
             return;
 
@@ -267,7 +295,7 @@ WebInspector.NetworkManager.prototype = {
 
     didCloseWebSocket: function(identifier, time)
     {
-        var resource = this._inflightResources[identifier];
+        var resource = this._inflightResourcesById[identifier];
         if (!resource)
             return;
         this._finishResource(resource, time);
@@ -275,40 +303,76 @@ WebInspector.NetworkManager.prototype = {
 
     _appendRedirect: function(identifier, time, redirectURL)
     {
-        var originalResource = this._inflightResources[identifier];
+        var originalResource = this._inflightResourcesById[identifier];
         var previousRedirects = originalResource.redirects || [];
         originalResource.identifier = "redirected:" + identifier + "." + previousRedirects.length;
         delete originalResource.redirects;
         this._finishResource(originalResource, time);
-        // We bound resource early, but it happened to be a redirect and won't make it through to
-        // the resource tree -- so unbind it.
-        // FIXME: we should bind upon adding to the tree only (encapsulated into ResourceTreeModel),
-        // Script debugger should do explicit late binding on its own.
-        this._resourceTreeModel.unbindResourceURL(originalResource);
-        
-        var newResource = this._resourceTreeModel.createResource(identifier, redirectURL, originalResource.loader, originalResource.stackTrace);
+        var newResource = this._createResource(identifier, redirectURL, originalResource.loader, originalResource.stackTrace);
         newResource.redirects = previousRedirects.concat(originalResource);
         return newResource;
     },
 
     _startResource: function(resource)
     {
-        this._inflightResources[resource.identifier] = resource;
-        this.dispatchEventToListeners(WebInspector.NetworkManager.EventTypes.ResourceStarted, resource);
+        this._inflightResourcesById[resource.identifier] = resource;
+        this._inflightResourcesByURL[resource.url] = resource;
+        this._dispatchEventToListeners(WebInspector.NetworkManager.EventTypes.ResourceStarted, resource);
     },
 
     _updateResource: function(resource)
     {
-        this.dispatchEventToListeners(WebInspector.NetworkManager.EventTypes.ResourceUpdated, resource);
+        this._dispatchEventToListeners(WebInspector.NetworkManager.EventTypes.ResourceUpdated, resource);
     },
 
     _finishResource: function(resource, finishTime)
     {
         resource.endTime = finishTime;
         resource.finished = true;
-        this.dispatchEventToListeners(WebInspector.NetworkManager.EventTypes.ResourceFinished, resource);
-        delete this._inflightResources[resource.identifier];
+        this._dispatchEventToListeners(WebInspector.NetworkManager.EventTypes.ResourceFinished, resource);
+        delete this._inflightResourcesById[resource.identifier];
+        delete this._inflightResourcesByURL[resource.url];
+    },
+
+    _addFramesRecursively: function(framePayload)
+    {
+        var frameResource = this._createResource(null, framePayload.resource.url, framePayload.resource.loader);
+        this._updateResourceWithRequest(frameResource, framePayload.resource.request);
+        this._updateResourceWithResponse(frameResource, framePayload.resource.response);
+        frameResource.type = WebInspector.Resource.Type["Document"];
+        frameResource.finished = true;
+
+        this._resourceTreeModel.addOrUpdateFrame(framePayload);
+        this._resourceTreeModel.addResourceToFrame(framePayload.id, frameResource);
+
+        for (var i = 0; framePayload.children && i < framePayload.children.length; ++i)
+            this._addFramesRecursively(framePayload.children[i]);
+
+        if (!framePayload.subresources)
+            return;
+
+        for (var i = 0; i < framePayload.subresources.length; ++i) {
+            var cachedResource = framePayload.subresources[i];
+            var resource = this._createResource(null, cachedResource.url, cachedResource.loader);
+            this._updateResourceWithCachedResource(resource, cachedResource);
+            resource.finished = true;
+            this._resourceTreeModel.addResourceToFrame(framePayload.id, resource);
+        }
+        return frameResource;
+    },
+
+    _dispatchEventToListeners: function(eventType, resource)
+    {
+        this._manager.dispatchEventToListeners(eventType, resource);
+    },
+
+    _createResource: function(identifier, url, loader, stackTrace)
+    {
+        var resource = new WebInspector.Resource(identifier, url);
+        resource.loader = loader;
+        if (loader)
+            resource.documentURL = loader.url;
+        resource.stackTrace = stackTrace;
+        return resource;
     }
 }
-
-WebInspector.NetworkManager.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/NetworkPanel.js b/Source/WebCore/inspector/front-end/NetworkPanel.js
index 943ee7f..085f468 100644
--- a/Source/WebCore/inspector/front-end/NetworkPanel.js
+++ b/Source/WebCore/inspector/front-end/NetworkPanel.js
@@ -103,7 +103,7 @@ WebInspector.NetworkPanel.prototype = {
 
     elementsToRestoreScrollPositionsFor: function()
     {
-        return [this.containerElement];
+        return [this.containerElement, this._dataGrid.scrollContainer];
     },
 
     resize: function()
@@ -118,8 +118,6 @@ WebInspector.NetworkPanel.prototype = {
         if (!this._viewingResourceMode)
             return;
         WebInspector.Panel.prototype.updateSidebarWidth.call(this, width);
-        if (this._summaryBarElement.parentElement === this.element)
-            this._summaryBarElement.style.width = width + "px";
     },
 
     updateMainViewWidth: function(width)
@@ -147,7 +145,6 @@ WebInspector.NetworkPanel.prototype = {
                 delete this._summaryBarRowNode;
             }
             this._summaryBarElement.addStyleClass("network-summary-bar-bottom");
-            this._summaryBarElement.style.setProperty("width", this.sidebarElement.offsetWidth + "px");
             this.element.appendChild(this._summaryBarElement);
             this._dataGrid.element.style.bottom = "20px";
             return;
@@ -157,11 +154,11 @@ WebInspector.NetworkPanel.prototype = {
             // Glue status to table.
             this._summaryBarRowNode = new WebInspector.NetworkTotalGridNode(this._summaryBarElement);
             this._summaryBarElement.removeStyleClass("network-summary-bar-bottom");
-            this._summaryBarElement.style.removeProperty("width");
             this._dataGrid.appendChild(this._summaryBarRowNode);
             this._dataGrid.element.style.bottom = 0;
             this._sortItems();
         }
+        this._updateOffscreenRows();
     },
 
     _resetSummaryBar: function()
@@ -218,6 +215,7 @@ WebInspector.NetworkPanel.prototype = {
         this.containerElement.appendChild(this._dataGrid.element);
         this._dataGrid.addEventListener("sorting changed", this._sortItems, this);
         this._dataGrid.addEventListener("width changed", this._updateDividersIfNeeded, this);
+        this._dataGrid.scrollContainer.addEventListener("scroll", this._updateOffscreenRows.bind(this));
 
         this._patchTimelineHeader();
     },
@@ -316,6 +314,7 @@ WebInspector.NetworkPanel.prototype = {
 
         this._dataGrid.sortNodes(sortingFunction, this._dataGrid.sortOrder === "descending");
         this._timelineSortSelector.selectedIndex = 0;
+        this._updateOffscreenRows();
     },
 
     _sortByTimeline: function()
@@ -334,6 +333,7 @@ WebInspector.NetworkPanel.prototype = {
         else
             this._timelineGrid.showEventDividers();
         this._dataGrid.markColumnAsSortedBy("timeline", "ascending");
+        this._updateOffscreenRows();
     },
 
     _createFilterStatusBarItems: function()
@@ -492,6 +492,7 @@ WebInspector.NetworkPanel.prototype = {
             target.addStyleClass("selected");
             this._showCategory(target.category);
         }
+        this._updateOffscreenRows();
     },
 
     _scheduleRefresh: function()
@@ -933,7 +934,6 @@ WebInspector.NetworkPanel.prototype = {
             this._viewsContainerElement.addStyleClass("hidden");
             this.sidebarElement.style.right = 0;
             this.sidebarElement.style.removeProperty("width");
-            this._summaryBarElement.style.removeProperty("width");
             if (this._dataGrid.selectedNode)
                 this._dataGrid.selectedNode.selected = false;
         }
@@ -1023,13 +1023,55 @@ WebInspector.NetworkPanel.prototype = {
         var harArchive = {
             log: (new WebInspector.HARLog()).build()
         }
-        offerFileForDownload(JSON.stringify(harArchive));
+        InspectorFrontendHost.copyText(JSON.stringify(harArchive));
     },
 
     _exportResource: function(resource)
     {
         var har = (new WebInspector.HAREntry(resource)).build();
-        offerFileForDownload(JSON.stringify(har));
+        InspectorFrontendHost.copyText(JSON.stringify(har));
+    },
+
+    _updateOffscreenRows: function(e)
+    {
+        var dataTableBody = this._dataGrid.dataTableBody;
+        var rows = dataTableBody.children;
+        var recordsCount = rows.length;
+        if (recordsCount < 2)
+            return;  // Filler row only.
+
+        var visibleTop = this._dataGrid.scrollContainer.scrollTop;
+        var visibleBottom = visibleTop + this._dataGrid.scrollContainer.offsetHeight;
+
+        var rowHeight = 0;
+
+        // Filler is at recordsCount - 1.
+        var unfilteredRowIndex = 0;
+        for (var i = 0; i < recordsCount - 1; ++i) {
+            var row = rows[i];
+            // Don't touch summaty - quit instead.
+            if (this._summaryBarRowNode && row === this._summaryBarRowNode.element)
+                break;
+
+            var dataGridNode = this._dataGrid.dataGridNodeFromNode(row);
+            if (dataGridNode.isFilteredOut()) {
+                row.removeStyleClass("offscreen");
+                continue;
+            }
+
+            if (!rowHeight)
+                rowHeight = row.offsetHeight;
+
+            var rowIsVisible = unfilteredRowIndex * rowHeight < visibleBottom && (unfilteredRowIndex + 1) * rowHeight > visibleTop;
+            if (rowIsVisible !== row.rowIsVisible) {
+                if (rowIsVisible)
+                    row.removeStyleClass("offscreen");
+                else
+                    row.addStyleClass("offscreen");
+                row.rowIsVisible = rowIsVisible;
+            }
+            unfilteredRowIndex++;
+        }
     }
 }
 
@@ -1335,6 +1377,14 @@ WebInspector.NetworkDataGridNode.prototype = {
         this._timeCell = this._createDivInTD("time");
         this._createTimelineCell();
         this._nameCell.addEventListener("click", this.select.bind(this), false);
+        this._nameCell.addEventListener("dblclick", this._openInNewTab.bind(this), false);
+    },
+
+    isFilteredOut: function()
+    {
+        if (!this._panel._hiddenCategories.all)
+            return false;
+        return this._resource.category.name in this._panel._hiddenCategories;
     },
 
     select: function()
@@ -1343,15 +1393,16 @@ WebInspector.NetworkDataGridNode.prototype = {
         WebInspector.DataGridNode.prototype.select.apply(this, arguments);
     },
 
+    _openInNewTab: function()
+    {
+        InspectorBackend.openInInspectedWindow(this._resource.url);
+    },
+
     get selectable()
     {
         if (!this._panel._viewingResourceMode)
             return false;
-        if (!this._panel._hiddenCategories.all)
-            return true;
-        if (this._panel._hiddenCategories[this._resource.category.name])
-            return false;
-        return true;
+        return !this.isFilteredOut();
     },
 
     _createDivInTD: function(columnIdentifier)
@@ -1668,6 +1719,16 @@ WebInspector.NetworkTotalGridNode = function(element)
 }
 
 WebInspector.NetworkTotalGridNode.prototype = {
+    isFilteredOut: function()
+    {
+        return false;
+    },
+
+    get selectable()
+    {
+        return false;
+    },
+
     createCells: function()
     {
         var td = document.createElement("td");
diff --git a/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js b/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
index e4794f3..88fddd6 100644
--- a/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
+++ b/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
@@ -180,7 +180,13 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
         
         this.valueElement = document.createElement("span");
         this.valueElement.className = "value";
-        this.valueElement.textContent = this.property.value.description;
+
+        var description = this.property.value.description;
+        // Render \n as a nice unicode cr symbol.
+        if (this.property.value.type === "string" && typeof description === "string")
+            description = description.replace(/\n/g, "\u21B5");
+        this.valueElement.textContent = description;
+
         if (this.property.isGetter)
             this.valueElement.addStyleClass("dimmed");
         if (this.property.value.isError())
@@ -188,7 +194,7 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
         if (this.property.value.type)
             this.valueElement.addStyleClass("console-formatted-" + this.property.value.type);
         if (this.property.value.type === "node")
-            this.valueElement.addEventListener("contextmenu", this._contextMenuEventFired.bind(this), true);
+            this.valueElement.addEventListener("contextmenu", this._contextMenuEventFired.bind(this), false);
 
         this.listItemElement.removeChildren();
 
@@ -203,8 +209,7 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
         function selectNode(nodeId)
         {
             if (nodeId) {
-                WebInspector.currentPanel = WebInspector.panels.elements;
-                WebInspector.panels.elements.focusedDOMNode = WebInspector.domAgent.nodeForId(nodeId);
+                WebInspector.panels.elements.switchToAndFocus(WebInspector.domAgent.nodeForId(nodeId));
             }
         }
 
diff --git a/Source/WebCore/inspector/front-end/PleaseWaitMessage.js b/Source/WebCore/inspector/front-end/PleaseWaitMessage.js
new file mode 100644
index 0000000..54d805d
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/PleaseWaitMessage.js
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.PleaseWaitMessage = function()
+{
+    this.element = document.createElement("div");
+    this.element.className = "please-wait-msg";
+    this.element.textContent = WebInspector.UIString("Please wait\u2026");
+
+    this.cancelButton = document.createElement("button");
+    this.cancelButton.textContent = WebInspector.UIString("Cancel");
+    this.cancelButton.addEventListener("click", this._cancelClicked.bind(this), false);
+}
+
+WebInspector.PleaseWaitMessage.prototype = {
+    _cancelClicked: function()
+    {
+        if (this._cancelCallback) {
+            var cancelCallback = this._cancelCallback;
+            delete this._cancelCallback;
+            cancelCallback();
+        }
+    },
+
+    hide: function()
+    {
+        var instance = WebInspector.PleaseWaitMessage.prototype.instance;
+        var message = instance.element;
+        if (message.parentNode)
+            message.parentNode.removeChild(message);
+    },
+
+    get instance()
+    {
+        if (!"_instance" in WebInspector.PleaseWaitMessage.prototype)
+            WebInspector.PleaseWaitMessage.prototype._instance = new WebInspector.PleaseWaitMessage();
+        return WebInspector.PleaseWaitMessage.prototype._instance;
+    },
+
+    show: function(element, cancelCallback)
+    {
+        var instance = WebInspector.PleaseWaitMessage.prototype.instance;
+        var message = instance.element;
+        if (message.parentNode === element)
+            return;
+        else if (message.parentNode)
+            message.parentNode.removeChild(message);
+        if (message.childNodes.length > 1)
+            message.removeChild(instance.cancelButton);
+        if (cancelCallback) {
+            message.appendChild(instance.cancelButton);
+            instance._cancelCallback = cancelCallback;
+        }
+        element.appendChild(message);
+    },
+
+    startAction: function(element, actionCallback, cancelCallback)
+    {
+        var instance = WebInspector.PleaseWaitMessage.prototype.instance;
+        var message = instance.element;
+        if (message.parentNode === element) {
+            actionCallback();
+            return;
+        }
+     
+        function doAction()
+        {
+            try {
+                actionCallback();
+            } finally {
+                if (message.parentNode)
+                    message.parentNode.removeChild(message);
+            }
+        }
+
+        WebInspector.PleaseWaitMessage.prototype.show(element, cancelCallback);
+        setTimeout(doAction, 0);
+    }
+};
+
diff --git a/Source/WebCore/inspector/front-end/ProfilesPanel.js b/Source/WebCore/inspector/front-end/ProfilesPanel.js
index 2e0ab28..b87ea7f 100644
--- a/Source/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/Source/WebCore/inspector/front-end/ProfilesPanel.js
@@ -112,7 +112,7 @@ WebInspector.ProfilesPanel = function()
     this.enableToggleButton = new WebInspector.StatusBarButton("", "enable-toggle-status-bar-item");
     this.enableToggleButton.addEventListener("click", this._toggleProfiling.bind(this), false);
 
-    this.clearResultsButton = new WebInspector.StatusBarButton(WebInspector.UIString("Clear CPU profiles."), "clear-status-bar-item");
+    this.clearResultsButton = new WebInspector.StatusBarButton(WebInspector.UIString("Clear all profiles."), "clear-status-bar-item");
     this.clearResultsButton.addEventListener("click", this._clearProfiles.bind(this), false);
 
     this.profileViewStatusBarItemsContainer = document.createElement("div");
@@ -195,7 +195,7 @@ WebInspector.ProfilesPanel.prototype = {
         this._profiles = [];
         this._profilesIdMap = {};
         this._profileGroups = {};
-        this._profileGroupsForLinks = {}
+        this._profileGroupsForLinks = {};
         this._profilesWereRequested = false;
 
         this.sidebarTreeElement.removeStyleClass("some-expandable");
@@ -259,6 +259,13 @@ WebInspector.ProfilesPanel.prototype = {
 
     _addProfileHeader: function(profile)
     {
+        if (this.hasTemporaryProfile(profile.typeId)) {
+            if (profile.typeId === WebInspector.CPUProfileType.TypeId)
+                this._removeProfileHeader(this._temporaryRecordingProfile);
+            else
+                this._removeProfileHeader(this._temporaryTakingSnapshot);
+        }
+
         var typeId = profile.typeId;
         var profileType = this.getProfileType(typeId);
         var sidebarParent = profileType.treeElement;
@@ -308,6 +315,7 @@ WebInspector.ProfilesPanel.prototype = {
         }
 
         var profileTreeElement = profileType.createSidebarTreeElementForProfile(profile);
+        profile.sideBarElement = profileTreeElement;
         profileTreeElement.small = small;
         if (alternateTitle)
             profileTreeElement.mainTitle = alternateTitle;
@@ -370,17 +378,20 @@ WebInspector.ProfilesPanel.prototype = {
         this.profileViewStatusBarItemsContainer.removeChildren();
 
         var statusBarItems = view.statusBarItems;
-        for (var i = 0; i < statusBarItems.length; ++i)
-            this.profileViewStatusBarItemsContainer.appendChild(statusBarItems[i]);
+        if (statusBarItems)
+            for (var i = 0; i < statusBarItems.length; ++i)
+                this.profileViewStatusBarItemsContainer.appendChild(statusBarItems[i]);
     },
 
     getProfiles: function(typeId)
     {
         var result = [];
         var profilesCount = this._profiles.length;
-        for (var i = 0; i < profilesCount; ++i)
-            if (this._profiles[i].typeId === typeId)
-                result.push(this._profiles[i]);
+        for (var i = 0; i < profilesCount; ++i) {
+            var profile = this._profiles[i];
+            if (!profile.isTemporary && profile.typeId === typeId)
+                result.push(profile);
+        }
         return result;
     },
 
@@ -398,17 +409,6 @@ WebInspector.ProfilesPanel.prototype = {
         return !!this._profilesIdMap[this._makeKey(profile.uid, profile.typeId)];
     },
 
-    updateProfile: function(profile)
-    {
-        var profilesCount = this._profiles.length;
-        for (var i = 0; i < profilesCount; ++i)
-            if (this._profiles[i].typeId === profile.typeId
-                && this._profiles[i].uid === profile.uid) {
-                this._profiles[i] = profile;
-                break;
-            }
-    },
-
     loadHeapSnapshot: function(uid, callback)
     {
         var profile = this._profilesIdMap[this._makeKey(uid, WebInspector.HeapSnapshotProfileType.TypeId)];
@@ -423,6 +423,7 @@ WebInspector.ProfilesPanel.prototype = {
             profile._is_loading = true;
             profile._callbacks = [callback];
             profile._json = "";
+            profile.sideBarElement.subtitle = WebInspector.UIString("Loading…");
             InspectorBackend.getProfile(profile.typeId, profile.uid);
         }
     },
@@ -444,13 +445,23 @@ WebInspector.ProfilesPanel.prototype = {
 
         var callbacks = profile._callbacks;
         delete profile._callbacks;
-        var loadedSnapshot = JSON.parse(profile._json);
-        delete profile._json;
-        delete profile._is_loading;
-        profile._loaded = true;
-        WebInspector.HeapSnapshotView.prototype.processLoadedSnapshot(profile, loadedSnapshot);
-        for (var i = 0; i < callbacks.length; ++i)
-            callbacks[i](profile);
+        profile.sideBarElement.subtitle = WebInspector.UIString("Parsing…");
+        window.setTimeout(doParse, 0);
+
+        function doParse()
+        {
+            var loadedSnapshot = JSON.parse(profile._json);
+            delete profile._json;
+            delete profile._is_loading;
+            profile._loaded = true;
+            profile.sideBarElement.subtitle = "";
+            if (!Preferences.detailedHeapProfiles)
+                WebInspector.HeapSnapshotView.prototype.processLoadedSnapshot(profile, loadedSnapshot);
+            else
+                WebInspector.DetailedHeapshotView.prototype.processLoadedSnapshot(profile, loadedSnapshot);
+            for (var i = 0; i < callbacks.length; ++i)
+                callbacks[i](profile);
+        }
     },
 
     showView: function(view)
@@ -579,10 +590,13 @@ WebInspector.ProfilesPanel.prototype = {
 
     _toggleProfiling: function(optionalAlways)
     {
-        if (this._profilerEnabled)
+        if (this._profilerEnabled) {
+            WebInspector.settings.profilerEnabled = false;
             InspectorBackend.disableProfiler(true);
-        else
-            InspectorBackend.enableProfiler(!!optionalAlways);
+        } else {
+            WebInspector.settings.profilerEnabled = !!optionalAlways;
+            InspectorBackend.enableProfiler();
+        }
     },
 
     _populateProfiles: function()
@@ -629,6 +643,31 @@ WebInspector.ProfilesPanel.prototype = {
                 this._removeProfileHeader(this._temporaryRecordingProfile);
         }
         this.updateProfileTypeButtons();
+    },
+
+    takeHeapSnapshot: function(detailed)
+    {
+        if (!this.hasTemporaryProfile(WebInspector.HeapSnapshotProfileType.TypeId)) {
+            if (!this._temporaryTakingSnapshot) {
+                this._temporaryTakingSnapshot = {
+                    typeId: WebInspector.HeapSnapshotProfileType.TypeId,
+                    title: WebInspector.UIString("Snapshotting…"),
+                    uid: -1,
+                    isTemporary: true
+                };
+            }
+            this._addProfileHeader(this._temporaryTakingSnapshot);
+        }
+        InspectorBackend.takeHeapSnapshot(detailed);
+    },
+
+    _reportHeapSnapshotProgress: function(done, total)
+    {
+        if (this.hasTemporaryProfile(WebInspector.HeapSnapshotProfileType.TypeId)) {
+            this._temporaryTakingSnapshot.sideBarElement.subtitle = WebInspector.UIString("%.2f%%", (done / total) * 100);
+            if (done >= total)
+                this._removeProfileHeader(this._temporaryTakingSnapshot);
+        }
     }
 }
 
@@ -674,6 +713,11 @@ WebInspector.ProfilerDispatcher.prototype = {
     setRecordingProfile: function(isProfiling)
     {
         this._profiler._setRecordingProfile(isProfiling);
+    },
+
+    reportHeapSnapshotProgress: function(done, total)
+    {
+        this._profiler._reportHeapSnapshotProgress(done, total);
     }
 }
 
@@ -717,16 +761,6 @@ WebInspector.ProfileSidebarTreeElement.prototype = {
         this.refreshTitles();
     },
 
-    get subtitle()
-    {
-        // There is no subtitle.
-    },
-
-    set subtitle(x)
-    {
-        // Can't change subtitle.
-    },
-
     set searchMatches(matches)
     {
         if (!matches) {
diff --git a/Source/WebCore/inspector/front-end/Resource.js b/Source/WebCore/inspector/front-end/Resource.js
index 00c1fb9..6cf5b9c 100644
--- a/Source/WebCore/inspector/front-end/Resource.js
+++ b/Source/WebCore/inspector/front-end/Resource.js
@@ -31,9 +31,9 @@ WebInspector.Resource = function(identifier, url)
     this.url = url;
     this._startTime = -1;
     this._endTime = -1;
-    this._requestMethod = "";
     this._category = WebInspector.resourceCategories.other;
     this._pendingContentCallbacks = [];
+    this._responseHeadersSize = 0;
 }
 
 // Keep these in sync with WebCore::InspectorResource::Type
@@ -237,8 +237,21 @@ WebInspector.Resource.prototype = {
 
     get transferSize()
     {
-        // FIXME: this is wrong for chunked-encoding resources.
-        return this.cached ? 0 : Number(this.responseHeaders["Content-Length"] || this.resourceSize || 0);
+        if (this.cached)
+            return 0;
+        if (this.statusCode === 304) // Not modified
+            return this._responseHeadersSize;
+        // FIXME: We prefer using Content-Length over resourceSize as
+        // resourceSize may differ from actual transfer size if platform's
+        // network stack performed decoding (e.g. gzip decompression).
+        // The Content-Length, though, is expected to come from raw
+        // response headers and will reflect actual transfer length.
+        // This won't work for chunked content encoding, so fall back to
+        // resourceSize when we don't have Content-Length. This still won't
+        // work for chunks with non-trivial encodings. We need a way to
+        // get actaul transfer size from the network stack.
+        var bodySize = Number(this.responseHeaders["Content-Length"] || this.resourceSize);
+        return this._responseHeadersSize + bodySize;
     },
 
     get expectedContentLength()
@@ -303,7 +316,6 @@ WebInspector.Resource.prototype = {
             delete this._timing;
     },
 
-
     get timing()
     {
         return this._timing;
@@ -431,6 +443,8 @@ WebInspector.Resource.prototype = {
     set responseHeaders(x)
     {
         this._responseHeaders = x;
+        // FIXME: we should take actual headers size from network stack, when possible.
+        this._responseHeadersSize = this._headersSize(x);
         delete this._sortedResponseHeaders;
         delete this._responseCookies;
 
@@ -512,6 +526,14 @@ WebInspector.Resource.prototype = {
         }
     },
 
+    _headersSize: function(headers)
+    {
+        var size = 0;
+        for (var header in headers)
+            size += header.length + headers[header].length + 3; // _typical_ overhead per herader is ": ".length + "\n".length.
+        return size;
+    },
+
     get errors()
     {
         return this._errors || 0;
@@ -550,9 +572,9 @@ WebInspector.Resource.prototype = {
             return true;
 
         if (typeof this.type === "undefined"
-         || this.type === WebInspector.Resource.Type.Other
-         || this.type === WebInspector.Resource.Type.XHR
-         || this.type === WebInspector.Resource.Type.WebSocket)
+            || this.type === WebInspector.Resource.Type.Other
+            || this.type === WebInspector.Resource.Type.XHR
+            || this.type === WebInspector.Resource.Type.WebSocket)
             return true;
 
         if (!this.mimeType)
@@ -671,8 +693,8 @@ WebInspector.Resource.prototype = {
             callback(null, null);
             return;
         }
-        if (this._content) {
-            callback(this._content, this._contentEncoded);
+        if (typeof this._content !== "undefined") {
+            callback(this.content, this._contentEncoded);
             return;
         }
         this._pendingContentCallbacks.push(callback);
@@ -697,7 +719,7 @@ WebInspector.Resource.prototype = {
     {
         const maxDataUrlSize = 1024 * 1024;
         // If resource content is not available or won't fit a data URL, fall back to using original URL.
-        if (!this._content || this._content.length > maxDataUrlSize)
+        if (this._content == null || this._content.length > maxDataUrlSize)
             return this.url;
 
         return "data:" + this.mimeType + (this._contentEncoded ? ";base64," : ",") + this._content;
@@ -719,7 +741,7 @@ WebInspector.Resource.prototype = {
             this._pendingContentCallbacks.length = 0;
             delete this._contentRequested;
         }
-        WebInspector.NetworkManager.requestContent(this, this._contentEncoded, onResourceContent.bind(this));
+        WebInspector.networkManager.requestContent(this, this._contentEncoded, onResourceContent.bind(this));
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/ResourceTreeModel.js b/Source/WebCore/inspector/front-end/ResourceTreeModel.js
index b114b94..da2d47a 100644
--- a/Source/WebCore/inspector/front-end/ResourceTreeModel.js
+++ b/Source/WebCore/inspector/front-end/ResourceTreeModel.js
@@ -31,16 +31,17 @@
 
 WebInspector.ResourceTreeModel = function()
 {
-    this.reloadCachedResources();
+    this.reset();
 }
 
 WebInspector.ResourceTreeModel.prototype = {
-    reloadCachedResources: function()
+    reset: function()
     {
         this._resourcesByURL = {};
         this._resourcesByFrameId = {};
         this._subframes = {};
-        InspectorBackend.cachedResources(this._processCachedResources.bind(this));
+        if (WebInspector.panels)
+            WebInspector.panels.resources.clear();
     },
 
     addOrUpdateFrame: function(frame)
@@ -81,6 +82,7 @@ WebInspector.ResourceTreeModel.prototype = {
             this._resourcesByFrameId[frameId] = resourcesForFrame;
         }
         resourcesForFrame.push(resource);
+        this._bindResourceURL(resource);
 
         WebInspector.panels.resources.addResourceToFrame(frameId, resource);
     },
@@ -128,7 +130,7 @@ WebInspector.ResourceTreeModel.prototype = {
         return entry;
     },
 
-    bindResourceURL: function(resource)
+    _bindResourceURL: function(resource)
     {
         var resourceForURL = this._resourcesByURL[resource.url];
         if (!resourceForURL)
@@ -168,7 +170,7 @@ WebInspector.ResourceTreeModel.prototype = {
                 preservedResourcesForFrame.push(resource);
                 continue;
             }
-            this.unbindResourceURL(resource);
+            this._unbindResourceURL(resource);
         }
 
         delete this._resourcesByFrameId[frameId];
@@ -194,7 +196,7 @@ WebInspector.ResourceTreeModel.prototype = {
         return false;
     },
 
-    unbindResourceURL: function(resource)
+    _unbindResourceURL: function(resource)
     {
         var resourceForURL = this._resourcesByURL[resource.url];
         if (!resourceForURL)
@@ -208,52 +210,5 @@ WebInspector.ResourceTreeModel.prototype = {
         }
 
         delete this._resourcesByURL[resource.url];
-    },
-
-    _processCachedResources: function(mainFramePayload)
-    {
-        var mainResource = this._addFramesRecursively(mainFramePayload);
-        WebInspector.mainResource = mainResource;
-        mainResource.isMainResource = true;
-    },
-
-    _addFramesRecursively: function(framePayload)
-    {
-        var frameResource = this.createResource(null, framePayload.resource.url, framePayload.resource.loader);
-        WebInspector.NetworkManager.updateResourceWithRequest(frameResource, framePayload.resource.request);
-        WebInspector.NetworkManager.updateResourceWithResponse(frameResource, framePayload.resource.response);
-        frameResource.type = WebInspector.Resource.Type["Document"];
-        frameResource.finished = true;
-
-        this.addOrUpdateFrame(framePayload);
-        this.addResourceToFrame(framePayload.id, frameResource);
-
-        for (var i = 0; framePayload.children && i < framePayload.children.length; ++i)
-            this._addFramesRecursively(framePayload.children[i]);
-
-        if (!framePayload.subresources)
-            return;
-
-        for (var i = 0; i < framePayload.subresources.length; ++i) {
-            var cachedResource = framePayload.subresources[i];
-            var resource = this.createResource(null, cachedResource.url, cachedResource.loader);
-            WebInspector.NetworkManager.updateResourceWithCachedResource(resource, cachedResource);
-            resource.finished = true;
-            this.addResourceToFrame(framePayload.id, resource);
-        }
-        return frameResource;
-    },
-
-    createResource: function(identifier, url, loader, stackTrace)
-    {
-        var resource = new WebInspector.Resource(identifier, url);
-        resource.loader = loader;
-        if (loader) {
-            resource.documentURL = loader.url;
-            this.bindResourceURL(resource);
-        }
-        resource.stackTrace = stackTrace;
-
-        return resource;
     }
 }
diff --git a/Source/WebCore/inspector/front-end/ResourceView.js b/Source/WebCore/inspector/front-end/ResourceView.js
index b69097d..e38cd0a 100644
--- a/Source/WebCore/inspector/front-end/ResourceView.js
+++ b/Source/WebCore/inspector/front-end/ResourceView.js
@@ -50,7 +50,11 @@ WebInspector.ResourceView.createResourceView = function(resource)
     case WebInspector.resourceCategories.stylesheets:
     case WebInspector.resourceCategories.scripts:
     case WebInspector.resourceCategories.xhr:
-        return new WebInspector.SourceView(resource);
+        var contentProvider = new WebInspector.SourceFrameContentProviderForResource(resource);
+        var isScript = resource.type === WebInspector.Resource.Type.Script;
+        var view = new WebInspector.SourceFrame(contentProvider, resource.url, isScript);
+        view.resource = resource;
+        return view;
     case WebInspector.resourceCategories.images:
         return new WebInspector.ImageView(resource);
     case WebInspector.resourceCategories.fonts:
@@ -68,7 +72,7 @@ WebInspector.ResourceView.resourceViewTypeMatchesResource = function(resource)
     case WebInspector.resourceCategories.stylesheets:
     case WebInspector.resourceCategories.scripts:
     case WebInspector.resourceCategories.xhr:
-        return resourceView.__proto__ === WebInspector.SourceView.prototype;
+        return resourceView.__proto__ === WebInspector.SourceFrame.prototype;
     case WebInspector.resourceCategories.images:
         return resourceView.__proto__ === WebInspector.ImageView.prototype;
     case WebInspector.resourceCategories.fonts:
@@ -105,7 +109,6 @@ WebInspector.ResourceView.recreateResourceView = function(resource)
     if (scrollTop)
         newView.scrollTop = scrollTop;
 
-    WebInspector.panels.scripts.viewRecreated(oldView, newView);
     return newView;
 }
 
@@ -115,3 +118,37 @@ WebInspector.ResourceView.existingResourceViewForResource = function(resource)
         return null;
     return resource._resourcesView;
 }
+
+
+WebInspector.SourceFrameContentProviderForResource = function(resource)
+{
+    WebInspector.SourceFrameContentProvider.call(this);
+    this._resource = resource;
+}
+
+//This is a map from resource.type to mime types
+//found in WebInspector.SourceTokenizer.Registry.
+WebInspector.SourceFrameContentProviderForResource.DefaultMIMETypeForResourceType = {
+    0: "text/html",
+    1: "text/css",
+    4: "text/javascript"
+}
+
+WebInspector.SourceFrameContentProviderForResource.prototype = {
+    requestContent: function(callback)
+    {
+        function contentLoaded(content)
+        {
+            var mimeType = WebInspector.SourceFrameContentProviderForResource.DefaultMIMETypeForResourceType[this._resource.type] || this._resource.mimeType;
+            callback(mimeType, content);
+        }
+        this._resource.requestContent(contentLoaded.bind(this));
+    },
+
+    scripts: function()
+    {
+        return WebInspector.debuggerModel.scriptsForURL(this._resource.url);
+    }
+}
+
+WebInspector.SourceFrameContentProviderForResource.prototype.__proto__ = WebInspector.SourceFrameContentProvider.prototype;
diff --git a/Source/WebCore/inspector/front-end/ResourcesPanel.js b/Source/WebCore/inspector/front-end/ResourcesPanel.js
index 7e1fcc0..7c0649f 100644
--- a/Source/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/Source/WebCore/inspector/front-end/ResourcesPanel.js
@@ -56,12 +56,6 @@ WebInspector.ResourcesPanel = function(database)
     this.applicationCacheListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Application Cache"), "ApplicationCache", "application-cache-storage-tree-item");
     this.sidebarTree.appendChild(this.applicationCacheListTreeElement);
 
-    if (Preferences.fileSystemEnabled) {
-        this.fileSystemListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("File System"), "FileSystem", "file-system-storage-tree-item");
-        this.sidebarTree.appendChild(this.fileSystemListTreeElement);
-        this.fileSystemListTreeElement.expand();
-    }
-
     this.storageViews = document.createElement("div");
     this.storageViews.id = "storage-views";
     this.storageViews.className = "diff-container";
@@ -102,9 +96,19 @@ WebInspector.ResourcesPanel.prototype = {
     {
         WebInspector.Panel.prototype.show.call(this);
 
-        if (this.visibleView instanceof WebInspector.ResourceView)
+        if (this.visibleView && this.visibleView.resource)
             this._showResourceView(this.visibleView.resource);
 
+        this._initDefaultSelection();
+    },
+
+    loadEventFired: function()
+    {
+        this._initDefaultSelection();
+    },
+
+    _initDefaultSelection: function()
+    {
         if (this._initializedDefaultSelection)
             return;
 
@@ -119,17 +123,14 @@ WebInspector.ResourcesPanel.prototype = {
                 }
             }
         }
-        this._initDefaultSelection();
-    },
 
-    _initDefaultSelection: function()
-    {
         if (WebInspector.mainResource && this.resourcesListTreeElement && this.resourcesListTreeElement.expanded)
             this.showResource(WebInspector.mainResource);
     },
 
     reset: function()
     {
+        delete this._initializedDefaultSelection;
         this._origins = {};
         this._domains = {};
         for (var i = 0; i < this._databases.length; ++i) {
@@ -147,7 +148,6 @@ WebInspector.ResourcesPanel.prototype = {
         this._domStorage = [];
 
         this._cookieViews = {};
-        this._fileSystemView = null;
         
         this._applicationCacheView = null;
         delete this._cachedApplicationCacheViewStatus;
@@ -157,8 +157,6 @@ WebInspector.ResourcesPanel.prototype = {
         this.sessionStorageListTreeElement.removeChildren();
         this.cookieListTreeElement.removeChildren();
         this.applicationCacheListTreeElement.removeChildren();
-        if (Preferences.fileSystemEnabled)
-            this.fileSystemListTreeElement.removeChildren();
         this.storageViews.removeChildren();
 
         this.storageViewStatusBarItemsContainer.removeChildren();
@@ -170,6 +168,7 @@ WebInspector.ResourcesPanel.prototype = {
     clear: function()
     {
         this.resourcesListTreeElement.removeChildren();
+        this._treeElementForFrameId = {};
         this.reset();
     },
 
@@ -291,16 +290,6 @@ WebInspector.ResourcesPanel.prototype = {
             var applicationCacheTreeElement = new WebInspector.ApplicationCacheTreeElement(this, domain);
             this.applicationCacheListTreeElement.appendChild(applicationCacheTreeElement);
         }
-
-        if (Preferences.fileSystemEnabled) {
-            // FIXME: This should match the SecurityOrigin::toString(), add a test for this.
-            var securityOrigin = parsedURL.scheme + "://" + parsedURL.host + (parsedURL.port ? (":" + parsedURL.port) : "");
-            if (!this._origins[securityOrigin]) {
-                this._origins[securityOrigin] = true;
-                var fileSystemTreeElement = new WebInspector.FileSystemTreeElement(this, securityOrigin);
-                this.fileSystemListTreeElement.appendChild(fileSystemTreeElement);
-            }
-        }
     },
 
     addDOMStorage: function(domStorage)
@@ -338,12 +327,12 @@ WebInspector.ResourcesPanel.prototype = {
 
     canShowSourceLine: function(url, line)
     {
-        return !!WebInspector.resourceTreeModel.resourceForURL(url);
+        return !!WebInspector.resourceForURL(url);
     },
 
     showSourceLine: function(url, line)
     {
-        var resource = WebInspector.resourceTreeModel.resourceForURL(url);
+        var resource = WebInspector.resourceForURL(url);
         if (resource.type === WebInspector.Resource.Type.XHR) {
             // Show XHRs in the network panel only.
             if (WebInspector.panels.network && WebInspector.panels.network.canShowSourceLine(url, line)) {
@@ -352,7 +341,7 @@ WebInspector.ResourcesPanel.prototype = {
             }
             return;
         }
-        this.showResource(WebInspector.resourceTreeModel.resourceForURL(url), line);
+        this.showResource(WebInspector.resourceForURL(url), line);
     },
 
     showResource: function(resource, line)
@@ -378,7 +367,7 @@ WebInspector.ResourcesPanel.prototype = {
         var view = WebInspector.ResourceView.resourceViewForResource(resource);
 
         // Consider rendering diff markup here.
-        if (resource.baseRevision && view instanceof WebInspector.SourceView) {
+        if (resource.baseRevision && view instanceof WebInspector.SourceFrame) {
             function callback(baseContent)
             {
                 if (baseContent)
@@ -413,7 +402,7 @@ WebInspector.ResourcesPanel.prototype = {
             } else
                 offset = i - right[i].row;
         }
-        view.sourceFrame.markDiff(diffData);
+        view.markDiff(diffData);
     },
 
     showDatabase: function(database, tableName)
@@ -481,12 +470,6 @@ WebInspector.ResourcesPanel.prototype = {
             this._applicationCacheView.updateStatus(this._cachedApplicationCacheViewStatus);
     },
 
-    showFileSystem: function(treeElement, origin)
-    {
-        this._fileSystemView = new WebInspector.FileSystemView(treeElement, origin);
-        this._innerShowView(this._fileSystemView);
-    },
-    
     showCategoryView: function(categoryName)
     {
         if (!this._categoryView)
@@ -635,24 +618,6 @@ WebInspector.ResourcesPanel.prototype = {
             this._applicationCacheView.updateStatus(status);
     },
 
-    updateFileSystemPath: function(root, type, origin)
-    {
-        if (this._fileSystemView && this._fileSystemView === this.visibleView)
-            this._fileSystemView.updateFileSystemPath(root, type, origin);  
-    },
-  
-    updateFileSystemError: function(type, origin)
-    {
-        if (this._fileSystemView && this._fileSystemView === this.visibleView)
-            this._fileSystemView.updateFileSystemError(type, origin);  
-    },
-    
-    setFileSystemDisabled: function()
-    {
-        if (this._fileSystemView && this._fileSystemView === this.visibleView)
-            this._fileSystemView.setFileSystemDisabled();  
-    },
-
     updateNetworkState: function(isNowOnline)
     {
         if (this._applicationCacheView && this._applicationCacheView === this.visibleView)
@@ -690,7 +655,7 @@ WebInspector.ResourcesPanel.prototype = {
         var views = [];
 
         const visibleView = this.visibleView;
-        if (visibleView instanceof WebInspector.ResourceView && visibleView.performSearch)
+        if (visibleView.performSearch)
             views.push(visibleView);
 
         function callback(resourceTreeElement)
@@ -1076,7 +1041,7 @@ WebInspector.FrameResourceTreeElement.prototype = {
 
     _errorsWarningsUpdated: function()
     {
-        // FIXME: move to the Script/SourceView.
+        // FIXME: move to the SourceFrame.
         if (!this._resource.warnings && !this._resource.errors) {
             var view = WebInspector.ResourceView.existingResourceViewForResource(this._resource);
             if (view && view.clearMessages)
@@ -1275,27 +1240,6 @@ WebInspector.ResourceRevisionTreeElement.prototype = {
 
 WebInspector.ResourceRevisionTreeElement.prototype.__proto__ = WebInspector.BaseStorageTreeElement.prototype;
 
-WebInspector.FileSystemTreeElement = function(storagePanel, origin)
-{
-    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, origin, "file-system-storage-tree-item");
-    this._origin = origin;
-}
-
-WebInspector.FileSystemTreeElement.prototype = {
-    get itemURL()
-    {
-        return "file-system://" + encodeURI(this._origin);
-    },
-
-    onselect: function()
-    {
-        WebInspector.BaseStorageTreeElement.prototype.onselect.call(this);
-        this._storagePanel.showFileSystem(this, this._origin);
-    }
-}
- 
-WebInspector.FileSystemTreeElement.prototype.__proto__ = WebInspector.BaseStorageTreeElement.prototype;
- 
 WebInspector.StorageCategoryView = function()
 {
     WebInspector.View.call(this);
diff --git a/Source/WebCore/inspector/front-end/ScopeChainSidebarPane.js b/Source/WebCore/inspector/front-end/ScopeChainSidebarPane.js
index d3190a9..bdbb0cf 100644
--- a/Source/WebCore/inspector/front-end/ScopeChainSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/ScopeChainSidebarPane.js
@@ -26,6 +26,8 @@
 WebInspector.ScopeChainSidebarPane = function()
 {
     WebInspector.SidebarPane.call(this, WebInspector.UIString("Scope Variables"));
+    this._sections = [];
+    this._expandedSections = {};
     this._expandedProperties = [];
 }
 
@@ -34,9 +36,6 @@ WebInspector.ScopeChainSidebarPane.prototype = {
     {
         this.bodyElement.removeChildren();
 
-        this.sections = [];
-        this.callFrame = callFrame;
-
         if (!callFrame) {
             var infoElement = document.createElement("div");
             infoElement.className = "info";
@@ -45,6 +44,18 @@ WebInspector.ScopeChainSidebarPane.prototype = {
             return;
         }
 
+        for (var i = 0; i < this._sections.length; ++i) {
+            var section = this._sections[i];
+            if (!section.title)
+                continue;
+            if (section.expanded)
+                this._expandedSections[section.title] = true;
+            else
+                delete this._expandedSections[section.title];
+        }
+
+        this._sections = [];
+
         var foundLocalScope = false;
         var scopeChain = callFrame.scopeChain;
         for (var i = 0; i < scopeChain.length; ++i) {
@@ -81,10 +92,10 @@ WebInspector.ScopeChainSidebarPane.prototype = {
             section.editInSelectedCallFrameWhenPaused = true;
             section.pane = this;
 
-            if (!foundLocalScope || scopeObjectProxy.isLocal)
+            if (!foundLocalScope || scopeObjectProxy.isLocal || title in this._expandedSections)
                 section.expanded = true;
 
-            this.sections.push(section);
+            this._sections.push(section);
             this.bodyElement.appendChild(section.element);
         }
     }
diff --git a/Source/WebCore/inspector/front-end/Script.js b/Source/WebCore/inspector/front-end/Script.js
index 6e3b18d..8d3eabf 100644
--- a/Source/WebCore/inspector/front-end/Script.js
+++ b/Source/WebCore/inspector/front-end/Script.js
@@ -78,7 +78,7 @@ WebInspector.Script.prototype = {
     {
         function extractSourceLine()
         {
-            lineNumber -= this.startingLine;
+            lineNumber -= this.lineOffset;
             callback(this._source.substring(this._lineEndings[lineNumber - 1], this._lineEndings[lineNumber]));
         }
 
diff --git a/Source/WebCore/inspector/front-end/ScriptFormatter.js b/Source/WebCore/inspector/front-end/ScriptFormatter.js
index 69ffb74..5c00e51 100644
--- a/Source/WebCore/inspector/front-end/ScriptFormatter.js
+++ b/Source/WebCore/inspector/front-end/ScriptFormatter.js
@@ -28,107 +28,117 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.ScriptFormatter = function(source)
+WebInspector.ScriptFormatter = function()
 {
-    this._originalSource = source;
-    this._originalLineEndings = source.findAll("\n");
-    this._originalLineEndings.push(source.length);
-}
-
-WebInspector.ScriptFormatter.locationToPosition = function(lineEndings, location)
-{
-    var position = location.line ? lineEndings[location.line - 1] + 1 : 0;
-    return position + location.column;
-}
-
-WebInspector.ScriptFormatter.positionToLocation = function(lineEndings, position)
-{
-    var location = {};
-    location.line = lineEndings.upperBound(position - 1);
-    if (!location.line)
-        location.column = position;
-    else
-        location.column = position - lineEndings[location.line - 1] - 1;
-    return location;
+    this._worker = new Worker("ScriptFormatterWorker.js");
+    this._worker.onmessage = this._handleMessage.bind(this);
+    this._worker.onerror = this._handleError.bind(this);
+    this._tasks = [];
 }
 
 WebInspector.ScriptFormatter.prototype = {
-    format: function(callback)
+    formatContent: function(content, callback)
     {
-        var worker = new Worker("scriptFormatterWorker.js");
-        function messageHandler(event)
+        var chunks = this._splitContentIntoChunks(content.text, content.scriptRanges);
+
+        function didFormatChunks()
         {
-            var formattedSource = event.data;
-            this._formatted = true;
-            this._formattedSource = formattedSource;
-            this._formattedLineEndings = formattedSource.findAll("\n");
-            this._formattedLineEndings.push(formattedSource.length);
-            this._buildMapping();
-            callback(formattedSource);
+            var result = this._buildContentFromChunks(chunks);
+            callback(new WebInspector.FormattedSourceFrameContent(content, result.text, result.mapping));
         }
-        worker.onmessage = messageHandler.bind(this);
-        worker.postMessage(this._originalSource);
+        this._formatChunks(chunks, 0, didFormatChunks.bind(this));
     },
 
-    _buildMapping: function()
+    _splitContentIntoChunks: function(text, scriptRanges)
     {
-        this._originalSymbolPositions = [];
-        this._formattedSymbolPositions = [];
-        var lastCodePosition = 0;
-        var regexp = /[\$\.\w]+|{|}|;/g;
-        while (true) {
-            var match = regexp.exec(this._formattedSource);
-            if (!match)
-                break;
-            var position = this._originalSource.indexOf(match[0], lastCodePosition);
-            if (position === -1)
-                continue;
-            this._originalSymbolPositions.push(position);
-            this._formattedSymbolPositions.push(match.index);
-            lastCodePosition = position + match[0].length;
+        var chunks = [];
+        function addChunk(start, end, isScript)
+        {
+            var chunk = {};
+            chunk.start = start;
+            chunk.end = end;
+            chunk.isScript = isScript;
+            chunk.text = text.substring(start, end);
+            chunks.push(chunk);
+        }
+        var currentPosition = 0;
+        for (var i = 0; i < scriptRanges.length; ++i) {
+            var scriptRange = scriptRanges[i];
+            if (currentPosition < scriptRange.start)
+                addChunk(currentPosition, scriptRange.start, false);
+            addChunk(scriptRange.start, scriptRange.end, true);
+            currentPosition = scriptRange.end;
         }
-        this._originalSymbolPositions.push(this._originalSource.length);
-        this._formattedSymbolPositions.push(this._formattedSource.length);
+        if (currentPosition < text.length)
+            addChunk(currentPosition, text.length, false);
+        return chunks;
     },
 
-    originalLineNumberToFormattedLineNumber: function(originalLineNumber)
+    _formatChunks: function(chunks, index, callback)
     {
-        if (!this._formatted)
-            return originalLineNumber;
-        var originalPosition = WebInspector.ScriptFormatter.locationToPosition(this._originalLineEndings, { line: originalLineNumber, column: 0 });
-        return this.originalPositionToFormattedLineNumber(originalPosition);
+        while(true) {
+            if (index === chunks.length) {
+                callback();
+                return;
+            }
+            var chunk = chunks[index++];
+            if (chunk.isScript)
+                break;
+        }
+
+        function didFormat(formattedSource, mapping)
+        {
+            chunk.text = formattedSource;
+            chunk.mapping = mapping;
+            this._formatChunks(chunks, index, callback);
+        }
+        this._formatScript(chunk.text, didFormat.bind(this));
     },
 
-    formattedLineNumberToOriginalLineNumber: function(formattedLineNumber)
+    _buildContentFromChunks: function(chunks)
     {
-        if (!this._formatted)
-            return formattedLineNumber;
-        var originalPosition = this.formattedLineNumberToOriginalPosition(formattedLineNumber);
-        return WebInspector.ScriptFormatter.positionToLocation(this._originalLineEndings, originalPosition).line;
+        var text = "";
+        var mapping = { original: [], formatted: [] };
+        for (var i = 0; i < chunks.length; ++i) {
+            var chunk = chunks[i];
+            mapping.original.push(chunk.start);
+            mapping.formatted.push(text.length);
+            if (chunk.isScript) {
+                if (text)
+                    text += "\n";
+                for (var j = 0; j < chunk.mapping.original.length; ++j) {
+                    mapping.original.push(chunk.mapping.original[j] + chunk.start);
+                    mapping.formatted.push(chunk.mapping.formatted[j] + text.length);
+                }
+                text += chunk.text;
+            } else {
+                if (text)
+                    text += "\n";
+                text += chunk.text;
+            }
+            mapping.original.push(chunk.end);
+            mapping.formatted.push(text.length);
+        }
+        return { text: text, mapping: mapping };
     },
 
-    originalPositionToFormattedLineNumber: function(originalPosition)
+    _formatScript: function(source, callback)
     {
-        var lineEndings = this._formatted ? this._formattedLineEndings : this._originalLineEndings;
-        if (this._formatted)
-            formattedPosition = this._convertPosition(this._originalSymbolPositions, this._formattedSymbolPositions, originalPosition);
-        return WebInspector.ScriptFormatter.positionToLocation(lineEndings, formattedPosition).line;
+        this._tasks.push({ source: source, callback: callback });
+        this._worker.postMessage(source);
     },
 
-    formattedLineNumberToOriginalPosition: function(formattedLineNumber)
+    _handleMessage: function(event)
     {
-        var lineEndings = this._formatted ? this._formattedLineEndings : this._originalLineEndings;
-        var formattedPosition = WebInspector.ScriptFormatter.locationToPosition(lineEndings, { line: formattedLineNumber, column: 0 });
-        if (!this._formatted)
-            return formattedPosition;
-        return this._convertPosition(this._formattedSymbolPositions, this._originalSymbolPositions, formattedPosition);
+        var task = this._tasks.shift();
+        task.callback(event.data.formattedSource, event.data.mapping);
     },
 
-    _convertPosition: function(symbolPositions1, symbolPositions2, position)
+    _handleError: function(event)
     {
-        var index = symbolPositions1.upperBound(position);
-        if (index === symbolPositions2.length - 1)
-            return symbolPositions2[index] - 1;
-        return symbolPositions2[index];
+        console.warn("Error in script formatter worker:", event);
+        event.preventDefault()
+        var task = this._tasks.shift();
+        task.callback(task.source, { original: [], formatted: [] });
     }
 }
diff --git a/Source/WebCore/inspector/front-end/ScriptFormatterWorker.js b/Source/WebCore/inspector/front-end/ScriptFormatterWorker.js
index e900317..1a4c28e 100644
--- a/Source/WebCore/inspector/front-end/ScriptFormatterWorker.js
+++ b/Source/WebCore/inspector/front-end/ScriptFormatterWorker.js
@@ -32,7 +32,10 @@ var parse = loadModule("parse-js.js");
 var process = loadModule("process.js");
 
 onmessage = function(event) {
-    postMessage(beautify(event.data));
+    var source = event.data;
+    var formattedSource = beautify(source);
+    var mapping = buildMapping(source, formattedSource);
+    postMessage({ formattedSource: formattedSource, mapping: mapping });
 };
 
 function beautify(source)
@@ -47,6 +50,25 @@ function beautify(source)
     return process.gen_code(ast, beautifyOptions);
 }
 
+function buildMapping(source, formattedSource)
+{
+    var mapping = { original: [], formatted: [] };
+    var lastCodePosition = 0;
+    var regexp = /[\$\.\w]+|{|}/g;
+    while (true) {
+        var match = regexp.exec(formattedSource);
+        if (!match)
+            break;
+        var position = source.indexOf(match[0], lastCodePosition);
+        if (position === -1)
+            continue;
+        mapping.original.push(position);
+        mapping.formatted.push(match.index);
+        lastCodePosition = position + match[0].length;
+    }
+    return mapping;
+}
+
 function loadModule(src)
 {
     var request = new XMLHttpRequest();
diff --git a/Source/WebCore/inspector/front-end/ScriptView.js b/Source/WebCore/inspector/front-end/ScriptView.js
deleted file mode 100644
index f631fcc..0000000
--- a/Source/WebCore/inspector/front-end/ScriptView.js
+++ /dev/null
@@ -1,96 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-WebInspector.ScriptView = function(script)
-{
-    WebInspector.View.call(this);
-
-    this.element.addStyleClass("script-view");
-
-    var contentProvider = new WebInspector.SourceFrameContentProviderForScript(script);
-    this.sourceFrame = new WebInspector.SourceFrame(this.element, contentProvider, "", true);
-}
-
-WebInspector.ScriptView.prototype = {
-    // The following methods are pulled from SourceView, since they are
-    // generic and work with ScriptView just fine.
-
-    show: WebInspector.SourceView.prototype.show,
-    hide: WebInspector.SourceView.prototype.hide,
-    revealLine: WebInspector.SourceView.prototype.revealLine,
-    highlightLine: WebInspector.SourceView.prototype.highlightLine,
-    addMessage: WebInspector.SourceView.prototype.addMessage,
-    clearMessages: WebInspector.SourceView.prototype.clearMessages,
-    searchCanceled: WebInspector.SourceView.prototype.searchCanceled,
-    performSearch: WebInspector.SourceView.prototype.performSearch,
-    jumpToFirstSearchResult: WebInspector.SourceView.prototype.jumpToFirstSearchResult,
-    jumpToLastSearchResult: WebInspector.SourceView.prototype.jumpToLastSearchResult,
-    jumpToNextSearchResult: WebInspector.SourceView.prototype.jumpToNextSearchResult,
-    jumpToPreviousSearchResult: WebInspector.SourceView.prototype.jumpToPreviousSearchResult,
-    showingFirstSearchResult: WebInspector.SourceView.prototype.showingFirstSearchResult,
-    showingLastSearchResult: WebInspector.SourceView.prototype.showingLastSearchResult,
-    _jumpToSearchResult: WebInspector.SourceView.prototype._jumpToSearchResult,
-    resize: WebInspector.SourceView.prototype.resize
-}
-
-WebInspector.ScriptView.prototype.__proto__ = WebInspector.View.prototype;
-
-
-WebInspector.SourceFrameContentProviderForScript = function(script)
-{
-    WebInspector.SourceFrameContentProvider.call(this);
-    this._script = script;
-}
-
-WebInspector.SourceFrameContentProviderForScript.prototype = {
-    requestContent: function(callback)
-    {
-        if (this._script.source) {
-            callback("text/javascript", this._script.source);
-            return;
-        }
-
-        function didRequestSource(content)
-        {
-            var source;
-            if (content) {
-                var prefix = "";
-                for (var i = 0; i < this._script.startingLine - 1; ++i)
-                    prefix += "\n";
-                source = prefix + content;
-            } else
-                source = WebInspector.UIString("<source is not available>");
-            callback("text/javascript", source);
-        }
-        this._script.requestSource(didRequestSource.bind(this));
-    },
-
-    scripts: function()
-    {
-        return [this._script];
-    }
-}
-
-WebInspector.SourceFrameContentProviderForScript.prototype.__proto__ = WebInspector.SourceFrameContentProvider.prototype;
diff --git a/Source/WebCore/inspector/front-end/ScriptsPanel.js b/Source/WebCore/inspector/front-end/ScriptsPanel.js
index a74f80d..264291f 100644
--- a/Source/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/Source/WebCore/inspector/front-end/ScriptsPanel.js
@@ -242,9 +242,7 @@ WebInspector.ScriptsPanel.prototype = {
 
     _parsedScriptSource: function(event)
     {
-        var sourceID = event.data;
-        var script = WebInspector.debuggerModel.scriptForSourceID(sourceID);
-        this._addScript(script);
+        this._addScript(event.data);
     },
 
     _failedToParseScriptSource: function(event)
@@ -257,16 +255,23 @@ WebInspector.ScriptsPanel.prototype = {
         var sourceID = event.data.sourceID;
         var oldSource = event.data.oldSource;
 
+        var oldView, newView;
         var script = WebInspector.debuggerModel.scriptForSourceID(sourceID);
-        var oldView = script._scriptView;
-        if (oldView) {
-            script._scriptView = new WebInspector.ScriptView(script);
-            this.viewRecreated(oldView, script._scriptView);
-        }
         if (script.resource) {
+            oldView = this._urlToSourceFrame[script.resource.url];
+            delete this._urlToSourceFrame[script.resource.url];
+            newView = this._sourceFrameForResource(script.resource);
             var revertHandle = WebInspector.debuggerModel.editScriptSource.bind(WebInspector.debuggerModel, sourceID, oldSource);
             script.resource.setContent(script.source, revertHandle);
+        } else {
+            var oldView = script._sourceFrame;
+            delete script._sourceFrame;
+            newView = this._sourceFrameForScript(script);
         }
+        newView.scrollTop = oldView.scrollTop;
+
+        if (this.visibleView === oldView)
+            this.visibleView = newView;
 
         var callFrames = WebInspector.debuggerModel.callFrames;
         if (callFrames.length)
@@ -275,7 +280,7 @@ WebInspector.ScriptsPanel.prototype = {
 
     _addScript: function(script)
     {
-        var resource = WebInspector.resourceForURL(script.sourceURL);
+        var resource = WebInspector.networkManager.inflightResourceForURL(script.sourceURL) || WebInspector.resourceForURL(script.sourceURL);
         if (resource) {
             if (resource.finished) {
                 // Resource is finished, bind the script right away.
@@ -295,17 +300,41 @@ WebInspector.ScriptsPanel.prototype = {
     _resourceLoadingFinished: function(e)
     {
         var resource = e.target;
+
+        var visible = false;
+        var select = this.filesSelectElement;
         for (var i = 0; i < resource._scriptsPendingResourceLoad.length; ++i) {
             // Bind script to resource.
             var script = resource._scriptsPendingResourceLoad[i];
             script.resource = resource;
 
+            if (select.options[select.selectedIndex] === script.filesSelectOption)
+                visible = true;
+
             // Remove script from the files list.
             script.filesSelectOption.parentElement.removeChild(script.filesSelectOption);
         }
         // Adding first script will add resource.
         this._addScriptToFilesMenu(resource._scriptsPendingResourceLoad[0]);
         delete resource._scriptsPendingResourceLoad;
+
+        if (visible)
+            this._showScriptOrResource(resource, { initialLoad: true });
+    },
+
+    addConsoleMessage: function(message)
+    {
+        this._messages.push(message);
+        var sourceFrame = this._urlToSourceFrame[message.url];
+        if (sourceFrame)
+            sourceFrame.addMessage(message);
+    },
+
+    clearConsoleMessages: function()
+    {
+        this._messages = [];
+        for (var url in this._urlToSourceFrame)
+            this._urlToSourceFrame[url].clearMessages();
     },
 
     selectedCallFrameId: function()
@@ -316,7 +345,7 @@ WebInspector.ScriptsPanel.prototype = {
         return selectedCallFrame.id;
     },
 
-    evaluateInSelectedCallFrame: function(code, updateInterface, objectGroup, callback)
+    evaluateInSelectedCallFrame: function(code, updateInterface, objectGroup, includeCommandLineAPI, callback)
     {
         var selectedCallFrame = this.sidebarPanes.callstack.selectedCallFrame;
         if (!this._paused || !selectedCallFrame)
@@ -325,24 +354,15 @@ WebInspector.ScriptsPanel.prototype = {
         if (typeof updateInterface === "undefined")
             updateInterface = true;
 
-        var self = this;
         function updatingCallbackWrapper(result)
         {
-            callback(result);
-            if (updateInterface)
-                self.sidebarPanes.scopechain.update(selectedCallFrame);
-        }
-        this.doEvalInCallFrame(selectedCallFrame, code, objectGroup, updatingCallbackWrapper);
-    },
-
-    doEvalInCallFrame: function(callFrame, code, objectGroup, callback)
-    {
-        function evalCallback(result)
-        {
-            if (result)
+            if (result) {
                 callback(WebInspector.RemoteObject.fromPayload(result));
+                if (updateInterface)
+                    this.sidebarPanes.scopechain.update(selectedCallFrame);
+            }
         }
-        InspectorBackend.evaluateOnCallFrame(callFrame.id, code, objectGroup, evalCallback);
+        InspectorBackend.evaluateOnCallFrame(selectedCallFrame.id, code, objectGroup, includeCommandLineAPI, updatingCallbackWrapper.bind(this));
     },
 
     _debuggerPaused: function(event)
@@ -405,6 +425,8 @@ WebInspector.ScriptsPanel.prototype = {
         this._currentBackForwardIndex = -1;
         this._updateBackAndForwardButtons();
 
+        this._urlToSourceFrame = {};
+        this._messages = [];
         this._resourceForURLInFilesSelect = {};
         this.filesSelectElement.removeChildren();
         this.functionsSelectElement.removeChildren();
@@ -434,12 +456,6 @@ WebInspector.ScriptsPanel.prototype = {
             x.show(this.viewsContainerElement);
     },
 
-    viewRecreated: function(oldView, newView)
-    {
-        if (this.visibleView === oldView)
-            this.visibleView = newView;
-    },
-
     canShowSourceLine: function(url, line)
     {
         if (!this._debuggerEnabled)
@@ -484,43 +500,37 @@ WebInspector.ScriptsPanel.prototype = {
             this.sidebarPanes.callstack.handleShortcut(event);
     },
 
-    scriptViewForScript: function(script)
-    {
-        if (!script)
-            return null;
-        if (!script._scriptView)
-            script._scriptView = new WebInspector.ScriptView(script);
-        return script._scriptView;
-    },
-
-    sourceFrameForScript: function(script)
-    {
-        var view = this.scriptViewForScript(script);
-        if (!view)
-            return null;
-
-        // Setting up the source frame requires that we be attached.
-        if (!this.element.parentNode)
-            this.attach();
-
-        return view.sourceFrame;
-    },
-
     _sourceFrameForScriptOrResource: function(scriptOrResource)
     {
         if (scriptOrResource instanceof WebInspector.Resource)
             return this._sourceFrameForResource(scriptOrResource);
-        if (scriptOrResource instanceof WebInspector.Script)
-            return this.sourceFrameForScript(scriptOrResource);
+        return this._sourceFrameForScript(scriptOrResource);
     },
 
     _sourceFrameForResource: function(resource)
     {
-        var view = WebInspector.ResourceView.resourceViewForResource(resource);
-        if (!view)
-            return null;
+        var sourceFrame = this._urlToSourceFrame[resource.url];
+        if (sourceFrame)
+            return sourceFrame;
+        var contentProvider = new WebInspector.SourceFrameContentProviderForResource(resource);
+        var isScript = resource.type === WebInspector.Resource.Type.Script;
+        sourceFrame = new WebInspector.SourceFrame(contentProvider, resource.url, isScript);
+        for (var i = 0; i < this._messages.length; ++i) {
+            var message = this._messages[i];
+            if (this._messages[i].url === resource.url)
+                sourceFrame.addMessage(message);
+        }
+        this._urlToSourceFrame[resource.url] = sourceFrame;
+        return sourceFrame;
+    },
 
-        return view.sourceFrame;
+    _sourceFrameForScript: function(script)
+    {
+        if (script._sourceFrame)
+            return script._sourceFrame;
+        var contentProvider = new WebInspector.SourceFrameContentProviderForScript(script);
+        script._sourceFrame = new WebInspector.SourceFrame(contentProvider, script.sourceURL, true);
+        return script._sourceFrame;
     },
 
     _showScriptOrResource: function(scriptOrResource, options)
@@ -531,12 +541,7 @@ WebInspector.ScriptsPanel.prototype = {
         if (!scriptOrResource)
             return;
 
-        var view;
-        if (scriptOrResource instanceof WebInspector.Resource)
-            view = WebInspector.ResourceView.resourceViewForResource(scriptOrResource);
-        else if (scriptOrResource instanceof WebInspector.Script)
-            view = this.scriptViewForScript(scriptOrResource);
-
+        var view = this._sourceFrameForScriptOrResource(scriptOrResource);
         if (!view)
             return;
 
@@ -738,7 +743,7 @@ WebInspector.ScriptsPanel.prototype = {
                 this._pauseOnExceptionButton.title = WebInspector.UIString("Pause on all exceptions.\nClick to Pause on uncaught exceptions.");
             else if (pauseOnExceptionsState == WebInspector.ScriptsPanel.PauseOnExceptionsState.PauseOnUncaughtExceptions)
                 this._pauseOnExceptionButton.title = WebInspector.UIString("Pause on uncaught exceptions.\nClick to Not pause on exceptions.");
-    
+
             this._pauseOnExceptionButton.state = pauseOnExceptionsState;
             WebInspector.settings.pauseOnExceptionState = pauseOnExceptionsState;
         }
@@ -824,8 +829,8 @@ WebInspector.ScriptsPanel.prototype = {
 
     _formatScript: function()
     {
-        if (this.visibleView && this.visibleView.sourceFrame)
-            this.visibleView.sourceFrame.formatSource();
+        if (this.visibleView)
+            this.visibleView.formatSource();
     },
 
     _enableDebugging: function()
@@ -841,10 +846,13 @@ WebInspector.ScriptsPanel.prototype = {
         this._waitingToPause = false;
         this._stepping = false;
 
-        if (this._debuggerEnabled)
-            InspectorBackend.disableDebugger(true);
-        else
-            InspectorBackend.enableDebugger(!!optionalAlways);
+        if (this._debuggerEnabled) {
+            WebInspector.settings.debuggerEnabled = false;
+            WebInspector.debuggerModel.disableDebugger();
+        } else {
+            WebInspector.settings.debuggerEnabled = !!optionalAlways;
+            WebInspector.debuggerModel.enableDebugger();
+        }
     },
 
     _togglePauseOnExceptions: function()
@@ -1043,3 +1051,41 @@ WebInspector.ScriptsPanel.prototype = {
 }
 
 WebInspector.ScriptsPanel.prototype.__proto__ = WebInspector.Panel.prototype;
+
+
+WebInspector.SourceFrameContentProviderForScript = function(script)
+{
+    WebInspector.SourceFrameContentProvider.call(this);
+    this._script = script;
+}
+
+WebInspector.SourceFrameContentProviderForScript.prototype = {
+    requestContent: function(callback)
+    {
+        if (this._script.source) {
+            callback("text/javascript", this._script.source);
+            return;
+        }
+
+        function didRequestSource(content)
+        {
+            var source;
+            if (content) {
+                var prefix = "";
+                for (var i = 0; i < this._script.startingLine - 1; ++i)
+                    prefix += "\n";
+                source = prefix + content;
+            } else
+                source = WebInspector.UIString("<source is not available>");
+            callback("text/javascript", source);
+        }
+        this._script.requestSource(didRequestSource.bind(this));
+    },
+
+    scripts: function()
+    {
+        return [this._script];
+    }
+}
+
+WebInspector.SourceFrameContentProviderForScript.prototype.__proto__ = WebInspector.SourceFrameContentProvider.prototype;
diff --git a/Source/WebCore/inspector/front-end/Settings.js b/Source/WebCore/inspector/front-end/Settings.js
index e26b1d7..68b81a5 100644
--- a/Source/WebCore/inspector/front-end/Settings.js
+++ b/Source/WebCore/inspector/front-end/Settings.js
@@ -45,29 +45,33 @@ var Preferences = {
     onlineDetectionEnabled: true,
     nativeInstrumentationEnabled: false,
     resourceExportEnabled: false,
-    fileSystemEnabled: false,
     useDataURLForResourceImageIcons: true,
     showTimingTab: false,
     showCookiesTab: false,
-    debugMode: false
+    debugMode: false,
+    heapProfilerPresent: false,
+    detailedHeapProfiles: false
 }
 
 WebInspector.Settings = function()
 {
     this.installApplicationSetting("colorFormat", "hex");
     this.installApplicationSetting("consoleHistory", []);
+    this.installApplicationSetting("debuggerEnabled", false);
+    this.installApplicationSetting("profilerEnabled", false);
     this.installApplicationSetting("eventListenersFilter", "all");
+    this.installApplicationSetting("lastActivePanel", "elements");
     this.installApplicationSetting("lastViewedScriptFile", "application");
+    this.installApplicationSetting("monitoringXHREnabled", false);
+    this.installApplicationSetting("pauseOnExceptionState", WebInspector.ScriptsPanel.PauseOnExceptionsState.DontPauseOnExceptions);
     this.installApplicationSetting("resourcesLargeRows", true);
     this.installApplicationSetting("resourcesSortOptions", {timeOption: "responseTime", sizeOption: "transferSize"});
     this.installApplicationSetting("resourceViewTab", "content");
     this.installApplicationSetting("showInheritedComputedStyleProperties", false);
     this.installApplicationSetting("showUserAgentStyles", true);
     this.installApplicationSetting("watchExpressions", []);
-    this.installApplicationSetting("lastActivePanel", "elements");
-    this.installApplicationSetting("pauseOnExceptionState", WebInspector.ScriptsPanel.PauseOnExceptionsState.DontPauseOnExceptions);
+    this.installApplicationSetting("breakpoints", []);
 
-    this.installProjectSetting("breakpoints", {});
     this.installProjectSetting("nativeBreakpoints", []);
 }
 
diff --git a/Source/WebCore/inspector/front-end/ShowMoreDataGridNode.js b/Source/WebCore/inspector/front-end/ShowMoreDataGridNode.js
new file mode 100644
index 0000000..4fe2fef
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/ShowMoreDataGridNode.js
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.ShowMoreDataGridNode = function(callback, nextCount, allCount)
+{
+    function populate(count)
+    {
+        var index = this.parent.children.indexOf(this);
+        this.parent.removeChild(this);
+        callback(count, index);
+    }
+
+    this.showNext = document.createElement("button");
+    this.showNext.setAttribute("type", "button");
+    this.showNext.textContent = WebInspector.UIString("Show next %d", nextCount);
+    this.showNext.addEventListener("click", populate.bind(this, nextCount), false);
+
+    if (allCount) {
+        this.showAll = document.createElement("button");
+        this.showAll.setAttribute("type", "button");
+        this.showAll.textContent = WebInspector.UIString("Show all %d", allCount);
+        this.showAll.addEventListener("click", populate.bind(this, allCount), false);
+    }
+
+    WebInspector.DataGridNode.call(this, {summaryRow:true}, false);
+    this.selectable = false;
+}
+
+WebInspector.ShowMoreDataGridNode.prototype = {
+    createCells: function()
+    {
+        var cell = document.createElement("td");
+        if (this.depth)
+            cell.style.setProperty("padding-left", (this.depth * this.dataGrid.indentWidth) + "px");
+        cell.appendChild(this.showNext);
+        if (this.showAll)
+            cell.appendChild(this.showAll);
+        this._element.appendChild(cell);
+
+        var columns = this.dataGrid.columns;
+        var count = 0;
+        for (var c in columns)
+            ++count;
+        while (--count > 0) {
+            cell = document.createElement("td");
+            this._element.appendChild(cell);
+        }
+    }
+};
+
+WebInspector.ShowMoreDataGridNode.prototype.__proto__ = WebInspector.DataGridNode.prototype;
diff --git a/Source/WebCore/inspector/front-end/SidebarTreeElement.js b/Source/WebCore/inspector/front-end/SidebarTreeElement.js
index c08b0ef..a27c457 100644
--- a/Source/WebCore/inspector/front-end/SidebarTreeElement.js
+++ b/Source/WebCore/inspector/front-end/SidebarTreeElement.js
@@ -164,8 +164,10 @@ WebInspector.SidebarTreeElement.prototype = {
             if (this.subtitleElement.textContent !== subtitle)
                 this.subtitleElement.textContent = subtitle;
             this.titlesElement.removeStyleClass("no-subtitle");
-        } else
+        } else {
+            this.subtitleElement.textContent = "";
             this.titlesElement.addStyleClass("no-subtitle");
+        }
     },
 
     isEventWithinDisclosureTriangle: function(event)
diff --git a/Source/WebCore/inspector/front-end/SourceFrame.js b/Source/WebCore/inspector/front-end/SourceFrame.js
index eb89f24..f2e0be1 100644
--- a/Source/WebCore/inspector/front-end/SourceFrame.js
+++ b/Source/WebCore/inspector/front-end/SourceFrame.js
@@ -28,17 +28,22 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.SourceFrame = function(parentElement, contentProvider, url, isScript)
+WebInspector.SourceFrame = function(contentProvider, url, isScript)
 {
-    this._parentElement = parentElement;
+    WebInspector.View.call(this);
+
+    this.element.addStyleClass("script-view");
+
     this._contentProvider = contentProvider;
     this._url = url;
     this._isScript = isScript;
 
-
     this._textModel = new WebInspector.TextEditorModel();
     this._textModel.replaceTabsWithSpaces = true;
 
+    this._currentSearchResultIndex = -1;
+    this._searchResults = [];
+
     this._messages = [];
     this._rowMessages = {};
     this._messageBubbles = {};
@@ -48,28 +53,41 @@ WebInspector.SourceFrame = function(parentElement, contentProvider, url, isScrip
 
 WebInspector.SourceFrame.prototype = {
 
-    set visible(visible)
+    show: function(parentElement)
     {
+        WebInspector.View.prototype.show.call(this, parentElement);
+
         if (!this._contentRequested) {
             this._contentRequested = true;
             this._contentProvider.requestContent(this._createTextViewer.bind(this));
         }
 
-        if (visible) {
-            if (this._textViewer && this._scrollTop)
-                this._textViewer.element.scrollTop = this._scrollTop;
-            if (this._textViewer && this._scrollLeft)
-                this._textViewer.element.scrollLeft = this._scrollLeft;
-            if (this._textViewer)
-                this._textViewer.resize();
-        } else {
-            this._hidePopup();
-            if (this._textViewer) {
-                this._scrollTop = this._textViewer.element.scrollTop;
-                this._scrollLeft = this._textViewer.element.scrollLeft;
-                this._textViewer.freeCachedElements();
-            }
+        if (this._textViewer) {
+            if (this._scrollTop)
+                this._textViewer.scrollTop = this._scrollTop;
+            if (this._scrollLeft)
+                this._textViewer.scrollLeft = this._scrollLeft;
+            this._textViewer.resize();
+        }
+    },
+
+    hide: function()
+    {
+        if (this._textViewer) {
+            this._scrollTop = this._textViewer.scrollTop;
+            this._scrollLeft = this._textViewer.scrollLeft;
+            this._textViewer.freeCachedElements();
         }
+
+        WebInspector.View.prototype.hide.call(this);
+
+        this._hidePopup();
+        this._clearLineHighlight();
+    },
+
+    hasContent: function()
+    {
+        return true;
     },
 
     markDiff: function(diffData)
@@ -95,7 +113,7 @@ WebInspector.SourceFrame.prototype = {
         // Don't add the message if there is no message or valid line or if the msg isn't an error or warning.
         if (!msg.message || msg.line <= 0 || !msg.isErrorOrWarning())
             return;
-        this._messages.push(msg)
+        this._messages.push(msg);
         if (this._textViewer)
             this._addMessageToSource(msg);
     },
@@ -127,13 +145,14 @@ WebInspector.SourceFrame.prototype = {
 
     get scrollTop()
     {
-        return this._textViewer ? this._textViewer.element.scrollTop : 0;
+        return this._textViewer ? this._textViewer.scrollTop : this._scrollTop;
     },
 
     set scrollTop(scrollTop)
     {
+        this._scrollTop = scrollTop;
         if (this._textViewer)
-            this._textViewer.element.scrollTop = scrollTop;
+            this._textViewer.scrollTop = scrollTop;
     },
 
     highlightLine: function(line)
@@ -144,7 +163,7 @@ WebInspector.SourceFrame.prototype = {
             this._lineToHighlight = line;
     },
 
-    clearLineHighlight: function()
+    _clearLineHighlight: function()
     {
         if (this._textViewer)
             this._textViewer.clearLineHighlight();
@@ -152,11 +171,10 @@ WebInspector.SourceFrame.prototype = {
             delete this._lineToHighlight;
     },
 
-    _createTextViewer: function(mimeType, content)
+    _createTextViewer: function(mimeType, text)
     {
-        this._content = content;
-        this._textModel.setText(null, content);
-        this._formatter = new WebInspector.ScriptFormatter(content);
+        this._content = new WebInspector.SourceFrameContent(text, this._contentProvider.scripts());
+        this._textModel.setText(null, text);
 
         this._textViewer = new WebInspector.TextViewer(this._textModel, WebInspector.platform, this._url);
         var element = this._textViewer.element;
@@ -165,7 +183,7 @@ WebInspector.SourceFrame.prototype = {
         element.addEventListener("mousemove", this._mouseMove.bind(this), true);
         element.addEventListener("scroll", this._scroll.bind(this), true);
         element.addEventListener("dblclick", this._doubleClick.bind(this), true);
-        this._parentElement.appendChild(element);
+        this.element.appendChild(element);
 
         this._textViewer.beginUpdates();
 
@@ -177,12 +195,6 @@ WebInspector.SourceFrame.prototype = {
             delete this._lineNumberToReveal;
         }
 
-        if (this._pendingMarkRange) {
-            var range = this._pendingMarkRange;
-            this.markAndRevealRange(range);
-            delete this._pendingMarkRange;
-        }
-
         if (this._lineToHighlight) {
             this.highlightLine(this._lineToHighlight);
             delete this._lineToHighlight;
@@ -196,9 +208,8 @@ WebInspector.SourceFrame.prototype = {
         this._textViewer.endUpdates();
 
         WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointAdded, this._breakpointAdded, this);
-
-        if (this._canEditScripts)
-            this._textViewer.editCallback = this._editLine.bind(this);
+        WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointRemoved, this._breakpointRemoved, this);
+        WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointResolved, this._breakpointResolved, this);
     },
 
     _setTextViewerDecorations: function()
@@ -214,44 +225,108 @@ WebInspector.SourceFrame.prototype = {
         if (this._executionLine)
             this.setExecutionLine(this._executionLine);
 
-        var breakpoints = this._breakpoints();
-        for (var i = 0; i < breakpoints.length; ++i)
-            this._addBreakpoint(breakpoints[i]);
+        this._breakpointIdToTextViewerLineNumber = {};
+        this._textViewerLineNumberToBreakpointId = {};
+        var breakpoints = WebInspector.debuggerModel.breakpoints;
+        for (var id in breakpoints)
+            this._breakpointAdded({ data: breakpoints[id] });
 
         this._textViewer.resize();
 
         this._textViewer.endUpdates();
     },
 
-    findSearchMatches: function(query, finishedCallback)
+    _shouldDisplayBreakpoint: function(breakpoint)
     {
-        function doFindSearchMatches()
+        if (this._url)
+            return this._url === breakpoint.url;
+        var scripts = this._contentProvider.scripts();
+        for (var i = 0; i < scripts.length; ++i) {
+            if (breakpoint.sourceID === scripts[i].sourceID)
+                return true;
+        }
+        return false;
+    },
+
+    performSearch: function(query, callback)
+    {
+        // Call searchCanceled since it will reset everything we need before doing a new search.
+        this.searchCanceled();
+
+        function doFindSearchMatches(query)
         {
-            var ranges = [];
+            this._currentSearchResultIndex = -1;
+            this._searchResults = [];
 
             // First do case-insensitive search.
             var regexObject = createSearchRegex(query);
-            this._collectRegexMatches(regexObject, ranges);
+            this._collectRegexMatches(regexObject, this._searchResults);
 
             // Then try regex search if user knows the / / hint.
             try {
                 if (/^\/.*\/$/.test(query))
-                    this._collectRegexMatches(new RegExp(query.substring(1, query.length - 1)), ranges);
+                    this._collectRegexMatches(new RegExp(query.substring(1, query.length - 1)), this._searchResults);
             } catch (e) {
                 // Silent catch.
             }
-            finishedCallback(ranges);
+
+            callback(this, this._searchResults.length);
         }
 
         if (this._textViewer)
-            doFindSearchMatches.call(this);
+            doFindSearchMatches.call(this, query);
         else
-            this._delayedFindSearchMatches = doFindSearchMatches.bind(this);
+            this._delayedFindSearchMatches = doFindSearchMatches.bind(this, query);
+
     },
 
-    cancelFindSearchMatches: function()
+    searchCanceled: function()
     {
         delete this._delayedFindSearchMatches;
+        if (!this._textViewer)
+            return;
+
+        this._currentSearchResultIndex = -1;
+        this._searchResults = [];
+        this._textViewer.markAndRevealRange(null);
+    },
+
+    jumpToFirstSearchResult: function()
+    {
+        this._jumpToSearchResult(0);
+    },
+
+    jumpToLastSearchResult: function()
+    {
+        this._jumpToSearchResult(this._searchResults.length - 1);
+    },
+
+    jumpToNextSearchResult: function()
+    {
+        this._jumpToSearchResult(this._currentSearchResultIndex + 1);
+    },
+
+    jumpToPreviousSearchResult: function()
+    {
+        this._jumpToSearchResult(this._currentSearchResultIndex - 1);
+    },
+
+    showingFirstSearchResult: function()
+    {
+        return this._searchResults.length &&  this._currentSearchResultIndex === 0;
+    },
+
+    showingLastSearchResult: function()
+    {
+        return this._searchResults.length && this._currentSearchResultIndex === (this._searchResults.length - 1);
+    },
+
+    _jumpToSearchResult: function(index)
+    {
+        if (!this._textViewer || !this._searchResults.length)
+            return;
+        this._currentSearchResultIndex = (index + this._searchResults.length) % this._searchResults.length;
+        this._textViewer.markAndRevealRange(this._searchResults[this._currentSearchResultIndex]);
     },
 
     _collectRegexMatches: function(regexObject, ranges)
@@ -271,22 +346,6 @@ WebInspector.SourceFrame.prototype = {
         return ranges;
     },
 
-    markAndRevealRange: function(range)
-    {
-        if (this._textViewer)
-            this._textViewer.markAndRevealRange(range);
-        else
-            this._pendingMarkRange = range;
-    },
-
-    clearMarkedRange: function()
-    {
-        if (this._textViewer) {
-            this._textViewer.markAndRevealRange(null);
-        } else
-            delete this._pendingMarkRange;
-    },
-
     _incrementMessageRepeatCount: function(msg, repeatDelta)
     {
         if (!msg._resourceMessageLineElement)
@@ -307,7 +366,7 @@ WebInspector.SourceFrame.prototype = {
         this._executionLine = lineNumber;
         if (!this._textViewer)
             return;
-        var textViewerLineNumber = this._formatter.originalLineNumberToFormattedLineNumber(this._executionLine - 1);
+        var textViewerLineNumber = this._originalLocationToTextViewerLineNumber(this._executionLine - 1, 0);
         this._textViewer.addDecoration(textViewerLineNumber, "webkit-execution-line");
     },
 
@@ -315,7 +374,7 @@ WebInspector.SourceFrame.prototype = {
     {
         if (!this._textViewer)
             return;
-        var textViewerLineNumber = this._formatter.originalLineNumberToFormattedLineNumber(this._executionLine - 1);
+        var textViewerLineNumber = this._originalLocationToTextViewerLineNumber(this._executionLine - 1, 0);
         this._textViewer.removeDecoration(textViewerLineNumber, "webkit-execution-line");
         delete this._executionLine;
     },
@@ -356,7 +415,7 @@ WebInspector.SourceFrame.prototype = {
 
     _addMessageToSource: function(msg)
     {
-        if (msg.line >= this._textModel.linesCount)
+        if (msg.line > this._textModel.linesCount)
             return;
 
         var messageBubbleElement = this._messageBubbles[msg.line];
@@ -412,54 +471,55 @@ WebInspector.SourceFrame.prototype = {
     {
         var breakpoint = event.data;
 
-        if (breakpoint.sourceID in this._sourceIDSet())
-            this._addBreakpoint(breakpoint);
-    },
+        if (!this._shouldDisplayBreakpoint(breakpoint))
+            return;
 
-    _addBreakpoint: function(breakpoint)
-    {
-        var textViewerLineNumber = this._formatter.originalLineNumberToFormattedLineNumber(breakpoint.line - 1);
+        var resolved = breakpoint.locations.length;
+        var location = resolved ? breakpoint.locations[0] : breakpoint;
+
+        var textViewerLineNumber = this._originalLocationToTextViewerLineNumber(location.lineNumber, location.columnNumber);
         if (textViewerLineNumber >= this._textModel.linesCount)
             return;
 
-        breakpoint.addEventListener("enable-changed", this._breakpointChanged, this);
-        breakpoint.addEventListener("condition-changed", this._breakpointChanged, this);
-        breakpoint.addEventListener("removed", this._breakpointRemoved, this);
+        var existingBreakpointId = this._textViewerLineNumberToBreakpointId[textViewerLineNumber];
+        if (existingBreakpointId) {
+            WebInspector.debuggerModel.removeBreakpoint(breakpoint.id);
+            return;
+        }
 
-        this._setBreakpointDecoration(textViewerLineNumber, breakpoint.enabled, !!breakpoint.condition);
+        this._breakpointIdToTextViewerLineNumber[breakpoint.id] = textViewerLineNumber;
+        this._textViewerLineNumberToBreakpointId[textViewerLineNumber] = breakpoint.id;
+        this._setBreakpointDecoration(textViewerLineNumber, resolved, breakpoint.enabled, !!breakpoint.condition);
     },
 
     _breakpointRemoved: function(event)
     {
-        var breakpoint = event.target;
+        var breakpointId = event.data;
 
-        breakpoint.removeEventListener("enable-changed", null, this);
-        breakpoint.removeEventListener("condition-changed", null, this);
-        breakpoint.removeEventListener("removed", null, this);
+        var textViewerLineNumber = this._breakpointIdToTextViewerLineNumber[breakpointId];
+        if (textViewerLineNumber === undefined)
+            return;
 
-        var textViewerLineNumber = this._formatter.originalLineNumberToFormattedLineNumber(breakpoint.line - 1);
+        delete this._breakpointIdToTextViewerLineNumber[breakpointId];
+        delete this._textViewerLineNumberToBreakpointId[textViewerLineNumber];
         this._removeBreakpointDecoration(textViewerLineNumber);
     },
 
-    _breakpointChanged: function(event)
+    _breakpointResolved: function(event)
     {
-        var breakpoint = event.target;
-        var textViewerLineNumber = this._formatter.originalLineNumberToFormattedLineNumber(breakpoint.line - 1);
-        this._setBreakpointDecoration(textViewerLineNumber, breakpoint.enabled, !!breakpoint.condition);
+        var breakpoint = event.data;
+        this._breakpointRemoved({ data: breakpoint.id });
+        this._breakpointAdded({ data: breakpoint });
     },
 
-    _setBreakpointDecoration: function(lineNumber, enabled, hasCondition)
+    _setBreakpointDecoration: function(lineNumber, resolved, enabled, hasCondition)
     {
         this._textViewer.beginUpdates();
         this._textViewer.addDecoration(lineNumber, "webkit-breakpoint");
-        if (enabled)
-            this._textViewer.removeDecoration(lineNumber, "webkit-breakpoint-disabled");
-        else
+        if (!enabled)
             this._textViewer.addDecoration(lineNumber, "webkit-breakpoint-disabled");
         if (hasCondition)
             this._textViewer.addDecoration(lineNumber, "webkit-breakpoint-conditional");
-        else
-            this._textViewer.removeDecoration(lineNumber, "webkit-breakpoint-conditional");
         this._textViewer.endUpdates();
     },
 
@@ -480,49 +540,49 @@ WebInspector.SourceFrame.prototype = {
         var target = event.target.enclosingNodeOrSelfWithClass("webkit-line-number");
         if (!target)
             return;
-        var textViewerLineNumber = target.parentElement.lineNumber;
-        var originalLineNumber = this._formatter.formattedLineNumberToOriginalLineNumber(textViewerLineNumber);
+        var textViewerLineNumber = target.lineNumber;
 
         var contextMenu = new WebInspector.ContextMenu();
 
-        contextMenu.appendItem(WebInspector.UIString("Continue to Here"), this._continueToLine.bind(this, originalLineNumber));
+        contextMenu.appendItem(WebInspector.UIString("Continue to Here"), this._continueToLine.bind(this, textViewerLineNumber));
 
-        var breakpoint = this._findBreakpoint(originalLineNumber);
+        var breakpoint = this._findBreakpoint(textViewerLineNumber);
         if (!breakpoint) {
             // This row doesn't have a breakpoint: We want to show Add Breakpoint and Add and Edit Breakpoint.
-            contextMenu.appendItem(WebInspector.UIString("Add Breakpoint"), this._setBreakpoint.bind(this, originalLineNumber, "", true));
+            contextMenu.appendItem(WebInspector.UIString("Add Breakpoint"), this._setBreakpoint.bind(this, textViewerLineNumber, "", true));
 
             function addConditionalBreakpoint()
             {
-                this._setBreakpointDecoration(textViewerLineNumber, true, true);
+                this._setBreakpointDecoration(textViewerLineNumber, true, true, true);
                 function didEditBreakpointCondition(committed, condition)
                 {
                     this._removeBreakpointDecoration(textViewerLineNumber);
                     if (committed)
-                        this._setBreakpoint(originalLineNumber, true, condition);
+                        this._setBreakpoint(textViewerLineNumber, condition, true);
                 }
                 this._editBreakpointCondition(textViewerLineNumber, "", didEditBreakpointCondition.bind(this));
             }
             contextMenu.appendItem(WebInspector.UIString("Add Conditional Breakpoint…"), addConditionalBreakpoint.bind(this));
         } else {
             // This row has a breakpoint, we want to show edit and remove breakpoint, and either disable or enable.
-            contextMenu.appendItem(WebInspector.UIString("Remove Breakpoint"), breakpoint.remove.bind(breakpoint));
+            function removeBreakpoint()
+            {
+                WebInspector.debuggerModel.removeBreakpoint(breakpoint.id);
+            }
+            contextMenu.appendItem(WebInspector.UIString("Remove Breakpoint"), removeBreakpoint);
             function editBreakpointCondition()
             {
                 function didEditBreakpointCondition(committed, condition)
                 {
-                    if (committed) {
-                        breakpoint.remove();
-                        this._setBreakpoint(originalLineNumber, breakpoint.enabled, condition);
-                    }
+                    if (committed)
+                        WebInspector.debuggerModel.updateBreakpoint(breakpoint.id, condition, breakpoint.enabled);
                 }
                 this._editBreakpointCondition(textViewerLineNumber, breakpoint.condition, didEditBreakpointCondition.bind(this));
             }
             contextMenu.appendItem(WebInspector.UIString("Edit Breakpoint…"), editBreakpointCondition.bind(this));
             function setBreakpointEnabled(enabled)
             {
-                breakpoint.remove();
-                this._setBreakpoint(originalLineNumber, enabled, breakpoint.condition);
+                WebInspector.debuggerModel.updateBreakpoint(breakpoint.id, breakpoint.condition, enabled);
             }
             if (breakpoint.enabled)
                 contextMenu.appendItem(WebInspector.UIString("Disable Breakpoint"), setBreakpointEnabled.bind(this, false));
@@ -546,15 +606,16 @@ WebInspector.SourceFrame.prototype = {
         var target = event.target.enclosingNodeOrSelfWithClass("webkit-line-number");
         if (!target)
             return;
-        var originalLineNumber = this._formatter.formattedLineNumberToOriginalLineNumber(target.parentElement.lineNumber);
+        var textViewerLineNumber = target.lineNumber;
 
-        var breakpoint = this._findBreakpoint(originalLineNumber);
+        var breakpoint = this._findBreakpoint(textViewerLineNumber);
         if (breakpoint) {
-            breakpoint.remove();
             if (event.shiftKey)
-                this._setBreakpoint(originalLineNumber, !breakpoint.enabled, breakpoint.condition);
+                WebInspector.debuggerModel.updateBreakpoint(breakpoint.id, breakpoint.condition, !breakpoint.enabled);
+            else
+                WebInspector.debuggerModel.removeBreakpoint(breakpoint.id);
         } else
-            this._setBreakpoint(originalLineNumber, true, "");
+            this._setBreakpoint(textViewerLineNumber, "", true);
         event.preventDefault();
     },
 
@@ -629,7 +690,7 @@ WebInspector.SourceFrame.prototype = {
         if (!WebInspector.panels.scripts || !WebInspector.panels.scripts.paused)
             return;
 
-        var lineRow = element.enclosingNodeOrSelfWithNodeName("tr");
+        var lineRow = element.enclosingNodeOrSelfWithClass("webkit-line-content");
         if (!lineRow)
             return;
 
@@ -713,7 +774,7 @@ WebInspector.SourceFrame.prototype = {
                 return;
             showObjectPopup.call(this, result);
         }
-        WebInspector.panels.scripts.evaluateInSelectedCallFrame(element.textContent, false, this._popoverObjectGroup, evaluateCallback.bind(this));
+        WebInspector.panels.scripts.evaluateInSelectedCallFrame(element.textContent, false, this._popoverObjectGroup, false, evaluateCallback.bind(this));
     },
 
     _editBreakpointCondition: function(lineNumber, condition, callback)
@@ -752,7 +813,7 @@ WebInspector.SourceFrame.prototype = {
         var editorElement = document.createElement("input");
         editorElement.id = "source-frame-breakpoint-condition";
         editorElement.className = "monospace";
-        editorElement.type = "text"
+        editorElement.type = "text";
         conditionElement.appendChild(editorElement);
         this._conditionEditorElement = editorElement;
 
@@ -785,23 +846,24 @@ WebInspector.SourceFrame.prototype = {
 
     formatSource: function()
     {
-        if (!this._formatter)
+        if (!this._content)
             return;
 
-        function didFormat(source)
+        function didFormat(formattedContent)
         {
-            this._textModel.setText(null, source);
+            this._formattedContent = formattedContent;
+            this._textModel.setText(null, formattedContent.text);
             this._setTextViewerDecorations();
         }
-        this._formatter.format(didFormat.bind(this));
+        var formatter = new WebInspector.ScriptFormatter();
+        formatter.formatContent(this._content, didFormat.bind(this))
     },
 
     _continueToLine: function(lineNumber)
     {
-        var sourceID = this._sourceIDForLine(lineNumber);
-        if (!sourceID)
-            return;
-        WebInspector.debuggerModel.continueToLine(sourceID, lineNumber + 1);
+        var location = this._textViewerLineNumberToScriptLocation(lineNumber);
+        if (location.sourceID)
+            WebInspector.debuggerModel.continueToLine(location.sourceID, location.lineNumber);
     },
 
     _doubleClick: function(event)
@@ -809,79 +871,66 @@ WebInspector.SourceFrame.prototype = {
         if (!Preferences.canEditScriptSource || !this._isScript)
             return;
 
-        var target = event.target.enclosingNodeOrSelfWithNodeName("TD");
-        if (!target || target.parentElement.firstChild === target)
+        var lineRow = event.target.enclosingNodeOrSelfWithClass("webkit-line-content");
+        if (!lineRow)
             return;  // Do not trigger editing from line numbers.
 
-        var lineRow = target.parentElement;
         var lineNumber = lineRow.lineNumber;
-        var sourceID = this._sourceIDForLine(lineNumber);
-        if (!sourceID)
+        var location = this._textViewerLineNumberToScriptLocation(lineNumber);
+        if (!location.sourceID)
             return;
 
         function didEditLine(newContent)
         {
             var lines = [];
-            var oldLines = this._content.split('\n');
+            var oldLines = this._content.text.split('\n');
             for (var i = 0; i < oldLines.length; ++i) {
                 if (i === lineNumber)
                     lines.push(newContent);
                 else
                     lines.push(oldLines[i]);
             }
-            WebInspector.debuggerModel.editScriptSource(sourceID, lines.join("\n"));
+            WebInspector.debuggerModel.editScriptSource(location.sourceID, lines.join("\n"));
         }
         this._textViewer.editLine(lineRow, didEditLine.bind(this));
     },
 
-    _setBreakpoint: function(lineNumber, enabled, condition)
+    _setBreakpoint: function(lineNumber, condition, enabled)
     {
-        var sourceID = this._sourceIDForLine(lineNumber);
-        if (!sourceID)
+        var location = this._textViewerLineNumberToScriptLocation(lineNumber);
+        if (this._url)
+            WebInspector.debuggerModel.setBreakpoint(this._url, location.lineNumber, location.columnNumber, condition, enabled);
+        else if (location.sourceID)
+            WebInspector.debuggerModel.setBreakpointBySourceId(location.sourceID, location.lineNumber, location.columnNumber, condition, enabled);
+        else
             return;
-        WebInspector.debuggerModel.setBreakpoint(sourceID, lineNumber + 1, enabled, condition);
+
         if (!WebInspector.panels.scripts.breakpointsActivated)
             WebInspector.panels.scripts.toggleBreakpointsClicked();
     },
 
-    _breakpoints: function()
+    _findBreakpoint: function(textViewerLineNumber)
     {
-        var sourceIDSet = this._sourceIDSet();
-        return WebInspector.debuggerModel.queryBreakpoints(function(b) { return b.sourceID in sourceIDSet; });
+        var breakpointId = this._textViewerLineNumberToBreakpointId[textViewerLineNumber];
+        return WebInspector.debuggerModel.breakpointForId(breakpointId);
     },
 
-    _findBreakpoint: function(lineNumber)
+    _originalLocationToTextViewerLineNumber: function(lineNumber, columnNumber)
     {
-        var sourceID = this._sourceIDForLine(lineNumber);
-        return WebInspector.debuggerModel.findBreakpoint(sourceID, lineNumber + 1);
+        if (!this._formattedContent)
+            return lineNumber;
+        return this._formattedContent.originalLocationToFormattedLocation(lineNumber, columnNumber).lineNumber;
     },
 
-    _sourceIDForLine: function(lineNumber)
+    _textViewerLineNumberToScriptLocation: function(lineNumber)
     {
-        var sourceIDForLine = null;
-        var closestStartingLine = 0;
-        var scripts = this._contentProvider.scripts();
-        for (var i = 0; i < scripts.length; ++i) {
-            var lineOffset = scripts[i].lineOffset;
-            if (lineOffset <= lineNumber && lineOffset >= closestStartingLine) {
-                closestStartingLine = lineOffset;
-                sourceIDForLine = scripts[i].sourceID;
-            }
-        }
-        return sourceIDForLine;
-    },
-
-    _sourceIDSet: function()
-    {
-        var scripts = this._contentProvider.scripts();
-        var sourceIDSet = {};
-        for (var i = 0; i < scripts.length; ++i)
-            sourceIDSet[scripts[i].sourceID] = true;
-        return sourceIDSet;
+        if (!this._formattedContent)
+            return this._content.scriptLocationForLineNumber(lineNumber);
+        return this._formattedContent.scriptLocationForFormattedLineNumber(lineNumber);
     }
 }
 
-WebInspector.SourceFrame.prototype.__proto__ = WebInspector.Object.prototype;
+WebInspector.SourceFrame.prototype.__proto__ = WebInspector.View.prototype;
 
 
 WebInspector.SourceFrameContentProvider = function()
diff --git a/Source/WebCore/inspector/front-end/SourceFrameContent.js b/Source/WebCore/inspector/front-end/SourceFrameContent.js
new file mode 100644
index 0000000..e4a74ec
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/SourceFrameContent.js
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.SourceFrameContent = function(text, scripts)
+{
+    if (scripts.length && scripts[0].length < text.length) {
+        // WebKit html lexer normalizes line endings and scripts are passed to VM with "\n" line endings.
+        // However, resource content has original line endings, so we have to normalize line endings here.
+        text = text.replace(/\r\n/g, "\n");
+    }
+    this._text = text;
+    this._lineEndings = text.findAll("\n");
+    this._lineEndings.push(text.length);
+
+    this._scriptRanges = [];
+    for (var i = 0; i < scripts.length; ++i) {
+        var script = scripts[i];
+        var offset = this.locationToPosition(script.lineOffset, script.columnOffset);
+        this._scriptRanges.push({ start: offset, end: offset + script.length, script: script });
+    }
+    this._scriptRanges.sort(function(x, y) { return x.start - y.start; });
+}
+
+WebInspector.SourceFrameContent.prototype = {
+    get text()
+    {
+        return this._text;
+    },
+
+    get scriptRanges()
+    {
+        return this._scriptRanges;
+    },
+
+    locationToPosition: function(lineNumber, columnNumber)
+    {
+        var position = lineNumber ? this._lineEndings[lineNumber - 1] + 1 : 0;
+        return position + columnNumber;
+    },
+
+    positionToLocation: function(position)
+    {
+        var location = {};
+        location.lineNumber = this._lineEndings.upperBound(position - 1);
+        if (!location.lineNumber)
+            location.columnNumber = position;
+        else
+            location.columnNumber = position - this._lineEndings[location.lineNumber - 1] - 1;
+        return location;
+    },
+
+    scriptLocationForLineNumber: function(lineNumber)
+    {
+        var range = this.lineNumberToRange(lineNumber);
+        return this.scriptLocationForRange(range.start, range.end);
+    },
+
+    scriptLocationForRange: function(start, end)
+    {
+        var position = start;
+        var scriptRange = this._intersectingScriptRange(start, end);
+        if (scriptRange)
+            position = Math.max(position, scriptRange.start);
+        var scriptLocation = this.positionToLocation(position);
+        if (scriptRange)
+            scriptLocation.sourceID = scriptRange.script.sourceID;
+        return scriptLocation;
+    },
+
+    lineNumberToRange: function(lineNumber)
+    {
+        var previousLineEnd = this._lineEndings[lineNumber - 1] || 0;
+        var lineEnd = this._lineEndings[lineNumber];
+        return { start: previousLineEnd + 1, end: lineEnd };
+    },
+
+    _intersectingScriptRange: function(start, end)
+    {
+        for (var i = 0; i < this._scriptRanges.length; ++i) {
+            var scriptRange = this._scriptRanges[i];
+            if (start < scriptRange.end && end > scriptRange.start)
+                return scriptRange;
+        }
+    }
+}
+
+
+WebInspector.FormattedSourceFrameContent = function(originalContent, text, mapping)
+{
+    this._originalContent = originalContent;
+    this._formattedContent = new WebInspector.SourceFrameContent(text, []);
+    this._mapping = mapping;
+}
+
+WebInspector.FormattedSourceFrameContent.prototype = {
+    get text()
+    {
+        return this._formattedContent.text;
+    },
+
+    originalLocationToFormattedLocation: function(lineNumber, columnNumber)
+    {
+        var originalPosition = this._originalContent.locationToPosition(lineNumber, columnNumber);
+        var formattedPosition = this._convertPosition(this._mapping.original, this._mapping.formatted, originalPosition);
+        return this._formattedContent.positionToLocation(formattedPosition);
+    },
+
+    scriptLocationForFormattedLineNumber: function(lineNumber)
+    {
+        var range = this._formattedContent.lineNumberToRange(lineNumber);
+        var start = this._convertPosition(this._mapping.formatted, this._mapping.original, range.start);
+        var end = this._convertPosition(this._mapping.formatted, this._mapping.original, range.end);
+        return this._originalContent.scriptLocationForRange(start, end);
+    },
+
+    _convertPosition: function(positions1, positions2, position)
+    {
+        var index = positions1.upperBound(position);
+        var range1 = positions1[index] - positions1[index - 1];
+        var range2 = positions2[index] - positions2[index - 1];
+        var position2 = positions2[index - 1];
+        if (range1)
+            position2 += Math.round((position - positions1[index - 1]) * range2 / range1);
+        return position2;
+    }
+}
diff --git a/Source/WebCore/inspector/front-end/SourceHTMLTokenizer.js b/Source/WebCore/inspector/front-end/SourceHTMLTokenizer.js
index cfbc44f..48c5bd4 100644
--- a/Source/WebCore/inspector/front-end/SourceHTMLTokenizer.js
+++ b/Source/WebCore/inspector/front-end/SourceHTMLTokenizer.js
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 on Thu Feb 25 21:44:55 2010 */
+/* Generated by re2c 0.13.5 on Fri Jan 28 18:32:27 2011 */
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
@@ -67,7 +67,8 @@ WebInspector.SourceHTMLTokenizer = function()
         ATTRIBUTE_VALUE: 2,
         LINKIFY: 4,
         A_NODE: 8,
-        SCRIPT: 16
+        SCRIPT: 16,
+        STYLE: 32
     };
 
     this.initialCondition = { lexCondition: this._lexConditions.INITIAL, parseCondition: this._parseConditions.INITIAL };
@@ -82,6 +83,12 @@ WebInspector.SourceHTMLTokenizer.prototype = {
                 this._internalJavaScriptTokenizer.line = line.substring(0, match.index);
             } else
                 this._internalJavaScriptTokenizer.line = line;
+        } else if (this._internalCSSTokenizer) {
+            var match = /<\/style/i.exec(line);
+            if (match) {
+                this._internalCSSTokenizer.line = line.substring(0, match.index);
+            } else
+                this._internalCSSTokenizer.line = line;
         }
         this._line = line;
     },
@@ -146,6 +153,18 @@ WebInspector.SourceHTMLTokenizer.prototype = {
                 return result;
             } else if (cursor !== this._line.length)
                 delete this._internalJavaScriptTokenizer;
+        } else if (this._internalCSSTokenizer) {
+            // Re-set line to force </style> detection first.
+            this.line = this._line;
+            if (cursor !== this._internalCSSTokenizer._line.length) {
+                // Tokenizer is stateless, so restore its condition before tokenizing and save it after.
+                this._internalCSSTokenizer.condition = this._condition.internalCSSTokenizerCondition;
+                var result = this._internalCSSTokenizer.nextToken(cursor);
+                this.tokenType = this._internalCSSTokenizer.tokenType;
+                this._condition.internalCSSTokenizerCondition = this._internalCSSTokenizer.condition;
+                return result;
+            } else if (cursor !== this._line.length)
+                delete this._internalCSSTokenizer;
         }
 
         var cursorOnEnter = cursor;
@@ -331,8 +350,8 @@ case 39:
 case 40:
             this.setLexCondition(this._lexConditions.TAG);
             {
-                    if (this._condition.parseCondition & this._parseConditions.SCRIPT) {
-                        // Do not tokenize script tag contents, keep lexer state although processing "<".
+                    if (this._condition.parseCondition & (this._parseConditions.SCRIPT | this._parseConditions.STYLE)) {
+                        // Do not tokenize script and style tag contents, keep lexer state, even though processing "<".
                         this.setLexCondition(this._lexConditions.INITIAL);
                         this.tokenType = null;
                         return cursor;
@@ -345,13 +364,21 @@ case 40:
 case 41:
             yyaccept = 0;
             yych = this._charAt(YYMARKER = ++cursor);
-            if (yych == 'S') { gotoCase = 68; continue; };
-            if (yych == 's') { gotoCase = 68; continue; };
+            if (yych == 'S') { gotoCase = 73; continue; };
+            if (yych == 's') { gotoCase = 73; continue; };
             { gotoCase = 40; continue; };
 case 42:
             yych = this._charAt(++cursor);
-            if (yych == 'C') { gotoCase = 62; continue; };
-            if (yych == 'c') { gotoCase = 62; continue; };
+            if (yych <= 'T') {
+                if (yych == 'C') { gotoCase = 62; continue; };
+                if (yych >= 'T') { gotoCase = 63; continue; };
+            } else {
+                if (yych <= 'c') {
+                    if (yych >= 'c') { gotoCase = 62; continue; };
+                } else {
+                    if (yych == 't') { gotoCase = 63; continue; };
+                }
+            }
 case 43:
             cursor = YYMARKER;
             { gotoCase = 40; continue; };
@@ -421,56 +448,113 @@ case 59:
             { this.tokenType = "html-comment"; return cursor; }
 case 62:
             yych = this._charAt(++cursor);
-            if (yych == 'R') { gotoCase = 63; continue; };
-            if (yych != 'r') { gotoCase = 43; continue; };
+            if (yych == 'R') { gotoCase = 68; continue; };
+            if (yych == 'r') { gotoCase = 68; continue; };
+            { gotoCase = 43; continue; };
 case 63:
             yych = this._charAt(++cursor);
-            if (yych == 'I') { gotoCase = 64; continue; };
-            if (yych != 'i') { gotoCase = 43; continue; };
+            if (yych == 'Y') { gotoCase = 64; continue; };
+            if (yych != 'y') { gotoCase = 43; continue; };
 case 64:
             yych = this._charAt(++cursor);
-            if (yych == 'P') { gotoCase = 65; continue; };
-            if (yych != 'p') { gotoCase = 43; continue; };
+            if (yych == 'L') { gotoCase = 65; continue; };
+            if (yych != 'l') { gotoCase = 43; continue; };
 case 65:
             yych = this._charAt(++cursor);
-            if (yych == 'T') { gotoCase = 66; continue; };
-            if (yych != 't') { gotoCase = 43; continue; };
+            if (yych == 'E') { gotoCase = 66; continue; };
+            if (yych != 'e') { gotoCase = 43; continue; };
 case 66:
             ++cursor;
             this.setLexCondition(this._lexConditions.TAG);
             {
-                    if (this._condition.parseCondition & this._parseConditions.SCRIPT) {
-                        // Do not tokenize script tag contents, keep lexer state although processing "<".
+                    if (this._condition.parseCondition & this._parseConditions.STYLE) {
+                        // Do not tokenize style tag contents, keep lexer state, even though processing "<".
                         this.setLexCondition(this._lexConditions.INITIAL);
                         this.tokenType = null;
                         return cursor;
                     }
                     this.tokenType = "html-tag";
-                    this._condition.parseCondition = this._parseConditions.SCRIPT;
+                    this._condition.parseCondition = this._parseConditions.STYLE;
                     this._setExpectingAttribute();
                     return cursor;
                 }
 case 68:
             yych = this._charAt(++cursor);
-            if (yych == 'C') { gotoCase = 69; continue; };
-            if (yych != 'c') { gotoCase = 43; continue; };
+            if (yych == 'I') { gotoCase = 69; continue; };
+            if (yych != 'i') { gotoCase = 43; continue; };
 case 69:
             yych = this._charAt(++cursor);
-            if (yych == 'R') { gotoCase = 70; continue; };
-            if (yych != 'r') { gotoCase = 43; continue; };
+            if (yych == 'P') { gotoCase = 70; continue; };
+            if (yych != 'p') { gotoCase = 43; continue; };
 case 70:
             yych = this._charAt(++cursor);
-            if (yych == 'I') { gotoCase = 71; continue; };
-            if (yych != 'i') { gotoCase = 43; continue; };
+            if (yych == 'T') { gotoCase = 71; continue; };
+            if (yych != 't') { gotoCase = 43; continue; };
 case 71:
+            ++cursor;
+            this.setLexCondition(this._lexConditions.TAG);
+            {
+                    if (this._condition.parseCondition & this._parseConditions.SCRIPT) {
+                        // Do not tokenize script tag contents, keep lexer state, even though processing "<".
+                        this.setLexCondition(this._lexConditions.INITIAL);
+                        this.tokenType = null;
+                        return cursor;
+                    }
+                    this.tokenType = "html-tag";
+                    this._condition.parseCondition = this._parseConditions.SCRIPT;
+                    this._setExpectingAttribute();
+                    return cursor;
+                }
+case 73:
+            yych = this._charAt(++cursor);
+            if (yych <= 'T') {
+                if (yych == 'C') { gotoCase = 75; continue; };
+                if (yych <= 'S') { gotoCase = 43; continue; };
+            } else {
+                if (yych <= 'c') {
+                    if (yych <= 'b') { gotoCase = 43; continue; };
+                    { gotoCase = 75; continue; };
+                } else {
+                    if (yych != 't') { gotoCase = 43; continue; };
+                }
+            }
+            yych = this._charAt(++cursor);
+            if (yych == 'Y') { gotoCase = 81; continue; };
+            if (yych == 'y') { gotoCase = 81; continue; };
+            { gotoCase = 43; continue; };
+case 75:
+            yych = this._charAt(++cursor);
+            if (yych == 'R') { gotoCase = 76; continue; };
+            if (yych != 'r') { gotoCase = 43; continue; };
+case 76:
+            yych = this._charAt(++cursor);
+            if (yych == 'I') { gotoCase = 77; continue; };
+            if (yych != 'i') { gotoCase = 43; continue; };
+case 77:
             yych = this._charAt(++cursor);
-            if (yych == 'P') { gotoCase = 72; continue; };
+            if (yych == 'P') { gotoCase = 78; continue; };
             if (yych != 'p') { gotoCase = 43; continue; };
-case 72:
+case 78:
             yych = this._charAt(++cursor);
-            if (yych == 'T') { gotoCase = 73; continue; };
+            if (yych == 'T') { gotoCase = 79; continue; };
             if (yych != 't') { gotoCase = 43; continue; };
-case 73:
+case 79:
+            ++cursor;
+            this.setLexCondition(this._lexConditions.TAG);
+            {
+                    this.tokenType = "html-tag";
+                    this._condition.parseCondition = this._parseConditions.INITIAL;
+                    return cursor;
+                }
+case 81:
+            yych = this._charAt(++cursor);
+            if (yych == 'L') { gotoCase = 82; continue; };
+            if (yych != 'l') { gotoCase = 43; continue; };
+case 82:
+            yych = this._charAt(++cursor);
+            if (yych == 'E') { gotoCase = 83; continue; };
+            if (yych != 'e') { gotoCase = 43; continue; };
+case 83:
             ++cursor;
             this.setLexCondition(this._lexConditions.TAG);
             {
@@ -482,78 +566,78 @@ case 73:
 case this.case_SSTRING:
             yych = this._charAt(cursor);
             if (yych <= '\f') {
-                if (yych == '\n') { gotoCase = 79; continue; };
-                { gotoCase = 78; continue; };
+                if (yych == '\n') { gotoCase = 89; continue; };
+                { gotoCase = 88; continue; };
             } else {
-                if (yych <= '\r') { gotoCase = 79; continue; };
-                if (yych == '\'') { gotoCase = 81; continue; };
-                { gotoCase = 78; continue; };
+                if (yych <= '\r') { gotoCase = 89; continue; };
+                if (yych == '\'') { gotoCase = 91; continue; };
+                { gotoCase = 88; continue; };
             }
-case 77:
+case 87:
             { return this._stringToken(cursor); }
-case 78:
+case 88:
             yych = this._charAt(++cursor);
-            { gotoCase = 85; continue; };
-case 79:
+            { gotoCase = 95; continue; };
+case 89:
             ++cursor;
             { this.tokenType = null; return cursor; }
-case 81:
+case 91:
             ++cursor;
-case 82:
+case 92:
             this.setLexCondition(this._lexConditions.TAG);
             { return this._stringToken(cursor, true); }
-case 83:
+case 93:
             yych = this._charAt(++cursor);
-            { gotoCase = 82; continue; };
-case 84:
+            { gotoCase = 92; continue; };
+case 94:
             ++cursor;
             yych = this._charAt(cursor);
-case 85:
+case 95:
             if (yych <= '\f') {
-                if (yych == '\n') { gotoCase = 77; continue; };
-                { gotoCase = 84; continue; };
+                if (yych == '\n') { gotoCase = 87; continue; };
+                { gotoCase = 94; continue; };
             } else {
-                if (yych <= '\r') { gotoCase = 77; continue; };
-                if (yych == '\'') { gotoCase = 83; continue; };
-                { gotoCase = 84; continue; };
+                if (yych <= '\r') { gotoCase = 87; continue; };
+                if (yych == '\'') { gotoCase = 93; continue; };
+                { gotoCase = 94; continue; };
             }
 /* *********************************** */
 case this.case_TAG:
             yych = this._charAt(cursor);
             if (yych <= '&') {
                 if (yych <= '\r') {
-                    if (yych == '\n') { gotoCase = 90; continue; };
-                    if (yych >= '\r') { gotoCase = 90; continue; };
+                    if (yych == '\n') { gotoCase = 100; continue; };
+                    if (yych >= '\r') { gotoCase = 100; continue; };
                 } else {
                     if (yych <= ' ') {
-                        if (yych >= ' ') { gotoCase = 90; continue; };
+                        if (yych >= ' ') { gotoCase = 100; continue; };
                     } else {
-                        if (yych == '"') { gotoCase = 92; continue; };
+                        if (yych == '"') { gotoCase = 102; continue; };
                     }
                 }
             } else {
                 if (yych <= '>') {
                     if (yych <= ';') {
-                        if (yych <= '\'') { gotoCase = 93; continue; };
+                        if (yych <= '\'') { gotoCase = 103; continue; };
                     } else {
-                        if (yych <= '<') { gotoCase = 90; continue; };
-                        if (yych <= '=') { gotoCase = 94; continue; };
-                        { gotoCase = 96; continue; };
+                        if (yych <= '<') { gotoCase = 100; continue; };
+                        if (yych <= '=') { gotoCase = 104; continue; };
+                        { gotoCase = 106; continue; };
                     }
                 } else {
                     if (yych <= '[') {
-                        if (yych >= '[') { gotoCase = 90; continue; };
+                        if (yych >= '[') { gotoCase = 100; continue; };
                     } else {
-                        if (yych == ']') { gotoCase = 90; continue; };
+                        if (yych == ']') { gotoCase = 100; continue; };
                     }
                 }
             }
             ++cursor;
             yych = this._charAt(cursor);
-            { gotoCase = 109; continue; };
-case 89:
+            { gotoCase = 119; continue; };
+case 99:
             {
-                    if (this._condition.parseCondition === this._parseConditions.SCRIPT) {
+                    if (this._condition.parseCondition === this._parseConditions.SCRIPT || this._condition.parseCondition === this._parseConditions.STYLE) {
                         // Fall through if expecting attributes.
                         this.tokenType = null;
                         return cursor;
@@ -580,18 +664,18 @@ case 89:
                         this.tokenType = null;
                     return cursor;
                 }
-case 90:
+case 100:
             ++cursor;
             { this.tokenType = null; return cursor; }
-case 92:
+case 102:
             yyaccept = 0;
             yych = this._charAt(YYMARKER = ++cursor);
-            { gotoCase = 105; continue; };
-case 93:
+            { gotoCase = 115; continue; };
+case 103:
             yyaccept = 0;
             yych = this._charAt(YYMARKER = ++cursor);
-            { gotoCase = 99; continue; };
-case 94:
+            { gotoCase = 109; continue; };
+case 104:
             ++cursor;
             {
                     if (this._isExpectingAttribute())
@@ -599,7 +683,7 @@ case 94:
                     this.tokenType = null;
                     return cursor;
                 }
-case 96:
+case 106:
             ++cursor;
             this.setLexCondition(this._lexConditions.INITIAL);
             {
@@ -613,68 +697,77 @@ case 96:
                         return cursor;
                     }
 
+                    if (this._condition.parseCondition & this._parseConditions.STYLE) {
+                        if (!this._internalCSSTokenizer) {
+                            this._internalCSSTokenizer = WebInspector.SourceTokenizer.Registry.getInstance().getTokenizer("text/css");
+                            this._condition.internalCSSTokenizerCondition = this._internalCSSTokenizer.initialCondition;
+                        }
+                        // Do not tokenize style tag contents.
+                        return cursor;
+                    }
+
                     this._condition.parseCondition = this._parseConditions.INITIAL;
                     return cursor;
                 }
-case 98:
+case 108:
             ++cursor;
             yych = this._charAt(cursor);
-case 99:
+case 109:
             if (yych <= '\f') {
-                if (yych != '\n') { gotoCase = 98; continue; };
+                if (yych != '\n') { gotoCase = 108; continue; };
             } else {
-                if (yych <= '\r') { gotoCase = 100; continue; };
-                if (yych == '\'') { gotoCase = 102; continue; };
-                { gotoCase = 98; continue; };
+                if (yych <= '\r') { gotoCase = 110; continue; };
+                if (yych == '\'') { gotoCase = 112; continue; };
+                { gotoCase = 108; continue; };
             }
-case 100:
+case 110:
             ++cursor;
             this.setLexCondition(this._lexConditions.SSTRING);
             { return this._stringToken(cursor); }
-case 102:
+case 112:
             ++cursor;
             { return this._stringToken(cursor, true); }
-case 104:
+case 114:
             ++cursor;
             yych = this._charAt(cursor);
-case 105:
+case 115:
             if (yych <= '\f') {
-                if (yych != '\n') { gotoCase = 104; continue; };
+                if (yych != '\n') { gotoCase = 114; continue; };
             } else {
-                if (yych <= '\r') { gotoCase = 106; continue; };
-                if (yych == '"') { gotoCase = 102; continue; };
-                { gotoCase = 104; continue; };
+                if (yych <= '\r') { gotoCase = 116; continue; };
+                if (yych == '"') { gotoCase = 112; continue; };
+                { gotoCase = 114; continue; };
             }
-case 106:
+case 116:
             ++cursor;
             this.setLexCondition(this._lexConditions.DSTRING);
             { return this._stringToken(cursor); }
-case 108:
+case 118:
             ++cursor;
             yych = this._charAt(cursor);
-case 109:
+case 119:
             if (yych <= '"') {
                 if (yych <= '\r') {
-                    if (yych == '\n') { gotoCase = 89; continue; };
-                    if (yych <= '\f') { gotoCase = 108; continue; };
-                    { gotoCase = 89; continue; };
+                    if (yych == '\n') { gotoCase = 99; continue; };
+                    if (yych <= '\f') { gotoCase = 118; continue; };
+                    { gotoCase = 99; continue; };
                 } else {
-                    if (yych == ' ') { gotoCase = 89; continue; };
-                    if (yych <= '!') { gotoCase = 108; continue; };
-                    { gotoCase = 89; continue; };
+                    if (yych == ' ') { gotoCase = 99; continue; };
+                    if (yych <= '!') { gotoCase = 118; continue; };
+                    { gotoCase = 99; continue; };
                 }
             } else {
                 if (yych <= '>') {
-                    if (yych == '\'') { gotoCase = 89; continue; };
-                    if (yych <= ';') { gotoCase = 108; continue; };
-                    { gotoCase = 89; continue; };
+                    if (yych == '\'') { gotoCase = 99; continue; };
+                    if (yych <= ';') { gotoCase = 118; continue; };
+                    { gotoCase = 99; continue; };
                 } else {
                     if (yych <= '[') {
-                        if (yych <= 'Z') { gotoCase = 108; continue; };
-                        { gotoCase = 89; continue; };
+                        if (yych <= 'Z') { gotoCase = 118; continue; };
+                        { gotoCase = 99; continue; };
                     } else {
-                        if (yych == ']') { gotoCase = 89; continue; };
-                        { gotoCase = 108; continue; };
+                        if (yych == ']') { gotoCase = 99; continue; };
+                        { gotoCase = 118; continue; };
                     }
                 }
             }
diff --git a/Source/WebCore/inspector/front-end/SourceHTMLTokenizer.re2js b/Source/WebCore/inspector/front-end/SourceHTMLTokenizer.re2js
index 44c62b3..769e984 100644
--- a/Source/WebCore/inspector/front-end/SourceHTMLTokenizer.re2js
+++ b/Source/WebCore/inspector/front-end/SourceHTMLTokenizer.re2js
@@ -66,7 +66,8 @@ WebInspector.SourceHTMLTokenizer = function()
         ATTRIBUTE_VALUE: 2,
         LINKIFY: 4,
         A_NODE: 8,
-        SCRIPT: 16
+        SCRIPT: 16,
+        STYLE: 32
     };
 
     this.initialCondition = { lexCondition: this._lexConditions.INITIAL, parseCondition: this._parseConditions.INITIAL };
@@ -81,6 +82,12 @@ WebInspector.SourceHTMLTokenizer.prototype = {
                 this._internalJavaScriptTokenizer.line = line.substring(0, match.index);
             } else
                 this._internalJavaScriptTokenizer.line = line;
+        } else if (this._internalCSSTokenizer) {
+            var match = /<\/style/i.exec(line);
+            if (match) {
+                this._internalCSSTokenizer.line = line.substring(0, match.index);
+            } else
+                this._internalCSSTokenizer.line = line;
         }
         this._line = line;
     },
@@ -145,6 +152,18 @@ WebInspector.SourceHTMLTokenizer.prototype = {
                 return result;
             } else if (cursor !== this._line.length)
                 delete this._internalJavaScriptTokenizer;
+        } else if (this._internalCSSTokenizer) {
+            // Re-set line to force </style> detection first.
+            this.line = this._line;
+            if (cursor !== this._internalCSSTokenizer._line.length) {
+                // Tokenizer is stateless, so restore its condition before tokenizing and save it after.
+                this._internalCSSTokenizer.condition = this._condition.internalCSSTokenizerCondition;
+                var result = this._internalCSSTokenizer.nextToken(cursor);
+                this.tokenType = this._internalCSSTokenizer.tokenType;
+                this._condition.internalCSSTokenizerCondition = this._internalCSSTokenizer.condition;
+                return result;
+            } else if (cursor !== this._line.length)
+                delete this._internalCSSTokenizer;
         }
 
         var cursorOnEnter = cursor;
@@ -175,6 +194,9 @@ WebInspector.SourceHTMLTokenizer.prototype = {
                 ScriptStart = "<" [Ss] [Cc] [Rr] [Ii] [Pp] [Tt];
                 ScriptEnd = "</" [Ss] [Cc] [Rr] [Ii] [Pp] [Tt];
 
+                StyleStart = "<" [Ss] [Tt] [Yy] [Ll] [Ee];
+                StyleEnd = "</" [Ss] [Tt] [Yy] [Ll] [Ee];
+
                 LT = "<" | "</";
                 GT = ">";
                 EqualSign = "=";
@@ -201,7 +223,7 @@ WebInspector.SourceHTMLTokenizer.prototype = {
                 <INITIAL> ScriptStart => TAG
                 {
                     if (this._condition.parseCondition & this._parseConditions.SCRIPT) {
-                        // Do not tokenize script tag contents, keep lexer state although processing "<".
+                        // Do not tokenize script tag contents, keep lexer state, even though processing "<".
                         this.setLexCondition(this._lexConditions.INITIAL);
                         this.tokenType = null;
                         return cursor;
@@ -219,10 +241,31 @@ WebInspector.SourceHTMLTokenizer.prototype = {
                     return cursor;
                 }
 
+                <INITIAL> StyleStart => TAG
+                {
+                    if (this._condition.parseCondition & this._parseConditions.STYLE) {
+                        // Do not tokenize style tag contents, keep lexer state, even though processing "<".
+                        this.setLexCondition(this._lexConditions.INITIAL);
+                        this.tokenType = null;
+                        return cursor;
+                    }
+                    this.tokenType = "html-tag";
+                    this._condition.parseCondition = this._parseConditions.STYLE;
+                    this._setExpectingAttribute();
+                    return cursor;
+                }
+
+                <INITIAL> StyleEnd => TAG
+                {
+                    this.tokenType = "html-tag";
+                    this._condition.parseCondition = this._parseConditions.INITIAL;
+                    return cursor;
+                }
+
                 <INITIAL> LT => TAG
                 {
-                    if (this._condition.parseCondition & this._parseConditions.SCRIPT) {
-                        // Do not tokenize script tag contents, keep lexer state although processing "<".
+                    if (this._condition.parseCondition & (this._parseConditions.SCRIPT | this._parseConditions.STYLE)) {
+                        // Do not tokenize script and style tag contents, keep lexer state, even though processing "<".
                         this.setLexCondition(this._lexConditions.INITIAL);
                         this.tokenType = null;
                         return cursor;
@@ -245,6 +288,15 @@ WebInspector.SourceHTMLTokenizer.prototype = {
                         return cursor;
                     }
 
+                    if (this._condition.parseCondition & this._parseConditions.STYLE) {
+                        if (!this._internalCSSTokenizer) {
+                            this._internalCSSTokenizer = WebInspector.SourceTokenizer.Registry.getInstance().getTokenizer("text/css");
+                            this._condition.internalCSSTokenizerCondition = this._internalCSSTokenizer.initialCondition;
+                        }
+                        // Do not tokenize style tag contents.
+                        return cursor;
+                    }
+
                     this._condition.parseCondition = this._parseConditions.INITIAL;
                     return cursor;
                 }
@@ -267,7 +319,7 @@ WebInspector.SourceHTMLTokenizer.prototype = {
 
                 <TAG> Identifier
                 {
-                    if (this._condition.parseCondition === this._parseConditions.SCRIPT) {
+                    if (this._condition.parseCondition === this._parseConditions.SCRIPT || this._condition.parseCondition === this._parseConditions.STYLE) {
                         // Fall through if expecting attributes.
                         this.tokenType = null;
                         return cursor;
diff --git a/Source/WebCore/inspector/front-end/SourceView.js b/Source/WebCore/inspector/front-end/SourceView.js
deleted file mode 100644
index 37caabb..0000000
--- a/Source/WebCore/inspector/front-end/SourceView.js
+++ /dev/null
@@ -1,208 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-WebInspector.SourceView = function(resource)
-{
-    WebInspector.ResourceView.call(this, resource);
-
-    this.element.addStyleClass("source");
-
-    var contentProvider = new WebInspector.SourceFrameContentProviderForResource(resource);
-    var isScript = resource.type === WebInspector.Resource.Type.Script;
-    this.sourceFrame = new WebInspector.SourceFrame(this.element, contentProvider, resource.url, isScript);
-}
-
-WebInspector.SourceView.prototype = {
-    show: function(parentElement)
-    {
-        WebInspector.View.prototype.show.call(this, parentElement);
-        this.sourceFrame.visible = true;
-    },
-
-    hide: function()
-    {
-        this.sourceFrame.visible = false;
-        this.sourceFrame.clearLineHighlight();
-        WebInspector.View.prototype.hide.call(this);
-        this._currentSearchResultIndex = -1;
-    },
-
-    resize: function()
-    {
-        this.sourceFrame.resize();
-    },
-
-    get scrollTop()
-    {
-        return this.sourceFrame.scrollTop;
-    },
-
-    set scrollTop(scrollTop)
-    {
-        this.sourceFrame.scrollTop = scrollTop;
-    },
-
-    hasContent: function()
-    {
-        return true;
-    },
-
-    // The rest of the methods in this prototype need to be generic enough to work with a ScriptView.
-    // The ScriptView prototype pulls these methods into it's prototype to avoid duplicate code.
-
-    searchCanceled: function()
-    {
-        this._currentSearchResultIndex = -1;
-        this._searchResults = [];
-        this.sourceFrame.clearMarkedRange();
-        this.sourceFrame.cancelFindSearchMatches();
-    },
-
-    performSearch: function(query, finishedCallback)
-    {
-        // Call searchCanceled since it will reset everything we need before doing a new search.
-        this.searchCanceled();
-
-        function didFindSearchMatches(searchResults)
-        {
-            this._searchResults = searchResults;
-            if (this._searchResults)
-                finishedCallback(this, this._searchResults.length);
-        }
-        this.sourceFrame.findSearchMatches(query, didFindSearchMatches.bind(this));
-    },
-
-    jumpToFirstSearchResult: function()
-    {
-        if (!this._searchResults || !this._searchResults.length)
-            return;
-        this._currentSearchResultIndex = 0;
-        this._jumpToSearchResult(this._currentSearchResultIndex);
-    },
-
-    jumpToLastSearchResult: function()
-    {
-        if (!this._searchResults || !this._searchResults.length)
-            return;
-        this._currentSearchResultIndex = (this._searchResults.length - 1);
-        this._jumpToSearchResult(this._currentSearchResultIndex);
-    },
-
-    jumpToNextSearchResult: function()
-    {
-        if (!this._searchResults || !this._searchResults.length)
-            return;
-        if (++this._currentSearchResultIndex >= this._searchResults.length)
-            this._currentSearchResultIndex = 0;
-        this._jumpToSearchResult(this._currentSearchResultIndex);
-    },
-
-    jumpToPreviousSearchResult: function()
-    {
-        if (!this._searchResults || !this._searchResults.length)
-            return;
-        if (--this._currentSearchResultIndex < 0)
-            this._currentSearchResultIndex = (this._searchResults.length - 1);
-        this._jumpToSearchResult(this._currentSearchResultIndex);
-    },
-
-    showingFirstSearchResult: function()
-    {
-        return (this._currentSearchResultIndex === 0);
-    },
-
-    showingLastSearchResult: function()
-    {
-        return (this._searchResults && this._currentSearchResultIndex === (this._searchResults.length - 1));
-    },
-
-    revealLine: function(lineNumber)
-    {
-        this.sourceFrame.revealLine(lineNumber);
-    },
-
-    highlightLine: function(lineNumber)
-    {
-        this.sourceFrame.highlightLine(lineNumber);
-    },
-
-    addMessage: function(msg)
-    {
-        this.sourceFrame.addMessage(msg);
-    },
-
-    clearMessages: function()
-    {
-        this.sourceFrame.clearMessages();
-    },
-
-    _jumpToSearchResult: function(index)
-    {
-        var foundRange = this._searchResults[index];
-        if (!foundRange)
-            return;
-
-        this.sourceFrame.markAndRevealRange(foundRange);
-    }
-}
-
-WebInspector.SourceView.prototype.__proto__ = WebInspector.ResourceView.prototype;
-
-
-WebInspector.SourceFrameContentProviderForResource = function(resource)
-{
-    WebInspector.SourceFrameContentProvider.call(this);
-    this._resource = resource;
-}
-
-//This is a map from resource.type to mime types
-//found in WebInspector.SourceTokenizer.Registry.
-WebInspector.SourceFrameContentProviderForResource.DefaultMIMETypeForResourceType = {
- 0: "text/html",
- 1: "text/css",
- 4: "text/javascript"
-}
-
-WebInspector.SourceFrameContentProviderForResource.prototype = {
-    requestContent: function(callback)
-    {
-        function contentLoaded(content)
-        {
-            var mimeType = WebInspector.SourceFrameContentProviderForResource.DefaultMIMETypeForResourceType[this._resource.type] || this._resource.mimeType;
-            callback(mimeType, content);
-        }
-        this._resource.requestContent(contentLoaded.bind(this));
-    },
-
-    scripts: function()
-    {
-        return WebInspector.debuggerModel.scriptsForURL(this._resource.url);
-    }
-}
-
-WebInspector.SourceFrameContentProviderForResource.prototype.__proto__ = WebInspector.SourceFrameContentProvider.prototype;
diff --git a/Source/WebCore/inspector/front-end/StylesSidebarPane.js b/Source/WebCore/inspector/front-end/StylesSidebarPane.js
index 9880adc..57d3b76 100644
--- a/Source/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -1709,10 +1709,6 @@ WebInspector.StylePropertyTreeElement.prototype = {
 
     editingEnded: function(context)
     {
-        if (this._prompt) {
-            this._prompt.removeFromElement();
-            delete this._prompt;
-        }
         this.hasChildren = context.hasChildren;
         if (context.expanded)
             this.expand();
@@ -1727,6 +1723,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
 
     editingCancelled: function(element, context)
     {
+        this._removePrompt();
         if ("originalPropertyText" in this)
             this.applyStyleText(this.originalPropertyText, true);
         else {
@@ -1742,6 +1739,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
 
     editingCommitted: function(element, userInput, previousContent, context, moveDirection)
     {
+        this._removePrompt();
         this.editingEnded(context);
         var isEditingName = context.isEditingName;
 
@@ -1839,6 +1837,15 @@ WebInspector.StylePropertyTreeElement.prototype = {
         }
     },
 
+    _removePrompt: function()
+    {
+        // BUG 53242. This cannot go into editingEnded(), as it should always happen first for any editing outcome.
+        if (this._prompt) {
+            this._prompt.removeFromElement();
+            delete this._prompt;
+        }
+    },
+
     _hasBeenAppliedToPageViaUpDown: function()
     {
         // New properties applied via up/down have an originalPropertyText and will be deleted later
@@ -1922,16 +1929,34 @@ WebInspector.StylesSidebarPane.CSSPropertyPrompt.prototype = {
         var reverse = event.keyIdentifier === "Up";
         if (this.autoCompleteElement)
             this.complete(false, reverse); // Accept the current suggestion, if any.
+        else {
+            // Select the word suffix to affect it when computing the subsequent suggestion.
+            this._selectCurrentWordSuffix();
+        }
+
         this.complete(false, reverse); // Actually increment/decrement the suggestion.
         event.handled = true;
     },
 
-    _buildPropertyCompletions: function(wordRange, bestMatchOnly, completionsReadyCallback)
+    _selectCurrentWordSuffix: function()
     {
-        var prefix = wordRange.toString().toLowerCase();
-        if (!prefix.length)
+        var selection = window.getSelection();
+        if (!selection.rangeCount)
             return;
 
+        var selectionRange = selection.getRangeAt(0);
+        if (!selectionRange.commonAncestorContainer.isDescendant(this.element))
+            return;
+        var wordSuffixRange = selectionRange.startContainer.rangeOfWord(selectionRange.startOffset, WebInspector.StylesSidebarPane.StyleValueDelimiters, this.element, "forward");
+        if (!wordSuffixRange.toString())
+            return;
+        selection.removeAllRanges();
+        selection.addRange(wordSuffixRange);
+    },
+
+    _buildPropertyCompletions: function(wordRange, bestMatchOnly, completionsReadyCallback)
+    {
+        var prefix = wordRange.toString().toLowerCase();
         var results;
         if (bestMatchOnly) {
             results = [];
diff --git a/Source/WebCore/inspector/front-end/TextPrompt.js b/Source/WebCore/inspector/front-end/TextPrompt.js
index ac54d8c..36a38cc 100644
--- a/Source/WebCore/inspector/front-end/TextPrompt.js
+++ b/Source/WebCore/inspector/front-end/TextPrompt.js
@@ -196,7 +196,12 @@ WebInspector.TextPrompt.prototype = {
             return;
 
         var selectionRange = selection.getRangeAt(0);
-        if (!selectionRange.commonAncestorContainer.isDescendant(this.element))
+        var isEmptyInput = selectionRange.commonAncestorContainer === this.element; // this.element has no child Text nodes.
+
+        // Do not attempt to auto-complete an empty input in the auto mode (only on demand).
+        if (auto && isEmptyInput)
+            return;
+        if (!auto && !isEmptyInput && !selectionRange.commonAncestorContainer.isDescendant(this.element))
             return;
         if (auto && !this.isCaretAtEndOfPrompt())
             return;
diff --git a/Source/WebCore/inspector/front-end/TextViewer.js b/Source/WebCore/inspector/front-end/TextViewer.js
index ea36513..ce6502d 100644
--- a/Source/WebCore/inspector/front-end/TextViewer.js
+++ b/Source/WebCore/inspector/front-end/TextViewer.js
@@ -32,37 +32,23 @@
 WebInspector.TextViewer = function(textModel, platform, url)
 {
     this._textModel = textModel;
-    this._textModel.changeListener = this._buildChunks.bind(this);
-    this._highlighter = new WebInspector.TextEditorHighlighter(this._textModel, this._highlightDataReady.bind(this));
+    this._textModel.changeListener = this._textChanged.bind(this);
 
     this.element = document.createElement("div");
     this.element.className = "text-editor monospace";
-    this.element.tabIndex = 0;
-
-    this.element.addEventListener("scroll", this._scroll.bind(this), false);
-    this.element.addEventListener("keydown", this._handleKeyDown.bind(this), false);
-    this.element.addEventListener("beforecopy", this._beforeCopy.bind(this), false);
-    this.element.addEventListener("copy", this._copy.bind(this), false);
-
-    this._url = url;
-
-    this._linesContainerElement = document.createElement("table");
-    this._linesContainerElement.className = "text-editor-lines";
-    this._linesContainerElement.setAttribute("cellspacing", 0);
-    this._linesContainerElement.setAttribute("cellpadding", 0);
-    this.element.appendChild(this._linesContainerElement);
-
-    this._defaultChunkSize = 50;
-    this._paintCoalescingLevel = 0;
 
-    this.freeCachedElements();
-    this._buildChunks();
+    var syncScrollListener = this._syncScroll.bind(this);
+    var syncDecorationsForLineListener = this._syncDecorationsForLine.bind(this);
+    this._mainPanel = new WebInspector.TextEditorMainPanel(this._textModel, url, syncScrollListener, syncDecorationsForLineListener);
+    this._gutterPanel = new WebInspector.TextEditorGutterPanel(this._textModel, syncDecorationsForLineListener);
+    this.element.appendChild(this._mainPanel.element);
+    this.element.appendChild(this._gutterPanel.element);
 }
 
 WebInspector.TextViewer.prototype = {
     set mimeType(mimeType)
     {
-        this._highlighter.mimeType = mimeType;
+        this._mainPanel.mimeType = mimeType;
     },
 
     get textModel()
@@ -72,85 +58,190 @@ WebInspector.TextViewer.prototype = {
 
     revealLine: function(lineNumber)
     {
-        if (lineNumber >= this._textModel.linesCount)
-            return;
-
-        var chunk = this._makeLineAChunk(lineNumber);
-        chunk.element.scrollIntoViewIfNeeded();
+        this._mainPanel.revealLine(lineNumber);
     },
 
     addDecoration: function(lineNumber, decoration)
     {
-        var chunk = this._makeLineAChunk(lineNumber);
-        chunk.addDecoration(decoration);
+        this._mainPanel.addDecoration(lineNumber, decoration);
+        this._gutterPanel.addDecoration(lineNumber, decoration);
     },
 
     removeDecoration: function(lineNumber, decoration)
     {
-        var chunk = this._makeLineAChunk(lineNumber);
-        chunk.removeDecoration(decoration);
+        this._mainPanel.removeDecoration(lineNumber, decoration);
+        this._gutterPanel.removeDecoration(lineNumber, decoration);
     },
 
     markAndRevealRange: function(range)
     {
-        if (this._rangeToMark) {
-            var markedLine = this._rangeToMark.startLine;
-            this._rangeToMark = null;
-            this._paintLines(markedLine, markedLine + 1);
-        }
-
-        if (range) {
-            this._rangeToMark = range;
-            this.revealLine(range.startLine);
-            this._paintLines(range.startLine, range.startLine + 1);
-            if (this._markedRangeElement)
-                this._markedRangeElement.scrollIntoViewIfNeeded();
-        }
-        delete this._markedRangeElement;
+        this._mainPanel.markAndRevealRange(range);
     },
 
     highlightLine: function(lineNumber)
     {
-        this.clearLineHighlight();
-        this._highlightedLine = lineNumber;
-        this.revealLine(lineNumber);
-        var chunk = this._makeLineAChunk(lineNumber);
-        chunk.addDecoration("webkit-highlighted-line");
+        this._mainPanel.highlightLine(lineNumber);
     },
 
     clearLineHighlight: function()
     {
-        if (typeof this._highlightedLine === "number") {
-            var chunk = this._makeLineAChunk(this._highlightedLine);
-            chunk.removeDecoration("webkit-highlighted-line");
-            delete this._highlightedLine;
-        }
+        this._mainPanel.clearLineHighlight();
     },
 
     freeCachedElements: function()
     {
-        this._cachedSpans = [];
-        this._cachedTextNodes = [];
-        this._cachedRows = [];
+        this._mainPanel.freeCachedElements();
+        this._gutterPanel.freeCachedElements();
+    },
+
+    editLine: function(lineRow, callback)
+    {
+        this._mainPanel.editLine(lineRow, callback);
+    },
+
+    get scrollTop()
+    {
+        return this._mainPanel.element.scrollTop;
+    },
+
+    set scrollTop(scrollTop)
+    {
+        this._mainPanel.element.scrollTop = scrollTop;
+    },
+
+    get scrollLeft()
+    {
+        return this._mainPanel.element.scrollLeft;
+    },
+
+    set scrollLeft(scrollLeft)
+    {
+        this._mainPanel.element.scrollLeft = scrollLeft;
+    },
+
+    beginUpdates: function()
+    {
+        this._mainPanel.beginUpdates();
+        this._gutterPanel.beginUpdates();
+    },
+
+    endUpdates: function()
+    {
+        this._mainPanel.endUpdates();
+        this._gutterPanel.endUpdates();
+    },
+
+    resize: function()
+    {
+        this._mainPanel.resize();
+        this._gutterPanel.resize();
+        this._updatePanelOffsets();
+    },
+
+    // WebInspector.TextModel listener
+    _textChanged: function(oldRange, newRange, oldText, newText)
+    {
+        this._mainPanel.textChanged();
+        this._gutterPanel.textChanged();
+        this._updatePanelOffsets();
+    },
+
+    _updatePanelOffsets: function()
+    {
+        var lineNumbersWidth = this._gutterPanel.element.offsetWidth;
+        if (lineNumbersWidth)
+            this._mainPanel.element.style.setProperty("left", lineNumbersWidth + "px");
+        else
+            this._mainPanel.element.style.removeProperty("left"); // Use default value set in CSS.
+    },
+
+    _syncScroll: function()
+    {
+        // Async call due to performance reasons.
+        setTimeout(function() {
+            var mainElement = this._mainPanel.element;
+            var gutterElement = this._gutterPanel.element;
+
+            // Handle horizontal scroll bar at the bottom of the main panel.
+            if (gutterElement.offsetHeight > mainElement.clientHeight)
+                gutterElement.style.setProperty("padding-bottom", (gutterElement.offsetHeight - mainElement.clientHeight) + "px");
+            else
+                gutterElement.style.removeProperty("padding-bottom");
+
+            gutterElement.scrollTop = mainElement.scrollTop;
+        }.bind(this), 0);
+    },
+
+    _syncDecorationsForLine: function(lineNumber)
+    {
+        if (lineNumber >= this._textModel.linesCount)
+            return;
+
+        var mainChunk = this._mainPanel.makeLineAChunk(lineNumber);
+        var gutterChunk = this._gutterPanel.makeLineAChunk(lineNumber);
+        var height = mainChunk.height;
+        if (height)
+            gutterChunk.element.style.setProperty("height", height + "px");
+        else
+            gutterChunk.element.style.removeProperty("height");
+    }
+}
+
+WebInspector.TextEditorChunkedPanel = function(textModel)
+{
+    this._textModel = textModel;
+
+    this._defaultChunkSize = 50;
+    this._paintCoalescingLevel = 0;
+}
+
+WebInspector.TextEditorChunkedPanel.prototype = {
+    get textModel()
+    {
+        return this._textModel;
+    },
+
+    revealLine: function(lineNumber)
+    {
+        if (lineNumber >= this._textModel.linesCount)
+            return;
+
+        var chunk = this.makeLineAChunk(lineNumber);
+        chunk.element.scrollIntoViewIfNeeded();
+    },
+
+    addDecoration: function(lineNumber, decoration)
+    {
+        var chunk = this.makeLineAChunk(lineNumber);
+        chunk.addDecoration(decoration);
+    },
+
+    removeDecoration: function(lineNumber, decoration)
+    {
+        var chunk = this.makeLineAChunk(lineNumber);
+        chunk.removeDecoration(decoration);
+    },
+
+    textChanged: function(oldRange, newRange, oldText, newText)
+    {
+        this._buildChunks();
     },
 
     _buildChunks: function()
     {
-        this._linesContainerElement.removeChildren();
+        this.element.removeChildren();
 
         this._textChunks = [];
         for (var i = 0; i < this._textModel.linesCount; i += this._defaultChunkSize) {
-            var chunk = new WebInspector.TextChunk(this, i, i + this._defaultChunkSize);
+            var chunk = this._createNewChunk(i, i + this._defaultChunkSize);
             this._textChunks.push(chunk);
-            this._linesContainerElement.appendChild(chunk.element);
+            this.element.appendChild(chunk.element);
         }
 
-        this._indexChunks();
-        this._highlighter.reset();
         this._repaintAll();
     },
 
-    _makeLineAChunk: function(lineNumber)
+    makeLineAChunk: function(lineNumber)
     {
         if (!this._textChunks)
             this._buildChunks();
@@ -163,31 +254,30 @@ WebInspector.TextViewer.prototype = {
         var wasExpanded = oldChunk.expanded;
         oldChunk.expanded = false;
 
-        var insertIndex = oldChunk.chunkNumber + 1;
+        var insertIndex = chunkNumber + 1;
 
         // Prefix chunk.
         if (lineNumber > oldChunk.startLine) {
-            var prefixChunk = new WebInspector.TextChunk(this, oldChunk.startLine, lineNumber);
+            var prefixChunk = this._createNewChunk(oldChunk.startLine, lineNumber);
             this._textChunks.splice(insertIndex++, 0, prefixChunk);
-            this._linesContainerElement.insertBefore(prefixChunk.element, oldChunk.element);
+            this.element.insertBefore(prefixChunk.element, oldChunk.element);
         }
 
         // Line chunk.
-        var lineChunk = new WebInspector.TextChunk(this, lineNumber, lineNumber + 1);
+        var lineChunk = this._createNewChunk(lineNumber, lineNumber + 1);
         this._textChunks.splice(insertIndex++, 0, lineChunk);
-        this._linesContainerElement.insertBefore(lineChunk.element, oldChunk.element);
+        this.element.insertBefore(lineChunk.element, oldChunk.element);
 
         // Suffix chunk.
         if (oldChunk.startLine + oldChunk.linesCount > lineNumber + 1) {
-            var suffixChunk = new WebInspector.TextChunk(this, lineNumber + 1, oldChunk.startLine + oldChunk.linesCount);
+            var suffixChunk = this._createNewChunk(lineNumber + 1, oldChunk.startLine + oldChunk.linesCount);
             this._textChunks.splice(insertIndex, 0, suffixChunk);
-            this._linesContainerElement.insertBefore(suffixChunk.element, oldChunk.element);
+            this.element.insertBefore(suffixChunk.element, oldChunk.element);
         }
 
         // Remove enclosing chunk.
-        this._textChunks.splice(oldChunk.chunkNumber, 1);
-        this._linesContainerElement.removeChild(oldChunk.element);
-        this._indexChunks();
+        this._textChunks.splice(chunkNumber, 1);
+        this.element.removeChild(oldChunk.element);
 
         if (wasExpanded) {
             if (prefixChunk)
@@ -200,19 +290,315 @@ WebInspector.TextViewer.prototype = {
         return lineChunk;
     },
 
-    _indexChunks: function()
+    _scroll: function()
     {
-        for (var i = 0; i < this._textChunks.length; ++i)
-            this._textChunks[i].chunkNumber = i;
+        this._scheduleRepaintAll();
+        if (this._syncScrollListener)
+            this._syncScrollListener();
     },
 
-    _scroll: function()
+    _scheduleRepaintAll: function()
     {
-        var scrollTop = this.element.scrollTop;
-        setTimeout(function() {
-            if (scrollTop === this.element.scrollTop)
-                this._repaintAll();
-        }.bind(this), 50);
+        if (this._repaintAllTimer)
+            clearTimeout(this._repaintAllTimer);
+        this._repaintAllTimer = setTimeout(this._repaintAll.bind(this), 50);
+    },
+
+    beginUpdates: function()
+    {
+        this._paintCoalescingLevel++;
+    },
+
+    endUpdates: function()
+    {
+        this._paintCoalescingLevel--;
+        if (!this._paintCoalescingLevel)
+            this._repaintAll();
+    },
+
+    _chunkNumberForLine: function(lineNumber)
+    {
+        for (var i = 0; i < this._textChunks.length; ++i) {
+            var line = this._textChunks[i].startLine;
+            if (lineNumber >= line && lineNumber < line + this._textChunks[i].linesCount)
+                return i;
+        }
+        return this._textChunks.length - 1;
+    },
+
+    _chunkForLine: function(lineNumber)
+    {
+        return this._textChunks[this._chunkNumberForLine(lineNumber)];
+    },
+
+    _repaintAll: function()
+    {
+        delete this._repaintAllTimer;
+
+        if (this._paintCoalescingLevel)
+            return;
+
+        if (!this._textChunks)
+            this._buildChunks();
+
+        var visibleFrom = this.element.scrollTop;
+        var visibleTo = this.element.scrollTop + this.element.clientHeight;
+
+        var offset = 0;
+        var fromIndex = -1;
+        var toIndex = 0;
+        for (var i = 0; i < this._textChunks.length; ++i) {
+            var chunk = this._textChunks[i];
+            var chunkHeight = chunk.height;
+            if (offset + chunkHeight > visibleFrom && offset < visibleTo) {
+                if (fromIndex === -1)
+                    fromIndex = i;
+                toIndex = i + 1;
+            } else {
+                if (offset >= visibleTo)
+                    break;
+            }
+            offset += chunkHeight;
+        }
+
+        if (toIndex)
+            this._expandChunks(fromIndex, toIndex);
+    },
+
+    _totalHeight: function(firstElement, lastElement)
+    {
+        lastElement = (lastElement || firstElement).nextElementSibling;
+        if (lastElement)
+            return lastElement.offsetTop - firstElement.offsetTop;
+        else if (firstElement.offsetParent)
+            return firstElement.offsetParent.scrollHeight - firstElement.offsetTop;
+        return firstElement.offsetHeight;
+    },
+    
+    resize: function()
+    {
+        this._repaintAll();
+    }
+}
+
+WebInspector.TextEditorGutterPanel = function(textModel, syncDecorationsForLineListener)
+{
+    WebInspector.TextEditorChunkedPanel.call(this, textModel);
+
+    this._syncDecorationsForLineListener = syncDecorationsForLineListener;
+
+    this.element = document.createElement("div");
+    this.element.className = "text-editor-lines";
+
+    this.element.addEventListener("scroll", this._scroll.bind(this), false);
+
+    this.freeCachedElements();
+    this._buildChunks();
+}
+
+WebInspector.TextEditorGutterPanel.prototype = {
+    freeCachedElements: function()
+    {
+        this._cachedRows = [];
+    },
+
+    _createNewChunk: function(startLine, endLine)
+    {
+        return new WebInspector.TextEditorGutterChunk(this, startLine, endLine);
+    },
+
+    _expandChunks: function(fromIndex, toIndex)
+    {
+        for (var i = 0; i < this._textChunks.length; ++i) {
+            this._textChunks[i].expanded = (fromIndex <= i && i < toIndex);
+        }
+    }
+}
+
+WebInspector.TextEditorGutterPanel.prototype.__proto__ = WebInspector.TextEditorChunkedPanel.prototype;
+
+WebInspector.TextEditorGutterChunk = function(textViewer, startLine, endLine)
+{
+    this._textViewer = textViewer;
+    this._textModel = textViewer._textModel;
+
+    this.startLine = startLine;
+    endLine = Math.min(this._textModel.linesCount, endLine);
+    this.linesCount = endLine - startLine;
+
+    this._expanded = false;
+
+    this.element = document.createElement("div");
+    this.element.lineNumber = startLine;
+    this.element.className = "webkit-line-number";
+
+    if (this.linesCount === 1) {
+        // Single line chunks are typically created for decorations. Host line number in
+        // the sub-element in order to allow flexible border / margin management.
+        var innerSpan = document.createElement("span");
+        innerSpan.className = "webkit-line-number-inner";
+        innerSpan.textContent = startLine + 1;
+        var outerSpan = document.createElement("div");
+        outerSpan.className = "webkit-line-number-outer";
+        outerSpan.appendChild(innerSpan);
+        this.element.appendChild(outerSpan);
+    } else {
+        var lineNumbers = [];
+        for (var i = startLine; i < endLine; ++i) {
+            lineNumbers.push(i + 1);
+        }
+        this.element.textContent = lineNumbers.join("\n");
+    }
+}
+
+WebInspector.TextEditorGutterChunk.prototype = {
+    addDecoration: function(decoration)
+    {
+        if (typeof decoration === "string") {
+            this.element.addStyleClass(decoration);
+        }
+    },
+
+    removeDecoration: function(decoration)
+    {
+        if (typeof decoration === "string") {
+            this.element.removeStyleClass(decoration);
+        }
+    },
+
+    get expanded()
+    {
+        return this._expanded;
+    },
+
+    set expanded(expanded)
+    {
+        if (this.linesCount === 1)
+            this._textViewer._syncDecorationsForLineListener(this.startLine);
+
+        if (this._expanded === expanded)
+            return;
+
+        this._expanded = expanded;
+
+        if (this.linesCount === 1)
+            return;
+
+        if (expanded) {
+            this._expandedLineRows = [];
+            var parentElement = this.element.parentElement;
+            for (var i = this.startLine; i < this.startLine + this.linesCount; ++i) {
+                var lineRow = this._createRow(i);
+                parentElement.insertBefore(lineRow, this.element);
+                this._expandedLineRows.push(lineRow);
+            }
+            parentElement.removeChild(this.element);
+        } else {
+            var elementInserted = false;
+            for (var i = 0; i < this._expandedLineRows.length; ++i) {
+                var lineRow = this._expandedLineRows[i];
+                var parentElement = lineRow.parentElement;
+                if (parentElement) {
+                    if (!elementInserted) {
+                        elementInserted = true;
+                        parentElement.insertBefore(this.element, lineRow);
+                    }
+                    this._textViewer._cachedRows.push(lineRow);
+                    parentElement.removeChild(lineRow);
+                }
+            }
+            delete this._expandedLineRows;
+        }
+    },
+
+    get height()
+    {
+        if (!this._expandedLineRows)
+            return this._textViewer._totalHeight(this.element);
+        return this._textViewer._totalHeight(this._expandedLineRows[0], this._expandedLineRows[this._expandedLineRows.length - 1]);
+    },
+
+    _createRow: function(lineNumber)
+    {
+        var lineRow = this._textViewer._cachedRows.pop() || document.createElement("div");
+        lineRow.lineNumber = lineNumber;
+        lineRow.className = "webkit-line-number";
+        lineRow.textContent = lineNumber + 1;
+        return lineRow;
+    }
+}
+
+WebInspector.TextEditorMainPanel = function(textModel, url, syncScrollListener, syncDecorationsForLineListener)
+{
+    WebInspector.TextEditorChunkedPanel.call(this, textModel);
+
+    this._syncScrollListener = syncScrollListener;
+    this._syncDecorationsForLineListener = syncDecorationsForLineListener;
+
+    this._url = url;
+    this._highlighter = new WebInspector.TextEditorHighlighter(textModel, this._highlightDataReady.bind(this));
+
+    this.element = document.createElement("div");
+    this.element.className = "text-editor-contents";
+    this.element.tabIndex = 0;
+
+    this.element.addEventListener("scroll", this._scroll.bind(this), false);
+    this.element.addEventListener("keydown", this._handleKeyDown.bind(this), false);
+
+    var handleDOMUpdates = this._handleDOMUpdates.bind(this);
+    this.element.addEventListener("DOMCharacterDataModified", handleDOMUpdates, false);
+    this.element.addEventListener("DOMNodeInserted", handleDOMUpdates, false);
+    this.element.addEventListener("DOMNodeRemoved", handleDOMUpdates, false);
+
+    this.freeCachedElements();
+    this._buildChunks();
+}
+
+WebInspector.TextEditorMainPanel.prototype = {
+    set mimeType(mimeType)
+    {
+        this._highlighter.mimeType = mimeType;
+    },
+
+    markAndRevealRange: function(range)
+    {
+        if (this._rangeToMark) {
+            var markedLine = this._rangeToMark.startLine;
+            this._rangeToMark = null;
+            this._paintLines(markedLine, markedLine + 1);
+        }
+
+        if (range) {
+            this._rangeToMark = range;
+            this.revealLine(range.startLine);
+            this._paintLines(range.startLine, range.startLine + 1);
+            if (this._markedRangeElement)
+                this._markedRangeElement.scrollIntoViewIfNeeded();
+        }
+        delete this._markedRangeElement;
+    },
+
+    highlightLine: function(lineNumber)
+    {
+        this.clearLineHighlight();
+        this._highlightedLine = lineNumber;
+        this.revealLine(lineNumber);
+        this.addDecoration(lineNumber, "webkit-highlighted-line");
+    },
+
+    clearLineHighlight: function()
+    {
+        if (typeof this._highlightedLine === "number") {
+            this.removeDecoration(this._highlightedLine, "webkit-highlighted-line");
+            delete this._highlightedLine;
+        }
+    },
+
+    freeCachedElements: function()
+    {
+        this._cachedSpans = [];
+        this._cachedTextNodes = [];
+        this._cachedRows = [];
     },
 
     _handleKeyDown: function()
@@ -248,16 +634,15 @@ WebInspector.TextViewer.prototype = {
 
     editLine: function(lineRow, callback)
     {
-        var element = lineRow.lastChild;
-        var oldContent = element.innerHTML;
+        var oldContent = lineRow.innerHTML;
         function finishEditing(committed, e, newContent)
         {
             if (committed)
                 callback(newContent);
-            element.innerHTML = oldContent;
+            lineRow.innerHTML = oldContent;
             delete this._editingLine;
         }
-        this._editingLine = WebInspector.startEditing(element, {
+        this._editingLine = WebInspector.startEditing(lineRow, {
             context: null,
             commitHandler: finishEditing.bind(this, true),
             cancelHandler: finishEditing.bind(this, false),
@@ -265,102 +650,21 @@ WebInspector.TextViewer.prototype = {
         });
     },
 
-    _beforeCopy: function(e)
-    {
-        e.preventDefault();
-    },
-
-    _copy: function(e)
-    {
-        var range = this._getSelection();
-        var text = this._textModel.copyRange(range);
-        InspectorFrontendHost.copyText(text);
-        e.preventDefault();
-    },
-
-    beginUpdates: function(enabled)
-    {
-        this._paintCoalescingLevel++;
-    },
-
-    endUpdates: function(enabled)
-    {
-        this._paintCoalescingLevel--;
-        if (!this._paintCoalescingLevel)
-            this._repaintAll();
-    },
-
-    _chunkForOffset: function(offset)
-    {
-        var currentOffset = 0;
-        var row = this._linesContainerElement.firstChild;
-        while (row) {
-            var rowHeight = row.offsetHeight;
-            if (offset >= currentOffset && offset < currentOffset + rowHeight)
-                return row.chunkNumber;
-            row = row.nextSibling;
-            currentOffset += rowHeight;
-        }
-        return this._textChunks.length - 1;
-    },
-
-    _chunkNumberForLine: function(lineNumber)
-    {
-        for (var i = 0; i < this._textChunks.length; ++i) {
-            var line = this._textChunks[i].startLine;
-            if (lineNumber >= this._textChunks[i].startLine && lineNumber < this._textChunks[i].startLine + this._textChunks[i].linesCount)
-                return i;
-        }
-        return this._textChunks.length - 1;
-    },
-
-    _chunkForLine: function(lineNumber)
+    _buildChunks: function()
     {
-        return this._textChunks[this._chunkNumberForLine(lineNumber)];
+        this._highlighter.reset();
+        WebInspector.TextEditorChunkedPanel.prototype._buildChunks.call(this);
     },
 
-    _chunkStartLine: function(chunkNumber)
+    _createNewChunk: function(startLine, endLine)
     {
-        var lineNumber = 0;
-        for (var i = 0; i < chunkNumber && i < this._textChunks.length; ++i)
-            lineNumber += this._textChunks[i].linesCount;
-        return lineNumber;
+        return new WebInspector.TextEditorMainChunk(this, startLine, endLine);
     },
 
-    _repaintAll: function()
+    _expandChunks: function(fromIndex, toIndex)
     {
-        if (this._paintCoalescingLevel)
-            return;
-
-        if (!this._textChunks)
-            this._buildChunks();
-
-        var visibleFrom = this.element.scrollTop;
-        var visibleTo = this.element.scrollTop + this.element.clientHeight;
-
-        var offset = 0;
-        var firstVisibleLine = -1;
-        var lastVisibleLine = 0;
-        var toExpand = [];
-        var toCollapse = [];
-        for (var i = 0; i < this._textChunks.length; ++i) {
-            var chunk = this._textChunks[i];
-            var chunkHeight = chunk.height;
-            if (offset + chunkHeight > visibleFrom && offset < visibleTo) {
-                toExpand.push(chunk);
-                if (firstVisibleLine === -1)
-                    firstVisibleLine = chunk.startLine;
-                lastVisibleLine = chunk.startLine + chunk.linesCount;
-            } else {
-                toCollapse.push(chunk);
-                if (offset >= visibleTo)
-                    break;
-            }
-            offset += chunkHeight;
-        }
-
-        for (var j = i; j < this._textChunks.length; ++j)
-            toCollapse.push(this._textChunks[i]);
+        var lastChunk = this._textChunks[toIndex - 1];
+        var lastVisibleLine = lastChunk.startLine + lastChunk.linesCount;
 
         var selection = this._getSelection();
 
@@ -368,10 +672,9 @@ WebInspector.TextViewer.prototype = {
         this._highlighter.highlight(lastVisibleLine);
         delete this._muteHighlightListener;
 
-        for (var i = 0; i < toCollapse.length; ++i)
-            toCollapse[i].expanded = false;
-        for (var i = 0; i < toExpand.length; ++i)
-            toExpand[i].expanded = true;
+        for (var i = 0; i < this._textChunks.length; ++i) {
+            this._textChunks[i].expanded = (fromIndex <= i && i < toIndex);
+        }
 
         this._restoreSelection(selection);
     },
@@ -380,40 +683,40 @@ WebInspector.TextViewer.prototype = {
     {
         if (this._muteHighlightListener)
             return;
+        this._paintLines(fromLine, toLine, true /*restoreSelection*/);
+    },
 
+    _paintLines: function(fromLine, toLine, restoreSelection)
+    {
         var selection;
+        var chunk = this._chunkForLine(fromLine);
         for (var i = fromLine; i < toLine; ++i) {
-            var lineRow = this._textModel.getAttribute(i, "line-row");
-            if (!lineRow || lineRow.highlighted)
+            if (i >= chunk.startLine + chunk.linesCount)
+                chunk = this._chunkForLine(i);
+            var lineRow = chunk.getExpandedLineRow(i);
+            if (!lineRow)
                 continue;
-            if (!selection)
+            if (restoreSelection && !selection)
                 selection = this._getSelection();
             this._paintLine(lineRow, i);
         }
-        this._restoreSelection(selection);
-    },
-
-    _paintLines: function(fromLine, toLine)
-    {
-        for (var i = fromLine; i < toLine; ++i) {
-            var lineRow = this._textModel.getAttribute(i, "line-row");
-            if (lineRow)
-                this._paintLine(lineRow, i);
-        }
+        if (restoreSelection)
+            this._restoreSelection(selection);
     },
 
     _paintLine: function(lineRow, lineNumber)
     {
-        var element = lineRow.lastChild;
         var highlight = this._textModel.getAttribute(lineNumber, "highlight");
         if (!highlight) {
             if (this._rangeToMark && this._rangeToMark.startLine === lineNumber)
-                this._markedRangeElement = highlightSearchResult(element, this._rangeToMark.startColumn, this._rangeToMark.endColumn - this._rangeToMark.startColumn);
+                this._markedRangeElement = highlightSearchResult(lineRow, this._rangeToMark.startColumn, this._rangeToMark.endColumn - this._rangeToMark.startColumn);
             return;
         }
 
-        element.removeChildren();
+        lineRow.removeChildren();
         var line = this._textModel.line(lineNumber);
+        if (!line)
+            lineRow.appendChild(document.createElement("br"));
 
         var plainTextStart = -1;
         for (var j = 0; j < line.length;) {
@@ -430,98 +733,64 @@ WebInspector.TextViewer.prototype = {
                 j++;
             } else {
                 if (plainTextStart !== -1) {
-                    this._appendTextNode(element, line.substring(plainTextStart, j));
+                    this._appendTextNode(lineRow, line.substring(plainTextStart, j));
                     plainTextStart = -1;
                 }
-                this._appendSpan(element, line.substring(j, j + attribute.length), attribute.tokenType);
+                this._appendSpan(lineRow, line.substring(j, j + attribute.length), attribute.tokenType);
                 j += attribute.length;
             }
         }
         if (plainTextStart !== -1)
-            this._appendTextNode(element, line.substring(plainTextStart, line.length));
+            this._appendTextNode(lineRow, line.substring(plainTextStart, line.length));
         if (this._rangeToMark && this._rangeToMark.startLine === lineNumber)
-            this._markedRangeElement = highlightSearchResult(element, this._rangeToMark.startColumn, this._rangeToMark.endColumn - this._rangeToMark.startColumn);
+            this._markedRangeElement = highlightSearchResult(lineRow, this._rangeToMark.startColumn, this._rangeToMark.endColumn - this._rangeToMark.startColumn);
         if (lineRow.decorationsElement)
-            element.appendChild(lineRow.decorationsElement);
+            lineRow.appendChild(lineRow.decorationsElement);
     },
 
-    _releaseLinesHighlight: function(fromLine, toLine)
+    _releaseLinesHighlight: function(lineRow)
     {
-        for (var i = fromLine; i < toLine; ++i) {
-            var lineRow = this._textModel.getAttribute(i, "line-row");
-            if (!lineRow)
-                continue;
-            var element = lineRow.lastChild;
-            if ("spans" in element) {
-                var spans = element.spans;
-                for (var j = 0; j < spans.length; ++j)
-                    this._cachedSpans.push(spans[j]);
-                delete element.spans;
-            }
-            if ("textNodes" in element) {
-                var textNodes = element.textNodes;
-                for (var j = 0; j < textNodes.length; ++j)
-                    this._cachedTextNodes.push(textNodes[j]);
-                delete element.textNodes;
-            }
+        if (!lineRow)
+            return;
+        if ("spans" in lineRow) {
+            var spans = lineRow.spans;
+            for (var j = 0; j < spans.length; ++j)
+                this._cachedSpans.push(spans[j]);
+            delete lineRow.spans;
         }
+        if ("textNodes" in lineRow) {
+            var textNodes = lineRow.textNodes;
+            for (var j = 0; j < textNodes.length; ++j)
+                this._cachedTextNodes.push(textNodes[j]);
+            delete lineRow.textNodes;
+        }
+        this._cachedRows.push(lineRow);
     },
 
     _getSelection: function()
     {
         var selection = window.getSelection();
-        if (selection.isCollapsed)
+        if (!selection.rangeCount)
             return null;
         var selectionRange = selection.getRangeAt(0);
         // Selection may be outside of the viewer.
         if (!this.element.isAncestor(selectionRange.startContainer) || !this.element.isAncestor(selectionRange.endContainer))
             return null;
         var start = this._selectionToPosition(selectionRange.startContainer, selectionRange.startOffset);
-        var end = this._selectionToPosition(selectionRange.endContainer, selectionRange.endOffset);
-        return new WebInspector.TextRange(start.line, start.column, end.line, end.column);
+        var end = selectionRange.collapsed ? start : this._selectionToPosition(selectionRange.endContainer, selectionRange.endOffset);
+        if (selection.anchorNode === selectionRange.startContainer && selection.anchorOffset === selectionRange.startOffset)
+            return new WebInspector.TextRange(start.line, start.column, end.line, end.column);
+        else
+            return new WebInspector.TextRange(end.line, end.column, start.line, start.column);
     },
 
     _restoreSelection: function(range)
     {
         if (!range)
             return;
-        var startRow = this._textModel.getAttribute(range.startLine, "line-row");
-        if (startRow)
-            var start = startRow.lastChild.rangeBoundaryForOffset(range.startColumn);
-        else {
-            var offset = range.startColumn;
-            var chunkNumber = this._chunkNumberForLine(range.startLine);
-            for (var i = this._chunkStartLine(chunkNumber); i < range.startLine; ++i)
-                offset += this._textModel.line(i).length + 1; // \n
-            var lineCell = this._textChunks[chunkNumber].element.lastChild;
-            if (lineCell.firstChild)
-                var start = { container: lineCell.firstChild, offset: offset };
-            else
-                var start = { container: lineCell, offset: 0 };
-        }
-
-        var endRow = this._textModel.getAttribute(range.endLine, "line-row");
-        if (endRow)
-            var end = endRow.lastChild.rangeBoundaryForOffset(range.endColumn);
-        else {
-            var offset = range.endColumn;
-            var chunkNumber = this._chunkNumberForLine(range.endLine);
-            for (var i = this._chunkStartLine(chunkNumber); i < range.endLine; ++i)
-                offset += this._textModel.line(i).length + 1; // \n
-            var lineCell = this._textChunks[chunkNumber].element.lastChild;
-            if (lineCell.firstChild)
-                var end = { container: lineCell.firstChild, offset: offset };
-            else
-                var end = { container: lineCell, offset: 0 };
-        }
-
-        var selectionRange = document.createRange();
-        selectionRange.setStart(start.container, start.offset);
-        selectionRange.setEnd(end.container, end.offset);
-
-        var selection = window.getSelection();
-        selection.removeAllRanges();
-        selection.addRange(selectionRange);
+        var start = this._positionToSelection(range.startLine, range.startColumn);
+        var end = range.isEmpty() ? start : this._positionToSelection(range.endLine, range.endColumn);
+        window.getSelection().setBaseAndExtent(start.container, start.offset, end.container, end.offset);
     },
 
     _selectionToPosition: function(container, offset)
@@ -531,21 +800,26 @@ WebInspector.TextViewer.prototype = {
         if (container === this.element && offset === 1)
             return { line: this._textModel.linesCount - 1, column: this._textModel.lineLength(this._textModel.linesCount - 1) };
 
-        var lineRow = container.enclosingNodeOrSelfWithNodeName("tr");
+        var lineRow = container.enclosingNodeOrSelfWithNodeName("DIV");
         var lineNumber = lineRow.lineNumber;
-        if (container.nodeName === "TD" && offset === 0)
+        if (container === lineRow && offset === 0)
             return { line: lineNumber, column: 0 };
-        if (container.nodeName === "TD" && offset === 1)
-            return { line: lineNumber, column: this._textModel.lineLength(lineNumber) };
 
+        // This may be chunk and chunks may contain \n.
         var column = 0;
-        var node = lineRow.lastChild.traverseNextTextNode(lineRow.lastChild);
+        var node = lineRow.traverseNextTextNode(lineRow);
         while (node && node !== container) {
-            column += node.textContent.length;
-            node = node.traverseNextTextNode(lineRow.lastChild);
+            var text = node.textContent;
+            for (var i = 0; i < text.length; ++i) {
+                if (text.charAt(i) === "\n") {
+                    lineNumber++;
+                    column = 0;
+                } else
+                    column++;
+            }
+            node = node.traverseNextTextNode(lineRow);
         }
 
-        // This may be chunk and chunks may contain \n.
         if (node === container && offset) {
             var text = node.textContent;
             for (var i = 0; i < offset; ++i) {
@@ -559,6 +833,25 @@ WebInspector.TextViewer.prototype = {
         return { line: lineNumber, column: column };
     },
 
+    _positionToSelection: function(line, column)
+    {
+        var chunk = this._chunkForLine(line);
+        var lineRow = chunk.getExpandedLineRow(line);
+        if (lineRow)
+            var rangeBoundary = lineRow.rangeBoundaryForOffset(column);
+        else {
+            var offset = column;
+            for (var i = chunk.startLine; i < line; ++i)
+                offset += this._textModel.lineLength(i) + 1; // \n
+            lineRow = chunk.element;
+            if (lineRow.firstChild)
+                var rangeBoundary = { container: lineRow.firstChild, offset: offset };
+            else
+                var rangeBoundary = { container: lineRow, offset: 0 };
+        }
+        return rangeBoundary;
+    },
+
     _appendSpan: function(element, content, className)
     {
         if (className === "html-resource-link" || className === "html-external-link") {
@@ -578,9 +871,9 @@ WebInspector.TextViewer.prototype = {
     _appendTextNode: function(element, text)
     {
         var textNode = this._cachedTextNodes.pop();
-        if (textNode) {
+        if (textNode)
             textNode.nodeValue = text;
-        } else
+        else
             textNode = document.createTextNode(text);
         element.appendChild(textNode);
         if (!("textNodes" in element))
@@ -614,58 +907,52 @@ WebInspector.TextViewer.prototype = {
         return WebInspector.completeURL(this._url, hrefValue);
     },
 
-    resize: function()
+    _handleDOMUpdates: function(e)
     {
-        this._repaintAll();
+        var target = e.target;
+        var lineRow = target.enclosingNodeOrSelfWithClass("webkit-line-content");
+        if (lineRow === target || !lineRow || !lineRow.decorationsElement || !lineRow.decorationsElement.isAncestor(target))
+            return;
+        if (this._syncDecorationsForLineListener) {
+            // Wait until this event is processed and only then sync the sizes. This is necessary in
+            // case of the DOMNodeRemoved event, because it is dispatched before the removal takes place.
+            setTimeout(function() {
+                this._syncDecorationsForLineListener(lineRow.lineNumber);
+            }.bind(this), 0);
+        }
     }
 }
 
-var cachedSpans = [];
+WebInspector.TextEditorMainPanel.prototype.__proto__ = WebInspector.TextEditorChunkedPanel.prototype;
 
-WebInspector.TextChunk = function(textViewer, startLine, endLine)
+WebInspector.TextEditorMainChunk = function(textViewer, startLine, endLine)
 {
     this._textViewer = textViewer;
-    this.element = document.createElement("tr");
     this._textModel = textViewer._textModel;
-    this.element.chunk = this;
+
+    this.element = document.createElement("div");
     this.element.lineNumber = startLine;
+    this.element.className = "webkit-line-content";
 
     this.startLine = startLine;
     endLine = Math.min(this._textModel.linesCount, endLine);
     this.linesCount = endLine - startLine;
 
-    this._lineNumberElement = document.createElement("td");
-    this._lineNumberElement.className = "webkit-line-number";
-    this.element.appendChild(this._lineNumberElement);
-
-    this._lineContentElement = document.createElement("td");
-    this._lineContentElement.className = "webkit-line-content";
-    this.element.appendChild(this._lineContentElement);
-
     this._expanded = false;
 
-    var lineNumbers = [];
     var lines = [];
     for (var i = startLine; i < endLine; ++i) {
-        lineNumbers.push(i + 1);
         lines.push(this._textModel.line(i));
     }
-    if (this.linesCount === 1) {
-        // Single line chunks are typically created for decorations. Host line number in
-        // the sub-element in order to allow flexible border / margin management.
-        var innerSpan = document.createElement("span");
-        innerSpan.className = "webkit-line-number-inner";
-        innerSpan.textContent = startLine + 1;
-        var outerSpan = document.createElement("div");
-        outerSpan.className = "webkit-line-number-outer";
-        outerSpan.appendChild(innerSpan);
-        this._lineNumberElement.appendChild(outerSpan);
-    } else
-        this._lineNumberElement.textContent = lineNumbers.join("\n");
-    this._lineContentElement.textContent = lines.join("\n");
+
+    this.element.textContent = lines.join("\n");
+
+    // The last empty line will get swallowed otherwise.
+    if (!lines[lines.length - 1])
+        this.element.appendChild(document.createElement("br"));
 }
 
-WebInspector.TextChunk.prototype = {
+WebInspector.TextEditorMainChunk.prototype = {
     addDecoration: function(decoration)
     {
         if (typeof decoration === "string") {
@@ -674,7 +961,8 @@ WebInspector.TextChunk.prototype = {
         }
         if (!this.element.decorationsElement) {
             this.element.decorationsElement = document.createElement("div");
-            this._lineContentElement.appendChild(this.element.decorationsElement);
+            this.element.decorationsElement.className = "webkit-line-decorations";
+            this.element.appendChild(this.element.decorationsElement);
         }
         this.element.decorationsElement.appendChild(decoration);
     },
@@ -703,71 +991,63 @@ WebInspector.TextChunk.prototype = {
         this._expanded = expanded;
 
         if (this.linesCount === 1) {
-            this._textModel.setAttribute(this.startLine, "line-row", this.element);
             if (expanded)
-                this._textViewer._paintLines(this.startLine, this.startLine + 1);
+                this._textViewer._paintLine(this.element, this.startLine);
             return;
         }
 
         if (expanded) {
+            this._expandedLineRows = [];
             var parentElement = this.element.parentElement;
             for (var i = this.startLine; i < this.startLine + this.linesCount; ++i) {
                 var lineRow = this._createRow(i);
-                this._textModel.setAttribute(i, "line-row", lineRow);
                 parentElement.insertBefore(lineRow, this.element);
+                this._expandedLineRows.push(lineRow);
+                this._textViewer._paintLine(lineRow, i);
             }
             parentElement.removeChild(this.element);
-
-            this._textViewer._paintLines(this.startLine, this.startLine + this.linesCount);
         } else {
-            var firstLine = this._textModel.getAttribute(this.startLine, "line-row");
-            var parentElement = firstLine.parentElement;
-            this._textViewer._releaseLinesHighlight(this.startLine, this.startLine + this.linesCount);
-
-            parentElement.insertBefore(this.element, firstLine);
-            for (var i = this.startLine; i < this.startLine + this.linesCount; ++i) {
-                var lineRow = this._textModel.getAttribute(i, "line-row");
-                this._textModel.removeAttribute(i, "line-row");
-                this._textViewer._cachedRows.push(lineRow);
-                parentElement.removeChild(lineRow);
+            var elementInserted = false;
+            for (var i = 0; i < this._expandedLineRows.length; ++i) {
+                var lineRow = this._expandedLineRows[i];
+                var parentElement = lineRow.parentElement;
+                if (parentElement) {
+                    if (!elementInserted) {
+                        elementInserted = true;
+                        parentElement.insertBefore(this.element, lineRow);
+                    }
+                    this._textViewer._releaseLinesHighlight(lineRow);
+                    parentElement.removeChild(lineRow);
+                }
             }
+            delete this._expandedLineRows;
         }
     },
 
     get height()
     {
-        if (!this._expanded)
-            return this.element.offsetHeight;
-        var result = 0;
-        for (var i = this.startLine; i < this.startLine + this.linesCount; ++i) {
-            var lineRow = this._textModel.getAttribute(i, "line-row");
-            result += lineRow.offsetHeight;
-        }
-        return result;
+        if (!this._expandedLineRows)
+            return this._textViewer._totalHeight(this.element);
+        return this._textViewer._totalHeight(this._expandedLineRows[0], this._expandedLineRows[this._expandedLineRows.length - 1]);
     },
 
     _createRow: function(lineNumber)
     {
-        var cachedRows = this._textViewer._cachedRows;
-        if (cachedRows.length) {
-            var lineRow = cachedRows[cachedRows.length - 1];
-            cachedRows.length--;
-            var lineNumberElement = lineRow.firstChild;
-            var lineContentElement = lineRow.lastChild;
-        } else {
-            var lineRow = document.createElement("tr");
-
-            var lineNumberElement = document.createElement("td");
-            lineNumberElement.className = "webkit-line-number";
-            lineRow.appendChild(lineNumberElement);
-
-            var lineContentElement = document.createElement("td");
-            lineContentElement.className = "webkit-line-content";
-            lineRow.appendChild(lineContentElement);
-        }
+        var lineRow = this._textViewer._cachedRows.pop() || document.createElement("div");
         lineRow.lineNumber = lineNumber;
-        lineNumberElement.textContent = lineNumber + 1;
-        lineContentElement.textContent = this._textModel.line(lineNumber);
+        lineRow.className = "webkit-line-content";
+        lineRow.textContent = this._textModel.line(lineNumber);
+        if (!lineRow.textContent)
+            lineRow.appendChild(document.createElement("br"));
         return lineRow;
+    },
+
+    getExpandedLineRow: function(lineNumber)
+    {
+        if (!this._expanded || lineNumber < this.startLine || lineNumber >= this.startLine + this.linesCount)
+            return null;
+        if (!this._expandedLineRows)
+            return this.element;
+        return this._expandedLineRows[lineNumber - this.startLine];
     }
 }
diff --git a/Source/WebCore/inspector/front-end/UglifyJS/parse-js.js b/Source/WebCore/inspector/front-end/UglifyJS/parse-js.js
index a218c01..a559145 100644
--- a/Source/WebCore/inspector/front-end/UglifyJS/parse-js.js
+++ b/Source/WebCore/inspector/front-end/UglifyJS/parse-js.js
@@ -182,7 +182,6 @@ var OPERATORS = array_to_hash([
         ">>=",
         "<<=",
         ">>>=",
-        "~=",
         "%=",
         "|=",
         "^=",
@@ -253,18 +252,19 @@ function is_token(token, type, val) {
 
 var EX_EOF = {};
 
-function tokenizer($TEXT, skip_comments) {
+function tokenizer($TEXT) {
 
         var S = {
-                text           : $TEXT.replace(/\r\n?|[\n\u2028\u2029]/g, "\n").replace(/^\uFEFF/, ''),
-                pos            : 0,
-                tokpos         : 0,
-                line           : 0,
-                tokline        : 0,
-                col            : 0,
-                tokcol         : 0,
-                newline_before : false,
-                regex_allowed  : false
+                text            : $TEXT.replace(/\r\n?|[\n\u2028\u2029]/g, "\n").replace(/^\uFEFF/, ''),
+                pos             : 0,
+                tokpos          : 0,
+                line            : 0,
+                tokline         : 0,
+                col             : 0,
+                tokcol          : 0,
+                newline_before  : false,
+                regex_allowed   : false,
+                comments_before : []
         };
 
         function peek() { return S.text.charAt(S.pos); };
@@ -299,7 +299,7 @@ function tokenizer($TEXT, skip_comments) {
                 S.tokpos = S.pos;
         };
 
-        function token(type, value) {
+        function token(type, value, is_comment) {
                 S.regex_allowed = ((type == "operator" && !HOP(UNARY_POSTFIX, value)) ||
                                    (type == "keyword" && HOP(KEYWORDS_BEFORE_EXPRESSION, value)) ||
                                    (type == "punc" && HOP(PUNC_BEFORE_EXPRESSION, value)));
@@ -311,6 +311,10 @@ function tokenizer($TEXT, skip_comments) {
                         pos   : S.tokpos,
                         nlb   : S.newline_before
                 };
+                if (!is_comment) {
+                        ret.comments_before = S.comments_before;
+                        S.comments_before = [];
+                }
                 S.newline_before = false;
                 return ret;
         };
@@ -334,7 +338,7 @@ function tokenizer($TEXT, skip_comments) {
         };
 
         function read_num(prefix) {
-                var has_e = false, after_e = false, has_x = false;
+                var has_e = false, after_e = false, has_x = false, has_dot = prefix == ".";
                 var num = read_while(function(ch, i){
                         if (ch == "x" || ch == "X") {
                                 if (has_x) return false;
@@ -350,7 +354,12 @@ function tokenizer($TEXT, skip_comments) {
                         }
                         if (ch == "+") return after_e;
                         after_e = false;
-                        return is_alphanumeric_char(ch) || ch == ".";
+                        if (ch == ".") {
+                                if (!has_dot)
+                                        return has_dot = true;
+                                return false;
+                        }
+                        return is_alphanumeric_char(ch);
                 });
                 if (prefix)
                         num = prefix + num;
@@ -412,7 +421,7 @@ function tokenizer($TEXT, skip_comments) {
                         ret = S.text.substring(S.pos, i);
                         S.pos = i;
                 }
-                return token("comment1", ret);
+                return token("comment1", ret, true);
         };
 
         function read_multiline_comment() {
@@ -420,8 +429,9 @@ function tokenizer($TEXT, skip_comments) {
                 return with_eof_error("Unterminated multiline comment", function(){
                         var i = find("*/", true),
                             text = S.text.substring(S.pos, i),
-                            tok = token("comment2", text);
+                            tok = token("comment2", text, true);
                         S.pos = i + 2;
+                        S.line += text.split("\n").length - 1;
                         S.newline_before = text.indexOf("\n") >= 0;
                         return tok;
                 });
@@ -455,6 +465,7 @@ function tokenizer($TEXT, skip_comments) {
 
         function read_operator(prefix) {
                 function grow(op) {
+                        if (!peek()) return op;
                         var bigger = op + peek();
                         if (HOP(OPERATORS, bigger)) {
                                 next();
@@ -466,19 +477,18 @@ function tokenizer($TEXT, skip_comments) {
                 return token("operator", grow(prefix || next()));
         };
 
-        var handle_slash = skip_comments ? function() {
+        function handle_slash() {
                 next();
                 var regex_allowed = S.regex_allowed;
                 switch (peek()) {
-                    case "/": read_line_comment(); S.regex_allowed = regex_allowed; return next_token();
-                    case "*": read_multiline_comment(); S.regex_allowed = regex_allowed; return next_token();
-                }
-                return S.regex_allowed ? read_regexp() : read_operator("/");
-        } : function() {
-                next();
-                switch (peek()) {
-                    case "/": return read_line_comment();
-                    case "*": return read_multiline_comment();
+                    case "/":
+                        S.comments_before.push(read_line_comment());
+                        S.regex_allowed = regex_allowed;
+                        return next_token();
+                    case "*":
+                        S.comments_before.push(read_multiline_comment());
+                        S.regex_allowed = regex_allowed;
+                        return next_token();
                 }
                 return S.regex_allowed ? read_regexp() : read_operator("/");
         };
@@ -559,7 +569,7 @@ var ASSIGNMENT = (function(a, ret, i){
         }
         return ret;
 })(
-        ["+=", "-=", "/=", "*=", "%=", ">>=", "<<=", ">>>=", "~=", "%=", "|=", "^=", "&="],
+        ["+=", "-=", "/=", "*=", "%=", ">>=", "<<=", ">>>=", "|=", "^=", "&="],
         { "=": true },
         0
 );
@@ -605,13 +615,13 @@ NodeWithToken.prototype.toString = function() { return this.name; };
 function parse($TEXT, strict_mode, embed_tokens) {
 
         var S = {
-                input: tokenizer($TEXT, true),
-                token: null,
-                prev: null,
-                peeked: null,
-                in_function: 0,
-                in_loop: 0,
-                labels: []
+                input       : typeof $TEXT == "string" ? tokenizer($TEXT, true) : $TEXT,
+                token       : null,
+                prev        : null,
+                peeked      : null,
+                in_function : 0,
+                in_loop     : 0,
+                labels      : []
         };
 
         S.token = next();
@@ -1016,20 +1026,23 @@ function parse($TEXT, strict_mode, embed_tokens) {
                 unexpected();
         };
 
-        function expr_list(closing, allow_trailing_comma) {
+        function expr_list(closing, allow_trailing_comma, allow_empty) {
                 var first = true, a = [];
                 while (!is("punc", closing)) {
                         if (first) first = false; else expect(",");
-                        if (allow_trailing_comma && is("punc", closing))
-                                break;
-                        a.push(expression(false));
+                        if (allow_trailing_comma && is("punc", closing)) break;
+                        if (is("punc", ",") && allow_empty) {
+                                a.push([ "atom", "undefined" ]);
+                        } else {
+                                a.push(expression(false));
+                        }
                 }
                 next();
                 return a;
         };
 
         function array_() {
-                return as("array", expr_list("]", !strict_mode));
+                return as("array", expr_list("]", !strict_mode, true));
         };
 
         function object_() {
@@ -1231,3 +1244,4 @@ exports.KEYWORDS = KEYWORDS;
 exports.ATOMIC_START_TOKEN = ATOMIC_START_TOKEN;
 exports.OPERATORS = OPERATORS;
 exports.is_alphanumeric_char = is_alphanumeric_char;
+exports.is_identifier_char = is_identifier_char;
diff --git a/Source/WebCore/inspector/front-end/UglifyJS/process.js b/Source/WebCore/inspector/front-end/UglifyJS/process.js
index 65dbc0e..5e32dd0 100755
--- a/Source/WebCore/inspector/front-end/UglifyJS/process.js
+++ b/Source/WebCore/inspector/front-end/UglifyJS/process.js
@@ -69,139 +69,135 @@ var jsp = require("./parse-js"),
 
 function ast_walker(ast) {
         function _vardefs(defs) {
-                return MAP(defs, function(def){
+                return [ this[0], MAP(defs, function(def){
                         var a = [ def[0] ];
                         if (def.length > 1)
                                 a[1] = walk(def[1]);
                         return a;
-                });
+                }) ];
         };
         var walkers = {
                 "string": function(str) {
-                        return [ "string", str ];
+                        return [ this[0], str ];
                 },
                 "num": function(num) {
-                        return [ "num", num ];
+                        return [ this[0], num ];
                 },
                 "name": function(name) {
-                        return [ "name", name ];
+                        return [ this[0], name ];
                 },
                 "toplevel": function(statements) {
-                        return [ "toplevel", MAP(statements, walk) ];
+                        return [ this[0], MAP(statements, walk) ];
                 },
                 "block": function(statements) {
-                        var out = [ "block" ];
+                        var out = [ this[0] ];
                         if (statements != null)
                                 out.push(MAP(statements, walk));
                         return out;
                 },
-                "var": function(defs) {
-                        return [ "var", _vardefs(defs) ];
-                },
-                "const": function(defs) {
-                        return [ "const", _vardefs(defs) ];
-                },
+                "var": _vardefs,
+                "const": _vardefs,
                 "try": function(t, c, f) {
                         return [
-                                "try",
+                                this[0],
                                 MAP(t, walk),
                                 c != null ? [ c[0], MAP(c[1], walk) ] : null,
                                 f != null ? MAP(f, walk) : null
                         ];
                 },
                 "throw": function(expr) {
-                        return [ "throw", walk(expr) ];
+                        return [ this[0], walk(expr) ];
                 },
                 "new": function(ctor, args) {
-                        return [ "new", walk(ctor), MAP(args, walk) ];
+                        return [ this[0], walk(ctor), MAP(args, walk) ];
                 },
                 "switch": function(expr, body) {
-                        return [ "switch", walk(expr), MAP(body, function(branch){
+                        return [ this[0], walk(expr), MAP(body, function(branch){
                                 return [ branch[0] ? walk(branch[0]) : null,
                                          MAP(branch[1], walk) ];
                         }) ];
                 },
                 "break": function(label) {
-                        return [ "break", label ];
+                        return [ this[0], label ];
                 },
                 "continue": function(label) {
-                        return [ "continue", label ];
+                        return [ this[0], label ];
                 },
                 "conditional": function(cond, t, e) {
-                        return [ "conditional", walk(cond), walk(t), walk(e) ];
+                        return [ this[0], walk(cond), walk(t), walk(e) ];
                 },
                 "assign": function(op, lvalue, rvalue) {
-                        return [ "assign", op, walk(lvalue), walk(rvalue) ];
+                        return [ this[0], op, walk(lvalue), walk(rvalue) ];
                 },
                 "dot": function(expr) {
-                        return [ "dot", walk(expr) ].concat(slice(arguments, 1));
+                        return [ this[0], walk(expr) ].concat(slice(arguments, 1));
                 },
                 "call": function(expr, args) {
-                        return [ "call", walk(expr), MAP(args, walk) ];
+                        return [ this[0], walk(expr), MAP(args, walk) ];
                 },
                 "function": function(name, args, body) {
-                        return [ "function", name, args.slice(), MAP(body, walk) ];
+                        return [ this[0], name, args.slice(), MAP(body, walk) ];
                 },
                 "defun": function(name, args, body) {
-                        return [ "defun", name, args.slice(), MAP(body, walk) ];
+                        return [ this[0], name, args.slice(), MAP(body, walk) ];
                 },
                 "if": function(conditional, t, e) {
-                        return [ "if", walk(conditional), walk(t), walk(e) ];
+                        return [ this[0], walk(conditional), walk(t), walk(e) ];
                 },
                 "for": function(init, cond, step, block) {
-                        return [ "for", walk(init), walk(cond), walk(step), walk(block) ];
+                        return [ this[0], walk(init), walk(cond), walk(step), walk(block) ];
                 },
                 "for-in": function(has_var, key, hash, block) {
-                        return [ "for-in", has_var, key, walk(hash), walk(block) ];
+                        return [ this[0], has_var, key, walk(hash), walk(block) ];
                 },
                 "while": function(cond, block) {
-                        return [ "while", walk(cond), walk(block) ];
+                        return [ this[0], walk(cond), walk(block) ];
                 },
                 "do": function(cond, block) {
-                        return [ "do", walk(cond), walk(block) ];
+                        return [ this[0], walk(cond), walk(block) ];
                 },
                 "return": function(expr) {
-                        return [ "return", walk(expr) ];
+                        return [ this[0], walk(expr) ];
                 },
                 "binary": function(op, left, right) {
-                        return [ "binary", op, walk(left), walk(right) ];
+                        return [ this[0], op, walk(left), walk(right) ];
                 },
                 "unary-prefix": function(op, expr) {
-                        return [ "unary-prefix", op, walk(expr) ];
+                        return [ this[0], op, walk(expr) ];
                 },
                 "unary-postfix": function(op, expr) {
-                        return [ "unary-postfix", op, walk(expr) ];
+                        return [ this[0], op, walk(expr) ];
                 },
                 "sub": function(expr, subscript) {
-                        return [ "sub", walk(expr), walk(subscript) ];
+                        return [ this[0], walk(expr), walk(subscript) ];
                 },
                 "object": function(props) {
-                        return [ "object", MAP(props, function(p){
+                        return [ this[0], MAP(props, function(p){
                                 return p.length == 2
                                         ? [ p[0], walk(p[1]) ]
                                         : [ p[0], walk(p[1]), p[2] ]; // get/set-ter
                         }) ];
                 },
                 "regexp": function(rx, mods) {
-                        return [ "regexp", rx, mods ];
+                        return [ this[0], rx, mods ];
                 },
                 "array": function(elements) {
-                        return [ "array", MAP(elements, walk) ];
+                        return [ this[0], MAP(elements, walk) ];
                 },
                 "stat": function(stat) {
-                        return [ "stat", walk(stat) ];
+                        return [ this[0], walk(stat) ];
                 },
                 "seq": function() {
-                        return [ "seq" ].concat(MAP(slice(arguments), walk));
+                        return [ this[0] ].concat(MAP(slice(arguments), walk));
                 },
                 "label": function(name, block) {
-                        return [ "label", name, walk(block) ];
+                        return [ this[0], name, walk(block) ];
                 },
                 "with": function(expr, block) {
-                        return [ "with", walk(expr), walk(block) ];
+                        return [ this[0], walk(expr), walk(block) ];
                 },
                 "atom": function(name) {
-                        return [ "atom", name ];
+                        return [ this[0], name ];
                 }
         };
 
@@ -405,7 +401,7 @@ function ast_add_scope(ast) {
                         },
                         "try": function(t, c, f) {
                                 if (c != null) return [
-                                        "try",
+                                        this[0],
                                         MAP(t, walk),
                                         [ define(c[0]), MAP(c[1], walk) ],
                                         f != null ? MAP(f, walk) : null
@@ -491,9 +487,9 @@ function ast_mangle(ast, do_toplevel) {
         };
 
         function _vardefs(defs) {
-                return MAP(defs, function(d){
+                return [ this[0], MAP(defs, function(d){
                         return [ get_mangled(d[0]), walk(d[1]) ];
-                });
+                }) ];
         };
 
         return w.with_walkers({
@@ -510,28 +506,25 @@ function ast_mangle(ast, do_toplevel) {
                         }
                         return ast;
                 },
-                "var": function(defs) {
-                        return [ "var", _vardefs(defs) ];
-                },
-                "const": function(defs) {
-                        return [ "const", _vardefs(defs) ];
-                },
+                "var": _vardefs,
+                "const": _vardefs,
                 "name": function(name) {
-                        return [ "name", get_mangled(name) ];
+                        return [ this[0], get_mangled(name) ];
                 },
                 "try": function(t, c, f) {
-                        return [ "try",
+                        return [ this[0],
                                  MAP(t, walk),
                                  c != null ? [ get_mangled(c[0]), MAP(c[1], walk) ] : null,
                                  f != null ? MAP(f, walk) : null ];
                 },
                 "toplevel": function(body) {
-                        return with_scope(this.scope, function(){
-                                return [ "toplevel", MAP(body, walk) ];
+                        var self = this;
+                        return with_scope(self.scope, function(){
+                                return [ self[0], MAP(body, walk) ];
                         });
                 },
                 "for-in": function(has_var, name, obj, stat) {
-                        return [ "for-in", has_var, get_mangled(name), walk(obj), walk(stat) ];
+                        return [ this[0], has_var, get_mangled(name), walk(obj), walk(stat) ];
                 }
         }, function() {
                 return walk(ast_add_scope(ast));
@@ -569,28 +562,29 @@ function aborts(t) {
         }
 };
 
-function negate(c) {
-        var not_c = [ "unary-prefix", "!", c ];
-        switch (c[0]) {
-            case "unary-prefix":
-                return c[1] == "!" ? c[2] : not_c;
-            case "binary":
-                var op = c[1], left = c[2], right = c[3];
-                switch (op) {
-                    case "<=": return [ "binary", ">", left, right ];
-                    case "<": return [ "binary", ">=", left, right ];
-                    case ">=": return [ "binary", "<", left, right ];
-                    case ">": return [ "binary", "<=", left, right ];
-                    case "==": return [ "binary", "!=", left, right ];
-                    case "!=": return [ "binary", "==", left, right ];
-                    case "===": return [ "binary", "!==", left, right ];
-                    case "!==": return [ "binary", "===", left, right ];
-                    case "&&": return best_of(not_c, [ "binary", "||", negate(left), negate(right) ]);
-                    case "||": return best_of(not_c, [ "binary", "&&", negate(left), negate(right) ]);
-                }
-                break;
-        }
-        return not_c;
+function boolean_expr(expr) {
+        return ( (expr[0] == "unary-prefix"
+                  && member(expr[1], [ "!", "delete" ])) ||
+
+                 (expr[0] == "binary"
+                  && member(expr[1], [ "in", "instanceof", "==", "!=", "===", "!==", "<", "<=", ">=", ">" ])) ||
+
+                 (expr[0] == "binary"
+                  && member(expr[1], [ "&&", "||" ])
+                  && boolean_expr(expr[2])
+                  && boolean_expr(expr[3])) ||
+
+                 (expr[0] == "conditional"
+                  && boolean_expr(expr[2])
+                  && boolean_expr(expr[3])) ||
+
+                 (expr[0] == "assign"
+                  && expr[1] === true
+                  && boolean_expr(expr[3])) ||
+
+                 (expr[0] == "seq"
+                  && boolean_expr(expr[expr.length - 1]))
+               );
 };
 
 function make_conditional(c, t, e) {
@@ -609,12 +603,44 @@ function ast_squeeze(ast, options) {
         options = defaults(options, {
                 make_seqs   : true,
                 dead_code   : true,
-                no_warnings : false,
-                extra       : false
+                keep_comps  : true,
+                no_warnings : false
         });
 
         var w = ast_walker(), walk = w.walk, scope;
 
+        function negate(c) {
+                    var not_c = [ "unary-prefix", "!", c ];
+                switch (c[0]) {
+                    case "unary-prefix":
+                        return c[1] == "!" && boolean_expr(c[2]) ? c[2] : not_c;
+                    case "seq":
+                        c = slice(c);
+                        c[c.length - 1] = negate(c[c.length - 1]);
+                        return c;
+                    case "conditional":
+                        return best_of(not_c, [ "conditional", c[1], negate(c[2]), negate(c[3]) ]);
+                    case "binary":
+                        var op = c[1], left = c[2], right = c[3];
+                        if (!options.keep_comps) switch (op) {
+                            case "<="  : return [ "binary", ">", left, right ];
+                            case "<"   : return [ "binary", ">=", left, right ];
+                            case ">="  : return [ "binary", "<", left, right ];
+                            case ">"   : return [ "binary", "<=", left, right ];
+                        }
+                        switch (op) {
+                            case "=="  : return [ "binary", "!=", left, right ];
+                            case "!="  : return [ "binary", "==", left, right ];
+                            case "===" : return [ "binary", "!==", left, right ];
+                            case "!==" : return [ "binary", "===", left, right ];
+                            case "&&"  : return best_of(not_c, [ "binary", "||", negate(left), negate(right) ]);
+                            case "||"  : return best_of(not_c, [ "binary", "&&", negate(left), negate(right) ]);
+                        }
+                        break;
+                }
+                return not_c;
+        };
+
         function with_scope(s, cont) {
                 var _scope = scope;
                 scope = s;
@@ -628,87 +654,12 @@ function ast_squeeze(ast, options) {
                 return node[0] == "string" || node[0] == "num";
         };
 
-        function find_first_execute(node) {
-                if (!node)
-                        return false;
-
-                switch (node[0]) {
-                        case "num":
-                        case "string":
-                        case "name":
-                                return node;
-                        case "call":
-                        case "conditional":
-                        case "for":
-                        case "if":
-                        case "new":
-                        case "return":
-                        case "stat":
-                        case "switch":
-                        case "throw":
-                                return find_first_execute(node[1]);
-                        case "binary":
-                                return find_first_execute(node[2]);
-                        case "assign":
-                                if (node[1] === true)
-                                        return find_first_execute(node[3]);
-                                break;
-                        case "var":
-                                if (node[1][0].length > 1)
-                                        return find_first_execute(node[1][0][1]);
-                                break;
-                }
-                return null;
-        }
-
-        function find_assign_recursive(p, v) {
-                if (p[0] == "assign" && p[1] != true || p[0] == "unary-prefix") {
-                        if (p[2][0] == "name" && v[0] == "name" && p[2][1] == v[1])
-                                return true;
-                        return false;
-                }
-
-                if (p[0] != "assign" || p[1] !== true)
-                        return false;
-
-                if ((is_constant(p[3]) && p[3][0] == v[0] && p[3][1] == v[1]) ||
-                    (p[3][0] == "name" && v[0] == "name" && p[3][1] == v[1]) ||
-                    (p[2][0] == "name" && v[0] == "name" && p[2][1] == v[1]))
-                        return true;
-
-                return find_assign_recursive(p[3], v);
-        };
-
         function rmblock(block) {
                 if (block != null && block[0] == "block" && block[1] && block[1].length == 1)
                         block = block[1][0];
                 return block;
         };
 
-        function clone(obj) {
-                if (obj && obj.constructor == Array)
-                        return MAP(obj, clone);
-                return obj;
-        };
-
-        function make_seq_to_statements(node) {
-                if (node[0] != "seq") {
-                        switch (node[0]) {
-                                case "var":
-                                case "const":
-                                        return [ node ];
-                                default:
-                                        return [ [ "stat", node ] ];
-                        }
-                }
-
-                var ret = [];
-                for (var i = 1; i < node.length; i++)
-                        ret.push.apply(ret, make_seq_to_statements(node[i]));
-
-                return ret;
-        };
-
         function _lambda(name, args, body) {
                 return [ this[0], name, args, with_scope(body.scope, function(){
                         return tighten(MAP(body, walk), "lambda");
@@ -734,64 +685,6 @@ function ast_squeeze(ast, options) {
                         return a;
                 }, []);
 
-                if (options.extra) {
-                        // Detightening things. We do this because then we can assume that the
-                        // statements are structured in a specific way.
-                        statements = (function(a, prev) {
-                                statements.forEach(function(cur) {
-                                        switch (cur[0]) {
-                                            case "for":
-                                                if (cur[1] != null) {
-                                                        a.push.apply(a, make_seq_to_statements(cur[1]));
-                                                        cur[1] = null;
-                                                }
-                                                a.push(cur);
-                                                break;
-                                            case "stat":
-                                                var stats = make_seq_to_statements(cur[1]);
-                                                stats.forEach(function(s) {
-                                                        if (s[1][0] == "unary-postfix")
-                                                                s[1][0] = "unary-prefix";
-                                                });
-                                                a.push.apply(a, stats);
-                                                break;
-                                            default:
-                                                a.push(cur);
-                                        }
-                                });
-                                return a;
-                        })([]);
-
-                        statements = (function(a, prev) {
-                                statements.forEach(function(cur) {
-                                        if (!(prev && prev[0] == "stat")) {
-                                                a.push(cur);
-                                                prev = cur;
-                                                return;
-                                        }
-
-                                        var p = prev[1];
-                                        var c = find_first_execute(cur);
-                                        if (c && find_assign_recursive(p, c)) {
-                                                var old_cur = clone(cur);
-                                                c.splice(0, c.length);
-                                                c.push.apply(c, p);
-                                                var tmp_cur = best_of(cur, [ "toplevel", [ prev, old_cur ] ]);
-                                                if (tmp_cur == cur) {
-                                                        a[a.length -1] = cur;
-                                                } else {
-                                                        cur = old_cur;
-                                                        a.push(cur);
-                                                }
-                                        } else {
-                                                a.push(cur);
-                                        }
-                                        prev = cur;
-                                });
-                                return a;
-                        })([]);
-                }
-
                 statements = (function(a, prev){
                         statements.forEach(function(cur){
                                 if (prev && ((cur[0] == "var" && prev[0] == "var") ||
@@ -835,22 +728,6 @@ function ast_squeeze(ast, options) {
                         return a;
                 })([]);
 
-                if (options.extra) {
-                        statements = (function(a, prev){
-                                statements.forEach(function(cur){
-                                        var replaced = false;
-                                        if (prev && cur[0] == "for" && cur[1] == null && (prev[0] == "var" || prev[0] == "const" || prev[0] == "stat")) {
-                                                cur[1] = prev;
-                                                a[a.length - 1] = cur;
-                                        } else {
-                                                a.push(cur);
-                                        }
-                                        prev = cur;
-                                });
-                                return a;
-                        })([]);
-                }
-
                 if (block_type == "lambda") statements = (function(i, a, stat){
                         while (i < statements.length) {
                                 stat = statements[i++];
@@ -901,7 +778,10 @@ function ast_squeeze(ast, options) {
                 if (empty(e) && empty(t))
                         return [ "stat", c ];
                 var ret = [ "if", c, t, e ];
-                if (t[0] == "stat") {
+                if (t[0] == "if" && empty(t[3]) && empty(e)) {
+                        ret = best_of(ret, walk([ "if", [ "binary", "&&", c, t[1] ], t[2] ]));
+                }
+                else if (t[0] == "stat") {
                         if (e) {
                                 if (e[0] == "stat") {
                                         ret = best_of(ret, [ "stat", make_conditional(c, t[1], e[1]) ]);
@@ -972,23 +852,34 @@ function ast_squeeze(ast, options) {
                         left = walk(left);
                         right = walk(right);
                         var best = [ "binary", op, left, right ];
-                        if (is_constant(right)) {
-                                if (is_constant(left)) {
-                                        var val = null;
-                                        switch (op) {
-                                            case "+": val = left[1] + right[1]; break;
-                                            case "*": val = left[1] * right[1]; break;
-                                            case "/": val = left[1] / right[1]; break;
-                                            case "-": val = left[1] - right[1]; break;
-                                            case "<<": val = left[1] << right[1]; break;
-                                            case ">>": val = left[1] >> right[1]; break;
-                                            case ">>>": val = left[1] >>> right[1]; break;
-                                        }
-                                        if (val != null) {
-                                                best = best_of(best, [ typeof val == "string" ? "string" : "num", val ]);
+                        if (is_constant(right) && is_constant(left)) {
+                                var val = {};
+                                var orig = val;
+                                switch (op) {
+                                    case "+"   : val = left[1] +   right[1]; break;
+                                    case "*"   : val = left[1] *   right[1]; break;
+                                    case "/"   : val = left[1] /   right[1]; break;
+                                    case "-"   : val = left[1] -   right[1]; break;
+                                    case "<<"  : val = left[1] <<  right[1]; break;
+                                    case ">>"  : val = left[1] >>  right[1]; break;
+                                    case ">>>" : val = left[1] >>> right[1]; break;
+                                    case "=="  : val = left[1] ==  right[1]; break;
+                                    case "===" : val = left[1] === right[1]; break;
+                                    case "!="  : val = left[1] !=  right[1]; break;
+                                    case "!==" : val = left[1] !== right[1]; break;
+                                    case "<"   : val = left[1] <   right[1]; break;
+                                    case "<="  : val = left[1] <=  right[1]; break;
+                                    case ">"   : val = left[1] >   right[1]; break;
+                                    case ">="  : val = left[1] >=  right[1]; break;
+                                }
+                                if (val !== orig) {
+                                        switch (typeof val) {
+                                            case "string": val = [ "string", val ]; break;
+                                            case "boolean": val = [ "name", val+"" ]; break;
+                                            case "number": val = [ "num", val ]; break;
+                                            default: return best;
                                         }
-                                } else if (left[0] == "binary" && left[1] == "+" && left[3][0] == "string") {
-                                        best = best_of(best, [ "binary", "+", left[2], [ "string", left[3][1] + right[1] ] ]);
+                                        best = best_of(best, walk(val));
                                 }
                         }
                         return best;
@@ -1004,17 +895,12 @@ function ast_squeeze(ast, options) {
                                 f != null ? tighten(MAP(f, walk)) : null
                         ];
                 },
-                "unary-prefix": function(op, cond) {
-                        if (op == "!") {
-                                cond = walk(cond);
-                                if (cond[0] == "unary-prefix" && cond[1] == "!") {
-                                        var p = w.parent();
-                                        if (p[0] == "unary-prefix" && p[1] == "!")
-                                                return cond[2];
-                                        return [ "unary-prefix", "!", cond ];
-                                }
-                                return best_of(this, negate(cond));
-                        }
+                "unary-prefix": function(op, expr) {
+                        expr = walk(expr);
+                        var ret = [ "unary-prefix", op, expr ];
+                        if (op == "!")
+                                ret = best_of(ret, negate(expr));
+                        return ret;
                 },
                 "name": function(name) {
                         switch (name) {
@@ -1253,7 +1139,9 @@ function gen_code(ast, beautify) {
                 },
                 "dot": function(expr) {
                         var out = make(expr), i = 1;
-                        if (needs_parens(expr))
+                        if (expr[0] == "num")
+                                out += ".";
+                        else if (needs_parens(expr))
                                 out = "(" + out + ")";
                         while (i < arguments.length)
                                 out += "." + make_name(arguments[i++]);
@@ -1314,7 +1202,8 @@ function gen_code(ast, beautify) {
                                 left = "(" + left + ")";
                         }
                         if (member(rvalue[0], [ "assign", "conditional", "seq" ]) ||
-                            rvalue[0] == "binary" && PRECEDENCE[operator] >= PRECEDENCE[rvalue[1]]) {
+                            rvalue[0] == "binary" && PRECEDENCE[operator] >= PRECEDENCE[rvalue[1]] &&
+                            !(rvalue[1] == operator && member(operator, [ "&&", "||", "*" ]))) {
                                 right = "(" + right + ")";
                         }
                         return add_spaces([ left, operator, right ]);
@@ -1350,7 +1239,8 @@ function gen_code(ast, beautify) {
                                         var key = p[0], val = make(p[1]);
                                         if (beautify && beautify.quote_keys) {
                                                 key = make_string(key);
-                                        } else if (typeof key == "number" || !beautify && +key + "" == key) {
+                                        } else if ((typeof key == "number" || !beautify && +key + "" == key)
+                                                   && parseFloat(key) >= 0) {
                                                 key = make_num(+key);
                                         } else if (!is_identifier(key)) {
                                                 key = make_string(key);
@@ -1367,6 +1257,7 @@ function gen_code(ast, beautify) {
                 "array": function(elements) {
                         if (elements.length == 0) return "[]";
                         return add_spaces([ "[", add_commas(MAP(elements, function(el){
+                                if (!beautify && el[0] == "atom" && el[1] == "undefined") return "";
                                 return parenthesize(el, "seq");
                         })), "]" ]);
                 },
@@ -1384,12 +1275,6 @@ function gen_code(ast, beautify) {
                 },
                 "atom": function(name) {
                         return make_name(name);
-                },
-                "comment1": function(text) {
-                        return "//" + text + "\n";
-                },
-                "comment2": function(text) {
-                        return "/*" + text + "*/";
                 }
         };
 
@@ -1442,8 +1327,16 @@ function gen_code(ast, beautify) {
                         var stat = statements[i];
                         var code = make(stat);
                         if (code != ";") {
-                                if (!beautify && i == last)
-                                        code = code.replace(/;+\s*$/, "");
+                                if (!beautify && i == last) {
+                                        if ((stat[0] == "while" && empty(stat[2])) ||
+                                            (member(stat[0], [ "for", "for-in"] ) && empty(stat[4])) ||
+                                            (stat[0] == "if" && empty(stat[2]) && !stat[3]) ||
+                                            (stat[0] == "if" && stat[3] && empty(stat[3]))) {
+                                                code = code.replace(/;*\s*$/, ";");
+                                        } else {
+                                                code = code.replace(/;+\s*$/, "");
+                                        }
+                                }
                                 a.push(code);
                         }
                 }
@@ -1498,6 +1391,49 @@ function gen_code(ast, beautify) {
         return make(ast);
 };
 
+function split_lines(code, max_line_length) {
+        var splits = [ 0 ];
+        jsp.parse(function(){
+                var next_token = jsp.tokenizer(code);
+                var last_split = 0;
+                var prev_token;
+                function current_length(tok) {
+                        return tok.pos - last_split;
+                };
+                function split_here(tok) {
+                        last_split = tok.pos;
+                        splits.push(last_split);
+                };
+                function custom(){
+                        var tok = next_token.apply(this, arguments);
+                        out: {
+                                if (prev_token) {
+                                        if (prev_token.type == "keyword") break out;
+                                }
+                                if (current_length(tok) > max_line_length) {
+                                        switch (tok.type) {
+                                            case "keyword":
+                                            case "atom":
+                                            case "name":
+                                            case "punc":
+                                                split_here(tok);
+                                                break out;
+                                        }
+                                }
+                        }
+                        prev_token = tok;
+                        return tok;
+                };
+                custom.context = function() {
+                        return next_token.context.apply(this, arguments);
+                };
+                return custom;
+        }());
+        return splits.map(function(pos, i){
+                return code.substring(pos, splits[i + 1] || code.length);
+        }).join("\n");
+};
+
 /* -----[ Utilities ]----- */
 
 function repeat_string(str, i) {
@@ -1558,3 +1494,5 @@ exports.gen_code = gen_code;
 exports.ast_add_scope = ast_add_scope;
 exports.ast_squeeze_more = require("./squeeze-more").ast_squeeze_more;
 exports.set_logger = function(logger) { warn = logger };
+exports.make_string = make_string;
+exports.split_lines = split_lines;
diff --git a/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js b/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
index a01046b..a6f59ca 100644
--- a/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
@@ -139,7 +139,7 @@ WebInspector.WatchExpressionsSection.prototype = {
             if (!expression)
                 continue;
 
-            WebInspector.console.evalInInspectedWindow("(" + expression + ")", this._watchObjectGroupId, appendResult.bind(this, expression, i));
+            WebInspector.console.evalInInspectedWindow("(" + expression + ")", this._watchObjectGroupId, false, appendResult.bind(this, expression, i));
         }
 
         // note this is setting the expansion of the tree, not the section;
diff --git a/Source/WebCore/inspector/front-end/WebKit.qrc b/Source/WebCore/inspector/front-end/WebKit.qrc
index edc1861..dd325ba 100644
--- a/Source/WebCore/inspector/front-end/WebKit.qrc
+++ b/Source/WebCore/inspector/front-end/WebKit.qrc
@@ -13,7 +13,6 @@
     <file>BreakpointManager.js</file>
     <file>BreakpointsSidebarPane.js</file>
     <file>CallStackSidebarPane.js</file>
-    <file>ChangesView.js</file>
     <file>Checkbox.js</file>
     <file>Color.js</file>
     <file>ConsolePanel.js</file>
@@ -28,6 +27,7 @@
     <file>Database.js</file>
     <file>DatabaseQueryView.js</file>
     <file>DatabaseTableView.js</file>
+    <file>DetailedHeapshotView.js</file>
     <file>DataGrid.js</file>
     <file>DebuggerModel.js</file>
     <file>DOMAgent.js</file>
@@ -44,10 +44,10 @@
     <file>ExtensionPanel.js</file>
     <file>ExtensionRegistryStub.js</file>
     <file>ExtensionServer.js</file>
-    <file>FileSystemView.js</file>
     <file>FontView.js</file>
     <file>GoToLineDialog.js</file>
     <file>HAREntry.js</file>
+    <file>HeapSnapshot.js</file>
     <file>HeapSnapshotView.js</file>
     <file>HelpScreen.js</file>
     <file>ImageView.js</file>
@@ -64,6 +64,7 @@
     <file>Panel.js</file>
     <file>PanelEnablerView.js</file>
     <file>Placard.js</file>
+    <file>PleaseWaitMessage.js</file>
     <file>Popover.js</file>
     <file>ProfileDataGridTree.js</file>
     <file>ProfilesPanel.js</file>
@@ -84,18 +85,18 @@
     <file>ScriptFormatter.js</file>
     <file>ScriptFormatterWorker.js</file>
     <file>ScriptsPanel.js</file>
-    <file>ScriptView.js</file>
     <file>Section.js</file>
     <file>Settings.js</file>
     <file>ShortcutsHelp.js</file>
+    <file>ShowMoreDataGridNode.js</file>
     <file>SidebarPane.js</file>
     <file>SidebarTreeElement.js</file>
     <file>SourceCSSTokenizer.js</file>
     <file>SourceFrame.js</file>
+    <file>SourceFrameContent.js</file>
     <file>SourceHTMLTokenizer.js</file>
     <file>SourceJavaScriptTokenizer.js</file>
     <file>SourceTokenizer.js</file>
-    <file>SourceView.js</file>
     <file>StatusBarButton.js</file>
     <file>StylesSidebarPane.js</file>
     <file>SummaryBar.js</file>
diff --git a/Source/WebCore/inspector/front-end/inspector.css b/Source/WebCore/inspector/front-end/inspector.css
index f629d12..c992806 100644
--- a/Source/WebCore/inspector/front-end/inspector.css
+++ b/Source/WebCore/inspector/front-end/inspector.css
@@ -428,10 +428,6 @@ body.port-qt #dock-status-bar-item {
     -webkit-mask-image: url(Images/clearConsoleButtonGlyph.png);
 }
 
-#changes-status-bar-item .glyph {
-    -webkit-mask-image: url(Images/consoleButtonGlyph.png); /* TODO: Needs Image for Changes Toggle Button */
-}
-
 #counters {
     position: absolute;
     right: 16px;
@@ -442,22 +438,14 @@ body.port-qt #dock-status-bar-item {
     height: 19px;
 }
 
-#changes-count, #error-warning-count {
+#error-warning-count {
     display: inline;
 }
 
-#error-warning-count:hover, #changes-count:hover {
+#error-warning-count:hover {
     border-bottom: 1px solid rgb(96, 96, 96);
 }
 
-#style-changes-count::before {
-    content: url(Images/styleIcon.png); /* TODO: Needs Image for Style Changes Icon */
-    width: 10px;
-    height: 10px;
-    vertical-align: -1px;
-    margin-right: 2px;
-}
-
 #error-count::before {
     content: url(Images/errorIcon.png);
     width: 10px;
@@ -466,7 +454,7 @@ body.port-qt #dock-status-bar-item {
     margin-right: 2px;
 }
     
-#changes-count + #error-warning-count, #error-count + #warning-count {
+#error-count + #warning-count {
     margin-left: 6px;
 }
 
@@ -685,6 +673,7 @@ body.platform-linux .monospace, body.platform-linux .source-code {
 
 .console-message-url {
     float: right;
+    margin-left: 4px;
 }
 
 .console-group-messages .section {
@@ -2096,6 +2085,10 @@ li.selected .base-storage-tree-element-subtitle {
     content: url(Images/treeDownTriangleBlack.png);
 }
 
+.data-grid button {
+    line-height: 19px;
+}
+
 body.inactive .data-grid th.sort-ascending, body.inactive .data-grid th.sort-descending {
     background-image: url(Images/glossyHeader.png);
     border-right: 1px solid rgb(179, 179, 179);
@@ -4320,3 +4313,17 @@ a.worker-item:hover {
 .cursor-auto {
     cursor: auto;
 }
+
+.please-wait-msg {
+    position: absolute;
+    left: 0;
+    top: 0;
+    border: 4px black solid;
+    border-radius: 4px;
+    background-color: black;
+    opacity: 0.85;
+    color: white;
+    font-size: 12px;
+    font-weight: bold;
+    z-index: 10000;
+}
diff --git a/Source/WebCore/inspector/front-end/inspector.html b/Source/WebCore/inspector/front-end/inspector.html
index 0e0b9e9..0435dc3 100644
--- a/Source/WebCore/inspector/front-end/inspector.html
+++ b/Source/WebCore/inspector/front-end/inspector.html
@@ -54,9 +54,9 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="Popover.js"></script>
     <script type="text/javascript" src="TabbedPane.js"></script>
     <script type="text/javascript" src="Placard.js"></script>
+    <script type="text/javascript" src="PleaseWaitMessage.js"></script>
     <script type="text/javascript" src="View.js"></script>
     <script type="text/javascript" src="Drawer.js"></script>
-    <script type="text/javascript" src="ChangesView.js"></script>
     <script type="text/javascript" src="ConsoleView.js"></script>
     <script type="text/javascript" src="Panel.js"></script>
     <script type="text/javascript" src="TimelineGrid.js"></script>    
@@ -68,10 +68,10 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="DOMStorage.js"></script>
     <script type="text/javascript" src="DOMStorageItemsView.js"></script>
     <script type="text/javascript" src="DataGrid.js"></script>
+    <script type="text/javascript" src="ShowMoreDataGridNode.js"></script>
     <script type="text/javascript" src="CookiesTable.js"></script>
     <script type="text/javascript" src="CookieItemsView.js"></script>
     <script type="text/javascript" src="ApplicationCacheItemsView.js"></script>
-    <script type="text/javascript" src="FileSystemView.js"></script>
     <script type="text/javascript" src="Script.js"></script>
     <script type="text/javascript" src="Breakpoint.js"></script>
     <script type="text/javascript" src="BreakpointManager.js"></script>
@@ -101,6 +101,9 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="ElementsPanel.js"></script>
     <script type="text/javascript" src="NetworkPanel.js"></script>
     <script type="text/javascript" src="InjectedFakeWorker.js"></script>
+    <script type="text/javascript" src="SourceFrame.js"></script>
+    <script type="text/javascript" src="SourceFrameContent.js"></script>
+    <script type="text/javascript" src="ResourceView.js"></script>
     <script type="text/javascript" src="ScriptsPanel.js"></script>
     <script type="text/javascript" src="ResourcesPanel.js"></script>
     <script type="text/javascript" src="ProfilesPanel.js"></script>
@@ -120,8 +123,6 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="ResourceCookiesView.js"></script>
     <script type="text/javascript" src="ResourceTimingView.js"></script>
     <script type="text/javascript" src="NetworkItemView.js"></script>
-    <script type="text/javascript" src="ResourceView.js"></script>
-    <script type="text/javascript" src="SourceFrame.js"></script>
     <script type="text/javascript" src="ScriptFormatter.js"></script>
     <script type="text/javascript" src="DOMSyntaxHighlighter.js"></script>
     <script type="text/javascript" src="TextEditorModel.js"></script>
@@ -131,17 +132,17 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="SourceCSSTokenizer.js"></script>
     <script type="text/javascript" src="SourceHTMLTokenizer.js"></script>
     <script type="text/javascript" src="SourceJavaScriptTokenizer.js"></script>
-    <script type="text/javascript" src="SourceView.js"></script>
     <script type="text/javascript" src="FontView.js"></script>
     <script type="text/javascript" src="ImageView.js"></script>
     <script type="text/javascript" src="DatabaseTableView.js"></script>
     <script type="text/javascript" src="DatabaseQueryView.js"></script>
-    <script type="text/javascript" src="ScriptView.js"></script>
     <script type="text/javascript" src="ProfileDataGridTree.js"></script>
     <script type="text/javascript" src="BottomUpProfileDataGridTree.js"></script>
     <script type="text/javascript" src="TopDownProfileDataGridTree.js"></script>
     <script type="text/javascript" src="ProfileView.js"></script>
+    <script type="text/javascript" src="HeapSnapshot.js"></script>
     <script type="text/javascript" src="HeapSnapshotView.js"></script>
+    <script type="text/javascript" src="DetailedHeapshotView.js"></script>
     <script type="text/javascript" src="DebuggerModel.js"></script>
     <script type="text/javascript" src="DOMAgent.js"></script>
     <script type="text/javascript" src="TimelineAgent.js"></script>
@@ -164,7 +165,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     </div>
     <div id="main">
         <div id="main-panels" spellcheck="false"></div>
-        <div id="main-status-bar" class="status-bar"><div id="anchored-status-bar-items"><button id="dock-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><button id="console-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><button id="changes-status-bar-item" class="status-bar-item hidden"></button><div id="counters"><div id="changes-count" class="hidden"></div><div id="error-warning-count" class="hidden"></div></div></div></div>
+        <div id="main-status-bar" class="status-bar"><div id="anchored-status-bar-items"><button id="dock-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><button id="console-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><div id="counters"><div id="error-warning-count" class="hidden"></div></div></div></div>
     </div>
     <div id="drawer">
         <div id="console-view"><div id="console-messages" class="monospace"><div id="console-prompt" spellcheck="false"><br></div></div></div>
diff --git a/Source/WebCore/inspector/front-end/inspector.js b/Source/WebCore/inspector/front-end/inspector.js
index 77abe78..0959289 100644
--- a/Source/WebCore/inspector/front-end/inspector.js
+++ b/Source/WebCore/inspector/front-end/inspector.js
@@ -223,8 +223,12 @@ var WebInspector = {
         if (hiddenPanels.indexOf("profiles") === -1) {
             this.panels.profiles = new WebInspector.ProfilesPanel();
             this.panels.profiles.registerProfileType(new WebInspector.CPUProfileType());
-            if (Preferences.heapProfilerPresent)
-                this.panels.profiles.registerProfileType(new WebInspector.HeapSnapshotProfileType());
+            if (Preferences.heapProfilerPresent) {
+                if (!Preferences.detailedHeapProfiles)
+                    this.panels.profiles.registerProfileType(new WebInspector.HeapSnapshotProfileType());
+                else
+                    this.panels.profiles.registerProfileType(new WebInspector.DetailedHeapshotProfileType());
+            }
         }
         if (hiddenPanels.indexOf("audits") === -1)
             this.panels.audits = new WebInspector.AuditsPanel();
@@ -344,53 +348,6 @@ var WebInspector = {
             errorWarningElement.title = null;
     },
 
-    get styleChanges()
-    {
-        return this._styleChanges;
-    },
-
-    set styleChanges(x)
-    {
-        x = Math.max(x, 0);
-
-        if (this._styleChanges === x)
-            return;
-        this._styleChanges = x;
-        this._updateChangesCount();
-    },
-
-    _updateChangesCount: function()
-    {
-        // TODO: Remove immediate return when enabling the Changes Panel
-        return;
-
-        var changesElement = document.getElementById("changes-count");
-        if (!changesElement)
-            return;
-
-        if (!this.styleChanges) {
-            changesElement.addStyleClass("hidden");
-            return;
-        }
-
-        changesElement.removeStyleClass("hidden");
-        changesElement.removeChildren();
-
-        if (this.styleChanges) {
-            var styleChangesElement = document.createElement("span");
-            styleChangesElement.id = "style-changes-count";
-            styleChangesElement.textContent = this.styleChanges;
-            changesElement.appendChild(styleChangesElement);
-        }
-
-        if (this.styleChanges) {
-            if (this.styleChanges === 1)
-                changesElement.title = WebInspector.UIString("%d style change", this.styleChanges);
-            else
-                changesElement.title = WebInspector.UIString("%d style changes", this.styleChanges);
-        }
-    },
-
     highlightDOMNode: function(nodeId)
     {
         if ("_hideDOMNodeHighlightTimeout" in this) {
@@ -445,6 +402,11 @@ var WebInspector = {
     resourceForURL: function(url)
     {
         return this.resourceTreeModel.resourceForURL(url);
+    },
+
+    openLinkExternallyLabel: function()
+    {
+        return WebInspector.UIString("Open Link in New Window");
     }
 }
 
@@ -471,7 +433,9 @@ WebInspector.PlatformFlavor = {
 WebInspector.loaded = function()
 {
     if ("page" in WebInspector.queryParamsObject) {
-        WebInspector.socket = new WebSocket("ws://" + window.location.host + "/devtools/page/" + WebInspector.queryParamsObject.page);
+        var page = WebInspector.queryParamsObject.page;
+        var host = "host" in WebInspector.queryParamsObject ? WebInspector.queryParamsObject.host : window.location.host;
+        WebInspector.socket = new WebSocket("ws://" + host + "/devtools/page/" + page);
         WebInspector.socket.onmessage = function(message) { InspectorBackend.dispatch(message.data); }
         WebInspector.socket.onerror = function(error) { console.error(error); }
         WebInspector.socket.onopen = function() {
@@ -506,9 +470,6 @@ WebInspector.doLoadedDone = function()
 
     this.drawer = new WebInspector.Drawer();
     this.console = new WebInspector.ConsoleView(this.drawer);
-    // TODO: Uncomment when enabling the Changes Panel
-    // this.changes = new WebInspector.ChangesView(this.drawer);
-    // TODO: Remove class="hidden" from inspector.html on button#changes-status-bar-item
     this.drawer.visibleView = this.console;
     this.resourceTreeModel = new WebInspector.ResourceTreeModel();
     this.networkManager = new WebInspector.NetworkManager(this.resourceTreeModel);
@@ -573,12 +534,6 @@ WebInspector.doLoadedDone = function()
     errorWarningCount.addEventListener("click", this.showConsole.bind(this), false);
     this._updateErrorAndWarningCounts();
 
-    this.styleChanges = 0;
-    // TODO: Uncomment when enabling the Changes Panel
-    // var changesElement = document.getElementById("changes-count");
-    // changesElement.addEventListener("click", this.showChanges.bind(this), false);
-    // this._updateErrorAndWarningCounts();
-
     var searchField = document.getElementById("search");
     searchField.addEventListener("search", this.performSearch.bind(this), false); // when the search is emptied
     searchField.addEventListener("mousedown", this._searchFieldManualFocus.bind(this), false); // when the search field is manually selected
@@ -597,6 +552,13 @@ WebInspector.doLoadedDone = function()
     }
     InspectorBackend.populateScriptObjects(onPopulateScriptObjects);
 
+    if (Preferences.debuggerAlwaysEnabled || WebInspector.settings.debuggerEnabled)
+        this.debuggerModel.enableDebugger();
+    if (Preferences.profilerAlwaysEnabled || WebInspector.settings.profilerEnabled)
+        InspectorBackend.enableProfiler();
+    if (WebInspector.settings.monitoringXHREnabled)
+        InspectorBackend.setMonitoringXHREnabled(true);
+
     InspectorBackend.setConsoleMessagesEnabled(true);
 
     function propertyNamesCallback(names)
@@ -913,13 +875,13 @@ WebInspector.documentKeyDown = function(event)
 
         case "U+0052": // R key
             if ((event.metaKey && isMac) || (event.ctrlKey && !isMac)) {
-                InspectorBackend.reloadPage();
+                InspectorBackend.reloadPage(event.shiftKey);
                 event.preventDefault();
             }
             break;
         case "F5":
             if (!isMac)
-                InspectorBackend.reloadPage();
+                InspectorBackend.reloadPage(event.ctrlKey || event.shiftKey);
             break;
     }
 }
@@ -946,6 +908,7 @@ WebInspector.animateStyle = function(animations, duration, callback)
 {
     var interval;
     var complete = 0;
+    var hasCompleted = false;
 
     const intervalDuration = (1000 / 30); // 30 frames per second.
     const animationsLength = animations.length;
@@ -1014,14 +977,32 @@ WebInspector.animateStyle = function(animations, duration, callback)
 
         // End condition.
         if (complete >= duration) {
+            hasCompleted = true;
             clearInterval(interval);
             if (callback)
                 callback();
         }
     }
 
+    function forceComplete()
+    {
+        if (!hasCompleted) {
+            complete = duration;
+            animateLoop();
+        }
+    }
+
+    function cancel()
+    {
+        hasCompleted = true;
+        clearInterval(interval);
+    }
+
     interval = setInterval(animateLoop, intervalDuration);
-    return interval;
+    return {
+        cancel: cancel,
+        forceComplete: forceComplete
+    };
 }
 
 WebInspector.updateSearchLabel = function()
@@ -1147,11 +1128,6 @@ WebInspector.showConsole = function()
     this.drawer.showView(this.console);
 }
 
-WebInspector.showChanges = function()
-{
-    this.drawer.showView(this.changes);
-}
-
 WebInspector.showPanel = function(panel)
 {
     if (!(panel in this.panels))
@@ -1171,8 +1147,8 @@ WebInspector.domContentEventFired = function(time)
 WebInspector.loadEventFired = function(time)
 {
     this.panels.audits.mainResourceLoadTime = time;
-    if (this.panels.network)
-        this.panels.network.mainResourceLoadTime = time;
+    this.panels.network.mainResourceLoadTime = time;
+    this.panels.resources.loadEventFired();
     this.extensionServer.notifyPageLoaded((time - WebInspector.mainResource.startTime) * 1000);
     this.mainResourceLoadTime = time;
 }
@@ -1381,6 +1357,8 @@ WebInspector.showSourceLine = function(url, line, preferredPanel)
     this.currentPanel = this._choosePanelToShowSourceLine(url, line, preferredPanel);
     if (!this.currentPanel)
         return false;
+    if (this.drawer)
+        this.drawer.immediatelyFinishAnimation();
     this.currentPanel.showSourceLine(url, line);
     return true;
 }
@@ -1511,7 +1489,19 @@ WebInspector.completeURL = function(baseURL, href)
         var path = href;
         if (path.charAt(0) !== "/") {
             var basePath = parsedURL.path;
-            path = basePath.substring(0, basePath.lastIndexOf("/")) + "/" + path;
+            // A href of "?foo=bar" implies "basePath?foo=bar".
+            // With "basePath?a=b" and "?foo=bar" we should get "basePath?foo=bar".
+            var prefix;
+            if (path.charAt(0) === "?") {
+                var basePathCutIndex = basePath.indexOf("?");
+                if (basePathCutIndex !== -1)
+                    prefix = basePath.substring(0, basePathCutIndex);
+                else
+                    prefix = basePath;
+            } else
+                prefix = basePath.substring(0, basePath.lastIndexOf("/")) + "/";
+
+            path = prefix + path;
         } else if (path.length > 1 && path.charAt(1) === "/") {
             // href starts with "//" which is a full URL with the protocol dropped (use the baseURL protocol).
             return parsedURL.scheme + ":" + path;
@@ -1576,6 +1566,12 @@ WebInspector.performSearch = function(event)
     this.doPerformSearch(event.target.value, forceSearch, event.shiftKey, false);
 }
 
+WebInspector.cancelSearch = function()
+{
+    document.getElementById("search").value = "";
+    this.doPerformSearch("");
+}
+
 WebInspector.doPerformSearch = function(query, forceSearch, isBackwardSearch, repeatSearch)
 {
     var isShortSearch = (query.length < 3);
@@ -1873,6 +1869,7 @@ WebInspector.MIMETypes = {
     "font/opentype":               {3: true},
     "application/x-font-type1":    {3: true},
     "application/x-font-ttf":      {3: true},
+    "application/x-font-woff":     {3: true},
     "application/x-truetype-font": {3: true},
     "text/javascript":             {4: true},
     "text/ecmascript":             {4: true},
diff --git a/Source/WebCore/inspector/front-end/networkPanel.css b/Source/WebCore/inspector/front-end/networkPanel.css
index 95ed1bf..c750323 100644
--- a/Source/WebCore/inspector/front-end/networkPanel.css
+++ b/Source/WebCore/inspector/front-end/networkPanel.css
@@ -65,6 +65,18 @@
     font-weight: bold;
 }
 
+.network-sidebar .data-grid.small tr.offscreen {
+    height: 21px;
+}
+
+.network-sidebar .data-grid tr.offscreen {
+    height: 41px;
+}
+
+.network-sidebar .data-grid tr.offscreen td {
+    display: none;
+}
+
 .network-sidebar .data-grid tr.filler {
     background-color: white;
 }
diff --git a/Source/WebCore/inspector/front-end/textViewer.css b/Source/WebCore/inspector/front-end/textViewer.css
index bee9fe5..f6aa65e 100644
--- a/Source/WebCore/inspector/front-end/textViewer.css
+++ b/Source/WebCore/inspector/front-end/textViewer.css
@@ -9,12 +9,34 @@
 }
 
 .text-editor-lines {
-    border: 0;
-    -webkit-border-horizontal-spacing: 0;
-    -webkit-border-vertical-spacing: 0;
+    position: absolute;
+    top: 0;
+    left: 0;
+    bottom: 0;
+    overflow: hidden;
+    -webkit-user-select: none;
+}
+
+.text-editor-contents {
+    position: absolute;
+    top: 0;
+    left: 0;
+    right: 0;
+    bottom: 0;
+    overflow: auto;
     -webkit-user-select: text;
 }
 
+.text-editor-editable {
+    -webkit-user-modify: read-write-plaintext-only;
+}
+
+.webkit-line-decorations {
+    pointer-events: none;
+    -webkit-user-select: none;
+    -webkit-user-modify: read-only;
+}
+
 .webkit-html-message-bubble {
     -webkit-box-shadow: black 0px 2px 5px;
     -webkit-border-radius: 9px;
@@ -63,7 +85,6 @@
     text-align: right;
     vertical-align: top;
     word-break: normal;
-    -webkit-user-select: none;
     padding-right: 4px;
     padding-left: 6px;
 }
@@ -86,9 +107,7 @@
 }
 
 .webkit-line-content {
-    width: 100%;
     padding-left: 2px;
-    vertical-align: top;
 }
 
 .webkit-breakpoint .webkit-line-number-outer {
@@ -136,21 +155,21 @@
     opacity: 0.3;
 }
 
-.webkit-execution-line .webkit-line-content {
+.webkit-execution-line.webkit-line-content {
     background-color: rgb(171, 191, 254);
     outline: 1px solid rgb(64, 115, 244);
 }
 
-.diff-container .webkit-added-line .webkit-line-content {
+.diff-container .webkit-added-line.webkit-line-content {
     background-color: rgb(220, 255, 220);
 }
 
-.diff-container .webkit-removed-line .webkit-line-content {
+.diff-container .webkit-removed-line.webkit-line-content {
     background-color: rgb(255, 220, 220);
     text-decoration: line-through;
 }
 
-.diff-container .webkit-changed-line .webkit-line-content {
+.diff-container .webkit-changed-line.webkit-line-content {
     background-color: rgb(220, 220, 255);
 }
 
@@ -164,7 +183,7 @@
     color: black;
 }
 
-.webkit-highlighted-line .webkit-line-content {
+.webkit-highlighted-line.webkit-line-content {
     -webkit-animation: "fadeout" 2s 0s;
 }
 
diff --git a/Source/WebCore/loader/DocumentLoader.cpp b/Source/WebCore/loader/DocumentLoader.cpp
index 6e91107..3ae23fa 100644
--- a/Source/WebCore/loader/DocumentLoader.cpp
+++ b/Source/WebCore/loader/DocumentLoader.cpp
@@ -30,13 +30,13 @@
 #include "DocumentLoader.h"
 
 #include "ApplicationCacheHost.h"
-#include "ArchiveFactory.h"
 #include "ArchiveResourceCollection.h"
 #include "CachedPage.h"
 #include "CachedResourceLoader.h"
 #include "DOMWindow.h"
 #include "Document.h"
 #include "DocumentParser.h"
+#include "DocumentWriter.h"
 #include "Event.h"
 #include "Frame.h"
 #include "FrameLoader.h"
@@ -49,11 +49,15 @@
 #include "PlatformString.h"
 #include "Settings.h"
 #include "SharedBuffer.h"
-
+#include "TextResourceDecoder.h"
 #include <wtf/Assertions.h>
 #include <wtf/text/CString.h>
 #include <wtf/unicode/Unicode.h>
 
+#if ENABLE(WEB_ARCHIVE)
+#include "ArchiveFactory.h"
+#endif
+
 namespace WebCore {
 
 static void cancelAll(const ResourceLoaderSet& loaders)
@@ -77,6 +81,7 @@ static void setAllDefersLoading(const ResourceLoaderSet& loaders, bool defers)
 DocumentLoader::DocumentLoader(const ResourceRequest& req, const SubstituteData& substituteData)
     : m_deferMainResourceDataLoad(true)
     , m_frame(0)
+    , m_writer(m_frame)
     , m_originalRequest(req)
     , m_substituteData(substituteData)
     , m_originalRequestCopy(req)
@@ -168,9 +173,9 @@ void DocumentLoader::setRequest(const ResourceRequest& req)
     KURL oldURL = m_request.url();
     m_request = req;
 
-    // Only send webView:didReceiveServerRedirectForProvisionalLoadForFrame: if URL changed.
+    // Only send webView:didReceiveServerRedirectForProvisionalLoadForFrame: if URL changed (and is non-null).
     // Also, don't send it when replacing unreachable URLs with alternate content.
-    if (!handlingUnreachableURL && oldURL != req.url())
+    if (!handlingUnreachableURL && !req.url().isNull() && oldURL != req.url())
         frameLoader()->didReceiveServerRedirectForProvisionalLoadForFrame();
 }
 
@@ -276,7 +281,7 @@ void DocumentLoader::finishedLoading()
     commitIfReady();
     if (FrameLoader* loader = frameLoader()) {
         loader->finishedLoadingDocument(this);
-        loader->writer()->end();
+        m_writer.end();
     }
 }
 
@@ -290,7 +295,11 @@ void DocumentLoader::commitLoad(const char* data, int length)
     FrameLoader* frameLoader = DocumentLoader::frameLoader();
     if (!frameLoader)
         return;
+<<<<<<< HEAD
 #if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
+=======
+#if ENABLE(WEB_ARCHIVE)
+>>>>>>> webkit.org at r78450
     if (ArchiveFactory::isArchiveMimeType(response().mimeType()))
         return;
 #endif
@@ -306,10 +315,9 @@ void DocumentLoader::commitData(const char* bytes, int length)
         userChosen = false;
         encoding = response().textEncodingName();
     }
-    // FIXME: DocumentWriter should be owned by DocumentLoader.
-    m_frame->loader()->writer()->setEncoding(encoding, userChosen);
+    m_writer.setEncoding(encoding, userChosen);
     ASSERT(m_frame->document()->parsing());
-    m_frame->loader()->writer()->addData(bytes, length);
+    m_writer.addData(bytes, length);
 }
 
 bool DocumentLoader::doesProgressiveLoad(const String& MIMEType) const
@@ -339,7 +347,7 @@ void DocumentLoader::setupForReplaceByMIMEType(const String& newMIMEType)
     }
     
     frameLoader()->finishedLoadingDocument(this);
-    m_frame->loader()->writer()->end();
+    m_writer.end();
     
     frameLoader()->setReplacing();
     m_gotFirstByte = false;
@@ -351,7 +359,11 @@ void DocumentLoader::setupForReplaceByMIMEType(const String& newMIMEType)
     
     stopLoadingSubresources();
     stopLoadingPlugIns();
+<<<<<<< HEAD
 #if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
+=======
+#if ENABLE(WEB_ARCHIVE)
+>>>>>>> webkit.org at r78450
     clearArchiveResources();
 #endif
 }
@@ -378,6 +390,7 @@ void DocumentLoader::setFrame(Frame* frame)
         return;
     ASSERT(frame && !m_frame);
     m_frame = frame;
+    m_writer.setFrame(frame);
     attachToFrame();
 }
 
@@ -440,7 +453,11 @@ bool DocumentLoader::isLoadingInAPISense() const
     return frameLoader()->subframeIsLoading();
 }
 
+<<<<<<< HEAD
 #if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
+=======
+#if ENABLE(WEB_ARCHIVE)
+>>>>>>> webkit.org at r78450
 void DocumentLoader::addAllArchiveResources(Archive* archive)
 {
     if (!m_archiveResourceCollection)
@@ -467,16 +484,6 @@ void DocumentLoader::addArchiveResource(PassRefPtr<ArchiveResource> resource)
     m_archiveResourceCollection->addResource(resource);
 }
 
-ArchiveResource* DocumentLoader::archiveResourceForURL(const KURL& url) const
-{
-    if (!m_archiveResourceCollection)
-        return 0;
-        
-    ArchiveResource* resource = m_archiveResourceCollection->archiveResourceForURL(url);
-
-    return resource && !resource->shouldIgnoreWhenUnarchiving() ? resource : 0;
-}
-
 PassRefPtr<Archive> DocumentLoader::popArchiveForSubframe(const String& frameName)
 {
     return m_archiveResourceCollection ? m_archiveResourceCollection->popSubframeArchive(frameName) : 0;
@@ -497,6 +504,17 @@ SharedBuffer* DocumentLoader::parsedArchiveData() const
 {
     return m_parsedArchiveData.get();
 }
+#endif // ENABLE(WEB_ARCHIVE)
+
+ArchiveResource* DocumentLoader::archiveResourceForURL(const KURL& url) const
+{
+    if (!m_archiveResourceCollection)
+        return 0;
+        
+    ArchiveResource* resource = m_archiveResourceCollection->archiveResourceForURL(url);
+
+    return resource && !resource->shouldIgnoreWhenUnarchiving() ? resource : 0;
+}
 
 PassRefPtr<ArchiveResource> DocumentLoader::mainResource() const
 {
@@ -605,7 +623,11 @@ void DocumentLoader::cancelPendingSubstituteLoad(ResourceLoader* loader)
         m_substituteResourceDeliveryTimer.stop();
 }
 
+<<<<<<< HEAD
 #if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
+=======
+#if ENABLE(WEB_ARCHIVE)
+>>>>>>> webkit.org at r78450
 bool DocumentLoader::scheduleArchiveLoad(ResourceLoader* loader, const ResourceRequest& request, const KURL& originalURL)
 {
     ArchiveResource* resource = 0;
@@ -626,7 +648,11 @@ bool DocumentLoader::scheduleArchiveLoad(ResourceLoader* loader, const ResourceR
     
     return true;
 }
+<<<<<<< HEAD
 #endif
+=======
+#endif // ENABLE(WEB_ARCHIVE)
+>>>>>>> webkit.org at r78450
 
 void DocumentLoader::addResponse(const ResourceResponse& r)
 {
diff --git a/Source/WebCore/loader/DocumentLoader.h b/Source/WebCore/loader/DocumentLoader.h
index 241102d..38127c1 100644
--- a/Source/WebCore/loader/DocumentLoader.h
+++ b/Source/WebCore/loader/DocumentLoader.h
@@ -30,6 +30,7 @@
 #define DocumentLoader_h
 
 #include "DocumentLoadTiming.h"
+#include "DocumentWriter.h"
 #include "NavigationAction.h"
 #include "ResourceError.h"
 #include "ResourceRequest.h"
@@ -43,8 +44,13 @@
 namespace WebCore {
 
     class ApplicationCacheHost;
+<<<<<<< HEAD
 #if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
+=======
+#if ENABLE(WEB_ARCHIVE)
+>>>>>>> webkit.org at r78450
     class Archive;
+#endif
     class ArchiveResource;
     class ArchiveResourceCollection;
 #endif
@@ -77,6 +83,8 @@ namespace WebCore {
         FrameLoader* frameLoader() const;
         MainResourceLoader* mainResourceLoader() const { return m_mainResourceLoader.get(); }
         PassRefPtr<SharedBuffer> mainResourceData() const;
+        
+        DocumentWriter* writer() const { return &m_writer; }
 
         const ResourceRequest& originalRequest() const;
         const ResourceRequest& originalRequestCopy() const;
@@ -126,26 +134,39 @@ namespace WebCore {
         void unschedule(SchedulePair*);
 #endif
 
+<<<<<<< HEAD
 #if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
+=======
+#if ENABLE(WEB_ARCHIVE)
+>>>>>>> webkit.org at r78450
         void addAllArchiveResources(Archive*);
         void addArchiveResource(PassRefPtr<ArchiveResource>);
         
-        // Return an ArchiveResource for the URL, either creating from live data or
-        // pulling from the ArchiveResourceCollection
-        PassRefPtr<ArchiveResource> subresource(const KURL&) const;
-        // Return the ArchiveResource for the URL only when loading an Archive
-        ArchiveResource* archiveResourceForURL(const KURL&) const;
-        
         PassRefPtr<Archive> popArchiveForSubframe(const String& frameName);
         void clearArchiveResources();
         void setParsedArchiveData(PassRefPtr<SharedBuffer>);
         SharedBuffer* parsedArchiveData() const;
         
+        bool scheduleArchiveLoad(ResourceLoader*, const ResourceRequest&, const KURL&);
+#endif // ENABLE(WEB_ARCHIVE)
+
+        // Return the ArchiveResource for the URL only when loading an Archive
+        ArchiveResource* archiveResourceForURL(const KURL&) const;
+
         PassRefPtr<ArchiveResource> mainResource() const;
+
+        // Return an ArchiveResource for the URL, either creating from live data or
+        // pulling from the ArchiveResourceCollection
+        PassRefPtr<ArchiveResource> subresource(const KURL&) const;
         void getSubresources(Vector<PassRefPtr<ArchiveResource> >&) const;
+<<<<<<< HEAD
         
         bool scheduleArchiveLoad(ResourceLoader*, const ResourceRequest&, const KURL&);
 #endif
+=======
+
+
+>>>>>>> webkit.org at r78450
 #ifndef NDEBUG
         bool isSubstituteLoadPending(ResourceLoader*) const;
 #endif
@@ -253,6 +274,8 @@ namespace WebCore {
         ResourceLoaderSet m_plugInStreamLoaders;
 
         RefPtr<SharedBuffer> m_mainResourceData;
+        
+        mutable DocumentWriter m_writer;
 
         // A reference to actual request used to create the data source.
         // This should only be used by the resourceLoadDelegate's
@@ -305,9 +328,14 @@ namespace WebCore {
         typedef HashMap<RefPtr<ResourceLoader>, RefPtr<SubstituteResource> > SubstituteResourceMap;
         SubstituteResourceMap m_pendingSubstituteResources;
         Timer<DocumentLoader> m_substituteResourceDeliveryTimer;
+<<<<<<< HEAD
                 
 #if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
+=======
+
+>>>>>>> webkit.org at r78450
         OwnPtr<ArchiveResourceCollection> m_archiveResourceCollection;
+#if ENABLE(WEB_ARCHIVE)
         RefPtr<SharedBuffer> m_parsedArchiveData;
 #endif
 
diff --git a/Source/WebCore/loader/DocumentThreadableLoader.cpp b/Source/WebCore/loader/DocumentThreadableLoader.cpp
index dee5001..0a132b1 100644
--- a/Source/WebCore/loader/DocumentThreadableLoader.cpp
+++ b/Source/WebCore/loader/DocumentThreadableLoader.cpp
@@ -144,6 +144,8 @@ void DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight(const R
         preflightRequest.setHTTPHeaderField("Access-Control-Request-Headers", String::adopt(headerBuffer));
     }
 
+    preflightRequest.setPriority(request.priority());
+
     loadRequest(preflightRequest, DoSecurityCheck);
 }
 
@@ -296,6 +298,8 @@ void DocumentThreadableLoader::preflightSuccess()
     OwnPtr<ResourceRequest> actualRequest;
     actualRequest.swap(m_actualRequest);
 
+    actualRequest->setHTTPOrigin(m_document->securityOrigin()->toString());
+
     // It should be ok to skip the security check since we already asked about the preflight request.
     loadRequest(*actualRequest, SkipSecurityCheck);
 }
diff --git a/Source/WebCore/loader/DocumentWriter.cpp b/Source/WebCore/loader/DocumentWriter.cpp
index 5b03cd7..af9ea53 100644
--- a/Source/WebCore/loader/DocumentWriter.cpp
+++ b/Source/WebCore/loader/DocumentWriter.cpp
@@ -67,7 +67,7 @@ DocumentWriter::DocumentWriter(Frame* frame)
 void DocumentWriter::replaceDocument(const String& source)
 {
     m_frame->loader()->stopAllLoaders();
-    begin(m_frame->loader()->url(), true, m_frame->document()->securityOrigin());
+    begin(m_frame->document()->url(), true, m_frame->document()->securityOrigin());
 
     if (!source.isNull()) {
         if (!m_receivedData) {
@@ -123,10 +123,11 @@ void DocumentWriter::begin(const KURL& url, bool dispatch, SecurityOrigin* origi
 
     bool resetScripting = !(m_frame->loader()->stateMachine()->isDisplayingInitialEmptyDocument() && m_frame->document()->securityOrigin()->isSecureTransitionTo(url));
     m_frame->loader()->clear(resetScripting, resetScripting);
+    clear();
     if (resetScripting)
         m_frame->script()->updatePlatformScriptObjects();
 
-    m_frame->loader()->setURL(url);
+    m_frame->loader()->setOutgoingReferrer(url);
     m_frame->setDocument(document);
 
     if (m_decoder)
@@ -245,7 +246,7 @@ void DocumentWriter::setDecoder(TextResourceDecoder* decoder)
 
 String DocumentWriter::deprecatedFrameEncoding() const
 {
-    return m_frame->loader()->url().isEmpty() ? m_encoding : encoding();
+    return m_frame->document()->url().isEmpty() ? m_encoding : encoding();
 }
 
 void DocumentWriter::setDocumentWasLoadedAsPartOfNavigation()
diff --git a/Source/WebCore/loader/DocumentWriter.h b/Source/WebCore/loader/DocumentWriter.h
index fb93606..9e737c1 100644
--- a/Source/WebCore/loader/DocumentWriter.h
+++ b/Source/WebCore/loader/DocumentWriter.h
@@ -53,7 +53,8 @@ public:
     void addData(const char* string, int length = -1, bool flush = false);
     void end();
     void endIfNotLoadingMainResource();
-    void clear();
+    
+    void setFrame(Frame* frame) { m_frame = frame; }
 
     String encoding() const;
     void setEncoding(const String& encoding, bool userChosen);
@@ -76,6 +77,7 @@ public:
 
 private:
     PassRefPtr<Document> createDocument(const KURL&);
+    void clear();
 
     Frame* m_frame;
 
diff --git a/Source/WebCore/loader/EmptyClients.h b/Source/WebCore/loader/EmptyClients.h
index d0a4350..4e8dd43 100644
--- a/Source/WebCore/loader/EmptyClients.h
+++ b/Source/WebCore/loader/EmptyClients.h
@@ -141,6 +141,7 @@ public:
     virtual bool shouldInterruptJavaScript() { return false; }
 
     virtual bool selectItemWritingDirectionIsNatural() { return false; }
+    virtual bool selectItemAlignmentFollowsMenuWritingDirection() { return false; }
     virtual PassRefPtr<PopupMenu> createPopupMenu(PopupMenuClient*) const { return adoptRef(new EmptyPopupMenu()); }
     virtual PassRefPtr<SearchPopupMenu> createSearchPopupMenu(PopupMenuClient*) const { return adoptRef(new EmptySearchPopupMenu()); }
 
@@ -148,6 +149,10 @@ public:
     virtual void showContextMenu() { }
 #endif
 
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+    virtual void registerProtocolHandler(const String&, const String&, const String&, const String&) { }
+#endif
+
     virtual void setStatusbarText(const String&) { }
 
     virtual bool tabsToLinks() const { return false; }
@@ -198,8 +203,6 @@ public:
     virtual void formDidFocus(const Node*) { }
     virtual void formDidBlur(const Node*) { }
 
-    virtual PassOwnPtr<HTMLParserQuirks> createHTMLParserQuirks() { return 0; }
-
     virtual void setCursor(const Cursor&) { }
 
     virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const {}
@@ -356,7 +359,7 @@ public:
     virtual void saveViewStateToItem(HistoryItem*) { }
     virtual bool canCachePage() const { return false; }
     virtual void didDisplayInsecureContent() { }
-    virtual void didRunInsecureContent(SecurityOrigin*) { }
+    virtual void didRunInsecureContent(SecurityOrigin*, const KURL&) { }
     virtual PassRefPtr<Frame> createFrame(const KURL&, const String&, HTMLFrameOwnerElement*, const String&, bool, int, int) { return 0; }
     virtual void didTransferChildFrameToNewDocument(Page*) { }
     virtual void transferLoadingResourceFromPage(unsigned long, DocumentLoader*, const ResourceRequest&, Page*) { }
@@ -555,7 +558,6 @@ public:
     virtual DragDestinationAction actionMaskForDrag(DragData*) { return DragDestinationActionNone; }
     virtual DragSourceAction dragSourceActionMaskForPoint(const IntPoint&) { return DragSourceActionNone; }
     virtual void startDrag(DragImageRef, const IntPoint&, const IntPoint&, Clipboard*, Frame*, bool) { }
-    virtual DragImageRef createDragImageForLink(KURL&, const String&, Frame*) { return 0; }
     virtual void dragControllerDestroyed() { }
 };
 #endif // ENABLE(DRAG_SUPPORT)
@@ -573,8 +575,6 @@ public:
     virtual void highlight(Node*) { }
     virtual void hideHighlight() { }
 
-    virtual void populateSetting(const String&, String*) { }
-    virtual void storeSetting(const String&, const String&) { }
     virtual bool sendMessageToFrontend(const String&) { return false; }
 };
 
diff --git a/Source/WebCore/loader/FrameLoader.cpp b/Source/WebCore/loader/FrameLoader.cpp
index 3a19791..22c59ad 100644
--- a/Source/WebCore/loader/FrameLoader.cpp
+++ b/Source/WebCore/loader/FrameLoader.cpp
@@ -34,10 +34,13 @@
 #include "FrameLoader.h"
 
 #include "ApplicationCacheHost.h"
+<<<<<<< HEAD
 #if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
 #include "Archive.h"
 #include "ArchiveFactory.h"
 #endif
+=======
+>>>>>>> webkit.org at r78450
 #include "BackForwardController.h"
 #include "BeforeUnloadEvent.h"
 #include "MemoryCache.h"
@@ -115,9 +118,15 @@
 #include "SVGViewSpec.h"
 #endif
 
+<<<<<<< HEAD
 #ifdef ANDROID_INSTRUMENT
 #include "TimeCounter.h"
 #include "RenderArena.h"
+=======
+#if ENABLE(WEB_ARCHIVE)
+#include "Archive.h"
+#include "ArchiveFactory.h"
+>>>>>>> webkit.org at r78450
 #endif
 
 namespace WebCore {
@@ -182,7 +191,6 @@ FrameLoader::FrameLoader(Frame* frame, FrameLoaderClient* client)
     , m_policyChecker(frame)
     , m_history(frame)
     , m_notifer(frame)
-    , m_writer(frame)
     , m_subframeLoader(frame)
     , m_state(FrameStateCommittedPage)
     , m_loadType(FrameLoadTypeStandard)
@@ -236,8 +244,8 @@ void FrameLoader::init()
     setState(FrameStateProvisional);
     m_provisionalDocumentLoader->setResponse(ResourceResponse(KURL(), "text/html", 0, String(), String()));
     m_provisionalDocumentLoader->finishedLoading();
-    writer()->begin(KURL(), false);
-    writer()->end();
+    m_documentLoader->writer()->begin(KURL(), false);
+    m_documentLoader->writer()->end();
     m_frame->document()->cancelParsing();
     m_stateMachine.advanceTo(FrameLoaderStateMachine::DisplayingInitialEmptyDocument);
     m_didCallImplicitClose = true;
@@ -392,7 +400,6 @@ void FrameLoader::stopLoading(UnloadEventPolicy unloadEventPolicy, DatabasePolic
                             DocumentLoadTiming* timing = documentLoader->timing();
                             ASSERT(timing->navigationStart);
                             m_frame->domWindow()->dispatchTimedEvent(unloadEvent, m_frame->domWindow()->document(), &timing->unloadEventStart, &timing->unloadEventEnd);
-                            ASSERT(timing->unloadEventStart >= timing->navigationStart);
                         } else
                             m_frame->domWindow()->dispatchEvent(unloadEvent, m_frame->domWindow()->document());
                     }
@@ -483,15 +490,16 @@ KURL FrameLoader::iconURL()
         return KURL(ParsedURLString, m_frame->document()->iconURL());
 
     // Don't return a favicon iconURL unless we're http or https
-    if (!m_URL.protocolInHTTPFamily())
+    KURL documentURL = m_frame->document()->url();
+    if (!documentURL.protocolInHTTPFamily())
         return KURL();
 
     KURL url;
-    bool couldSetProtocol = url.setProtocol(m_URL.protocol());
+    bool couldSetProtocol = url.setProtocol(documentURL.protocol());
     ASSERT_UNUSED(couldSetProtocol, couldSetProtocol);
-    url.setHost(m_URL.host());
-    if (m_URL.hasPort())
-        url.setPort(m_URL.port());
+    url.setHost(documentURL.host());
+    if (documentURL.hasPort())
+        url.setPort(documentURL.port());
     url.setPath("/favicon.ico");
     return url;
 }
@@ -520,10 +528,9 @@ bool FrameLoader::didOpenURL(const KURL& url)
             window->setDefaultStatus(String());
         }
     }
-    m_URL = url;
-    if (m_URL.protocolInHTTPFamily() && !m_URL.host().isEmpty() && m_URL.path().isEmpty())
-        m_URL.setPath("/");
-    m_workingURL = m_URL;
+    m_workingURL = url;
+    if (m_workingURL.protocolInHTTPFamily() && !m_workingURL.host().isEmpty() && m_workingURL.path().isEmpty())
+        m_workingURL.setPath("/");
 
     started();
 
@@ -543,9 +550,7 @@ void FrameLoader::didExplicitOpen()
     // from a subsequent window.document.open / window.document.write call. 
     // Canceling redirection here works for all cases because document.open 
     // implicitly precedes document.write.
-    m_frame->navigationScheduler()->cancel(); 
-    if (m_frame->document()->url() != blankURL())
-        m_URL = m_frame->document()->url();
+    m_frame->navigationScheduler()->cancel();
 }
 
 
@@ -593,7 +598,6 @@ void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects, boo
     // Do not drop the document before the ScriptController and view are cleared
     // as some destructors might still try to access the document.
     m_frame->setDocument(0);
-    writer()->clear();
 
     m_subframeLoader.clear();
 
@@ -612,8 +616,8 @@ void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects, boo
 
 void FrameLoader::receivedFirstData()
 {
-    writer()->begin(m_workingURL, false);
-    writer()->setDocumentWasLoadedAsPartOfNavigation();
+    activeDocumentLoader()->writer()->begin(m_workingURL, false);
+    activeDocumentLoader()->writer()->setDocumentWasLoadedAsPartOfNavigation();
 
     dispatchDidCommitLoad();
     dispatchDidClearWindowObjectsInAllWorlds();
@@ -637,21 +641,20 @@ void FrameLoader::receivedFirstData()
         return;
 
     if (url.isEmpty())
-        url = m_URL.string();
+        url = m_frame->document()->url().string();
     else
         url = m_frame->document()->completeURL(url).string();
 
     m_frame->navigationScheduler()->scheduleRedirect(delay, url);
 }
 
-void FrameLoader::setURL(const KURL& url)
+void FrameLoader::setOutgoingReferrer(const KURL& url)
 {
-    KURL ref(url);
-    ref.setUser(String());
-    ref.setPass(String());
-    ref.removeFragmentIdentifier();
-    m_outgoingReferrer = ref.string();
-    m_URL = url;
+    KURL outgoingReferrer(url);
+    outgoingReferrer.setUser(String());
+    outgoingReferrer.setPass(String());
+    outgoingReferrer.removeFragmentIdentifier();
+    m_outgoingReferrer = outgoingReferrer.string();
 }
 
 void FrameLoader::didBeginDocument(bool dispatch)
@@ -682,6 +685,10 @@ void FrameLoader::didBeginDocument(bool dispatch)
         String dnsPrefetchControl = m_documentLoader->response().httpHeaderField("X-DNS-Prefetch-Control");
         if (!dnsPrefetchControl.isEmpty())
             m_frame->document()->parseDNSPrefetchControlHeader(dnsPrefetchControl);
+
+        String contentSecurityPolicy = m_documentLoader->response().httpHeaderField("X-WebKit-CSP");
+        if (!contentSecurityPolicy.isEmpty())
+            m_frame->document()->contentSecurityPolicy()->didReceiveHeader(contentSecurityPolicy);
     }
 
     history()->restoreDocumentState();
@@ -730,7 +737,7 @@ void FrameLoader::startIconLoader()
             if (!iconDatabase()->iconDataKnownForIconURL(urlString)) {
                 LOG(IconDatabase, "Told not to load icon %s but icon data is not yet available - registering for notification and requesting load from disk", urlString.ascii().data());
                 m_client->registerForIconNotification();
-                iconDatabase()->iconForPageURL(m_URL.string(), IntSize(0, 0));
+                iconDatabase()->iconForPageURL(m_frame->document()->url().string(), IntSize(0, 0));
                 iconDatabase()->iconForPageURL(originalRequestURL().string(), IntSize(0, 0));
             } else
                 m_client->dispatchDidReceiveIcon();
@@ -767,8 +774,8 @@ void FrameLoader::startIconLoader()
 void FrameLoader::commitIconURLToIconDatabase(const KURL& icon)
 {
     ASSERT(iconDatabase());
-    LOG(IconDatabase, "Committing iconURL %s to database for pageURLs %s and %s", icon.string().ascii().data(), m_URL.string().ascii().data(), originalRequestURL().string().ascii().data());
-    iconDatabase()->setIconURLForPageURL(icon.string(), m_URL.string());
+    LOG(IconDatabase, "Committing iconURL %s to database for pageURLs %s and %s", icon.string().ascii().data(), m_frame->document()->url().string().ascii().data(), originalRequestURL().string().ascii().data());
+    iconDatabase()->setIconURLForPageURL(icon.string(), m_frame->document()->url().string());
     iconDatabase()->setIconURLForPageURL(icon.string(), originalRequestURL().string());
 }
 
@@ -794,7 +801,7 @@ void FrameLoader::finishedParsing()
     // Check if the scrollbars are really needed for the content.
     // If not, remove them, relayout, and repaint.
     m_frame->view()->restoreScrollbar();
-    m_frame->view()->scrollToFragment(m_URL);
+    m_frame->view()->scrollToFragment(m_frame->document()->url());
 }
 
 void FrameLoader::loadDone()
@@ -923,13 +930,21 @@ void FrameLoader::loadURLIntoChildFrame(const KURL& url, const String& referer,
 {
     ASSERT(childFrame);
 
+<<<<<<< HEAD
 #if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
+=======
+#if ENABLE(WEB_ARCHIVE)
+>>>>>>> webkit.org at r78450
     RefPtr<Archive> subframeArchive = activeDocumentLoader()->popArchiveForSubframe(childFrame->tree()->uniqueName());    
     if (subframeArchive) {
         childFrame->loader()->loadArchive(subframeArchive.release());
         return;
     }
+<<<<<<< HEAD
 #endif
+=======
+#endif // ENABLE(WEB_ARCHIVE)
+>>>>>>> webkit.org at r78450
 
     HistoryItem* parentItem = history()->currentItem();
     // If we're moving in the back/forward list, we might want to replace the content
@@ -945,7 +960,11 @@ void FrameLoader::loadURLIntoChildFrame(const KURL& url, const String& referer,
     childFrame->loader()->loadURL(url, referer, String(), false, FrameLoadTypeRedirectWithLockedBackForwardList, 0, 0);
 }
 
+<<<<<<< HEAD
 #if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
+=======
+#if ENABLE(WEB_ARCHIVE)
+>>>>>>> webkit.org at r78450
 void FrameLoader::loadArchive(PassRefPtr<Archive> prpArchive)
 {
     RefPtr<Archive> archive = prpArchive;
@@ -966,7 +985,11 @@ void FrameLoader::loadArchive(PassRefPtr<Archive> prpArchive)
     documentLoader->addAllArchiveResources(archive.get());
     load(documentLoader.get());
 }
+<<<<<<< HEAD
 #endif
+=======
+#endif // ENABLE(WEB_ARCHIVE)
+>>>>>>> webkit.org at r78450
 
 ObjectContentType FrameLoader::defaultObjectContentType(const KURL& url, const String& mimeTypeIn)
 {
@@ -1037,7 +1060,7 @@ void FrameLoader::checkIfDisplayInsecureContent(SecurityOrigin* context, const K
     if (!isMixedContent(context, url))
         return;
 
-    String message = makeString("The page at ", m_URL.string(), " displayed insecure content from ", url.string(), ".\n");
+    String message = makeString("The page at ", m_frame->document()->url().string(), " displayed insecure content from ", url.string(), ".\n");
     m_frame->domWindow()->console()->addMessage(HTMLMessageSource, LogMessageType, WarningMessageLevel, message, 1, String());
 
     m_client->didDisplayInsecureContent();
@@ -1048,10 +1071,10 @@ void FrameLoader::checkIfRunInsecureContent(SecurityOrigin* context, const KURL&
     if (!isMixedContent(context, url))
         return;
 
-    String message = makeString("The page at ", m_URL.string(), " ran insecure content from ", url.string(), ".\n");
+    String message = makeString("The page at ", m_frame->document()->url().string(), " ran insecure content from ", url.string(), ".\n");
     m_frame->domWindow()->console()->addMessage(HTMLMessageSource, LogMessageType, WarningMessageLevel, message, 1, String());
 
-    m_client->didRunInsecureContent(context);
+    m_client->didRunInsecureContent(context, url);
 }
 
 Frame* FrameLoader::opener()
@@ -1129,7 +1152,7 @@ void FrameLoader::updateFirstPartyForCookies()
     if (m_frame->tree()->parent())
         setFirstPartyForCookies(m_frame->tree()->parent()->document()->firstPartyForCookies());
     else
-        setFirstPartyForCookies(m_URL);
+        setFirstPartyForCookies(m_frame->document()->url());
 }
 
 void FrameLoader::setFirstPartyForCookies(const KURL& url)
@@ -1147,6 +1170,7 @@ void FrameLoader::loadInSameDocument(const KURL& url, SerializedScriptValue* sta
     ASSERT(!stateObject || (stateObject && !isNewNavigation));
 
     // Update the data source's request with the new URL to fake the URL change
+    KURL oldURL = m_frame->document()->url();
     m_frame->document()->setURL(url);
     documentLoader()->replaceRequestURLForSameDocumentNavigation(url);
     if (isNewNavigation && !shouldTreatURLAsSameAsCurrent(url) && !stateObject) {
@@ -1164,11 +1188,8 @@ void FrameLoader::loadInSameDocument(const KURL& url, SerializedScriptValue* sta
         history()->updateBackForwardListForFragmentScroll();
     }
     
-    String oldURL;
-    bool hashChange = equalIgnoringFragmentIdentifier(url, m_URL) && url.fragmentIdentifier() != m_URL.fragmentIdentifier();
-    oldURL = m_URL;
+    bool hashChange = equalIgnoringFragmentIdentifier(url, oldURL) && url.fragmentIdentifier() != oldURL.fragmentIdentifier();
     
-    m_URL = url;
     history()->updateForSameDocumentNavigation();
 
     // If we were in the autoscroll/panScroll mode we want to stop it before following the link to the anchor
@@ -1182,7 +1203,7 @@ void FrameLoader::loadInSameDocument(const KURL& url, SerializedScriptValue* sta
     // We need to scroll to the fragment whether or not a hash change occurred, since
     // the user might have scrolled since the previous navigation.
     if (FrameView* view = m_frame->view())
-        view->scrollToFragment(m_URL);
+        view->scrollToFragment(url);
     
     m_isComplete = false;
     checkCompleted();
@@ -1733,7 +1754,11 @@ void FrameLoader::stopAllLoaders(DatabasePolicy databasePolicy, ClearProvisional
 
     setProvisionalDocumentLoader(0);
     
+<<<<<<< HEAD
 #if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
+=======
+#if ENABLE(WEB_ARCHIVE)
+>>>>>>> webkit.org at r78450
     if (m_documentLoader)
         m_documentLoader->clearArchiveResources();
 #endif
@@ -1869,7 +1894,8 @@ void FrameLoader::commitProvisionalLoad()
     RefPtr<CachedPage> cachedPage = m_loadingFromCachedPage ? pageCache()->get(history()->provisionalItem()) : 0;
     RefPtr<DocumentLoader> pdl = m_provisionalDocumentLoader;
 
-    LOG(PageCache, "WebCoreLoading %s: About to commit provisional load from previous URL '%s' to new URL '%s'", m_frame->tree()->uniqueName().string().utf8().data(), m_URL.string().utf8().data(), 
+    LOG(PageCache, "WebCoreLoading %s: About to commit provisional load from previous URL '%s' to new URL '%s'", m_frame->tree()->uniqueName().string().utf8().data(),
+        m_frame->document() ? m_frame->document()->url().string().utf8().data() : "", 
         pdl ? pdl->url().string().utf8().data() : "<no provisional DocumentLoader>");
 
     // Check to see if we need to cache the page we are navigating away from into the back/forward cache.
@@ -1923,7 +1949,8 @@ void FrameLoader::commitProvisionalLoad()
         didOpenURL(url);
     }
 
-    LOG(Loading, "WebCoreLoading %s: Finished committing provisional load to URL %s", m_frame->tree()->uniqueName().string().utf8().data(), m_URL.string().utf8().data());
+    LOG(Loading, "WebCoreLoading %s: Finished committing provisional load to URL %s", m_frame->tree()->uniqueName().string().utf8().data(),
+        m_frame->document() ? m_frame->document()->url().string().utf8().data() : "");
 
     if (m_loadType == FrameLoadTypeStandard && m_documentLoader->isClientRedirect())
         history()->updateForClientRedirect();
@@ -2051,7 +2078,7 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
             ASSERT_NOT_REACHED();
     }
 
-    writer()->setMIMEType(dl->responseMIMEType());
+    m_documentLoader->writer()->setMIMEType(dl->responseMIMEType());
 
     // Tell the client we've committed this URL.
     ASSERT(m_frame->view());
@@ -2156,7 +2183,6 @@ void FrameLoader::open(CachedFrameBase& cachedFrame)
     if (url.protocolInHTTPFamily() && !url.host().isEmpty() && url.path().isEmpty())
         url.setPath("/");
     
-    m_URL = url;
     m_workingURL = url;
 
     started();
@@ -2187,8 +2213,6 @@ void FrameLoader::open(CachedFrameBase& cachedFrame)
     m_frame->domWindow()->setURL(document->url());
     m_frame->domWindow()->setSecurityOrigin(document->securityOrigin());
 
-    writer()->setDecoder(document->decoder());
-
     updateFirstPartyForCookies();
 
     cachedFrame.restore();
@@ -2255,6 +2279,9 @@ void FrameLoader::finishedLoadingDocument(DocumentLoader* loader)
     
 #if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
 
+#if !ENABLE(WEB_ARCHIVE)
+    m_client->finishedLoading(loader);
+#else
     // Give archive machinery a crack at this document. If the MIME type is not an archive type, it will return 0.
     RefPtr<Archive> archive = ArchiveFactory::create(loader->mainResourceData().get(), loader->responseMIMEType());
     if (!archive) {
@@ -2269,7 +2296,7 @@ void FrameLoader::finishedLoadingDocument(DocumentLoader* loader)
     ArchiveResource* mainResource = archive->mainResource();
     loader->setParsedArchiveData(mainResource->data());
 
-    writer()->setMIMEType(mainResource->mimeType());
+    loader->writer()->setMIMEType(mainResource->mimeType());
 
     closeURL();
     didOpenURL(mainResource->url());
@@ -2277,11 +2304,17 @@ void FrameLoader::finishedLoadingDocument(DocumentLoader* loader)
     ASSERT(m_frame->document());
     String userChosenEncoding = documentLoader()->overrideEncoding();
     bool encodingIsUserChosen = !userChosenEncoding.isNull();
+<<<<<<< HEAD
     writer()->setEncoding(encodingIsUserChosen ? userChosenEncoding : mainResource->textEncoding(), encodingIsUserChosen);
     writer()->addData(mainResource->data()->data(), mainResource->data()->size());
 #else
     m_client->finishedLoading(loader);
 #endif // ARCHIVE
+=======
+    loader->writer()->setEncoding(encodingIsUserChosen ? userChosenEncoding : mainResource->textEncoding(), encodingIsUserChosen);
+    loader->writer()->addData(mainResource->data()->data(), mainResource->data()->size());
+#endif // ENABLE(WEB_ARCHIVE)
+>>>>>>> webkit.org at r78450
 }
 
 bool FrameLoader::isReplacing() const
@@ -2591,7 +2624,9 @@ int FrameLoader::numPendingOrLoadingRequests(bool recurse) const
 
 String FrameLoader::userAgent(const KURL& url) const
 {
-    return m_client->userAgent(url);
+    String userAgent = m_client->userAgent(url);
+    InspectorInstrumentation::applyUserAgentOverride(m_frame, &userAgent);
+    return userAgent;
 }
 
 void FrameLoader::handledOnloadEvents()
@@ -2710,7 +2745,7 @@ void FrameLoader::addExtraFieldsToRequest(ResourceRequest& request, FrameLoadTyp
     // Always try UTF-8. If that fails, try frame encoding (if any) and then the default.
     // For a newly opened frame with an empty URL, encoding() should not be used, because this methods asks decoder, which uses ISO-8859-1.
     Settings* settings = m_frame->settings();
-    request.setResponseContentDispositionEncodingFallbackArray("UTF-8", writer()->deprecatedFrameEncoding(), settings ? settings->defaultTextEncodingName() : String());
+    request.setResponseContentDispositionEncodingFallbackArray("UTF-8", activeDocumentLoader()->writer()->deprecatedFrameEncoding(), settings ? settings->defaultTextEncodingName() : String());
 }
 
 void FrameLoader::addHTTPOriginIfNeeded(ResourceRequest& request, String origin)
@@ -2893,7 +2928,7 @@ bool FrameLoader::shouldScrollToAnchor(bool isFormSubmission, const String& http
         && loadType != FrameLoadTypeReload
         && loadType != FrameLoadTypeReloadFromOrigin
         && loadType != FrameLoadTypeSame
-        && !shouldReload(this->url(), url)
+        && !shouldReload(m_frame->document()->url(), url)
         // We don't want to just scroll if a link from within a
         // frameset is trying to reload the frameset into _top.
         && !m_frame->document()->isFrameSet();
@@ -3009,10 +3044,10 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
     if (!m_frame->page())
         return;
 
-#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR) && USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER) && USE(JSC)
     if (Page* page = m_frame->page()) {
         if (page->mainFrame() == m_frame)
-            page->inspectorController()->resume();
+            m_frame->page()->inspectorController()->resume();
     }
 #endif
 
@@ -3114,7 +3149,7 @@ void FrameLoader::loadedResourceFromMemoryCache(const CachedResource* resource)
 
 void FrameLoader::applyUserAgent(ResourceRequest& request)
 {
-    String userAgent = client()->userAgent(request.url());
+    String userAgent = this->userAgent(request.url());
     ASSERT(!userAgent.isNull());
     request.setHTTPUserAgent(userAgent);
 }
@@ -3414,6 +3449,11 @@ void FrameLoader::dispatchDidClearWindowObjectInWorld(DOMWrapperWorld* world)
 
     m_client->dispatchDidClearWindowObjectInWorld(world);
 
+#if ENABLE(INSPECTOR)
+    if (Page* page = m_frame->page())
+        page->inspectorController()->didClearWindowObjectInWorld(m_frame, world);
+#endif
+
     InspectorInstrumentation::didClearWindowObjectInWorld(m_frame, world);
 }
 
diff --git a/Source/WebCore/loader/FrameLoader.h b/Source/WebCore/loader/FrameLoader.h
index b9eac9d..fd0f595 100644
--- a/Source/WebCore/loader/FrameLoader.h
+++ b/Source/WebCore/loader/FrameLoader.h
@@ -32,7 +32,6 @@
 #define FrameLoader_h
 
 #include "CachePolicy.h"
-#include "DocumentWriter.h"
 #include "FrameLoaderStateMachine.h"
 #include "FrameLoaderTypes.h"
 #include "HistoryController.h"
@@ -99,7 +98,6 @@ public:
     PolicyChecker* policyChecker() const { return &m_policyChecker; }
     HistoryController* history() const { return &m_history; }
     ResourceLoadNotifier* notifier() const { return &m_notifer; }
-    DocumentWriter* writer() const { return &m_writer; }
     SubframeLoader* subframeLoader() const { return &m_subframeLoader; }
 
     // FIXME: This is not cool, people. There are too many different functions that all start loads.
@@ -118,8 +116,13 @@ public:
     void load(const ResourceRequest&, bool lockHistory);                                        // Called by WebFrame, calls load(ResourceRequest, SubstituteData).
     void load(const ResourceRequest&, const SubstituteData&, bool lockHistory);                 // Called both by WebFrame and internally, calls load(DocumentLoader*).
     void load(const ResourceRequest&, const String& frameName, bool lockHistory);               // Called by WebPluginController.
+<<<<<<< HEAD
     
 #if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
+=======
+
+#if ENABLE(WEB_ARCHIVE)
+>>>>>>> webkit.org at r78450
     void loadArchive(PassRefPtr<Archive>);
 #endif
 
@@ -269,10 +272,7 @@ public:
 
     void frameDetached();
 
-    const KURL& url() const { return m_URL; }
-
-    // setURL is a low-level setter and does not trigger loading.
-    void setURL(const KURL&);
+    void setOutgoingReferrer(const KURL&);
 
     void loadDone();
     void finishedParsing();
@@ -437,7 +437,6 @@ private:
     mutable PolicyChecker m_policyChecker;
     mutable HistoryController m_history;
     mutable ResourceLoadNotifier m_notifer;
-    mutable DocumentWriter m_writer;
     mutable SubframeLoader m_subframeLoader;
     mutable FrameLoaderStateMachine m_stateMachine;
 
@@ -470,7 +469,6 @@ private:
 
     RefPtr<SerializedScriptValue> m_pendingStateObject;
 
-    KURL m_URL;
     KURL m_workingURL;
 
     OwnPtr<IconLoader> m_iconLoader;
diff --git a/Source/WebCore/loader/FrameLoaderClient.h b/Source/WebCore/loader/FrameLoaderClient.h
index 73860a5..e97c1e0 100644
--- a/Source/WebCore/loader/FrameLoaderClient.h
+++ b/Source/WebCore/loader/FrameLoaderClient.h
@@ -198,7 +198,7 @@ namespace WebCore {
         // The indicated security origin has run active content (such as a
         // script) from an insecure source.  Note that the insecure content can
         // spread to other frames in the same origin.
-        virtual void didRunInsecureContent(SecurityOrigin*) = 0;
+        virtual void didRunInsecureContent(SecurityOrigin*, const KURL&) = 0;
 
         virtual ResourceError cancelledError(const ResourceRequest&) = 0;
         virtual ResourceError blockedError(const ResourceRequest&) = 0;
diff --git a/Source/WebCore/loader/HistoryController.cpp b/Source/WebCore/loader/HistoryController.cpp
index 7c0fc97..7bfe380 100644
--- a/Source/WebCore/loader/HistoryController.cpp
+++ b/Source/WebCore/loader/HistoryController.cpp
@@ -236,7 +236,7 @@ void HistoryController::goToItem(HistoryItem* targetItem, FrameLoadType type)
     // Set the BF cursor before commit, which lets the user quickly click back/forward again.
     // - plus, it only makes sense for the top level of the operation through the frametree,
     // as opposed to happening for some/one of the page commits that might happen soon
-    HistoryItem* currentItem = page->backForward()->currentItem();    
+    RefPtr<HistoryItem> currentItem = page->backForward()->currentItem();
     page->backForward()->setCurrentItem(targetItem);
     Settings* settings = m_frame->settings();
     page->setGlobalHistoryItem((!settings || settings->privateBrowsingEnabled()) ? 0 : targetItem);
@@ -245,9 +245,9 @@ void HistoryController::goToItem(HistoryItem* targetItem, FrameLoadType type)
     // This must be done before trying to navigate the desired frame, because some
     // navigations can commit immediately (such as about:blank).  We must be sure that
     // all frames have provisional items set before the commit.
-    recursiveSetProvisionalItem(targetItem, currentItem, type);
+    recursiveSetProvisionalItem(targetItem, currentItem.get(), type);
     // Now that all other frames have provisional items, do the actual navigation.
-    recursiveGoToItem(targetItem, currentItem, type);
+    recursiveGoToItem(targetItem, currentItem.get(), type);
 }
 
 void HistoryController::updateForBackForwardNavigation()
@@ -323,7 +323,7 @@ void HistoryController::updateForStandardLoad(HistoryUpdateType updateType)
         if (Page* page = m_frame->page())
             addVisitedLink(page, historyURL);
 
-        if (!frameLoader->documentLoader()->didCreateGlobalHistoryEntry() && frameLoader->documentLoader()->unreachableURL().isEmpty() && !frameLoader->url().isEmpty())
+        if (!frameLoader->documentLoader()->didCreateGlobalHistoryEntry() && frameLoader->documentLoader()->unreachableURL().isEmpty() && !m_frame->document()->url().isEmpty())
             frameLoader->client()->updateGlobalHistoryRedirectLinks();
     }
 }
@@ -365,7 +365,7 @@ void HistoryController::updateForRedirectWithLockedBackForwardList()
         if (Page* page = m_frame->page())
             addVisitedLink(page, historyURL);
 
-        if (!m_frame->loader()->documentLoader()->didCreateGlobalHistoryEntry() && m_frame->loader()->documentLoader()->unreachableURL().isEmpty() && !m_frame->loader()->url().isEmpty())
+        if (!m_frame->loader()->documentLoader()->didCreateGlobalHistoryEntry() && m_frame->loader()->documentLoader()->unreachableURL().isEmpty() && !m_frame->document()->url().isEmpty())
             m_frame->loader()->client()->updateGlobalHistoryRedirectLinks();
     }
 }
@@ -402,8 +402,9 @@ void HistoryController::updateForCommit()
         LOG(History, "WebCoreHistory: Updating History for commit in frame %s", frameLoader->documentLoader()->title().utf8().data());
 #endif
     FrameLoadType type = frameLoader->loadType();
-    if (isBackForwardLoadType(type) ||
-        ((type == FrameLoadTypeReload || type == FrameLoadTypeReloadFromOrigin) && !frameLoader->provisionalDocumentLoader()->unreachableURL().isEmpty())) {
+    if (isBackForwardLoadType(type)
+        || isReplaceLoadTypeWithProvisionalItem(type)
+        || ((type == FrameLoadTypeReload || type == FrameLoadTypeReloadFromOrigin) && !frameLoader->provisionalDocumentLoader()->unreachableURL().isEmpty())) {
         // Once committed, we want to use current item for saving DocState, and
         // the provisional item for restoring state.
         // Note previousItem must be set before we close the URL, which will
@@ -423,6 +424,13 @@ void HistoryController::updateForCommit()
     }
 }
 
+bool HistoryController::isReplaceLoadTypeWithProvisionalItem(FrameLoadType type)
+{
+    // Going back to an error page in a subframe can trigger a FrameLoadTypeReplace
+    // while m_provisionalItem is set, so we need to commit it.
+    return type == FrameLoadTypeReplace && m_provisionalItem;
+}
+
 void HistoryController::recursiveUpdateForCommit()
 {
     // The frame that navigated will now have a null provisional item.
@@ -459,7 +467,7 @@ void HistoryController::recursiveUpdateForCommit()
 
 void HistoryController::updateForSameDocumentNavigation()
 {
-    if (m_frame->loader()->url().isEmpty())
+    if (m_frame->document()->url().isEmpty())
         return;
 
     Settings* settings = m_frame->settings();
@@ -470,7 +478,26 @@ void HistoryController::updateForSameDocumentNavigation()
     if (!page)
         return;
 
-    addVisitedLink(page, m_frame->loader()->url());
+    addVisitedLink(page, m_frame->document()->url());
+    page->mainFrame()->loader()->history()->recursiveUpdateForSameDocumentNavigation();
+}
+
+void HistoryController::recursiveUpdateForSameDocumentNavigation()
+{
+    // The frame that navigated will now have a null provisional item.
+    // Ignore it and its children.
+    if (!m_provisionalItem)
+        return;
+
+    // Commit the provisional item.
+    m_frameLoadComplete = false;
+    m_previousItem = m_currentItem;
+    m_currentItem = m_provisionalItem;
+    m_provisionalItem = 0;
+
+    // Iterate over the rest of the tree.
+    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
+        child->loader()->history()->recursiveUpdateForSameDocumentNavigation();
 }
 
 void HistoryController::updateForFrameLoadCompleted()
@@ -620,6 +647,7 @@ void HistoryController::recursiveSetProvisionalItem(HistoryItem* item, HistoryIt
         const HistoryItemVector& childItems = item->children();
 
         int size = childItems.size();
+
         for (int i = 0; i < size; ++i) {
             String childFrameName = childItems[i]->target();
             HistoryItem* fromChildItem = fromItem->childItemWithTarget(childFrameName);
@@ -658,14 +686,6 @@ void HistoryController::recursiveGoToItem(HistoryItem* item, HistoryItem* fromIt
 
 bool HistoryController::itemsAreClones(HistoryItem* item1, HistoryItem* item2) const
 {
-    // It appears that one of the items can be null in release builds, leading
-    // to the crashes seen in http://webkit.org/b/52819.  For now, try to
-    // narrow it down with a more specific crash.
-    if (!item1)
-        CRASH();
-    if (!item2)
-        CRASH();
-
     // If the item we're going to is a clone of the item we're at, then we do
     // not need to load it again.  The current frame tree and the frame tree
     // snapshot in the item have to match.
diff --git a/Source/WebCore/loader/HistoryController.h b/Source/WebCore/loader/HistoryController.h
index 061f235..9514d2f 100644
--- a/Source/WebCore/loader/HistoryController.h
+++ b/Source/WebCore/loader/HistoryController.h
@@ -91,7 +91,9 @@ private:
 
     void recursiveSetProvisionalItem(HistoryItem*, HistoryItem*, FrameLoadType);
     void recursiveGoToItem(HistoryItem*, HistoryItem*, FrameLoadType);
+    bool isReplaceLoadTypeWithProvisionalItem(FrameLoadType);
     void recursiveUpdateForCommit();
+    void recursiveUpdateForSameDocumentNavigation();
     bool itemsAreClones(HistoryItem*, HistoryItem*) const;
     bool currentFramesMatchItem(HistoryItem*) const;
     void updateBackForwardListClippedAtTarget(bool doClip);
diff --git a/Source/WebCore/loader/MainResourceLoader.cpp b/Source/WebCore/loader/MainResourceLoader.cpp
index e6abefd..4bdb9ad 100644
--- a/Source/WebCore/loader/MainResourceLoader.cpp
+++ b/Source/WebCore/loader/MainResourceLoader.cpp
@@ -31,6 +31,7 @@
 #include "MainResourceLoader.h"
 
 #include "ApplicationCacheHost.h"
+#include "Document.h"
 #include "DocumentLoadTiming.h"
 #include "DocumentLoader.h"
 #include "FormState.h"
diff --git a/Source/WebCore/loader/NavigationScheduler.cpp b/Source/WebCore/loader/NavigationScheduler.cpp
index d51575b..65a4551 100644
--- a/Source/WebCore/loader/NavigationScheduler.cpp
+++ b/Source/WebCore/loader/NavigationScheduler.cpp
@@ -178,11 +178,10 @@ public:
     {
         UserGestureIndicator gestureIndicator(wasUserGesture() ? DefinitelyProcessingUserGesture : DefinitelyNotProcessingUserGesture);
 
-        FrameLoader* loader = frame->loader();
         if (!m_historySteps) {
             // Special case for go(0) from a frame -> reload only the frame
             // To follow Firefox and IE's behavior, history reload can only navigate the self frame.
-            loader->urlSelected(loader->url(), "_self", 0, lockHistory(), lockBackForwardList(), SendReferrer);
+            frame->loader()->urlSelected(frame->document()->url(), "_self", 0, lockHistory(), lockBackForwardList(), SendReferrer);
             return;
         }
         // go(i!=0) from a frame navigates into the history of the frame only,
@@ -322,7 +321,7 @@ void NavigationScheduler::scheduleLocationChange(PassRefPtr<SecurityOrigin> secu
     // If the URL we're going to navigate to is the same as the current one, except for the
     // fragment part, we don't need to schedule the location change.
     KURL parsedURL(ParsedURLString, url);
-    if (parsedURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(loader->url(), parsedURL)) {
+    if (parsedURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(m_frame->document()->url(), parsedURL)) {
         loader->changeLocation(securityOrigin, loader->completeURL(url), referrer, lockHistory, lockBackForwardList);
         return;
     }
@@ -359,7 +358,7 @@ void NavigationScheduler::scheduleRefresh()
 {
     if (!shouldScheduleNavigation())
         return;
-    const KURL& url = m_frame->loader()->url();
+    const KURL& url = m_frame->document()->url();
     if (url.isEmpty())
         return;
 
diff --git a/Source/WebCore/loader/PingLoader.h b/Source/WebCore/loader/PingLoader.h
index 5988b60..252c09b 100644
--- a/Source/WebCore/loader/PingLoader.h
+++ b/Source/WebCore/loader/PingLoader.h
@@ -62,7 +62,7 @@ private:
     PingLoader(Frame*, const ResourceRequest&);
 
     void didReceiveResponse(ResourceHandle*, const ResourceResponse&) { delete this; }
-    void didReceiveData(ResourceHandle*, const char*, int) { delete this; }
+    void didReceiveData(ResourceHandle*, const char*, int, int) { delete this; }
     void didFinishLoading(ResourceHandle*, double) { delete this; }
     void didFail(ResourceHandle*, const ResourceError&) { delete this; }
     void timeout(Timer<PingLoader>*) { delete this; }
diff --git a/Source/WebCore/loader/ResourceLoadScheduler.cpp b/Source/WebCore/loader/ResourceLoadScheduler.cpp
index 8cf2c18..dbb6914 100644
--- a/Source/WebCore/loader/ResourceLoadScheduler.cpp
+++ b/Source/WebCore/loader/ResourceLoadScheduler.cpp
@@ -90,7 +90,7 @@ PassRefPtr<SubresourceLoader> ResourceLoadScheduler::scheduleSubresourceLoad(Fra
         scheduleLoad(loader.get(), priority);
     return loader;
 }
-    
+
 PassRefPtr<NetscapePlugInStreamLoader> ResourceLoadScheduler::schedulePluginStreamLoad(Frame* frame, NetscapePlugInStreamLoaderClient* client, const ResourceRequest& request)
 {
     PassRefPtr<NetscapePlugInStreamLoader> loader = NetscapePlugInStreamLoader::create(frame, client, request);
@@ -120,11 +120,12 @@ void ResourceLoadScheduler::scheduleLoad(ResourceLoader* resourceLoader, Resourc
     if (priority > ResourceLoadPriorityLow || !resourceLoader->url().protocolInHTTPFamily() || (priority == ResourceLoadPriorityLow && !hadRequests)) {
         // Try to request important resources immediately.
         servePendingRequests(host, priority);
-    } else {
-        // Handle asynchronously so early low priority requests don't get scheduled before later high priority ones.
-        InspectorInstrumentation::didScheduleResourceRequest(resourceLoader->frameLoader() ? resourceLoader->frameLoader()->frame()->document() : 0, resourceLoader->url());
-        scheduleServePendingRequests();
+        return;
     }
+
+    // Handle asynchronously so early low priority requests don't get scheduled before later high priority ones.
+    InspectorInstrumentation::didScheduleResourceRequest(resourceLoader->frameLoader() ? resourceLoader->frameLoader()->frame()->document() : 0, resourceLoader->url());
+    scheduleServePendingRequests();
 }
 
 void ResourceLoadScheduler::remove(ResourceLoader* resourceLoader)
diff --git a/Source/WebCore/loader/ResourceLoader.cpp b/Source/WebCore/loader/ResourceLoader.cpp
index 85216fb..1dab6b2 100644
--- a/Source/WebCore/loader/ResourceLoader.cpp
+++ b/Source/WebCore/loader/ResourceLoader.cpp
@@ -145,7 +145,11 @@ void ResourceLoader::start()
     ASSERT(!m_request.isNull());
     ASSERT(m_deferredRequest.isNull());
 
+<<<<<<< HEAD
 #if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
+=======
+#if ENABLE(WEB_ARCHIVE)
+>>>>>>> webkit.org at r78450
     if (m_documentLoader->scheduleArchiveLoad(this, m_request, m_request.url()))
         return;
 #endif
diff --git a/Source/WebCore/loader/SubframeLoader.cpp b/Source/WebCore/loader/SubframeLoader.cpp
index ae8ce98..8bfd474 100644
--- a/Source/WebCore/loader/SubframeLoader.cpp
+++ b/Source/WebCore/loader/SubframeLoader.cpp
@@ -46,7 +46,6 @@
 #include "RenderEmbeddedObject.h"
 #include "RenderView.h"
 #include "Settings.h"
-#include "XSSAuditor.h"
 
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
 #include "HTMLMediaElement.h"
@@ -103,11 +102,6 @@ bool SubframeLoader::requestObject(HTMLPlugInImageElement* ownerElement, const S
 {
     if (url.isEmpty() && mimeType.isEmpty())
         return false;
-    
-    if (!m_frame->script()->xssAuditor()->canLoadObject(url)) {
-        // It is unsafe to honor the request for this object.
-        return false;
-    }
 
     // FIXME: None of this code should use renderers!
     RenderEmbeddedObject* renderer = ownerElement->renderEmbeddedObject();
@@ -150,9 +144,6 @@ PassRefPtr<Widget> SubframeLoader::loadMediaPlayerProxyPlugin(Node* node, const
 {
     ASSERT(node->hasTagName(videoTag) || node->hasTagName(audioTag));
 
-    if (!m_frame->script()->xssAuditor()->canLoadObject(url.string()))
-        return 0;
-
     KURL completedURL;
     if (!url.isEmpty())
         completedURL = completeURL(url);
diff --git a/Source/WebCore/loader/appcache/ApplicationCacheStorage.cpp b/Source/WebCore/loader/appcache/ApplicationCacheStorage.cpp
index 7b20775..0c00ee6 100644
--- a/Source/WebCore/loader/appcache/ApplicationCacheStorage.cpp
+++ b/Source/WebCore/loader/appcache/ApplicationCacheStorage.cpp
@@ -89,7 +89,7 @@ static unsigned urlHostHash(const KURL& url)
     unsigned hostStart = url.hostStart();
     unsigned hostEnd = url.hostEnd();
     
-    return AlreadyHashed::avoidDeletedValue(StringImpl::computeHash(url.string().characters() + hostStart, hostEnd - hostStart));
+    return AlreadyHashed::avoidDeletedValue(WTF::StringHasher::createHash(url.string().characters() + hostStart, hostEnd - hostStart));
 }
 
 ApplicationCacheGroup* ApplicationCacheStorage::loadCacheGroup(const KURL& manifestURL)
diff --git a/Source/WebCore/loader/appcache/ManifestParser.cpp b/Source/WebCore/loader/appcache/ManifestParser.cpp
index f58a55d..df83a96 100644
--- a/Source/WebCore/loader/appcache/ManifestParser.cpp
+++ b/Source/WebCore/loader/appcache/ManifestParser.cpp
@@ -28,9 +28,9 @@
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
 
-#include "CharacterNames.h"
 #include "KURL.h"
 #include "TextResourceDecoder.h"
+#include <wtf/unicode/CharacterNames.h>
 
 using namespace std;
 
diff --git a/Source/WebCore/loader/archive/ArchiveFactory.cpp b/Source/WebCore/loader/archive/ArchiveFactory.cpp
index 5926690..693e202 100644
--- a/Source/WebCore/loader/archive/ArchiveFactory.cpp
+++ b/Source/WebCore/loader/archive/ArchiveFactory.cpp
@@ -62,7 +62,7 @@ static ArchiveMIMETypesMap& archiveMIMETypes()
     if (initialized)
         return mimeTypes;
 
-#if PLATFORM(CF) && !PLATFORM(QT)
+#if PLATFORM(CF)
     mimeTypes.set("application/x-webarchive", archiveFactoryCreate<LegacyWebArchive>);
 #elif PLATFORM(ANDROID)
     mimeTypes.set("application/x-webarchive-xml", archiveFactoryCreate<WebArchiveAndroid>);
diff --git a/Source/WebCore/loader/cache/CachedFont.cpp b/Source/WebCore/loader/cache/CachedFont.cpp
index fe3281e..19eb3ba 100644
--- a/Source/WebCore/loader/cache/CachedFont.cpp
+++ b/Source/WebCore/loader/cache/CachedFont.cpp
@@ -117,7 +117,7 @@ bool CachedFont::ensureCustomFontData()
     return m_fontData;
 }
 
-FontPlatformData CachedFont::platformDataFromCustomData(float size, bool bold, bool italic, FontOrientation orientation, FontRenderingMode renderingMode)
+FontPlatformData CachedFont::platformDataFromCustomData(float size, bool bold, bool italic, FontOrientation orientation, FontWidthVariant widthVariant, FontRenderingMode renderingMode)
 {
 #if ENABLE(SVG_FONTS)
     if (m_externalSVGDocument)
@@ -125,7 +125,7 @@ FontPlatformData CachedFont::platformDataFromCustomData(float size, bool bold, b
 #endif
 #ifdef STORE_FONT_CUSTOM_PLATFORM_DATA
     ASSERT(m_fontData);
-    return m_fontData->fontPlatformData(static_cast<int>(size), bold, italic, orientation, renderingMode);
+    return m_fontData->fontPlatformData(static_cast<int>(size), bold, italic, orientation, widthVariant, renderingMode);
 #else
     return FontPlatformData();
 #endif
diff --git a/Source/WebCore/loader/cache/CachedFont.h b/Source/WebCore/loader/cache/CachedFont.h
index 5814087..cdc32ba 100644
--- a/Source/WebCore/loader/cache/CachedFont.h
+++ b/Source/WebCore/loader/cache/CachedFont.h
@@ -29,6 +29,7 @@
 #include "CachedResource.h"
 #include "FontOrientation.h"
 #include "FontRenderingMode.h"
+#include "FontWidthVariant.h"
 #include <wtf/Vector.h>
 
 #if ENABLE(SVG_FONTS)
@@ -63,7 +64,7 @@ public:
     void beginLoadIfNeeded(CachedResourceLoader* dl);
 
     bool ensureCustomFontData();
-    FontPlatformData platformDataFromCustomData(float size, bool bold, bool italic, FontOrientation = Horizontal, FontRenderingMode = NormalRenderingMode);
+    FontPlatformData platformDataFromCustomData(float size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
 
 #if ENABLE(SVG_FONTS)
     bool isSVGFont() const { return m_isSVGFont; }
diff --git a/Source/WebCore/loader/cache/CachedImage.cpp b/Source/WebCore/loader/cache/CachedImage.cpp
index 7d9ce3d..057b8ea 100644
--- a/Source/WebCore/loader/cache/CachedImage.cpp
+++ b/Source/WebCore/loader/cache/CachedImage.cpp
@@ -103,8 +103,7 @@ void CachedImage::didAddClient(CachedResourceClient* c)
     if (m_image && !m_image->isNull())
         c->imageChanged(this);
 
-    if (!isLoading())
-        c->notifyFinished(this);
+    CachedResource::didAddClient(c);
 }
 
 void CachedImage::allClientsRemoved()
diff --git a/Source/WebCore/loader/cache/CachedResource.cpp b/Source/WebCore/loader/cache/CachedResource.cpp
index 06b3131..0f9ff45 100644
--- a/Source/WebCore/loader/cache/CachedResource.cpp
+++ b/Source/WebCore/loader/cache/CachedResource.cpp
@@ -93,8 +93,8 @@ CachedResource::CachedResource(const String& url, Type type)
     , m_loading(false)
     , m_type(type)
     , m_status(Pending)
-#ifndef NDEBUG
     , m_deleted(false)
+#ifndef NDEBUG
     , m_lruIndex(0)
 #endif
     , m_nextInAllResourcesList(0)
@@ -117,8 +117,14 @@ CachedResource::~CachedResource()
     ASSERT(!inCache());
     ASSERT(!m_deleted);
     ASSERT(url().isNull() || memoryCache()->resourceForURL(KURL(ParsedURLString, url())) != this);
-#ifndef NDEBUG
+    
+    if (m_deleted) {
+        // FIXME: Remove when http://webkit.org/b/53045 is fixed.
+        CRASH();
+    }
+    
     m_deleted = true;
+#ifndef NDEBUG
     cachedResourceLeakCounter.decrement();
 #endif
 
diff --git a/Source/WebCore/loader/cache/CachedResource.h b/Source/WebCore/loader/cache/CachedResource.h
index 5c8b38f..3379f8c 100644
--- a/Source/WebCore/loader/cache/CachedResource.h
+++ b/Source/WebCore/loader/cache/CachedResource.h
@@ -266,8 +266,9 @@ private:
     unsigned m_type : 3; // Type
     unsigned m_status : 3; // Status
 
-#ifndef NDEBUG
+    // FIXME: Move m_deleted back inside NDEBUG when http://webkit.org/b/53045 is fixed.
     bool m_deleted;
+#ifndef NDEBUG
     unsigned m_lruIndex;
 #endif
 
diff --git a/Source/WebCore/loader/cache/CachedResourceLoader.cpp b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
index de02758..211ab85 100644
--- a/Source/WebCore/loader/cache/CachedResourceLoader.cpp
+++ b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
@@ -80,9 +80,13 @@ static CachedResource* createResource(CachedResource::Type type, const KURL& url
 CachedResourceLoader::CachedResourceLoader(Document* document)
     : m_document(document)
     , m_requestCount(0)
+<<<<<<< HEAD
 #ifdef ANDROID_BLOCK_NETWORK_IMAGE
     , m_blockNetworkImage(false)
 #endif
+=======
+    , m_loadDoneActionTimer(this, &CachedResourceLoader::loadDoneActionTimerFired)
+>>>>>>> webkit.org at r78450
     , m_autoLoadImages(true)
     , m_loadFinishing(false)
     , m_allowStaleResources(false)
@@ -566,6 +570,25 @@ void CachedResourceLoader::loadDone(CachedResourceRequest* request)
         m_requests.remove(request);
     if (frame())
         frame()->loader()->loadDone();
+
+    if (!request) {
+        // If the request passed to this function is null, loadDone finished synchronously from when
+        // the load was started, so we want to kick off our next set of loads (via checkForPendingPreloads
+        // and servePendingRequests) asynchronously.
+        m_loadDoneActionTimer.startOneShot(0);
+        return;
+    }
+
+    performPostLoadActions();
+}
+
+void CachedResourceLoader::loadDoneActionTimerFired(Timer<CachedResourceLoader>*)
+{
+    performPostLoadActions();
+}
+
+void CachedResourceLoader::performPostLoadActions()
+{
     checkForPendingPreloads();
     resourceLoadScheduler()->servePendingRequests();
 }
@@ -630,11 +653,10 @@ void CachedResourceLoader::preload(CachedResource::Type type, const String& url,
 
 void CachedResourceLoader::checkForPendingPreloads() 
 {
-    unsigned count = m_pendingPreloads.size();
-    if (!count || !m_document->body() || !m_document->body()->renderer())
+    if (m_pendingPreloads.isEmpty() || !m_document->body() || !m_document->body()->renderer())
         return;
-    for (unsigned i = 0; i < count; ++i) {
-        PendingPreload& preload = m_pendingPreloads[i];
+    while (!m_pendingPreloads.isEmpty()) {
+        PendingPreload preload = m_pendingPreloads.takeFirst();
         // Don't request preload if the resource already loaded normally (this will result in double load if the page is being reloaded with cached results ignored).
         if (!cachedResource(m_document->completeURL(preload.m_url)))
             requestPreload(preload.m_type, preload.m_url, preload.m_charset);
@@ -646,7 +668,7 @@ void CachedResourceLoader::requestPreload(CachedResource::Type type, const Strin
 {
     String encoding;
     if (type == CachedResource::Script || type == CachedResource::CSSStyleSheet)
-        encoding = charset.isEmpty() ? m_document->frame()->loader()->writer()->encoding() : charset;
+        encoding = charset.isEmpty() ? m_document->charset() : charset;
 
     CachedResource* resource = requestResource(type, url, encoding, ResourceLoadPriorityUnresolved, true);
     if (!resource || (m_preloads && m_preloads->contains(resource)))
diff --git a/Source/WebCore/loader/cache/CachedResourceLoader.h b/Source/WebCore/loader/cache/CachedResourceLoader.h
index 4f67e72..bd2bfec 100644
--- a/Source/WebCore/loader/cache/CachedResourceLoader.h
+++ b/Source/WebCore/loader/cache/CachedResourceLoader.h
@@ -30,6 +30,8 @@
 #include "CachedResourceHandle.h"
 #include "CachePolicy.h"
 #include "ResourceLoadPriority.h"
+#include "Timer.h"
+#include <wtf/Deque.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/ListHashSet.h>
@@ -123,6 +125,10 @@ private:
     
     void notifyLoadedFromMemoryCache(CachedResource*);
     bool canRequest(CachedResource::Type, const KURL&);
+
+    void loadDoneActionTimerFired(Timer<CachedResourceLoader>*);
+
+    void performPostLoadActions();
     
     HashSet<String> m_validatedURLs;
     mutable DocumentResourceMap m_documentResources;
@@ -139,7 +145,9 @@ private:
         String m_url;
         String m_charset;
     };
-    Vector<PendingPreload> m_pendingPreloads;
+    Deque<PendingPreload> m_pendingPreloads;
+
+    Timer<CachedResourceLoader> m_loadDoneActionTimer;
     
     //29 bits left
 #ifdef ANDROID_BLOCK_NETWORK_IMAGE
diff --git a/Source/WebCore/loader/cache/CachedResourceRequest.cpp b/Source/WebCore/loader/cache/CachedResourceRequest.cpp
index d5e1adf..1d2f706 100644
--- a/Source/WebCore/loader/cache/CachedResourceRequest.cpp
+++ b/Source/WebCore/loader/cache/CachedResourceRequest.cpp
@@ -113,6 +113,7 @@ PassRefPtr<CachedResourceRequest> CachedResourceRequest::load(CachedResourceLoad
 #endif
 
     ResourceLoadPriority priority = resource->loadPriority();
+    resourceRequest.setPriority(priority);
 
     RefPtr<SubresourceLoader> loader = resourceLoadScheduler()->scheduleSubresourceLoad(cachedResourceLoader->document()->frame(),
         request.get(), resourceRequest, priority, securityCheck, sendResourceLoadCallbacks);
diff --git a/Source/WebCore/loader/cache/CachedScript.cpp b/Source/WebCore/loader/cache/CachedScript.cpp
index 8950ddb..bfd39c5 100644
--- a/Source/WebCore/loader/cache/CachedScript.cpp
+++ b/Source/WebCore/loader/cache/CachedScript.cpp
@@ -55,9 +55,18 @@ CachedScript::~CachedScript()
 {
 }
 
+void CachedScript::didAddClient(CachedResourceClient* c)
+{
+    if (m_decodedDataDeletionTimer.isActive())
+        m_decodedDataDeletionTimer.stop();
+
+    CachedResource::didAddClient(c);
+}
+
 void CachedScript::allClientsRemoved()
 {
-    m_decodedDataDeletionTimer.startOneShot(0);
+    if (double interval = memoryCache()->deadDecodedDataDeletionInterval())
+        m_decodedDataDeletionTimer.startOneShot(interval);
 }
 
 void CachedScript::setEncoding(const String& chs)
@@ -79,7 +88,6 @@ const String& CachedScript::script()
         m_script += m_decoder->flush();
         setDecodedSize(m_script.length() * sizeof(UChar));
     }
-    m_decodedDataDeletionTimer.startOneShot(0);
     return m_script;
 }
 
@@ -117,7 +125,9 @@ void CachedScript::destroyDecodedData()
     m_script = String();
     unsigned extraSize = 0;
 #if USE(JSC)
-    // FIXME: SourceInfoCache should be wiped out too but not this easily.
+    if (m_sourceProviderCache)
+        m_sourceProviderCache->clear();
+
     extraSize = m_sourceProviderCache ? m_sourceProviderCache->byteSize() : 0;
 #endif
     setDecodedSize(extraSize);
diff --git a/Source/WebCore/loader/cache/CachedScript.h b/Source/WebCore/loader/cache/CachedScript.h
index 14294f2..85c3805 100644
--- a/Source/WebCore/loader/cache/CachedScript.h
+++ b/Source/WebCore/loader/cache/CachedScript.h
@@ -47,12 +47,13 @@ namespace WebCore {
 
         const String& script();
 
+        virtual void didAddClient(CachedResourceClient*);
         virtual void allClientsRemoved();
 
         virtual void setEncoding(const String&);
         virtual String encoding() const;
         virtual void data(PassRefPtr<SharedBuffer> data, bool allDataReceived);
-        virtual void error(CachedResource::Status);
+        virtual void error(Status);
 
         void checkNotify();
 
diff --git a/Source/WebCore/loader/icon/IconDatabase.cpp b/Source/WebCore/loader/icon/IconDatabase.cpp
index 6040037..95746ae 100644
--- a/Source/WebCore/loader/icon/IconDatabase.cpp
+++ b/Source/WebCore/loader/icon/IconDatabase.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Justin Haygood (jhaygood@reaktix.com)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -1056,7 +1056,6 @@ static int databaseVersionNumber(SQLiteDatabase& db)
 
 static bool isValidDatabase(SQLiteDatabase& db)
 {
-
     // These four tables should always exist in a valid db
     if (!db.tableExists("IconInfo") || !db.tableExists("IconData") || !db.tableExists("PageURL") || !db.tableExists("IconDatabaseInfo"))
         return false;
@@ -1160,6 +1159,13 @@ void IconDatabase::performOpenInitialization()
     // Reduce sqlite RAM cache size from default 2000 pages (~1.5kB per page). 3MB of cache for icon database is overkill
     if (!SQLiteStatement(m_syncDB, "PRAGMA cache_size = 200;").executeCommand())         
         LOG_ERROR("SQLite database could not set cache_size");
+
+    // Tell backup software (i.e., Time Machine) to never back up the icon database, because  
+    // it's a large file that changes frequently, thus using a lot of backup disk space, and 
+    // it's unlikely that many users would be upset about it not being backed up. We could 
+    // make this configurable on a per-client basis some day if some clients don't want this.
+    if (canExcludeFromBackup() && !wasExcludedFromBackup() && excludeFromBackup(m_completeDatabasePath))
+        setWasExcludedFromBackup();
 }
 
 bool IconDatabase::checkIntegrity()
@@ -2091,6 +2097,20 @@ void IconDatabase::writeIconSnapshotToSQLDatabase(const IconSnapshot& snapshot)
     }
 }
 
+bool IconDatabase::wasExcludedFromBackup()
+{
+    ASSERT_ICON_SYNC_THREAD();
+
+    return SQLiteStatement(m_syncDB, "SELECT value FROM IconDatabaseInfo WHERE key = 'ExcludedFromBackup';").getColumnInt(0);
+}
+
+void IconDatabase::setWasExcludedFromBackup()
+{
+    ASSERT_ICON_SYNC_THREAD();
+
+    SQLiteStatement(m_syncDB, "INSERT INTO IconDatabaseInfo (key, value) VALUES ('ExcludedFromBackup', 1)").executeCommand();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(ICONDATABASE)
diff --git a/Source/WebCore/loader/icon/IconDatabase.h b/Source/WebCore/loader/icon/IconDatabase.h
index e08dcd4..5dc8288 100644
--- a/Source/WebCore/loader/icon/IconDatabase.h
+++ b/Source/WebCore/loader/icon/IconDatabase.h
@@ -199,6 +199,9 @@ private:
     bool imported();
     void setImported(bool);
     
+    bool wasExcludedFromBackup();
+    void setWasExcludedFromBackup();
+
     bool m_initialPruningComplete;
         
     void setIconURLForPageURLInSQLDatabase(const String&, const String&);
diff --git a/Source/WebCore/loader/icon/IconLoader.cpp b/Source/WebCore/loader/icon/IconLoader.cpp
index 24562d0..bb738e8 100644
--- a/Source/WebCore/loader/icon/IconLoader.cpp
+++ b/Source/WebCore/loader/icon/IconLoader.cpp
@@ -69,7 +69,10 @@ void IconLoader::startLoading()
     // SubresourceLoader::create returns.
     m_loadIsInProgress = true;
 
-    RefPtr<SubresourceLoader> loader = resourceLoadScheduler()->scheduleSubresourceLoad(m_frame, this, m_frame->loader()->iconURL());
+    ResourceRequest resourceRequest(m_frame->loader()->iconURL());
+    resourceRequest.setPriority(ResourceLoadPriorityLow);
+
+    RefPtr<SubresourceLoader> loader = resourceLoadScheduler()->scheduleSubresourceLoad(m_frame, this, resourceRequest);
     if (!loader)
         LOG_ERROR("Failed to start load for icon at url %s", m_frame->loader()->iconURL().string().ascii().data());
 
diff --git a/Source/WebCore/manual-tests/autocorrection/autocorrection-cancelled-by-ESC.html b/Source/WebCore/manual-tests/autocorrection/autocorrection-cancelled-by-ESC.html
index 185e5c6..e6af6ec 100644
--- a/Source/WebCore/manual-tests/autocorrection/autocorrection-cancelled-by-ESC.html
+++ b/Source/WebCore/manual-tests/autocorrection/autocorrection-cancelled-by-ESC.html
@@ -8,7 +8,7 @@
     font-size: 24px;
 }
 </style>
-<script src=../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
+<script src=../../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
 
 <script>
 function editingTest() {
diff --git a/Source/WebCore/manual-tests/autocorrection/autocorrection-cancelled-by-typing-1.html b/Source/WebCore/manual-tests/autocorrection/autocorrection-cancelled-by-typing-1.html
index 9637195..3e78bb1 100644
--- a/Source/WebCore/manual-tests/autocorrection/autocorrection-cancelled-by-typing-1.html
+++ b/Source/WebCore/manual-tests/autocorrection/autocorrection-cancelled-by-typing-1.html
@@ -8,21 +8,9 @@
     font-size: 24px;
 }
 </style>
-<script src=../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
+<script src=../../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
 
 <script>
- if (window.layoutTestController)
-        layoutTestController.waitUntilDone();
-
-function keepTyping() {
-    typeCharacterCommand('i');
-    typeCharacterCommand('n');
-    typeCharacterCommand('g');
-    typeCharacterCommand(' ');
-    if (window.layoutTestController)
-            layoutTestController.notifyDone();
-}
-
 function editingTest() {
     typeCharacterCommand('t');
     typeCharacterCommand('h');
@@ -35,7 +23,6 @@ function editingTest() {
     typeCharacterCommand('a');
     typeCharacterCommand('p');
     typeCharacterCommand('s');
-    setTimeout("keepTyping()", 1000);
 }
 
 </script>
@@ -43,8 +30,7 @@ function editingTest() {
 <title>Autocorrection Cancellation By Typing Test</title>
 </head>
 <body>
-<div>This test verifies that autocorrection behaves correctly when continuing typing in a word on 
-which autocorrection panel is hown. You should see correction panel showing 'collapse' after 'collaps' is entered. And after a pause, phrase 'the collapsing' is shown without underline.</div>
+<div>This test verifies that autocorrection behaves correctly when continuing typing in a word on which autocorrection panel is hown. You should see correction panel showing 'collapse' after 'collaps' is entered. Then type "ing". Phrase 'the collapsing' should be shown without underline.</div>
 <p  style="color:green">Note, this test can fail due to user specific spell checking data. If the user has previously dismissed 'collapse' as the correct spelling of 'collaps' several times, the spell checker will not provide 'collapse' as a suggestion anymore. To fix this, remove all files in ~/Library/Spelling.</p>
 <div contenteditable id="root" class="editing">
 <span id="test"></span>
diff --git a/Source/WebCore/manual-tests/autocorrection/autocorrection-contraction.html b/Source/WebCore/manual-tests/autocorrection/autocorrection-contraction.html
index ef5bb68..39ad7f7 100644
--- a/Source/WebCore/manual-tests/autocorrection/autocorrection-contraction.html
+++ b/Source/WebCore/manual-tests/autocorrection/autocorrection-contraction.html
@@ -8,15 +8,9 @@
     font-size: 24px;
 }
 </style>
-<script src=../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
+<script src=../../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
 
 <script>
-function keepTyping() {
-    typeCharacterCommand('\'');
-    typeCharacterCommand('t');
-    typeCharacterCommand(' ');
-}
-
 function editingTest() {
     typeCharacterCommand('t');
     typeCharacterCommand('h');
@@ -29,7 +23,6 @@ function editingTest() {
     typeCharacterCommand('l');
     typeCharacterCommand('d');
     typeCharacterCommand('n');
-    setTimeout("keepTyping()", 1000);
 }
 
 </script>
diff --git a/Source/WebCore/manual-tests/autocorrection/continue-typing-to-dismiss-reversion.html b/Source/WebCore/manual-tests/autocorrection/continue-typing-to-dismiss-reversion.html
index b8521c0..a1011fa 100644
--- a/Source/WebCore/manual-tests/autocorrection/continue-typing-to-dismiss-reversion.html
+++ b/Source/WebCore/manual-tests/autocorrection/continue-typing-to-dismiss-reversion.html
@@ -8,7 +8,7 @@
     font-size: 24px;
 }
 </style>
-<script src=../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
+<script src=../../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
 
 <script>
 function editingTest() {
diff --git a/Source/WebCore/manual-tests/autocorrection/delete-to-dismiss-reversion.html b/Source/WebCore/manual-tests/autocorrection/delete-to-dismiss-reversion.html
index c39b2ac..bbaa77d 100644
--- a/Source/WebCore/manual-tests/autocorrection/delete-to-dismiss-reversion.html
+++ b/Source/WebCore/manual-tests/autocorrection/delete-to-dismiss-reversion.html
@@ -8,7 +8,7 @@
     font-size: 24px;
 }
 </style>
-<script src=../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
+<script src=../../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
 
 <script>
 function editingTest() {
diff --git a/Source/WebCore/manual-tests/autocorrection/delete-to-end-of-word-to-show-reversion.html b/Source/WebCore/manual-tests/autocorrection/delete-to-end-of-word-to-show-reversion.html
index 320ed8c..242fcb2 100644
--- a/Source/WebCore/manual-tests/autocorrection/delete-to-end-of-word-to-show-reversion.html
+++ b/Source/WebCore/manual-tests/autocorrection/delete-to-end-of-word-to-show-reversion.html
@@ -8,7 +8,7 @@
     font-size: 24px;
 }
 </style>
-<script src=../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
+<script src=../../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
 
 <script>
 function editingTest() {
@@ -32,10 +32,8 @@ function editingTest() {
 </head>
 <body>
 <div><p>This test verifies that reversion panel is shown when user moves carret to previously corrected word using delete key.</p>
-<p>After seeing the reversion panel, press ESC key, then space key. You should see the phrase "the mesage" 
-where "mesage" has red mispell underline. </p>
-<p  style="color:green">Note, this test can fail due to user specific spell checking data. If the user has previously 
-frequently revert 'message' to 'mesage'. To fix this, remove all files in ~/Library/Spelling, then kill AppleSpell.service process.</p>
+<p>After seeing the reversion panel, press ESC key, then space key. You should see the phrase "the mesage". </p>
+<p  style="color:green">Note, this test can fail due to user specific spell checking data. If the user has previously frequently revert 'message' to 'mesage'. To fix this, remove all files in ~/Library/Spelling, then kill AppleSpell.service process.</p>
 <div contenteditable id="root" class="editing">
 <span id="test"></span>
 </div>
diff --git a/Source/WebCore/manual-tests/autocorrection/dismiss-multiple-guesses.html b/Source/WebCore/manual-tests/autocorrection/dismiss-multiple-guesses.html
index 56724f1..67171b7 100644
--- a/Source/WebCore/manual-tests/autocorrection/dismiss-multiple-guesses.html
+++ b/Source/WebCore/manual-tests/autocorrection/dismiss-multiple-guesses.html
@@ -8,7 +8,7 @@
     font-size: 24px;
 }
 </style>
-<script src=../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
+<script src=../../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
 
 <script>
 function editingTest() {
diff --git a/Source/WebCore/manual-tests/autocorrection/move-to-end-of-word-to-show-reversion.html b/Source/WebCore/manual-tests/autocorrection/move-to-end-of-word-to-show-reversion.html
index 8ca2a6b..5579915 100644
--- a/Source/WebCore/manual-tests/autocorrection/move-to-end-of-word-to-show-reversion.html
+++ b/Source/WebCore/manual-tests/autocorrection/move-to-end-of-word-to-show-reversion.html
@@ -8,7 +8,7 @@
     font-size: 24px;
 }
 </style>
-<script src=../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
+<script src=../../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
 
 <script>
 function editingTest() {
@@ -32,10 +32,8 @@ function editingTest() {
 </head>
 <body>
 <div><p>This test verifies that reversion panel is shown when user moves carret to previously corrected word</p>
-<p>After seeing the reversion panel, press ESC key, then space key. You should see the phrase "the mesage" 
-where "mesage" has red mispell underline. </p>
-<p  style="color:green">Note, this test can fail due to user specific spell checking data. If the user has previously 
-frequently revert 'message' to 'mesage'. To fix this, remove all files in ~/Library/Spelling, then kill AppleSpell.service process.</p>
+<p>After seeing the reversion panel, press ESC key, then space key. You should see the phrase "the mesage". </p>
+<p  style="color:green">Note, this test can fail due to user specific spell checking data. If the user has previously frequently revert 'message' to 'mesage'. To fix this, remove all files in ~/Library/Spelling, then kill AppleSpell.service process.</p>
 <div contenteditable id="root" class="editing">
 <span id="test"></span>
 </div>
diff --git a/Source/WebCore/manual-tests/autocorrection/select-from-multiple-guesses.html b/Source/WebCore/manual-tests/autocorrection/select-from-multiple-guesses.html
index dc8881f..cbd1dcd 100644
--- a/Source/WebCore/manual-tests/autocorrection/select-from-multiple-guesses.html
+++ b/Source/WebCore/manual-tests/autocorrection/select-from-multiple-guesses.html
@@ -8,7 +8,7 @@
     font-size: 24px;
 }
 </style>
-<script src=../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
+<script src=../../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
 
 <script>
 function editingTest() {
diff --git a/Source/WebCore/manual-tests/autocorrection/spell-checking-after-reversion.html b/Source/WebCore/manual-tests/autocorrection/spell-checking-after-reversion.html
new file mode 100644
index 0000000..9ea5f58
--- /dev/null
+++ b/Source/WebCore/manual-tests/autocorrection/spell-checking-after-reversion.html
@@ -0,0 +1,53 @@
+<html>
+<head>
+
+<style>
+.editing {
+    border: 2px solid red;
+    padding: 12px;
+    font-size: 24px;
+}
+</style>
+<script src=../../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
+
+<script>
+function editingTest() {
+    typeCharacterCommand('t');
+    typeCharacterCommand('h');
+    typeCharacterCommand('e');
+    typeCharacterCommand(' ');
+    typeCharacterCommand('c');
+    typeCharacterCommand('y');
+    typeCharacterCommand('l');
+    typeCharacterCommand('i');
+    typeCharacterCommand('n');
+    typeCharacterCommand('d');
+    typeCharacterCommand('r');
+}
+
+</script>
+
+<title>Spellchecking After Reversion Test</title>
+</head>
+<body>
+<div><p>This test verifies the behavior of spellchecking after reversion.</p>
+<ol>
+<li>After seeing the correction panel, press space to accept the correction.</li>
+<li>Press delete key to bring up reversion bubble.</li>
+<li>Press ESC key to accept the reversion suggestion.</li>
+<li>Press space key again, and verify that the word "cylindr" IS NOT marked as misspelled.</li>
+<li>Press delete key twice.</li>
+<li>Press space key again, and verify that the word "cylind" IS marked as misspelled.</li>
+</ol>
+<p  style="color:green">Note, this test can fail due to user specific spell checking data. To fix this, remove all files in ~/Library/Spelling.</p>
+<div contenteditable id="root" class="editing">
+<span id="test"></span>
+</div>
+
+
+<script>
+runEditingTest();
+</script>
+
+</body>
+</html>
diff --git a/Source/WebCore/manual-tests/autocorrection/type-whitespace-to-dismiss-reversion.html b/Source/WebCore/manual-tests/autocorrection/type-whitespace-to-dismiss-reversion.html
index eeea0f7..41191fb 100644
--- a/Source/WebCore/manual-tests/autocorrection/type-whitespace-to-dismiss-reversion.html
+++ b/Source/WebCore/manual-tests/autocorrection/type-whitespace-to-dismiss-reversion.html
@@ -8,7 +8,7 @@
     font-size: 24px;
 }
 </style>
-<script src=../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
+<script src=../../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
 
 <script>
 function editingTest() {
diff --git a/Source/WebCore/manual-tests/pop-up-alignment-and-direction.html b/Source/WebCore/manual-tests/pop-up-alignment-and-direction.html
new file mode 100644
index 0000000..b51798e
--- /dev/null
+++ b/Source/WebCore/manual-tests/pop-up-alignment-and-direction.html
diff --git a/Source/WebCore/manual-tests/select_webkit_appearance_off_popup_alignment.html b/Source/WebCore/manual-tests/select_webkit_appearance_off_popup_alignment.html
new file mode 100644
index 0000000..3e48852
--- /dev/null
+++ b/Source/WebCore/manual-tests/select_webkit_appearance_off_popup_alignment.html
@@ -0,0 +1,78 @@
+<html>
+
+<body>
+  <p>Manual test for popup alignment of select with no apperance.</p>
+
+  <p>All popup boxes should all align with select element on both left and right side.</p>
+
+  No scrollbar in popup:<br>
+  
+  LTR: <select size="1" style="-webkit-appearance: none;">
+    <option>Item 1</option>
+    <option>Item 2</option>
+    <option>Item 3</option>
+    <option>Item 4</option>
+    <option>Item 5</option>
+  </select>
+
+  RTL: <select size="1" dir="rtl" style="-webkit-appearance: none;">
+    <option>Item 1</option>
+    <option>Item 2</option>
+    <option>Item 3</option>
+    <option>Item 4</option>
+    <option>Item 5</option>
+  </select>
+
+  <br>
+
+  Popup has scrollbar:<br>
+  LTR: <select size="1" style="-webkit-appearance: none; padding-right: 20px;">
+    <option>Item 1</option>
+    <option>Item 2</option>
+    <option>Item 3</option>
+    <option>Item 4</option>
+    <option>Item 5</option>
+    <option>Item 6</option>
+    <option>Item 7</option>
+    <option>Item 8</option>
+    <option>Item 9</option>
+    <option>Item 10</option>
+    <option>Item 11</option>
+    <option>Item 12</option>
+    <option>Item 13</option>
+    <option>Item 14</option>
+    <option>Item 15</option>
+    <option>Item 16</option>
+    <option>Item 17</option>
+    <option>Item 18</option>
+    <option>Item 19</option>
+    <option>Item 20</option>
+    <option>Item 21</option>
+  </select>
+
+  RTL: <select size="1" dir="rtL" style="-webkit-appearance: none; padding-left: 20px;">
+    <option>Item 1</option>
+    <option>Item 2</option>
+    <option>Item 3</option>
+    <option>Item 4</option>
+    <option>Item 5</option>
+    <option>Item 6</option>
+    <option>Item 7</option>
+    <option>Item 8</option>
+    <option>Item 9</option>
+    <option>Item 10</option>
+    <option>Item 11</option>
+    <option>Item 12</option>
+    <option>Item 13</option>
+    <option>Item 14</option>
+    <option>Item 15</option>
+    <option>Item 16</option>
+    <option>Item 17</option>
+    <option>Item 18</option>
+    <option>Item 19</option>
+    <option>Item 20</option>
+    <option>Item 21</option>
+  </select>
+
+</body>
+</html>
diff --git a/Source/WebCore/manual-tests/svg-filter-animation.svg b/Source/WebCore/manual-tests/svg-filter-animation.svg
index 5b7c9cc..4bca5e2 100644
--- a/Source/WebCore/manual-tests/svg-filter-animation.svg
+++ b/Source/WebCore/manual-tests/svg-filter-animation.svg
@@ -34,16 +34,16 @@
 
 <defs>
 <filter id="filt" filterUnits="objectBoundingBox" x="0" y="0" width="100%" height="100%">
-    <feTurbulence id="turb" baseFrequency="0.03" numOctaves="4" seed="67" result="turb"/>
-    <feGaussianBlur in="SourceGraphic" primitiveUnits="objectBoundingBox" id="blur" stdDeviation="1" result="blur"/>
+    <feTurbulence baseFrequency="0.03" numOctaves="4" seed="67" result="turb"/>
+    <feGaussianBlur in="SourceGraphic" primitiveUnits="objectBoundingBox" stdDeviation="1" result="blur"/>
     <feComposite in="turb" in2="blur" operator="arithmetic" k2="0.3" k3="1" result="comp"/>
-    <feDiffuseLighting in="comp" primitiveUnits="objectBoundingBox" id="diff" diffuseConstant="1" lighting-color="white" surfaceScale="10" result="light" >
+    <feDiffuseLighting in="comp" primitiveUnits="objectBoundingBox" diffuseConstant="1" lighting-color="white" surfaceScale="10" result="light" >
         <feSpotLight id="light" x="0" y="300" z="200" pointsAtX="-200" pointsAtY="100" pointsAtZ="0" limitingConeAngle="90" specularExponent="20" />
     </feDiffuseLighting>
-    <feSpecularLighting in="comp" primitiveUnits="objectBoundingBox" id="diff" diffuseConstant="1" lighting-color="#A66102" surfaceScale="10" result="ambient" >
-        <feDistantLight id="light" azimuth="0" elevation="90" />
+    <feSpecularLighting in="comp" primitiveUnits="objectBoundingBox" diffuseConstant="1" lighting-color="#A66102" surfaceScale="10" result="ambient" >
+        <feDistantLight azimuth="0" elevation="90" />
     </feSpecularLighting>
-        <feComposite in="light" in2="ambient" operator="arithmetic" k2="1.2" k3=".8"/>
+    <feComposite in="light" in2="ambient" operator="arithmetic" k2="1.2" k3=".8"/>
 </filter>
 </defs>
 
diff --git a/Source/WebCore/notifications/NotificationCenter.cpp b/Source/WebCore/notifications/NotificationCenter.cpp
index a2289ec..3d08055 100644
--- a/Source/WebCore/notifications/NotificationCenter.cpp
+++ b/Source/WebCore/notifications/NotificationCenter.cpp
@@ -42,21 +42,20 @@ namespace WebCore {
 
 NotificationCenter::NotificationCenter(ScriptExecutionContext* context, NotificationPresenter* presenter)
     : ActiveDOMObject(context, this)
-    , m_scriptExecutionContext(context)
     , m_notificationPresenter(presenter) {}
 
 int NotificationCenter::checkPermission()
 {
-    if (!presenter())
+    if (!presenter() || !scriptExecutionContext())
         return NotificationPresenter::PermissionDenied;
-    return m_notificationPresenter->checkPermission(m_scriptExecutionContext);
+    return m_notificationPresenter->checkPermission(scriptExecutionContext());
 }
 
 void NotificationCenter::requestPermission(PassRefPtr<VoidCallback> callback)
 {
-    if (!presenter())
+    if (!presenter() || !scriptExecutionContext())
         return;
-    m_notificationPresenter->requestPermission(m_scriptExecutionContext, callback);
+    m_notificationPresenter->requestPermission(scriptExecutionContext(), callback);
 }
 
 void NotificationCenter::disconnectFrame()
@@ -66,9 +65,8 @@ void NotificationCenter::disconnectFrame()
     ASSERT(m_notificationPresenter);
     if (!m_notificationPresenter)
         return;
-    m_notificationPresenter->cancelRequestsForPermission(m_scriptExecutionContext);
+    m_notificationPresenter->cancelRequestsForPermission(scriptExecutionContext());
     m_notificationPresenter = 0;
-    m_scriptExecutionContext = 0;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/notifications/NotificationCenter.h b/Source/WebCore/notifications/NotificationCenter.h
index adad59d..d12fbdf 100644
--- a/Source/WebCore/notifications/NotificationCenter.h
+++ b/Source/WebCore/notifications/NotificationCenter.h
@@ -58,7 +58,7 @@ namespace WebCore {
                 ec = SYNTAX_ERR;
                 return 0;
             }
-            return Notification::create(m_scriptExecutionContext->completeURL(URI), context(), ec, this);
+            return Notification::create(scriptExecutionContext()->completeURL(URI), scriptExecutionContext(), ec, this);
         }
 
         PassRefPtr<Notification> createNotification(const String& iconURI, const String& title, const String& body, ExceptionCode& ec)
@@ -67,11 +67,10 @@ namespace WebCore {
                 ec = INVALID_STATE_ERR;
                 return 0;
             }
-            NotificationContents contents(iconURI.isEmpty() ? KURL() : m_scriptExecutionContext->completeURL(iconURI), title, body);
-            return Notification::create(contents, context(), ec, this);
+            NotificationContents contents(iconURI.isEmpty() ? KURL() : scriptExecutionContext()->completeURL(iconURI), title, body);
+            return Notification::create(contents, scriptExecutionContext(), ec, this);
         }
 
-        ScriptExecutionContext* context() const { return m_scriptExecutionContext; }
         NotificationPresenter* presenter() const { return m_notificationPresenter; }
 
         int checkPermission();
@@ -82,7 +81,6 @@ namespace WebCore {
     private:
         NotificationCenter(ScriptExecutionContext*, NotificationPresenter*);
 
-        ScriptExecutionContext* m_scriptExecutionContext;
         NotificationPresenter* m_notificationPresenter;
     };
 
diff --git a/Source/WebCore/page/Chrome.cpp b/Source/WebCore/page/Chrome.cpp
index d96b6c9..08bf1c3 100644
--- a/Source/WebCore/page/Chrome.cpp
+++ b/Source/WebCore/page/Chrome.cpp
@@ -330,6 +330,13 @@ bool Chrome::shouldInterruptJavaScript()
     return m_client->shouldInterruptJavaScript();
 }
 
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+void Chrome::registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title) 
+{
+    m_client->registerProtocolHandler(scheme, baseURL, url, title);
+}
+#endif
+
 IntRect Chrome::windowResizerRect() const
 {
     return m_client->windowResizerRect();
@@ -503,11 +510,21 @@ bool ChromeClient::paintCustomScrollCorner(GraphicsContext*, const FloatRect&)
     return false;
 }
 
+bool ChromeClient::paintCustomOverhangArea(GraphicsContext*, const IntRect&, const IntRect&, const IntRect&)
+{
+    return false;
+}
+
 bool Chrome::selectItemWritingDirectionIsNatural()
 {
     return m_client->selectItemWritingDirectionIsNatural();
 }
 
+bool Chrome::selectItemAlignmentFollowsMenuWritingDirection()
+{
+    return m_client->selectItemAlignmentFollowsMenuWritingDirection();
+}
+
 PassRefPtr<PopupMenu> Chrome::createPopupMenu(PopupMenuClient* client) const
 {
     return m_client->createPopupMenu(client);
diff --git a/Source/WebCore/page/Chrome.h b/Source/WebCore/page/Chrome.h
index 0afd807..4d16214 100644
--- a/Source/WebCore/page/Chrome.h
+++ b/Source/WebCore/page/Chrome.h
@@ -134,6 +134,10 @@ namespace WebCore {
         void setStatusbarText(Frame*, const String&);
         bool shouldInterruptJavaScript();
 
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+        void registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title);
+#endif
+
         IntRect windowResizerRect() const;
 
         void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
@@ -163,6 +167,7 @@ namespace WebCore {
 #endif
 
         bool selectItemWritingDirectionIsNatural();
+        bool selectItemAlignmentFollowsMenuWritingDirection();
         PassRefPtr<PopupMenu> createPopupMenu(PopupMenuClient*) const;
         PassRefPtr<SearchPopupMenu> createSearchPopupMenu(PopupMenuClient*) const;
 
diff --git a/Source/WebCore/page/ChromeClient.h b/Source/WebCore/page/ChromeClient.h
index 98b56da..83f039f 100644
--- a/Source/WebCore/page/ChromeClient.h
+++ b/Source/WebCore/page/ChromeClient.h
@@ -26,7 +26,6 @@
 #include "Cursor.h"
 #include "FocusDirection.h"
 #include "GraphicsContext.h"
-#include "HTMLParserQuirks.h"
 #include "HostWindow.h"
 #include "PopupMenu.h"
 #include "PopupMenuClient.h"
@@ -53,7 +52,6 @@ namespace WebCore {
     class FloatRect;
     class Frame;
     class Geolocation;
-    class HTMLParserQuirks;
     class HitTestResult;
     class IntRect;
     class NavigationAction;
@@ -136,6 +134,10 @@ namespace WebCore {
         virtual bool shouldInterruptJavaScript() = 0;
         virtual bool tabsToLinks() const = 0;
 
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+        virtual void registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title) = 0;
+#endif
+
         virtual IntRect windowResizerRect() const = 0;
 
         // Methods used by HostWindow.
@@ -211,6 +213,8 @@ namespace WebCore {
                                           float value, float proportion, ScrollbarControlPartMask);
         virtual bool paintCustomScrollCorner(GraphicsContext*, const FloatRect&);
 
+        virtual bool paintCustomOverhangArea(GraphicsContext*, const IntRect&, const IntRect&, const IntRect&);
+
         // FIXME: Remove once all ports are using client-based geolocation. https://bugs.webkit.org/show_bug.cgi?id=40373
         // For client-based geolocation, these two methods have moved to GeolocationClient. https://bugs.webkit.org/show_bug.cgi?id=50061
         // This can be either a synchronous or asynchronous call. The ChromeClient can display UI asking the user for permission
@@ -229,8 +233,6 @@ namespace WebCore {
         virtual void formDidFocus(const Node*) { };
         virtual void formDidBlur(const Node*) { };
 
-        virtual PassOwnPtr<HTMLParserQuirks> createHTMLParserQuirks() = 0;
-
 #if USE(ACCELERATED_COMPOSITING)
         // Pass 0 as the GraphicsLayer to detatch the root layer.
         virtual void attachRootGraphicsLayer(Frame*, GraphicsLayer*) = 0;
@@ -292,6 +294,7 @@ namespace WebCore {
 #endif
 
         virtual bool selectItemWritingDirectionIsNatural() = 0;
+        virtual bool selectItemAlignmentFollowsMenuWritingDirection() = 0;
         virtual PassRefPtr<PopupMenu> createPopupMenu(PopupMenuClient*) const = 0;
         virtual PassRefPtr<SearchPopupMenu> createSearchPopupMenu(PopupMenuClient*) const = 0;
 
@@ -301,9 +304,13 @@ namespace WebCore {
 
         virtual void postAccessibilityNotification(AccessibilityObject*, AXObjectCache::AXNotification) { }
 
+<<<<<<< HEAD
 #if ENABLE(ANDROID_INSTALLABLE_WEB_APPS)
         virtual void webAppCanBeInstalled() = 0;
 #endif
+=======
+        virtual void didCompleteRubberBandForMainFrame(const IntSize&) const { }
+>>>>>>> webkit.org at r78450
 
     protected:
         virtual ~ChromeClient() { }
diff --git a/Source/WebCore/page/Console.cpp b/Source/WebCore/page/Console.cpp
index 0c19421..a1b92e9 100644
--- a/Source/WebCore/page/Console.cpp
+++ b/Source/WebCore/page/Console.cpp
@@ -34,8 +34,8 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameTree.h"
+#include "InspectorConsoleInstrumentation.h"
 #include "InspectorController.h"
-#include "InspectorInstrumentation.h"
 #include "MemoryInfo.h"
 #include "Page.h"
 #include "PageGroup.h"
@@ -147,7 +147,7 @@ void Console::addMessage(MessageSource source, MessageType type, MessageLevel le
         page->chrome()->client()->addMessageToConsole(source, type, level, message, lineNumber, sourceURL);
 
     if (callStack)
-        InspectorInstrumentation::addMessageToConsole(page, source, type, level, message, 0, callStack.get());
+        InspectorInstrumentation::addMessageToConsole(page, source, type, level, message, 0, callStack);
     else
         InspectorInstrumentation::addMessageToConsole(page, source, type, level, message, lineNumber, sourceURL);
 
@@ -160,8 +160,11 @@ void Console::addMessage(MessageSource source, MessageType type, MessageLevel le
     printf(" %s\n", message.utf8().data());
 }
 
-void Console::addMessage(MessageType type, MessageLevel level, PassRefPtr<ScriptArguments> arguments,  PassRefPtr<ScriptCallStack> callStack, bool acceptNoArguments)
+void Console::addMessage(MessageType type, MessageLevel level, PassRefPtr<ScriptArguments> prpArguments,  PassRefPtr<ScriptCallStack> prpCallStack, bool acceptNoArguments)
 {
+    RefPtr<ScriptArguments> arguments = prpArguments;
+    RefPtr<ScriptCallStack> callStack = prpCallStack;
+
     Page* page = this->page();
     if (!page)
         return;
@@ -187,7 +190,7 @@ void Console::addMessage(MessageType type, MessageLevel level, PassRefPtr<Script
     if (arguments->getFirstArgumentAsString(message))
         page->chrome()->client()->addMessageToConsole(JSMessageSource, type, level, message, lastCaller.lineNumber(), lastCaller.sourceURL());
 
-    InspectorInstrumentation::addMessageToConsole(page, JSMessageSource, type, level, message, arguments.get(), callStack.get());
+    InspectorInstrumentation::addMessageToConsole(page, JSMessageSource, type, level, message, arguments, callStack);
 }
 
 void Console::debug(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack)
@@ -222,8 +225,9 @@ void Console::dirxml(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCal
     log(arguments, callStack);
 }
 
-void Console::trace(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack)
+void Console::trace(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> prpCallStack)
 {
+    RefPtr<ScriptCallStack> callStack = prpCallStack;
     addMessage(TraceMessageType, LogMessageLevel, arguments, callStack, true);
 
     if (!shouldPrintExceptions())
@@ -246,12 +250,12 @@ void Console::assertCondition(bool condition, PassRefPtr<ScriptArguments> argume
 
 void Console::count(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack)
 {
-    InspectorInstrumentation::consoleCount(page(), arguments.get(), callStack.get());
+    InspectorInstrumentation::consoleCount(page(), arguments, callStack);
 }
 
 void Console::markTimeline(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack>)
 {
-    InspectorInstrumentation::consoleMarkTimeline(page(), arguments.get());
+    InspectorInstrumentation::consoleMarkTimeline(page(), arguments);
 }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
@@ -290,7 +294,7 @@ void Console::profileEnd(const String& title, ScriptState* state, PassRefPtr<Scr
         return;
 
     m_profiles.append(profile);
-    InspectorInstrumentation::addProfile(page, profile, callStack.get());
+    InspectorInstrumentation::addProfile(page, profile, callStack);
 }
 
 #endif
@@ -302,17 +306,17 @@ void Console::time(const String& title)
 
 void Console::timeEnd(const String& title, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack> callStack)
 {
-    InspectorInstrumentation::stopConsoleTiming(page(), title, callStack.get());
+    InspectorInstrumentation::stopConsoleTiming(page(), title, callStack);
 }
 
 void Console::group(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack)
 {
-    InspectorInstrumentation::addMessageToConsole(page(), JSMessageSource, StartGroupMessageType, LogMessageLevel, String(), arguments.get(), callStack.get());
+    InspectorInstrumentation::addMessageToConsole(page(), JSMessageSource, StartGroupMessageType, LogMessageLevel, String(), arguments, callStack);
 }
 
 void Console::groupCollapsed(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack)
 {
-    InspectorInstrumentation::addMessageToConsole(page(), JSMessageSource, StartGroupCollapsedMessageType, LogMessageLevel, String(), arguments.get(), callStack.get());
+    InspectorInstrumentation::addMessageToConsole(page(), JSMessageSource, StartGroupCollapsedMessageType, LogMessageLevel, String(), arguments, callStack);
 }
 
 void Console::groupEnd()
diff --git a/Source/WebCore/page/ContentSecurityPolicy.cpp b/Source/WebCore/page/ContentSecurityPolicy.cpp
new file mode 100644
index 0000000..045e5aa
--- /dev/null
+++ b/Source/WebCore/page/ContentSecurityPolicy.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2011 Google, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ContentSecurityPolicy.h"
+#include "Document.h"
+
+namespace WebCore {
+
+ContentSecurityPolicy::ContentSecurityPolicy()
+    : m_isEnabled(false)
+{
+}
+
+void ContentSecurityPolicy::didReceiveHeader(const String& header)
+{
+    m_isEnabled = true;
+    m_header = header;
+}
+
+bool ContentSecurityPolicy::canLoadExternalScriptFromSrc(const String&) const
+{
+    return !m_isEnabled;
+}
+
+}
diff --git a/Source/WebCore/page/ContentSecurityPolicy.h b/Source/WebCore/page/ContentSecurityPolicy.h
new file mode 100644
index 0000000..ef0d551
--- /dev/null
+++ b/Source/WebCore/page/ContentSecurityPolicy.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2011 Google, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ContentSecurityPolicy_h
+#define ContentSecurityPolicy_h
+
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class ContentSecurityPolicy {
+    WTF_MAKE_NONCOPYABLE(ContentSecurityPolicy);
+public:
+    ContentSecurityPolicy();
+
+    void didReceiveHeader(const String&);
+    bool canLoadExternalScriptFromSrc(const String& url) const;
+
+private:
+    bool m_isEnabled;
+    String m_header;
+};
+
+}
+
+#endif
diff --git a/Source/WebCore/page/ContextMenuController.cpp b/Source/WebCore/page/ContextMenuController.cpp
index 0909f70..36ac89d 100644
--- a/Source/WebCore/page/ContextMenuController.cpp
+++ b/Source/WebCore/page/ContextMenuController.cpp
@@ -207,6 +207,11 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
         // For now, call into the client. This is temporary!
         frame->editor()->copyImage(m_hitTestResult);
         break;
+#if PLATFORM(QT)
+    case ContextMenuItemTagCopyImageUrlToClipboard:
+        frame->editor()->copyURL(m_hitTestResult.absoluteImageURL(), m_hitTestResult.textContent());
+        break;
+#endif
     case ContextMenuItemTagOpenMediaInNewWindow:
         openNewWindow(m_hitTestResult.absoluteMediaURL(), frame);
         break;
@@ -642,6 +647,10 @@ void ContextMenuController::populate()
         contextMenuItemTagDownloadImageToDisk());
     ContextMenuItem CopyImageItem(ActionType, ContextMenuItemTagCopyImageToClipboard, 
         contextMenuItemTagCopyImageToClipboard());
+#if PLATFORM(QT)
+    ContextMenuItem CopyImageUrlItem(ActionType, ContextMenuItemTagCopyImageUrlToClipboard, 
+        contextMenuItemTagCopyImageUrlToClipboard());
+#endif
     ContextMenuItem OpenMediaInNewWindowItem(ActionType, ContextMenuItemTagOpenMediaInNewWindow, String());
     ContextMenuItem CopyMediaLinkItem(ActionType, ContextMenuItemTagCopyMediaLinkToClipboard, 
         String());
@@ -708,6 +717,10 @@ void ContextMenuController::populate()
                 appendItem(OpenLinkInNewWindowItem, m_contextMenu.get());
                 appendItem(DownloadFileItem, m_contextMenu.get());
             }
+#if PLATFORM(QT)
+            if (m_hitTestResult.isSelected()) 
+                appendItem(CopyItem, m_contextMenu.get());
+#endif
             appendItem(CopyLinkItem, m_contextMenu.get());
         }
 
@@ -720,6 +733,9 @@ void ContextMenuController::populate()
             appendItem(DownloadImageItem, m_contextMenu.get());
             if (imageURL.isLocalFile() || m_hitTestResult.image())
                 appendItem(CopyImageItem, m_contextMenu.get());
+#if PLATFORM(QT)
+            appendItem(CopyImageUrlItem, m_contextMenu.get());
+#endif
         }
 
         KURL mediaURL = m_hitTestResult.absoluteMediaURL();
@@ -1172,6 +1188,9 @@ void ContextMenuController::checkOrEnableIfNeeded(ContextMenuItem& item) const
         case ContextMenuItemTagOpenImageInNewWindow:
         case ContextMenuItemTagDownloadImageToDisk:
         case ContextMenuItemTagCopyImageToClipboard:
+#if PLATFORM(QT)
+        case ContextMenuItemTagCopyImageUrlToClipboard:
+#endif
             break;
         case ContextMenuItemTagOpenMediaInNewWindow:
             if (m_hitTestResult.mediaIsVideo())
diff --git a/Source/WebCore/page/Crypto.cpp b/Source/WebCore/page/Crypto.cpp
new file mode 100644
index 0000000..5621592
--- /dev/null
+++ b/Source/WebCore/page/Crypto.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Google, Inc. ("Google") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#include "config.h"
+#include "Crypto.h"
+
+#include "ExceptionCode.h"
+#include "Uint8Array.h"
+#include <wtf/CryptographicallyRandomNumber.h>
+
+namespace WebCore {
+
+namespace {
+
+bool isIntegerArray(ArrayBufferView* array)
+{
+    return array->isByteArray()
+        || array->isUnsignedByteArray()
+        || array->isShortArray()
+        || array->isUnsignedShortArray()
+        || array->isIntArray()
+        || array->isUnsignedIntArray();
+}
+
+}
+
+Crypto::Crypto()
+{
+}
+
+void Crypto::getRandomValues(ArrayBufferView* array, ExceptionCode& ec)
+{
+#if USE(OS_RANDOMNESS)
+    if (!array || !isIntegerArray(array)) {
+        ec = TYPE_MISMATCH_ERR;
+        return;
+    }
+    cryptographicallyRandomValues(array->baseAddress(), array->byteLength());
+#else
+    ASSERT_UNUSED(array, array);
+    ec = NOT_SUPPORTED_ERR;
+#endif
+}
+
+}
diff --git a/Source/WebCore/storage/IDBTimeoutEvent.cpp b/Source/WebCore/page/Crypto.h
index b61ee47..bcccd7e 100644
--- a/Source/WebCore/storage/IDBTimeoutEvent.cpp
+++ b/Source/WebCore/page/Crypto.h
@@ -1,20 +1,20 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
+ *     notice, this list of conditions and the following disclaimer. 
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Google, Inc. ("Google") nor the names of
  *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
+ *     from this software without specific prior written permission. 
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
@@ -26,30 +26,29 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "IDBTimeoutEvent.h"
+#ifndef Crypto_h
+#define Crypto_h
 
-#if ENABLE(INDEXED_DATABASE)
-
-#include "EventNames.h"
-#include "IDBAny.h"
+#include <wtf/Forward.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
-PassRefPtr<IDBTimeoutEvent> IDBTimeoutEvent::create()
-{
-    return adoptRef(new IDBTimeoutEvent());
-}
+class ArrayBufferView;
 
-IDBTimeoutEvent::IDBTimeoutEvent()
-    : IDBEvent(eventNames().abortEvent, 0) // FIXME: set the source to the transaction
-{
-}
+typedef int ExceptionCode;
 
-IDBTimeoutEvent::~IDBTimeoutEvent()
-{
-}
+class Crypto : public RefCounted<Crypto> {
+public:
+    static PassRefPtr<Crypto> create() { return adoptRef(new Crypto()); }
 
-} // namespace WebCore
+    void getRandomValues(ArrayBufferView*, ExceptionCode&);
+
+private:
+    Crypto();
+};
+
+}
 
 #endif
diff --git a/Source/WebCore/page/Crypto.idl b/Source/WebCore/page/Crypto.idl
new file mode 100644
index 0000000..807b63f
--- /dev/null
+++ b/Source/WebCore/page/Crypto.idl
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Googl, Inc. ("Google") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module window {
+
+    interface [
+        OmitConstructor
+    ] Crypto {
+        void getRandomValues(in ArrayBufferView array) raises(DOMException);
+    };
+
+}
diff --git a/Source/WebCore/page/DOMWindow.cpp b/Source/WebCore/page/DOMWindow.cpp
index 0860d65..c732a10 100644
--- a/Source/WebCore/page/DOMWindow.cpp
+++ b/Source/WebCore/page/DOMWindow.cpp
@@ -37,6 +37,7 @@
 #include "CSSStyleSelector.h"
 #include "Chrome.h"
 #include "Console.h"
+#include "Crypto.h"
 #include "DOMApplicationCache.h"
 #include "DOMSelection.h"
 #include "DOMSettableTokenList.h"
@@ -342,8 +343,8 @@ void DOMWindow::adjustWindowRect(const FloatRect& screen, FloatRect& window, con
     window.setHeight(min(max(100.0f, window.height()), screen.height()));
     
     // Constrain the window position to the screen.
-    window.setX(max(screen.x(), min(window.x(), screen.right() - window.width())));
-    window.setY(max(screen.y(), min(window.y(), screen.bottom() - window.height())));
+    window.setX(max(screen.x(), min(window.x(), screen.maxX() - window.width())));
+    window.setY(max(screen.y(), min(window.y(), screen.maxY() - window.height())));
 }
 
 // FIXME: We can remove this function once V8 showModalDialog is changed to use DOMWindow.
@@ -433,6 +434,8 @@ void DOMWindow::clear()
         m_history->disconnectFrame();
     m_history = 0;
 
+    m_crypto = 0;
+
     if (m_locationbar)
         m_locationbar->disconnectFrame();
     m_locationbar = 0;
@@ -530,6 +533,13 @@ History* DOMWindow::history() const
     return m_history.get();
 }
 
+Crypto* DOMWindow::crypto() const
+{
+    if (!m_crypto)
+        m_crypto = Crypto::create();
+    return m_crypto.get();
+}
+
 BarInfo* DOMWindow::locationbar() const
 {
     if (!m_locationbar)
@@ -964,33 +974,17 @@ String DOMWindow::prompt(const String& message, const String& defaultValue)
     return String();
 }
 
-static bool isSafeToConvertCharList(const String& string)
-{
-    for (unsigned i = 0; i < string.length(); i++) {
-        if (string[i] > 0xFF)
-            return false;
-    }
-
-    return true;
-}
-
 String DOMWindow::btoa(const String& stringToEncode, ExceptionCode& ec)
 {
     if (stringToEncode.isNull())
         return String();
 
-    if (!isSafeToConvertCharList(stringToEncode)) {
+    if (!stringToEncode.containsOnlyLatin1()) {
         ec = INVALID_CHARACTER_ERR;
         return String();
     }
 
-    Vector<char> in;
-    in.append(stringToEncode.characters(), stringToEncode.length());
-    Vector<char> out;
-
-    base64Encode(in, out);
-
-    return String(out.data(), out.size());
+    return base64Encode(stringToEncode.latin1());
 }
 
 String DOMWindow::atob(const String& encodedString, ExceptionCode& ec)
@@ -998,7 +992,7 @@ String DOMWindow::atob(const String& encodedString, ExceptionCode& ec)
     if (encodedString.isNull())
         return String();
 
-    if (!isSafeToConvertCharList(encodedString)) {
+    if (!encodedString.containsOnlyLatin1()) {
         ec = INVALID_CHARACTER_ERR;
         return String();
     }
@@ -1557,7 +1551,7 @@ void DOMWindow::dispatchLoadEvent()
         ownerElement->dispatchGenericEvent(ownerEvent.release());
     }
 
-    InspectorInstrumentation::mainResourceFiredLoadEvent(frame(), url());
+    InspectorInstrumentation::loadEventFired(frame(), url());
 }
 
 bool DOMWindow::dispatchEvent(PassRefPtr<Event> prpEvent, PassRefPtr<EventTarget> prpTarget)
@@ -1585,7 +1579,6 @@ void DOMWindow::dispatchTimedEvent(PassRefPtr<Event> event, Document* target, do
     *startTime = currentTime();
     dispatchEvent(event, target);
     *endTime = currentTime();
-    ASSERT(*endTime >= *startTime);
 }
 
 void DOMWindow::removeAllEventListeners()
diff --git a/Source/WebCore/page/DOMWindow.h b/Source/WebCore/page/DOMWindow.h
index f02a7ac..8318369 100644
--- a/Source/WebCore/page/DOMWindow.h
+++ b/Source/WebCore/page/DOMWindow.h
@@ -37,6 +37,7 @@ namespace WebCore {
     class CSSRuleList;
     class CSSStyleDeclaration;
     class Console;
+    class Crypto;
     class DOMApplicationCache;
     class DOMSelection;
     class DOMURL;
@@ -114,6 +115,7 @@ namespace WebCore {
 
         Screen* screen() const;
         History* history() const;
+        Crypto* crypto() const;
         BarInfo* locationbar() const;
         BarInfo* menubar() const;
         BarInfo* personalbar() const;
@@ -340,6 +342,7 @@ namespace WebCore {
         Screen* optionalScreen() const { return m_screen.get(); }
         DOMSelection* optionalSelection() const { return m_selection.get(); }
         History* optionalHistory() const { return m_history.get(); }
+        Crypto* optionalCrypto() const { return m_crypto.get(); }
         BarInfo* optionalLocationbar() const { return m_locationbar.get(); }
         BarInfo* optionalMenubar() const { return m_menubar.get(); }
         BarInfo* optionalPersonalbar() const { return m_personalbar.get(); }
@@ -444,6 +447,7 @@ namespace WebCore {
         mutable RefPtr<Screen> m_screen;
         mutable RefPtr<DOMSelection> m_selection;
         mutable RefPtr<History> m_history;
+        mutable RefPtr<Crypto>  m_crypto;
         mutable RefPtr<BarInfo> m_locationbar;
         mutable RefPtr<BarInfo> m_menubar;
         mutable RefPtr<BarInfo> m_personalbar;
diff --git a/Source/WebCore/page/DOMWindow.idl b/Source/WebCore/page/DOMWindow.idl
index a814558..b04a8a2 100644
--- a/Source/WebCore/page/DOMWindow.idl
+++ b/Source/WebCore/page/DOMWindow.idl
@@ -54,11 +54,11 @@ module window {
         attribute [Replaceable] BarInfo toolbar;
         attribute [Replaceable] Navigator navigator;
         attribute [Replaceable] Navigator clientInformation;
+        readonly attribute Crypto crypto;
         attribute [DoNotCheckDomainSecurity, JSCCustom, V8CustomSetter, V8DisallowShadowing, CPPCustom] Location location;
 
         attribute [Replaceable, CustomGetter, V8CustomSetter] Event event;
 
-        readonly attribute [Custom] Crypto crypto;
 
         DOMSelection getSelection();
 
@@ -493,28 +493,28 @@ module window {
         attribute CanvasGradientConstructor CanvasGradient;
         attribute CanvasRenderingContext2DConstructor CanvasRenderingContext2D;
         attribute ImageDataConstructor ImageData;
-        attribute [Conditional=3D_CANVAS,EnabledAtRuntime] WebGLActiveInfoConstructor WebGLActiveInfo;
-        attribute [Conditional=3D_CANVAS,EnabledAtRuntime] WebGLBufferConstructor WebGLBuffer;
-        attribute [Conditional=3D_CANVAS,EnabledAtRuntime] WebGLFramebufferConstructor WebGLFramebuffer;
-        attribute [Conditional=3D_CANVAS,EnabledAtRuntime] WebGLProgramConstructor WebGLProgram;
-        attribute [Conditional=3D_CANVAS,EnabledAtRuntime] WebGLRenderbufferConstructor WebGLRenderbuffer;
-        attribute [Conditional=3D_CANVAS,EnabledAtRuntime] WebGLRenderingContextConstructor WebGLRenderingContext;
-        attribute [Conditional=3D_CANVAS,EnabledAtRuntime] WebGLShaderConstructor WebGLShader;
-        attribute [Conditional=3D_CANVAS,EnabledAtRuntime] WebGLTextureConstructor WebGLTexture;
-        attribute [Conditional=3D_CANVAS,EnabledAtRuntime] WebGLUniformLocationConstructor WebGLUniformLocation;
+        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLActiveInfoConstructor WebGLActiveInfo;
+        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLBufferConstructor WebGLBuffer;
+        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLFramebufferConstructor WebGLFramebuffer;
+        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLProgramConstructor WebGLProgram;
+        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLRenderbufferConstructor WebGLRenderbuffer;
+        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLRenderingContextConstructor WebGLRenderingContext;
+        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLShaderConstructor WebGLShader;
+        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLTextureConstructor WebGLTexture;
+        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLUniformLocationConstructor WebGLUniformLocation;
         attribute TextMetricsConstructor TextMetrics;
 
         attribute DOMStringMapConstructor DOMStringMap;
 
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] ArrayBufferConstructor ArrayBuffer; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] Int8ArrayConstructor Int8Array; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] Uint8ArrayConstructor Uint8Array; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] Int16ArrayConstructor Int16Array; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] Uint16ArrayConstructor Uint16Array; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] Int32ArrayConstructor Int32Array; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] Uint32ArrayConstructor Uint32Array; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] Float32ArrayConstructor Float32Array; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] DataViewConstructor DataView; // Usable with new operator
+        attribute [JSCCustomGetter] ArrayBufferConstructor ArrayBuffer; // Usable with new operator
+        attribute [JSCCustomGetter] Int8ArrayConstructor Int8Array; // Usable with new operator
+        attribute [JSCCustomGetter] Uint8ArrayConstructor Uint8Array; // Usable with new operator
+        attribute [JSCCustomGetter] Int16ArrayConstructor Int16Array; // Usable with new operator
+        attribute [JSCCustomGetter] Uint16ArrayConstructor Uint16Array; // Usable with new operator
+        attribute [JSCCustomGetter] Int32ArrayConstructor Int32Array; // Usable with new operator
+        attribute [JSCCustomGetter] Uint32ArrayConstructor Uint32Array; // Usable with new operator
+        attribute [JSCCustomGetter] Float32ArrayConstructor Float32Array; // Usable with new operator
+        attribute [JSCCustomGetter] DataViewConstructor DataView; // Usable with new operator
 
         attribute [JSCCustomGetter,Conditional=WEB_AUDIO,EnabledAtRuntime] AudioContextConstructor webkitAudioContext; // Usable with new operator
         attribute [Conditional=WEB_AUDIO] AudioPannerNodeConstructor webkitAudioPannerNode; // Needed for panning model constants
diff --git a/Source/WebCore/page/DragClient.h b/Source/WebCore/page/DragClient.h
index 4f343a0..8f73baa 100644
--- a/Source/WebCore/page/DragClient.h
+++ b/Source/WebCore/page/DragClient.h
@@ -62,7 +62,6 @@ namespace WebCore {
         virtual DragSourceAction dragSourceActionMaskForPoint(const IntPoint& windowPoint) = 0;
         
         virtual void startDrag(DragImageRef dragImage, const IntPoint& dragImageOrigin, const IntPoint& eventPos, Clipboard*, Frame*, bool linkDrag = false) = 0;
-        virtual DragImageRef createDragImageForLink(KURL&, const String& label, Frame*) = 0;
         
         virtual void dragControllerDestroyed() = 0;
 #if PLATFORM(MAC)
diff --git a/Source/WebCore/page/DragController.cpp b/Source/WebCore/page/DragController.cpp
index 7be708c..b258e9d 100644
--- a/Source/WebCore/page/DragController.cpp
+++ b/Source/WebCore/page/DragController.cpp
@@ -644,9 +644,9 @@ static IntPoint dragLocForDHTMLDrag(const IntPoint& mouseDraggedPoint, const Int
 static IntPoint dragLocForSelectionDrag(Frame* src)
 {
     IntRect draggingRect = enclosingIntRect(src->selection()->bounds());
-    int xpos = draggingRect.right();
+    int xpos = draggingRect.maxX();
     xpos = draggingRect.x() < xpos ? draggingRect.x() : xpos;
-    int ypos = draggingRect.bottom();
+    int ypos = draggingRect.maxY();
 #if PLATFORM(MAC)
     // Deal with flipped coordinates on Mac
     ypos = draggingRect.y() > ypos ? draggingRect.y() : ypos;
@@ -739,7 +739,7 @@ bool DragController::startDrag(Frame* src, Clipboard* clipboard, DragOperation s
 
         m_client->willPerformDragSourceAction(DragSourceActionLink, dragOrigin, clipboard);
         if (!dragImage) {
-            dragImage = m_client->createDragImageForLink(linkURL, dragSource.textContent(), src);
+            dragImage = createDragImageForLink(linkURL, dragSource.textContent(), src);
             IntSize size = dragImageSize(dragImage);
             m_dragOffset = IntPoint(-size.width() / 2, -LinkDragBorderInset);
             dragLoc = IntPoint(mouseDraggedPoint.x() + m_dragOffset.x(), mouseDraggedPoint.y() + m_dragOffset.y());
diff --git a/Source/WebCore/page/EditorClient.h b/Source/WebCore/page/EditorClient.h
index 71ba3dd..c805920 100644
--- a/Source/WebCore/page/EditorClient.h
+++ b/Source/WebCore/page/EditorClient.h
@@ -119,8 +119,6 @@ public:
     virtual bool shouldChangeSelectedRange(Range* fromRange, Range* toRange, EAffinity, bool stillSelecting) = 0;
     
     virtual bool shouldApplyStyle(CSSStyleDeclaration*, Range*) = 0;
-//  virtual bool shouldChangeTypingStyle(CSSStyleDeclaration* fromStyle, CSSStyleDeclaration* toStyle) = 0;
-//  virtual bool doCommandBySelector(SEL selector) = 0;
     virtual bool shouldMoveRangeAfterDelete(Range*, Range*) = 0;
 
     virtual void didBeginEditing() = 0;
@@ -129,9 +127,6 @@ public:
     virtual void didEndEditing() = 0;
     virtual void didWriteSelectionToPasteboard() = 0;
     virtual void didSetSelectionTypesForPasteboard() = 0;
-//  virtual void didChangeTypingStyle:(NSNotification *)notification = 0;
-//  virtual void didChangeSelection:(NSNotification *)notification = 0;
-//  virtual NSUndoManager* undoManager:(WebView *)webView = 0;
     
     virtual void registerCommandForUndo(PassRefPtr<EditCommand>) = 0;
     virtual void registerCommandForRedo(PassRefPtr<EditCommand>) = 0;
diff --git a/Source/WebCore/page/EventHandler.cpp b/Source/WebCore/page/EventHandler.cpp
index 8432c10..b173532 100644
--- a/Source/WebCore/page/EventHandler.cpp
+++ b/Source/WebCore/page/EventHandler.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -68,6 +68,7 @@
 #include "RenderTextControlSingleLine.h"
 #include "RenderView.h"
 #include "RenderWidget.h"
+#include "ScrollAnimator.h"
 #include "Scrollbar.h"
 #include "SelectionController.h"
 #include "Settings.h"
@@ -81,6 +82,10 @@
 #include <wtf/CurrentTime.h>
 #include <wtf/StdLibExtras.h>
 
+#if ENABLE(GESTURE_EVENTS)
+#include "PlatformGestureEvent.h"
+#endif
+
 #if ENABLE(SVG)
 #include "SVGDocument.h"
 #include "SVGElementInstance.h"
@@ -1439,7 +1444,7 @@ bool EventHandler::handleMouseDoubleClickEvent(const PlatformMouseEvent& mouseEv
     m_clickCount = mouseEvent.clickCount();
     bool swallowMouseUpEvent = dispatchMouseEvent(eventNames().mouseupEvent, mev.targetNode(), true, m_clickCount, mouseEvent, false);
 
-    bool swallowClickEvent = mouseEvent.button() == LeftButton && mev.targetNode() == m_clickNode && dispatchMouseEvent(eventNames().clickEvent, mev.targetNode(), true, m_clickCount, mouseEvent, true);
+    bool swallowClickEvent = mouseEvent.button() != RightButton && mev.targetNode() == m_clickNode && dispatchMouseEvent(eventNames().clickEvent, mev.targetNode(), true, m_clickCount, mouseEvent, true);
 
     if (m_lastScrollbarUnderMouse)
         swallowMouseUpEvent = m_lastScrollbarUnderMouse->mouseUp();
@@ -1460,6 +1465,9 @@ bool EventHandler::mouseMoved(const PlatformMouseEvent& event)
     if (!page)
         return result;
 
+    if (FrameView* frameView = m_frame->view())
+        frameView->scrollAnimator()->mouseMovedInContentArea();  
+
     hoveredNode.setToNonShadowAncestor();
     page->chrome()->mouseDidMoveOverElement(hoveredNode, event.modifierFlags());
     page->chrome()->setToolTip(hoveredNode);
@@ -1557,7 +1565,7 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
                 // effect on plugins (which matches Firefox).
                 bool overPluginElement = false;
                 if (mev.targetNode() && mev.targetNode()->isHTMLElement()) {
-                    HTMLElement* el = static_cast<HTMLElement*>(mev.targetNode());
+                    HTMLElement* el = toHTMLElement(mev.targetNode());
                     overPluginElement = el->hasTagName(appletTag) || el->hasTagName(objectTag) || el->hasTagName(embedTag);
                 }
                 if (!overPluginElement) {
@@ -1637,7 +1645,7 @@ bool EventHandler::handleMouseReleaseEvent(const PlatformMouseEvent& mouseEvent)
 
     bool swallowMouseUpEvent = dispatchMouseEvent(eventNames().mouseupEvent, mev.targetNode(), true, m_clickCount, mouseEvent, false);
 
-    bool swallowClickEvent = m_clickCount > 0 && mouseEvent.button() == LeftButton && mev.targetNode() == m_clickNode && dispatchMouseEvent(eventNames().clickEvent, mev.targetNode(), true, m_clickCount, mouseEvent, true);
+    bool swallowClickEvent = m_clickCount > 0 && mouseEvent.button() != RightButton && mev.targetNode() == m_clickNode && dispatchMouseEvent(eventNames().clickEvent, mev.targetNode(), true, m_clickCount, mouseEvent, true);
 
     if (m_resizeLayer) {
         m_resizeLayer->setInResizeMode(false);
@@ -1881,6 +1889,23 @@ void EventHandler::updateMouseEventTargetNode(Node* targetNode, const PlatformMo
 
     // Fire mouseout/mouseover if the mouse has shifted to a different node.
     if (fireMouseOverOut) {
+        // FIXME: This code will only correctly handle transitions between frames with scrollbars,
+        // not transitions between overflow regions, or transitions between two frames
+        // that don't have scrollbars contained within a frame that does.
+        if (m_lastNodeUnderMouse && (!m_nodeUnderMouse || m_nodeUnderMouse->document() != m_frame->document())) {
+            if (Frame* frame = m_lastNodeUnderMouse->document()->frame()) {
+                if (FrameView* frameView = frame->view())
+                    frameView->scrollAnimator()->mouseExitedContentArea();
+            }
+        }
+        
+        if (m_nodeUnderMouse && (!m_lastNodeUnderMouse || m_lastNodeUnderMouse->document() != m_frame->document())) {
+            if (Frame* frame = m_nodeUnderMouse->document()->frame()) {
+                if (FrameView* frameView = frame->view())
+                    frameView->scrollAnimator()->mouseEnteredContentArea();
+            }
+        }
+        
         if (m_lastNodeUnderMouse && m_lastNodeUnderMouse->document() != m_frame->document()) {
             m_lastNodeUnderMouse = 0;
             m_lastScrollbarUnderMouse = 0;
@@ -2066,6 +2091,23 @@ void EventHandler::defaultWheelEventHandler(Node* startNode, WheelEvent* wheelEv
         m_previousWheelScrolledNode = stopNode;
 }
 
+#if ENABLE(GESTURE_EVENTS)
+bool EventHandler::handleGestureEvent(const PlatformGestureEvent& gestureEvent)
+{
+    // FIXME: This should hit test and go to the correct subframe rather than 
+    // always sending gestures to the main frame only. We should also ensure
+    // that if a frame gets a gesture begin gesture, it gets the corresponding
+    // end gesture as well.
+
+    FrameView* view = m_frame->view();
+    if (!view)
+        return false;
+
+    view->handleGestureEvent(gestureEvent);
+    return true;
+}
+#endif
+
 #if ENABLE(CONTEXT_MENUS)
 bool EventHandler::sendContextMenuEvent(const PlatformMouseEvent& event)
 {
@@ -2121,12 +2163,12 @@ bool EventHandler::sendContextMenuEventForKey()
         RefPtr<Range> selection = selectionController->toNormalizedRange();
         IntRect firstRect = m_frame->editor()->firstRectForRange(selection.get());
 
-        int x = rightAligned ? firstRect.right() : firstRect.x();
-        location = IntPoint(x, firstRect.bottom());
+        int x = rightAligned ? firstRect.maxX() : firstRect.x();
+        location = IntPoint(x, firstRect.maxY());
     } else if (focusedNode) {
         RenderBoxModelObject* box = focusedNode->renderBoxModelObject();
         IntRect clippedRect = box->absoluteClippedOverflowRect();
-        location = clippedRect.bottomLeft();
+        location = IntPoint(clippedRect.x(), clippedRect.maxY() - 1);
     } else {
         location = IntPoint(
             rightAligned ? view->contentsWidth() - kContextMenuMargin : kContextMenuMargin,
@@ -2171,6 +2213,15 @@ void EventHandler::scheduleHoverStateUpdate()
         m_hoverTimer.startOneShot(0);
 }
 
+void EventHandler::dispatchFakeMouseMoveEventSoon()
+{
+    if (m_mousePressed)
+        return;
+
+    if (!m_fakeMouseMoveEventTimer.isActive())
+        m_fakeMouseMoveEventTimer.startOneShot(fakeMouseMoveInterval);
+}
+
 void EventHandler::dispatchFakeMouseMoveEventSoonInQuad(const FloatQuad& quad)
 {
     FrameView* view = m_frame->view();
diff --git a/Source/WebCore/page/EventHandler.h b/Source/WebCore/page/EventHandler.h
index 77668f1..1e825c2 100644
--- a/Source/WebCore/page/EventHandler.h
+++ b/Source/WebCore/page/EventHandler.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -53,9 +53,9 @@ class EventTarget;
 class FloatPoint;
 class FloatQuad;
 class Frame;
+class HTMLFrameSetElement;
 class HitTestRequest;
 class HitTestResult;
-class HTMLFrameSetElement;
 class KeyboardEvent;
 class MouseEventWithHitTestResults;
 class Node;
@@ -65,13 +65,17 @@ class PlatformWheelEvent;
 class RenderLayer;
 class RenderObject;
 class RenderWidget;
-class Scrollbar;
 class SVGElementInstance;
+class Scrollbar;
 class TextEvent;
 class TouchEvent;
 class WheelEvent;
 class Widget;
-    
+
+#if ENABLE(GESTURE_EVENTS)
+class PlatformGestureEvent;
+#endif
+
 #if ENABLE(DRAG_SUPPORT)
 extern const int LinkDragHysteresis;
 extern const int ImageDragHysteresis;
@@ -104,6 +108,7 @@ public:
     RenderObject* autoscrollRenderer() const;
     void updateAutoscrollRenderer();
 
+    void dispatchFakeMouseMoveEventSoon();
     void dispatchFakeMouseMoveEventSoonInQuad(const FloatQuad&);
 
     HitTestResult hitTestResultAtPoint(const IntPoint&, bool allowShadowContent, bool ignoreClipping = false,
@@ -161,6 +166,10 @@ public:
     bool handleWheelEvent(PlatformWheelEvent&);
     void defaultWheelEventHandler(Node*, WheelEvent*);
 
+#if ENABLE(GESTURE_EVENTS)
+    bool handleGestureEvent(const PlatformGestureEvent&);
+#endif
+
 #if ENABLE(CONTEXT_MENUS)
     bool sendContextMenuEvent(const PlatformMouseEvent&);
     bool sendContextMenuEventForKey();
diff --git a/Source/WebCore/page/FocusController.cpp b/Source/WebCore/page/FocusController.cpp
index eda1005..679288f 100644
--- a/Source/WebCore/page/FocusController.cpp
+++ b/Source/WebCore/page/FocusController.cpp
@@ -50,6 +50,7 @@
 #include "RenderLayer.h"
 #include "RenderObject.h"
 #include "RenderWidget.h"
+#include "ScrollAnimator.h"
 #include "SelectionController.h"
 #include "Settings.h"
 #include "SpatialNavigation.h"
@@ -407,6 +408,11 @@ void FocusController::setActive(bool active)
             view->updateLayoutAndStyleIfNeededRecursive();
             view->updateControlTints();
         }
+        // FIXME: This should propogate to all ScrollableAreas.
+        if (!active)
+            view->scrollAnimator()->contentAreaDidHide();
+        else
+            view->scrollAnimator()->contentAreaDidShow();
     }
 
     focusedOrMainFrame()->selection()->pageActivationChanged();
diff --git a/Source/WebCore/page/Frame.cpp b/Source/WebCore/page/Frame.cpp
index 4c7c6b7..84df3d1 100644
--- a/Source/WebCore/page/Frame.cpp
+++ b/Source/WebCore/page/Frame.cpp
@@ -789,7 +789,7 @@ VisiblePosition Frame::visiblePositionForPoint(const IntPoint& framePoint)
         return VisiblePosition();
     VisiblePosition visiblePos = renderer->positionForPoint(result.localPoint());
     if (visiblePos.isNull())
-        visiblePos = VisiblePosition(Position(node, 0));
+        visiblePos = firstPositionInOrBeforeNode(node);
     return visiblePos;
 }
 
diff --git a/Source/WebCore/page/FrameView.cpp b/Source/WebCore/page/FrameView.cpp
index 7546270..f8aa068 100644
--- a/Source/WebCore/page/FrameView.cpp
+++ b/Source/WebCore/page/FrameView.cpp
@@ -56,6 +56,7 @@
 #include "RenderScrollbarPart.h"
 #include "RenderTheme.h"
 #include "RenderView.h"
+#include "ScrollAnimator.h"
 #include "Settings.h"
 #include "TextResourceDecoder.h"
 #include <wtf/CurrentTime.h>
@@ -443,7 +444,8 @@ void FrameView::setContentsSize(const IntSize& size)
     m_deferSetNeedsLayouts++;
 
     ScrollView::setContentsSize(size);
-
+    scrollAnimator()->contentsResized();
+    
     Page* page = frame() ? frame()->page() : 0;
     if (!page)
         return;
@@ -465,7 +467,7 @@ void FrameView::adjustViewSize()
 
     IntSize size = IntSize(root->docWidth(), root->docHeight());
 
-    ScrollView::setScrollOrigin(IntPoint(-root->docLeft(), -root->docTop()), size == contentsSize());
+    ScrollView::setScrollOrigin(IntPoint(-root->docLeft(), -root->docTop()), !m_frame->document()->printing(), size == contentsSize());
     
     setContentsSize(size);
 }
@@ -714,6 +716,7 @@ void FrameView::didMoveOnscreen()
     RenderView* view = m_frame->contentRenderer();
     if (view)
         view->didMoveOnscreen();
+    scrollAnimator()->contentAreaDidShow();
 }
 
 void FrameView::willMoveOffscreen()
@@ -721,6 +724,7 @@ void FrameView::willMoveOffscreen()
     RenderView* view = m_frame->contentRenderer();
     if (view)
         view->willMoveOffscreen();
+    scrollAnimator()->contentAreaDidHide();
 }
 
 RenderObject* FrameView::layoutRoot(bool onlyDuringLayout) const
@@ -733,6 +737,20 @@ void FrameView::layout(bool allowSubtree)
     if (m_inLayout)
         return;
 
+    bool inSubframeLayoutWithFrameFlattening = parent() && m_frame->settings() && m_frame->settings()->frameFlatteningEnabled();
+
+    if (inSubframeLayoutWithFrameFlattening) {
+        if (parent()->isFrameView()) {
+            FrameView* parentView =   static_cast<FrameView*>(parent());
+            if (!parentView->m_nestedLayoutCount) {
+                while (parentView->parent() && parentView->parent()->isFrameView())
+                    parentView = static_cast<FrameView*>(parentView->parent());
+                parentView->layout(allowSubtree);
+                return;
+            }
+        }
+    }
+
     m_layoutTimer.stop();
     m_delayedLayout = false;
     m_setNeedsLayoutWasDeferred = false;
@@ -765,7 +783,7 @@ void FrameView::layout(bool allowSubtree)
 
     m_layoutSchedulingEnabled = false;
 
-    if (!m_nestedLayoutCount && !m_inSynchronousPostLayout && m_hasPendingPostLayoutTasks) {
+    if (!m_nestedLayoutCount && !m_inSynchronousPostLayout && m_hasPendingPostLayoutTasks && !inSubframeLayoutWithFrameFlattening) {
         // This is a new top-level layout. If there are any remaining tasks from the previous
         // layout, finish them now.
         m_inSynchronousPostLayout = true;
@@ -908,9 +926,6 @@ void FrameView::layout(bool allowSubtree)
     }
     m_layoutRoot = 0;
 
-    m_frame->selection()->setCaretRectNeedsUpdate();
-    m_frame->selection()->updateAppearance();
-   
     m_layoutSchedulingEnabled = true;
 
     if (!subtree && !toRenderView(root)->printing())
@@ -953,14 +968,14 @@ void FrameView::layout(bool allowSubtree)
                              layoutHeight() < contentsHeight());
 
     if (!m_hasPendingPostLayoutTasks) {
-        if (!m_inSynchronousPostLayout) {
+        if (!m_inSynchronousPostLayout && !inSubframeLayoutWithFrameFlattening) {
             m_inSynchronousPostLayout = true;
             // Calls resumeScheduledEvents()
             performPostLayoutTasks();
             m_inSynchronousPostLayout = false;
         }
 
-        if (!m_hasPendingPostLayoutTasks && (needsLayout() || m_inSynchronousPostLayout)) {
+        if (!m_hasPendingPostLayoutTasks && (needsLayout() || m_inSynchronousPostLayout || inSubframeLayoutWithFrameFlattening)) {
             // If we need layout or are already in a synchronous call to postLayoutTasks(), 
             // defer widget updates and event dispatch until after we return. postLayoutTasks()
             // can make us need to update again, and we can get stuck in a nasty cycle unless
@@ -1119,6 +1134,7 @@ void FrameView::removeFixedObject()
         updateCanBlitOnScrollRecursively();
 }
 
+<<<<<<< HEAD
 #if PLATFORM(ANDROID)
 // When the screen size change, fixed positioned element should be updated.
 void FrameView::updatePositionedObjects()
@@ -1141,6 +1157,12 @@ void FrameView::updatePositionedObjects()
     }
 }
 #endif
+=======
+IntPoint FrameView::currentMousePosition() const
+{
+    return m_frame ? m_frame->eventHandler()->currentMousePosition() : IntPoint();
+}
+>>>>>>> webkit.org at r78450
 
 bool FrameView::scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect)
 {
@@ -1165,8 +1187,8 @@ bool FrameView::scrollContentsFastPath(const IntSize& scrollDelta, const IntRect
             continue;
         IntRect updateRect = renderBox->layer()->repaintRectIncludingDescendants();
         updateRect = contentsToWindow(updateRect);
-
-        updateRect.intersect(rectToScroll);
+        if (clipsRepaints())
+            updateRect.intersect(rectToScroll);
         if (!updateRect.isEmpty()) {
             if (subRectToUpdate.size() >= fixedObjectThreshold) {
                 updateInvalidatedSubRect = false;
@@ -1188,7 +1210,8 @@ bool FrameView::scrollContentsFastPath(const IntSize& scrollDelta, const IntRect
             IntRect scrolledRect = updateRect;
             scrolledRect.move(scrollDelta);
             updateRect.unite(scrolledRect);
-            updateRect.intersect(rectToScroll);
+            if (clipsRepaints())
+                updateRect.intersect(rectToScroll);
             hostWindow()->invalidateContentsAndWindow(updateRect, false);
         }
         return true;
@@ -1462,6 +1485,12 @@ void FrameView::repaintContentRectangle(const IntRect& r, bool immediate)
     ScrollView::repaintContentRectangle(r, immediate);
 }
 
+void FrameView::contentsResized()
+{
+    scrollAnimator()->contentsResized();
+    setNeedsLayout();
+}
+
 void FrameView::visibleContentsResized()
 {
     // We check to make sure the view is attached to a frame() as this method can
@@ -1727,10 +1756,10 @@ void FrameView::unscheduleRelayout()
 }
 
 #if ENABLE(REQUEST_ANIMATION_FRAME)
-void FrameView::serviceScriptedAnimations()
+void FrameView::serviceScriptedAnimations(DOMTimeStamp time)
 {
     for (Frame* frame = m_frame.get(); frame; frame = frame->tree()->traverseNext())
-        frame->document()->serviceScriptedAnimations();
+        frame->document()->serviceScriptedAnimations(time);
 }
 #endif
 
@@ -1854,11 +1883,11 @@ void FrameView::updateWidget(RenderEmbeddedObject* object)
     // FIXME: This could turn into a real virtual dispatch if we defined
     // updateWidget(bool) on HTMLElement.
     if (ownerElement->hasTagName(objectTag) || ownerElement->hasTagName(embedTag))
-        static_cast<HTMLPlugInImageElement*>(ownerElement)->updateWidget(false);
+        static_cast<HTMLPlugInImageElement*>(ownerElement)->updateWidget(CreateAnyWidgetType);
     // FIXME: It is not clear that Media elements need or want this updateWidget() call.
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     else if (ownerElement->hasTagName(videoTag) || ownerElement->hasTagName(audioTag))
-        static_cast<HTMLMediaElement*>(ownerElement)->updateWidget(false);
+        static_cast<HTMLMediaElement*>(ownerElement)->updateWidget(CreateAnyWidgetType);
 #endif
     else
         ASSERT_NOT_REACHED();
@@ -1896,11 +1925,23 @@ bool FrameView::updateWidgets()
     
     return m_widgetUpdateSet->isEmpty();
 }
-    
+
+void FrameView::flushAnyPendingPostLayoutTasks()
+{
+    if (!m_hasPendingPostLayoutTasks)
+        return;
+
+    m_postLayoutTasksTimer.stop();
+    performPostLayoutTasks();
+}
+
 void FrameView::performPostLayoutTasks()
 {
     m_hasPendingPostLayoutTasks = false;
 
+    m_frame->selection()->setCaretRectNeedsUpdate();
+    m_frame->selection()->updateAppearance();
+
     if (m_firstLayoutCallbackPending) {
         m_firstLayoutCallbackPending = false;
         m_frame->loader()->didFirstLayout();
@@ -2063,6 +2104,14 @@ IntRect FrameView::windowResizerRect() const
     return page->chrome()->windowResizerRect();
 }
 
+void FrameView::didCompleteRubberBand(const IntSize& initialOverhang) const
+{
+    Page* page = m_frame->page();
+    if (page->mainFrame() != m_frame)
+        return;
+    return page->chrome()->client()->didCompleteRubberBandForMainFrame(initialOverhang);
+}
+
 #if ENABLE(DASHBOARD_SUPPORT)
 void FrameView::updateDashboardRegions()
 {
@@ -2169,7 +2218,7 @@ void FrameView::updateControlTints()
     // to define when controls get the tint and to call this function when that changes.
     
     // Optimize the common case where we bring a window to the front while it's still empty.
-    if (!m_frame || m_frame->loader()->url().isEmpty())
+    if (!m_frame || m_frame->document()->url().isEmpty())
         return;
 
     if ((m_frame->contentRenderer() && m_frame->contentRenderer()->theme()->supportsControlTints()) || hasCustomScrollbars())  {
@@ -2305,6 +2354,23 @@ void FrameView::setNodeToDraw(Node* node)
     m_nodeToDraw = node;
 }
 
+void FrameView::paintOverhangAreas(GraphicsContext* context, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect)
+{
+    if (context->paintingDisabled())
+        return;
+
+    if (m_frame->document()->printing())
+        return;
+
+    Page* page = m_frame->page();
+    if (page->mainFrame() == m_frame) {
+        if (page->chrome()->client()->paintCustomOverhangArea(context, horizontalOverhangArea, verticalOverhangArea, dirtyRect))
+            return;
+    }
+
+    return ScrollView::paintOverhangAreas(context, horizontalOverhangArea, verticalOverhangArea, dirtyRect);
+}
+
 void FrameView::updateLayoutAndStyleIfNeededRecursive()
 {
     // We have to crawl our entire tree looking for any FrameViews that need
@@ -2353,27 +2419,38 @@ void FrameView::forceLayoutForPagination(const FloatSize& pageSize, float maximu
     // the state of things before and after the layout
     RenderView *root = toRenderView(m_frame->document()->renderer());
     if (root) {
-        int pageW = ceilf(pageSize.width());
-        root->setWidth(pageW);
-        root->setPageLogicalHeight(pageSize.height());
+        float pageLogicalWidth = root->style()->isHorizontalWritingMode() ? pageSize.width() : pageSize.height();
+        float pageLogicalHeight = root->style()->isHorizontalWritingMode() ? pageSize.height() : pageSize.width();
+
+        int flooredPageLogicalWidth = static_cast<int>(pageLogicalWidth);
+        root->setLogicalWidth(flooredPageLogicalWidth);
+        root->setPageLogicalHeight(pageLogicalHeight);
         root->setNeedsLayoutAndPrefWidthsRecalc();
         forceLayout();
-
+        
         // If we don't fit in the given page width, we'll lay out again. If we don't fit in the
         // page width when shrunk, we will lay out at maximum shrink and clip extra content.
         // FIXME: We are assuming a shrink-to-fit printing implementation.  A cropping
         // implementation should not do this!
-        int docWidth = root->docWidth();
-        if (docWidth > pageSize.width()) {
-            pageW = std::min<int>(docWidth, ceilf(pageSize.width() * maximumShrinkFactor));
-            if (pageSize.height())
-                root->setPageLogicalHeight(pageW / pageSize.width() * pageSize.height());
-            root->setWidth(pageW);
+        int docLogicalWidth = root->style()->isHorizontalWritingMode() ? root->docWidth() : root->docHeight();
+        if (docLogicalWidth > pageLogicalWidth) {
+            flooredPageLogicalWidth = std::min<int>(docLogicalWidth, pageLogicalWidth * maximumShrinkFactor);
+            if (pageLogicalHeight)
+                root->setPageLogicalHeight(flooredPageLogicalWidth / pageSize.width() * pageSize.height());
+            root->setLogicalWidth(flooredPageLogicalWidth);
             root->setNeedsLayoutAndPrefWidthsRecalc();
             forceLayout();
-            int docHeight = root->docHeight();
             root->clearLayoutOverflow();
-            root->addLayoutOverflow(IntRect(0, 0, pageW, docHeight)); // This is how we clip in case we overflow again.
+            int docLogicalHeight = root->style()->isHorizontalWritingMode() ? root->docHeight() : root->docWidth();
+            int docLogicalTop = root->style()->isHorizontalWritingMode() ? root->docTop() : root->docLeft();
+            int docLogicalRight = root->style()->isHorizontalWritingMode() ? root->docRight() : root->docBottom();
+            int clippedLogicalLeft = 0;
+            if (!root->style()->isLeftToRightDirection())
+                clippedLogicalLeft = docLogicalRight - flooredPageLogicalWidth;
+            IntRect overflow(clippedLogicalLeft, docLogicalTop, flooredPageLogicalWidth, docLogicalHeight);
+            if (!root->style()->isHorizontalWritingMode())
+                overflow = overflow.transposedRect();
+            root->addLayoutOverflow(overflow); // This is how we clip in case we overflow again.
         }
     }
 
@@ -2388,7 +2465,7 @@ void FrameView::adjustPageHeightDeprecated(float *newBottom, float oldTop, float
         // Use a context with painting disabled.
         GraphicsContext context((PlatformGraphicsContext*)0);
         root->setTruncatedAt((int)floorf(oldBottom));
-        IntRect dirtyRect(0, (int)floorf(oldTop), root->rightLayoutOverflow(), (int)ceilf(oldBottom - oldTop));
+        IntRect dirtyRect(0, (int)floorf(oldTop), root->maxXLayoutOverflow(), (int)ceilf(oldBottom - oldTop));
         root->setPrintRect(dirtyRect);
         root->layer()->paint(&context, dirtyRect);
         *newBottom = root->bestTruncatedAt();
diff --git a/Source/WebCore/page/FrameView.h b/Source/WebCore/page/FrameView.h
index e61099e..6c0ead2 100644
--- a/Source/WebCore/page/FrameView.h
+++ b/Source/WebCore/page/FrameView.h
@@ -45,6 +45,7 @@ class RenderLayer;
 class RenderObject;
 class RenderEmbeddedObject;
 class RenderScrollbarPart;
+
 struct ScheduledEvent;
 
 template <typename T> class Timer;
@@ -101,7 +102,7 @@ public:
     bool needsFullRepaint() const { return m_doFullRepaint; }
 
 #if ENABLE(REQUEST_ANIMATION_FRAME)
-    void serviceScriptedAnimations();
+    void serviceScriptedAnimations(DOMTimeStamp);
 #endif
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -209,6 +210,8 @@ public:
     bool isPainting() const;
     void setNodeToDraw(Node*);
 
+    virtual void paintOverhangAreas(GraphicsContext*, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect);
+
     static double currentPaintTimeStamp() { return sCurrentPaintTimeStamp; } // returns 0 if not painting
     
     void updateLayoutAndStyleIfNeededRecursive();
@@ -261,6 +264,11 @@ public:
     // On each repaint the delay increses by this amount
     static void setRepaintThrottlingDeferredRepaintDelayIncrementDuringLoading(double p);
 
+    virtual IntPoint currentMousePosition() const;
+
+    // FIXME: Remove this method once plugin loading is decoupled from layout.
+    void flushAnyPendingPostLayoutTasks();
+
 protected:
     virtual bool scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
     virtual void scrollContentsSlowPath(const IntRect& updateRect);
@@ -291,7 +299,7 @@ private:
     void performPostLayoutTasks();
 
     virtual void repaintContentRectangle(const IntRect&, bool immediate);
-    virtual void contentsResized() { setNeedsLayout(); }
+    virtual void contentsResized();
     virtual void visibleContentsResized();
 
     // Override ScrollView methods to do point conversion via renderers, in order to
@@ -305,8 +313,9 @@ private:
     virtual void invalidateScrollbarRect(Scrollbar*, const IntRect&);
     virtual bool isActive() const;
     virtual void getTickmarks(Vector<IntRect>&) const;
-
     virtual void scrollTo(const IntSize&);
+    virtual void didCompleteRubberBand(const IntSize&) const;
+    virtual bool scrollbarWillRenderIntoCompositingLayer() const { return hasCompositedContent() || isEnclosedInCompositingLayer(); }
 
     void deferredRepaintTimerFired(Timer<FrameView>*);
     void doDeferredRepaints();
diff --git a/Source/WebCore/page/Location.cpp b/Source/WebCore/page/Location.cpp
index be185f9..4835a83 100644
--- a/Source/WebCore/page/Location.cpp
+++ b/Source/WebCore/page/Location.cpp
@@ -51,7 +51,7 @@ inline const KURL& Location::url() const
 {
     ASSERT(m_frame);
 
-    const KURL& url = m_frame->loader()->url();
+    const KURL& url = m_frame->document()->url();
     if (!url.isValid())
         return blankURL(); // Use "about:blank" while the page is still loading (before we have a frame).
 
@@ -167,7 +167,7 @@ void Location::setProtocol(const String& protocol, DOMWindow* activeWindow, DOMW
 {
     if (!m_frame)
         return;
-    KURL url = m_frame->loader()->url();
+    KURL url = m_frame->document()->url();
     if (!url.setProtocol(protocol)) {
         ec = SYNTAX_ERR;
         return;
@@ -179,7 +179,7 @@ void Location::setHost(const String& host, DOMWindow* activeWindow, DOMWindow* f
 {
     if (!m_frame)
         return;
-    KURL url = m_frame->loader()->url();
+    KURL url = m_frame->document()->url();
     url.setHostAndPort(host);
     m_frame->domWindow()->setLocation(url.string(), activeWindow, firstWindow);
 }
@@ -188,7 +188,7 @@ void Location::setHostname(const String& hostname, DOMWindow* activeWindow, DOMW
 {
     if (!m_frame)
         return;
-    KURL url = m_frame->loader()->url();
+    KURL url = m_frame->document()->url();
     url.setHost(hostname);
     m_frame->domWindow()->setLocation(url.string(), activeWindow, firstWindow);
 }
@@ -197,7 +197,7 @@ void Location::setPort(const String& portString, DOMWindow* activeWindow, DOMWin
 {
     if (!m_frame)
         return;
-    KURL url = m_frame->loader()->url();
+    KURL url = m_frame->document()->url();
     int port = portString.toInt();
     if (port < 0 || port > 0xFFFF)
         url.removePort();
@@ -210,7 +210,7 @@ void Location::setPathname(const String& pathname, DOMWindow* activeWindow, DOMW
 {
     if (!m_frame)
         return;
-    KURL url = m_frame->loader()->url();
+    KURL url = m_frame->document()->url();
     url.setPath(pathname);
     m_frame->domWindow()->setLocation(url.string(), activeWindow, firstWindow);
 }
@@ -219,7 +219,7 @@ void Location::setSearch(const String& search, DOMWindow* activeWindow, DOMWindo
 {
     if (!m_frame)
         return;
-    KURL url = m_frame->loader()->url();
+    KURL url = m_frame->document()->url();
     url.setQuery(search);
     m_frame->domWindow()->setLocation(url.string(), activeWindow, firstWindow);
 }
@@ -228,7 +228,7 @@ void Location::setHash(const String& hash, DOMWindow* activeWindow, DOMWindow* f
 {
     if (!m_frame)
         return;
-    KURL url = m_frame->loader()->url();
+    KURL url = m_frame->document()->url();
     String oldFragmentIdentifier = url.fragmentIdentifier();
     String newFragmentIdentifier = hash;
     if (hash[0] == '#')
@@ -268,7 +268,7 @@ void Location::reload(DOMWindow* activeWindow)
         targetWindow->printErrorMessage(targetWindow->crossDomainAccessErrorMessage(activeWindow));
         return;
     }
-    if (protocolIsJavaScript(m_frame->loader()->url()))
+    if (protocolIsJavaScript(m_frame->document()->url()))
         return;
     m_frame->navigationScheduler()->scheduleRefresh();
 }
diff --git a/Source/WebCore/page/MemoryInfo.cpp b/Source/WebCore/page/MemoryInfo.cpp
index c2247b9..57dae2b 100644
--- a/Source/WebCore/page/MemoryInfo.cpp
+++ b/Source/WebCore/page/MemoryInfo.cpp
@@ -39,11 +39,12 @@ namespace WebCore {
 
 MemoryInfo::MemoryInfo(Frame* frame)
         : m_totalJSHeapSize(0),
-          m_usedJSHeapSize(0)
+          m_usedJSHeapSize(0),
+          m_jsHeapSizeLimit(0)
 {
     if (frame && frame->settings() && frame->settings()->memoryInfoEnabled()) {
 #if ENABLE(INSPECTOR)
-        ScriptGCEvent::getHeapSize(m_usedJSHeapSize, m_totalJSHeapSize);
+        ScriptGCEvent::getHeapSize(m_usedJSHeapSize, m_totalJSHeapSize, m_jsHeapSizeLimit);
 #endif
     }
 }
diff --git a/Source/WebCore/page/MemoryInfo.h b/Source/WebCore/page/MemoryInfo.h
index 615e952..27a7344 100644
--- a/Source/WebCore/page/MemoryInfo.h
+++ b/Source/WebCore/page/MemoryInfo.h
@@ -44,12 +44,14 @@ public:
 
     size_t totalJSHeapSize() const { return m_totalJSHeapSize; }
     size_t usedJSHeapSize() const { return m_usedJSHeapSize; }
+    size_t jsHeapSizeLimit() const { return m_jsHeapSizeLimit; }
 
 private:
     MemoryInfo(Frame*);
 
     size_t m_totalJSHeapSize;
     size_t m_usedJSHeapSize;
+    size_t m_jsHeapSizeLimit;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/MemoryInfo.idl b/Source/WebCore/page/MemoryInfo.idl
index 59b0081..13965a5 100644
--- a/Source/WebCore/page/MemoryInfo.idl
+++ b/Source/WebCore/page/MemoryInfo.idl
@@ -34,6 +34,7 @@ module window {
 
         readonly attribute unsigned long totalJSHeapSize;
         readonly attribute unsigned long usedJSHeapSize;
+        readonly attribute [JSCCustomGetter] unsigned long jsHeapSizeLimit;
 
     };
 
diff --git a/Source/WebCore/page/Navigator.cpp b/Source/WebCore/page/Navigator.cpp
index 5390fc9..53563b4 100644
--- a/Source/WebCore/page/Navigator.cpp
+++ b/Source/WebCore/page/Navigator.cpp
@@ -27,10 +27,12 @@
 #include "CookieJar.h"
 #include "DOMMimeTypeArray.h"
 #include "DOMPluginArray.h"
+#include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
 #include "Geolocation.h"
+#include "KURL.h"
 #include "Language.h"
 #include "Page.h"
 #include "PageGroup.h"
@@ -39,6 +41,7 @@
 #include "ScriptController.h"
 #include "Settings.h"
 #include "StorageNamespace.h"
+#include <wtf/StdLibExtras.h>
 
 #if PLATFORM(ANDROID)
 #include "ApplicationInstalledCallback.h"
@@ -209,4 +212,67 @@ void Navigator::getStorageUpdates()
 }
 #endif
 
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+static bool verifyCustomHandlerURL(const String& baseURL, const String& url, ExceptionCode& ec)
+{
+    // The specification requires that it is a SYNTAX_ERR if the "%s" token is
+    // not present.
+    static const char token[] = "%s";
+    int index = url.find(token);
+    if (-1 == index) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    // It is also a SYNTAX_ERR if the custom handler URL, as created by removing
+    // the "%s" token and prepending the base url, does not resolve.
+    String newURL = url;
+    newURL.remove(index, WTF_ARRAY_LENGTH(token) - 1);
+
+    KURL base(ParsedURLString, baseURL);
+    KURL kurl(base, newURL);
+
+    if (kurl.isEmpty() || !kurl.isValid()) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    return true;
+}
+
+static bool verifyProtocolHandlerScheme(const String& scheme, ExceptionCode& ec)
+{
+    // It is a SECURITY_ERR for these schemes to be handled by a custom handler.
+    if (equalIgnoringCase(scheme, "http") || equalIgnoringCase(scheme, "https") || equalIgnoringCase(scheme, "file")) {
+        ec = SECURITY_ERR;
+        return false;
+    }
+    return true;
+}
+
+void Navigator::registerProtocolHandler(const String& scheme, const String& url, const String& title, ExceptionCode& ec)
+{
+    if (!verifyProtocolHandlerScheme(scheme, ec))
+        return;
+
+    if (!m_frame)
+        return;
+
+    Document* document = m_frame->document();
+    if (!document)
+        return;
+
+    String baseURL = document->baseURL().baseAsString();
+
+    if (!verifyCustomHandlerURL(baseURL, url, ec))
+        return;
+
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+
+    page->chrome()->registerProtocolHandler(scheme, baseURL, url, m_frame->displayStringModifiedByEncoding(title));
+}
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebCore/page/Navigator.h b/Source/WebCore/page/Navigator.h
index e0801fe..f7dc543 100644
--- a/Source/WebCore/page/Navigator.h
+++ b/Source/WebCore/page/Navigator.h
@@ -42,6 +42,8 @@ class ApplicationInstalledCallback;
 class Connection;
 #endif
 
+typedef int ExceptionCode;
+
 class Navigator : public NavigatorBase, public RefCounted<Navigator> {
 public:
     static PassRefPtr<Navigator> create(Frame* frame) { return adoptRef(new Navigator(frame)); }
@@ -77,6 +79,10 @@ public:
     void getStorageUpdates();
 #endif
 
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+    void registerProtocolHandler(const String& scheme, const String& url, const String& title, ExceptionCode&);
+#endif
+
 private:
     Navigator(Frame*);
     Frame* m_frame;
diff --git a/Source/WebCore/page/Navigator.idl b/Source/WebCore/page/Navigator.idl
index 5699d86..b92ef4a 100644
--- a/Source/WebCore/page/Navigator.idl
+++ b/Source/WebCore/page/Navigator.idl
@@ -57,6 +57,11 @@ module window {
 #if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
         void getStorageUpdates();
 #endif
+
+#if defined(ENABLE_REGISTER_PROTOCOL_HANDLER) && ENABLE_REGISTER_PROTOCOL_HANDLER
+        void registerProtocolHandler(in DOMString scheme, in DOMString url, in DOMString title)
+            raises(DomException);
+#endif
     };
 
 }
diff --git a/Source/WebCore/page/Page.cpp b/Source/WebCore/page/Page.cpp
index c4d5ca4..6ffea29 100644
--- a/Source/WebCore/page/Page.cpp
+++ b/Source/WebCore/page/Page.cpp
@@ -83,10 +83,6 @@
 #include "StorageNamespace.h"
 #endif
 
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-#include "ScriptDebugServer.h"
-#endif
-
 #if ENABLE(WML)
 #include "WMLPageState.h"
 #endif
@@ -198,10 +194,6 @@ Page::Page(const PageClients& pageClients)
         m_pluginHalter->setPluginAllowedRunTime(m_settings->pluginAllowedRunTime());
     }
 
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    ScriptDebugServer::shared().pageCreated(this);
-#endif
-
 #ifndef NDEBUG
     pageCounter.increment();
 #endif
@@ -365,7 +357,7 @@ void Page::goToItem(HistoryItem* item, FrameLoadType type)
 
 #if ENABLE(DATABASE)
         // If we're navigating the history via a fragment on the same document, then we do not want to stop databases.
-        const KURL& currentURL = m_mainFrame->loader()->url();
+        const KURL& currentURL = m_mainFrame->document()->url();
         const KURL& newURL = item->url();
     
         if (newURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(currentURL, newURL))
diff --git a/Source/WebCore/page/PrintContext.cpp b/Source/WebCore/page/PrintContext.cpp
index e82420d..da29f0e 100644
--- a/Source/WebCore/page/PrintContext.cpp
+++ b/Source/WebCore/page/PrintContext.cpp
@@ -55,16 +55,6 @@ PrintContext::~PrintContext()
         end();
 }
 
-size_t PrintContext::pageCount() const
-{
-    return m_pageRects.size();
-}
-
-const IntRect& PrintContext::pageRect(size_t pageNumber) const
-{
-    return m_pageRects[pageNumber];
-}
-
 void PrintContext::computePageRects(const FloatRect& printRect, float headerHeight, float footerHeight, float userScaleFactor, float& outPageHeight, bool allowHorizontalTiling)
 {
     m_pageRects.clear();
@@ -80,10 +70,20 @@ void PrintContext::computePageRects(const FloatRect& printRect, float headerHeig
 
     RenderView* view = toRenderView(m_frame->document()->renderer());
 
-    float ratio = printRect.height() / printRect.width();
+    bool isHorizontal = view->style()->isHorizontalWritingMode();
+
+    float pageWidth;
+    float pageHeight;
+    if (isHorizontal) {
+        float ratio = printRect.height() / printRect.width();
+        pageWidth = view->docWidth();
+        pageHeight = floorf(pageWidth * ratio);
+    } else {
+        float ratio = printRect.width() / printRect.height();
+        pageHeight = view->docHeight();
+        pageWidth = floorf(pageHeight * ratio);
+    }
 
-    float pageWidth  = view->docWidth();
-    float pageHeight = floorf(pageWidth * ratio);
     outPageHeight = pageHeight; // this is the height of the page adjusted by margins
     pageHeight -= headerHeight + footerHeight;
 
@@ -101,7 +101,7 @@ void PrintContext::computePageRectsWithPageSize(const FloatSize& pageSizeInPixel
     computePageRectsWithPageSizeInternal(pageSizeInPixels, allowHorizontalTiling);
 }
 
-void PrintContext::computePageRectsWithPageSizeInternal(const FloatSize& pageSizeInPixels, bool allowHorizontalTiling)
+void PrintContext::computePageRectsWithPageSizeInternal(const FloatSize& pageSizeInPixels, bool allowInlineDirectionTiling)
 {
     if (!m_frame->document() || !m_frame->view() || !m_frame->document()->renderer())
         return;
@@ -113,13 +113,60 @@ void PrintContext::computePageRectsWithPageSizeInternal(const FloatSize& pageSiz
     int pageWidth = pageSizeInPixels.width();
     int pageHeight = pageSizeInPixels.height();
 
-    unsigned pageCount = ceilf((float)docRect.height() / pageHeight);
+    bool isHorizontal = view->style()->isHorizontalWritingMode();
+
+    int docLogicalHeight = isHorizontal ? docRect.height() : docRect.width();
+    int pageLogicalHeight = isHorizontal ? pageHeight : pageWidth;
+    int pageLogicalWidth = isHorizontal ? pageWidth : pageHeight;
+
+    int inlineDirectionStart;
+    int inlineDirectionEnd;
+    int blockDirectionStart;
+    int blockDirectionEnd;
+    if (isHorizontal) {
+        if (view->style()->isFlippedBlocksWritingMode()) {
+            blockDirectionStart = docRect.maxY();
+            blockDirectionEnd = docRect.y();
+        } else {
+            blockDirectionStart = docRect.y();
+            blockDirectionEnd = docRect.maxY();
+        }
+        inlineDirectionStart = view->style()->isLeftToRightDirection() ? docRect.x() : docRect.maxX();
+        inlineDirectionEnd = view->style()->isLeftToRightDirection() ? docRect.maxX() : docRect.x();
+    } else {
+        if (view->style()->isFlippedBlocksWritingMode()) {
+            blockDirectionStart = docRect.maxX();
+            blockDirectionEnd = docRect.x();
+        } else {
+            blockDirectionStart = docRect.x();
+            blockDirectionEnd = docRect.maxX();
+        }
+        inlineDirectionStart = view->style()->isLeftToRightDirection() ? docRect.y() : docRect.maxY();
+        inlineDirectionEnd = view->style()->isLeftToRightDirection() ? docRect.maxY() : docRect.y();
+    }
+
+    unsigned pageCount = ceilf((float)docLogicalHeight / pageLogicalHeight);
     for (unsigned i = 0; i < pageCount; ++i) {
-        if (allowHorizontalTiling) {
-            for (int currentX = docRect.x(); currentX < docRect.right(); currentX += pageWidth)
-                m_pageRects.append(IntRect(currentX, docRect.y() + i * pageHeight, pageWidth, pageHeight));
-        } else
-            m_pageRects.append(IntRect(docRect.x(), docRect.y() + i * pageHeight, pageWidth, pageHeight));
+        int pageLogicalTop = blockDirectionEnd > blockDirectionStart ?
+                                blockDirectionStart + i * pageLogicalHeight : 
+                                blockDirectionStart - (i + 1) * pageLogicalHeight;
+        if (allowInlineDirectionTiling) {
+            for (int currentInlinePosition = inlineDirectionStart;
+                 inlineDirectionEnd > inlineDirectionStart ? currentInlinePosition < inlineDirectionEnd : currentInlinePosition > inlineDirectionEnd;
+                 currentInlinePosition += (inlineDirectionEnd > inlineDirectionStart ? pageLogicalWidth : -pageLogicalWidth)) {
+                int pageLogicalLeft = inlineDirectionEnd > inlineDirectionStart ? currentInlinePosition : currentInlinePosition - pageLogicalWidth;
+                IntRect pageRect(pageLogicalLeft, pageLogicalTop, pageLogicalWidth, pageLogicalHeight);
+                if (!isHorizontal)
+                    pageRect = pageRect.transposedRect();
+                m_pageRects.append(pageRect);
+            }
+        } else {
+            int pageLogicalLeft = inlineDirectionEnd > inlineDirectionStart ? inlineDirectionStart : inlineDirectionStart - pageLogicalWidth;
+            IntRect pageRect(pageLogicalLeft, pageLogicalTop, pageLogicalWidth, pageLogicalHeight);
+            if (!isHorizontal)
+                pageRect = pageRect.transposedRect();
+            m_pageRects.append(pageRect);
+        }
     }
 }
 
@@ -135,22 +182,27 @@ void PrintContext::begin(float width, float height)
     m_frame->setPrinting(true, FloatSize(minLayoutWidth, minLayoutHeight), printingMaximumShrinkFactor / printingMinimumShrinkFactor, Frame::AdjustViewSize);
 }
 
-float PrintContext::computeAutomaticScaleFactor(float availablePaperWidth)
+float PrintContext::computeAutomaticScaleFactor(const FloatSize& availablePaperSize)
 {
     if (!m_frame->view())
         return 1;
 
-    float viewWidth = m_frame->view()->contentsWidth();
-    if (viewWidth < 1)
+    bool useViewWidth = true;
+    if (m_frame->document() && m_frame->document()->renderView())
+        useViewWidth = m_frame->document()->renderView()->style()->isHorizontalWritingMode();
+
+    float viewLogicalWidth = useViewWidth ? m_frame->view()->contentsWidth() : m_frame->view()->contentsHeight();
+    if (viewLogicalWidth < 1)
         return 1;
 
     float maxShrinkToFitScaleFactor = 1 / printingMaximumShrinkFactor;
-    float shrinkToFitScaleFactor = availablePaperWidth / viewWidth;
+    float shrinkToFitScaleFactor = (useViewWidth ? availablePaperSize.width() : availablePaperSize.height()) / viewLogicalWidth;
     return max(maxShrinkToFitScaleFactor, shrinkToFitScaleFactor);
 }
 
 void PrintContext::spoolPage(GraphicsContext& ctx, int pageNumber, float width)
 {
+    // FIXME: Not correct for vertical text.
     IntRect pageRect = m_pageRects[pageNumber];
     float scale = width / pageRect.width();
 
@@ -164,9 +216,9 @@ void PrintContext::spoolPage(GraphicsContext& ctx, int pageNumber, float width)
 
 void PrintContext::spoolRect(GraphicsContext& ctx, const IntRect& rect)
 {
+    // FIXME: Not correct for vertical text.
     ctx.save();
-    ctx.scale(FloatSize(1, -1));
-    ctx.translate(0, -rect.height());
+    ctx.translate(-rect.x(), -rect.y());
     ctx.clip(rect);
     m_frame->view()->paintContents(&ctx, rect);
     ctx.restore();
@@ -212,7 +264,7 @@ int PrintContext::pageNumberForElement(Element* element, const FloatSize& pageSi
     size_t pageNumber = 0;
     for (; pageNumber < printContext.pageCount(); pageNumber++) {
         const IntRect& page = printContext.pageRect(pageNumber);
-        if (page.x() <= left && left < page.right() && page.y() <= top && top < page.bottom())
+        if (page.x() <= left && left < page.maxX() && page.y() <= top && top < page.maxY())
             return pageNumber;
     }
     return -1;
diff --git a/Source/WebCore/page/PrintContext.h b/Source/WebCore/page/PrintContext.h
index ce2554a..873937a 100644
--- a/Source/WebCore/page/PrintContext.h
+++ b/Source/WebCore/page/PrintContext.h
@@ -50,11 +50,11 @@ public:
     void computePageRectsWithPageSize(const FloatSize& pageSizeInPixels, bool allowHorizontalTiling);
 
     // These are only valid after page rects are computed.
-    size_t pageCount() const;
-    const IntRect& pageRect(size_t pageNumber) const;
+    size_t pageCount() const { return m_pageRects.size(); }
+    const IntRect& pageRect(size_t pageNumber) const { return m_pageRects[pageNumber]; }
     const Vector<IntRect>& pageRects() const { return m_pageRects; }
 
-    float computeAutomaticScaleFactor(float availablePaperWidth);
+    float computeAutomaticScaleFactor(const FloatSize& availablePaperSize);
 
     // Enter print mode, updating layout for new page size.
     // This function can be called multiple times to apply new print options without going back to screen mode.
diff --git a/Source/WebCore/page/SecurityOrigin.cpp b/Source/WebCore/page/SecurityOrigin.cpp
index 789fdf9..977e860 100644
--- a/Source/WebCore/page/SecurityOrigin.cpp
+++ b/Source/WebCore/page/SecurityOrigin.cpp
@@ -79,6 +79,18 @@ SecurityOrigin::SecurityOrigin(const KURL& url, SandboxFlags sandboxFlags)
     if (m_protocol == "about" || m_protocol == "javascript")
         m_protocol = "";
 
+#if ENABLE(FILE_SYSTEM)
+    if (m_protocol == "filesystem") {
+        KURL originURL(ParsedURLString, url.path());
+        if (originURL.isValid()) {
+            m_protocol = originURL.protocol().lower();
+            m_host = originURL.host().lower();
+            m_port = originURL.port();
+        } else
+            m_isUnique = true;
+    }
+#endif
+
     // For edge case URLs that were probably misparsed, make sure that the origin is unique.
     if (schemeRequiresAuthority(m_protocol) && m_host.isEmpty())
         m_isUnique = true;
@@ -178,6 +190,9 @@ bool SecurityOrigin::canAccess(const SecurityOrigin* other) const
     if (m_universalAccess)
         return true;
 
+    if (this == other)
+        return true;
+
     if (isUnique() || other->isUnique())
         return false;
 
@@ -310,11 +325,8 @@ bool SecurityOrigin::canDisplay(const KURL& url) const
 {
     String protocol = url.protocol().lower();
 
-#if ENABLE(BLOB)
-    // FIXME: We should generalize this check.
-    if (protocol == BlobURL::blobProtocol())
+    if (SchemeRegistry::canDisplayOnlyIfCanRequest(protocol))
         return canRequest(url);
-#endif
 
     if (SchemeRegistry::shouldTreatURLSchemeAsDisplayIsolated(protocol))
         return m_protocol == protocol || isAccessToURLWhiteListed(url);
diff --git a/Source/WebCore/page/Settings.cpp b/Source/WebCore/page/Settings.cpp
index a88ca6b..49180f5 100644
--- a/Source/WebCore/page/Settings.cpp
+++ b/Source/WebCore/page/Settings.cpp
@@ -168,6 +168,7 @@ Settings::Settings(Page* page)
     , m_showRepaintCounter(false)
     , m_experimentalNotificationsEnabled(false)
     , m_webGLEnabled(false)
+    , m_openGLMultisamplingEnabled(true)
     , m_webAudioEnabled(false)
     , m_acceleratedCanvas2dEnabled(false)
     , m_loadDeferringEnabled(true)
@@ -712,10 +713,12 @@ void Settings::setFrameFlatteningEnabled(bool frameFlatteningEnabled)
     m_frameFlatteningEnabled = frameFlatteningEnabled;
 }
 
+#if ENABLE(WEB_ARCHIVE)
 void Settings::setWebArchiveDebugModeEnabled(bool enabled)
 {
     m_webArchiveDebugModeEnabled = enabled;
 }
+#endif
 
 void Settings::setLocalFileContentSniffingEnabled(bool enabled)
 {
@@ -868,6 +871,11 @@ void Settings::setWebGLEnabled(bool enabled)
     m_webGLEnabled = enabled;
 }
 
+void Settings::setOpenGLMultisamplingEnabled(bool enabled)
+{
+    m_openGLMultisamplingEnabled = enabled;
+}
+
 void Settings::setAccelerated2dCanvasEnabled(bool enabled)
 {
     m_acceleratedCanvas2dEnabled = enabled;
diff --git a/Source/WebCore/page/Settings.h b/Source/WebCore/page/Settings.h
index 9f0982a..3b06834 100644
--- a/Source/WebCore/page/Settings.h
+++ b/Source/WebCore/page/Settings.h
@@ -302,9 +302,11 @@ namespace WebCore {
 
         void setNeedsSiteSpecificQuirks(bool);
         bool needsSiteSpecificQuirks() const { return m_needsSiteSpecificQuirks; }
-        
+
+#if ENABLE(WEB_ARCHIVE)
         void setWebArchiveDebugModeEnabled(bool);
         bool webArchiveDebugModeEnabled() const { return m_webArchiveDebugModeEnabled; }
+#endif
 
         void setLocalFileContentSniffingEnabled(bool);
         bool localFileContentSniffingEnabled() const { return m_localFileContentSniffingEnabled; }
@@ -386,6 +388,9 @@ namespace WebCore {
         void setWebGLEnabled(bool);
         bool webGLEnabled() const { return m_webGLEnabled; }
 
+        void setOpenGLMultisamplingEnabled(bool);
+        bool openGLMultisamplingEnabled() const { return m_openGLMultisamplingEnabled; }
+
         void setAccelerated2dCanvasEnabled(bool);
         bool accelerated2dCanvasEnabled() const { return m_acceleratedCanvas2dEnabled; }
 
@@ -548,6 +553,7 @@ namespace WebCore {
         bool m_showRepaintCounter : 1;
         bool m_experimentalNotificationsEnabled : 1;
         bool m_webGLEnabled : 1;
+        bool m_openGLMultisamplingEnabled : 1;
         bool m_webAudioEnabled : 1;
         bool m_acceleratedCanvas2dEnabled : 1;
         bool m_loadDeferringEnabled : 1;
diff --git a/Source/WebCore/page/SpatialNavigation.cpp b/Source/WebCore/page/SpatialNavigation.cpp
index 7d8ede3..34a2c97 100644
--- a/Source/WebCore/page/SpatialNavigation.cpp
+++ b/Source/WebCore/page/SpatialNavigation.cpp
@@ -127,7 +127,7 @@ static inline int middle(FocusDirection direction, const IntRect& rect)
 
 static inline int end(FocusDirection direction, const IntRect& rect)
 {
-    return isHorizontalMove(direction) ? rect.bottom() : rect.right();
+    return isHorizontalMove(direction) ? rect.maxY() : rect.maxX();
 }
 
 // This method checks if rects |a| and |b| are fully aligned either vertically or
@@ -144,11 +144,11 @@ static bool areRectsFullyAligned(FocusDirection direction, const IntRect& a, con
     switch (direction) {
     case FocusDirectionLeft:
         aStart = a.x();
-        bEnd = b.right();
+        bEnd = b.maxX();
         break;
     case FocusDirectionRight:
         aStart = b.x();
-        bEnd = a.right();
+        bEnd = a.maxX();
         break;
     case FocusDirectionUp:
         aStart = a.y();
@@ -245,13 +245,13 @@ static bool areRectsMoreThanFullScreenApart(FocusDirection direction, const IntR
 
     switch (direction) {
     case FocusDirectionLeft:
-        return curRect.x() - targetRect.right() > viewSize.width();
+        return curRect.x() - targetRect.maxX() > viewSize.width();
     case FocusDirectionRight:
-        return targetRect.x() - curRect.right() > viewSize.width();
+        return targetRect.x() - curRect.maxX() > viewSize.width();
     case FocusDirectionUp:
-        return curRect.y() - targetRect.bottom() > viewSize.height();
+        return curRect.y() - targetRect.maxY() > viewSize.height();
     case FocusDirectionDown:
-        return targetRect.y() - curRect.bottom() > viewSize.height();
+        return targetRect.y() - curRect.maxY() > viewSize.height();
     default:
         ASSERT_NOT_REACHED();
         return true;
@@ -261,26 +261,26 @@ static bool areRectsMoreThanFullScreenApart(FocusDirection direction, const IntR
 // Return true if rect |a| is below |b|. False otherwise.
 static inline bool below(const IntRect& a, const IntRect& b)
 {
-    return a.y() > b.bottom();
+    return a.y() > b.maxY();
 }
 
 // Return true if rect |a| is on the right of |b|. False otherwise.
 static inline bool rightOf(const IntRect& a, const IntRect& b)
 {
-    return a.x() > b.right();
+    return a.x() > b.maxX();
 }
 
 static bool isRectInDirection(FocusDirection direction, const IntRect& curRect, const IntRect& targetRect)
 {
     switch (direction) {
     case FocusDirectionLeft:
-        return targetRect.right() <= curRect.x();
+        return targetRect.maxX() <= curRect.x();
     case FocusDirectionRight:
-        return targetRect.x() >= curRect.right();
+        return targetRect.x() >= curRect.maxX();
     case FocusDirectionUp:
-        return targetRect.bottom() <= curRect.y();
+        return targetRect.maxY() <= curRect.y();
     case FocusDirectionDown:
-        return targetRect.y() >= curRect.bottom();
+        return targetRect.y() >= curRect.maxY();
     default:
         ASSERT_NOT_REACHED();
         return false;
@@ -544,18 +544,18 @@ void entryAndExitPointsForDirection(FocusDirection direction, const IntRect& sta
     switch (direction) {
     case FocusDirectionLeft:
         exitPoint.setX(startingRect.x());
-        entryPoint.setX(potentialRect.right());
+        entryPoint.setX(potentialRect.maxX());
         break;
     case FocusDirectionUp:
         exitPoint.setY(startingRect.y());
-        entryPoint.setY(potentialRect.bottom());
+        entryPoint.setY(potentialRect.maxY());
         break;
     case FocusDirectionRight:
-        exitPoint.setX(startingRect.right());
+        exitPoint.setX(startingRect.maxX());
         entryPoint.setX(potentialRect.x());
         break;
     case FocusDirectionDown:
-        exitPoint.setY(startingRect.bottom());
+        exitPoint.setY(startingRect.maxY());
         entryPoint.setY(potentialRect.y());
         break;
     default:
@@ -567,9 +567,9 @@ void entryAndExitPointsForDirection(FocusDirection direction, const IntRect& sta
     case FocusDirectionRight:
         if (below(startingRect, potentialRect)) {
             exitPoint.setY(startingRect.y());
-            entryPoint.setY(potentialRect.bottom());
+            entryPoint.setY(potentialRect.maxY());
         } else if (below(potentialRect, startingRect)) {
-            exitPoint.setY(startingRect.bottom());
+            exitPoint.setY(startingRect.maxY());
             entryPoint.setY(potentialRect.y());
         } else {
             exitPoint.setY(max(startingRect.y(), potentialRect.y()));
@@ -580,9 +580,9 @@ void entryAndExitPointsForDirection(FocusDirection direction, const IntRect& sta
     case FocusDirectionDown:
         if (rightOf(startingRect, potentialRect)) {
             exitPoint.setX(startingRect.x());
-            entryPoint.setX(potentialRect.right());
+            entryPoint.setX(potentialRect.maxX());
         } else if (rightOf(potentialRect, startingRect)) {
-            exitPoint.setX(startingRect.right());
+            exitPoint.setX(startingRect.maxX());
             entryPoint.setX(potentialRect.x());
         } else {
             exitPoint.setX(max(startingRect.x(), potentialRect.x()));
@@ -675,11 +675,11 @@ IntRect virtualRectForDirection(FocusDirection direction, const IntRect& startin
     IntRect virtualStartingRect = startingRect;
     switch (direction) {
     case FocusDirectionLeft:
-        virtualStartingRect.setX(virtualStartingRect.right() - width);
+        virtualStartingRect.setX(virtualStartingRect.maxX() - width);
         virtualStartingRect.setWidth(width);
         break;
     case FocusDirectionUp:
-        virtualStartingRect.setY(virtualStartingRect.bottom() - width);
+        virtualStartingRect.setY(virtualStartingRect.maxY() - width);
         virtualStartingRect.setHeight(width);
         break;
     case FocusDirectionRight:
@@ -701,7 +701,7 @@ IntRect virtualRectForAreaElementAndDirection(HTMLAreaElement* area, FocusDirect
     ASSERT(area->imageElement());
     // Area elements tend to overlap more than other focusable elements. We flatten the rect of the area elements
     // to minimize the effect of overlapping areas.
-    IntRect rect = virtualRectForDirection(direction, rectToAbsoluteCoordinates(area->document()->frame(), area->getRect(area->imageElement()->renderer())), 1);
+    IntRect rect = virtualRectForDirection(direction, rectToAbsoluteCoordinates(area->document()->frame(), area->computeRect(area->imageElement()->renderer())), 1);
     return rect;
 }
 
diff --git a/Source/WebCore/page/SuspendableTimer.cpp b/Source/WebCore/page/SuspendableTimer.cpp
index 23f00b0..2a4d2e5 100644
--- a/Source/WebCore/page/SuspendableTimer.cpp
+++ b/Source/WebCore/page/SuspendableTimer.cpp
@@ -36,6 +36,7 @@ SuspendableTimer::SuspendableTimer(ScriptExecutionContext* context)
     , m_nextFireInterval(0)
     , m_repeatInterval(0)
 #if !ASSERT_DISABLED
+    , m_active(false)
     , m_suspended(false)
 #endif
 {
@@ -61,9 +62,12 @@ void SuspendableTimer::suspend(ReasonForSuspension)
     ASSERT(!m_suspended);
     m_suspended = true;
 #endif
-    m_nextFireInterval = nextFireInterval();
-    m_repeatInterval = repeatInterval();
-    TimerBase::stop();
+    m_active = isActive();
+    if (m_active) {
+        m_nextFireInterval = nextFireInterval();
+        m_repeatInterval = repeatInterval();
+        TimerBase::stop();
+    }
 }
 
 void SuspendableTimer::resume()
@@ -72,7 +76,8 @@ void SuspendableTimer::resume()
     ASSERT(m_suspended);
     m_suspended = false;
 #endif
-    start(m_nextFireInterval, m_repeatInterval);
+    if (m_active)
+        start(m_nextFireInterval, m_repeatInterval);
 }
 
 bool SuspendableTimer::canSuspend() const
diff --git a/Source/WebCore/page/SuspendableTimer.h b/Source/WebCore/page/SuspendableTimer.h
index cc90b62..fa03d6e 100644
--- a/Source/WebCore/page/SuspendableTimer.h
+++ b/Source/WebCore/page/SuspendableTimer.h
@@ -34,7 +34,7 @@ namespace WebCore {
 
 class SuspendableTimer : public TimerBase, public ActiveDOMObject {
 public:
-    SuspendableTimer(ScriptExecutionContext*);
+    explicit SuspendableTimer(ScriptExecutionContext*);
     virtual ~SuspendableTimer();
 
     // ActiveDOMObject
@@ -49,6 +49,7 @@ private:
 
     double m_nextFireInterval;
     double m_repeatInterval;
+    bool m_active;
 #if !ASSERT_DISABLED
     bool m_suspended;
 #endif
diff --git a/Source/WebCore/page/WindowFeatures.cpp b/Source/WebCore/page/WindowFeatures.cpp
index a229ae1..7564152 100644
--- a/Source/WebCore/page/WindowFeatures.cpp
+++ b/Source/WebCore/page/WindowFeatures.cpp
@@ -186,9 +186,9 @@ WindowFeatures::WindowFeatures(const String& dialogFeaturesString, const FloatRe
     width = floatFeature(features, "dialogwidth", 100, screenAvailableRect.width(), 620); // default here came from frame size of dialog in MacIE
     height = floatFeature(features, "dialogheight", 100, screenAvailableRect.height(), 450); // default here came from frame size of dialog in MacIE
 
-    x = floatFeature(features, "dialogleft", screenAvailableRect.x(), screenAvailableRect.right() - width, -1);
+    x = floatFeature(features, "dialogleft", screenAvailableRect.x(), screenAvailableRect.maxX() - width, -1);
     xSet = x > 0;
-    y = floatFeature(features, "dialogtop", screenAvailableRect.y(), screenAvailableRect.bottom() - height, -1);
+    y = floatFeature(features, "dialogtop", screenAvailableRect.y(), screenAvailableRect.maxY() - height, -1);
     ySet = y > 0;
 
     if (boolFeature(features, "center", true)) {
diff --git a/Source/WebCore/page/XSSAuditor.cpp b/Source/WebCore/page/XSSAuditor.cpp
deleted file mode 100644
index 1b0e83f..0000000
--- a/Source/WebCore/page/XSSAuditor.cpp
+++ /dev/null
@@ -1,432 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Daniel Bates (dbates@intudata.com)
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "XSSAuditor.h"
-
-#include <wtf/StdLibExtras.h>
-#include <wtf/Vector.h>
-
-#include "Console.h"
-#include "DocumentLoader.h"
-#include "DOMWindow.h"
-#include "Frame.h"
-#include "HTMLEntityParser.h"
-#include "KURL.h"
-#include "ResourceResponseBase.h"
-#include "ScriptSourceCode.h"
-#include "Settings.h"
-#include "TextResourceDecoder.h"
-#include <wtf/text/CString.h>
-#include <wtf/text/StringConcatenate.h>
-
-namespace WebCore {
-
-static bool isNonCanonicalCharacter(UChar c)
-{
-    // We remove all non-ASCII characters, including non-printable ASCII characters.
-    //
-    // Note, we don't remove backslashes like PHP stripslashes(), which among other things converts "\\0" to the \0 character.
-    // Instead, we remove backslashes and zeros (since the string "\\0" =(remove backslashes)=> "0"). However, this has the 
-    // adverse effect that we remove any legitimate zeros from a string.
-    //
-    // For instance: new String("http://localhost:8000") => new String("http://localhost:8").
-    return (c == '\\' || c == '0' || c < ' ' || c >= 127);
-}
-
-static bool isIllegalURICharacter(UChar c)
-{
-    // The characters described in section 2.4.3 of RFC 2396 <http://www.faqs.org/rfcs/rfc2396.html> in addition to the 
-    // single quote character "'" are considered illegal URI characters. That is, the following characters cannot appear
-    // in a valid URI: ', ", <, >
-    //
-    // If the request does not contain these characters then we can assume that no inline scripts have been injected 
-    // into the response page, because it is impossible to write an inline script of the form <script>...</script>
-    // without "<", ">".
-    return (c == '\'' || c == '"' || c == '<' || c == '>');
-}
-
-String XSSAuditor::CachingURLCanonicalizer::canonicalizeURL(FormData* formData, const TextEncoding& encoding, bool decodeEntities, 
-                                                            bool decodeURLEscapeSequencesTwice)
-{
-    if (decodeEntities == m_decodeEntities && decodeURLEscapeSequencesTwice == m_decodeURLEscapeSequencesTwice 
-        && encoding == m_encoding && formData == m_formData)
-        return m_cachedCanonicalizedURL;
-    m_formData = formData;
-    return canonicalizeURL(formData->flattenToString(), encoding, decodeEntities, decodeURLEscapeSequencesTwice);
-}
-
-String XSSAuditor::CachingURLCanonicalizer::canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities, 
-                                                            bool decodeURLEscapeSequencesTwice)
-{
-    if (decodeEntities == m_decodeEntities && decodeURLEscapeSequencesTwice == m_decodeURLEscapeSequencesTwice 
-        && encoding == m_encoding && url == m_inputURL)
-        return m_cachedCanonicalizedURL;
-
-    m_cachedCanonicalizedURL = canonicalize(decodeURL(url, encoding, decodeEntities, decodeURLEscapeSequencesTwice));
-    m_inputURL = url;
-    m_encoding = encoding;
-    m_decodeEntities = decodeEntities;
-    m_decodeURLEscapeSequencesTwice = decodeURLEscapeSequencesTwice;
-    ++m_generation;
-    return m_cachedCanonicalizedURL;
-}
-
-void XSSAuditor::CachingURLCanonicalizer::clear()
-{
-    m_formData.clear();
-    m_inputURL = String();
-}
-
-XSSAuditor::XSSAuditor(Frame* frame)
-    : m_frame(frame)
-    , m_generationOfSuffixTree(-1)
-{
-}
-
-XSSAuditor::~XSSAuditor()
-{
-}
-
-bool XSSAuditor::isEnabled() const
-{
-    Settings* settings = m_frame->settings();
-    return (settings && settings->xssAuditorEnabled());
-}
-
-bool XSSAuditor::canEvaluate(const String& code) const
-{
-    if (!isEnabled())
-        return true;
-
-    FindTask task;
-    task.string = code;
-    task.decodeEntities = false;
-    task.allowRequestIfNoIllegalURICharacters = true;
-
-    if (findInRequest(task)) {
-        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
-        m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
-        return false;
-    }
-    return true;
-}
-
-bool XSSAuditor::canEvaluateJavaScriptURL(const String& code) const
-{
-    if (!isEnabled())
-        return true;
-
-    FindTask task;
-    task.string = code;
-    task.decodeURLEscapeSequencesTwice = true;
-
-    if (findInRequest(task)) {
-        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
-        m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
-        return false;
-    }
-    return true;
-}
-
-bool XSSAuditor::canCreateInlineEventListener(const String&, const String& code) const
-{
-    if (!isEnabled())
-        return true;
-
-    FindTask task;
-    task.string = code;
-    task.allowRequestIfNoIllegalURICharacters = true;
-
-    if (findInRequest(task)) {
-        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
-        m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
-        return false;
-    }
-    return true;
-}
-
-bool XSSAuditor::canLoadExternalScriptFromSrc(const String& url) const
-{
-    if (!isEnabled())
-        return true;
-
-    if (isSameOriginResource(url))
-        return true;
-
-    FindTask task;
-    task.string = url;
-    task.allowRequestIfNoIllegalURICharacters = true;
-
-    if (findInRequest(task)) {
-        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
-        m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
-        return false;
-    }
-    return true;
-}
-
-bool XSSAuditor::canLoadObject(const String& url) const
-{
-    if (!isEnabled())
-        return true;
-
-    if (isSameOriginResource(url))
-        return true;
-
-    FindTask task;
-    task.string = url;
-    task.allowRequestIfNoIllegalURICharacters = true;
-
-    if (findInRequest(task)) {
-        String consoleMessage = makeString("Refused to load an object. URL found within request: \"", url, "\".\n");
-        m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
-        return false;
-    }
-    return true;
-}
-
-bool XSSAuditor::canSetBaseElementURL(const String& url) const
-{
-    if (!isEnabled())
-        return true;
-
-    if (isSameOriginResource(url))
-        return true;
-
-    FindTask task;
-    task.string = url;
-    task.allowRequestIfNoIllegalURICharacters = true;
-
-    if (findInRequest(task)) {
-        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to load from document base URL. URL found within request.\n"));
-        m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
-        return false;
-    }
-    return true;
-}
-
-String XSSAuditor::canonicalize(const String& string)
-{
-    String result = decodeHTMLEntities(string);
-    return result.removeCharacters(&isNonCanonicalCharacter);
-}
-
-String XSSAuditor::decodeURL(const String& string, const TextEncoding& encoding, bool decodeEntities, bool decodeURLEscapeSequencesTwice)
-{
-    String result;
-    String url = string;
-
-    url.replace('+', ' ');
-    result = decodeURLEscapeSequences(url);
-    CString utf8Url = result.utf8();
-    String decodedResult = encoding.decode(utf8Url.data(), utf8Url.length());
-    if (!decodedResult.isEmpty())
-        result = decodedResult;
-    if (decodeURLEscapeSequencesTwice) {
-        result = decodeURLEscapeSequences(result);
-        utf8Url = result.utf8();
-        decodedResult = encoding.decode(utf8Url.data(), utf8Url.length());
-        if (!decodedResult.isEmpty())
-            result = decodedResult;
-    }
-    if (decodeEntities)
-        result = decodeHTMLEntities(result);
-    return result;
-}
-
-String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodableEntitiesUntouched)
-{
-    SegmentedString source(string);
-    SegmentedString sourceShadow;
-    Vector<UChar> result;
-    
-    while (!source.isEmpty()) {
-        UChar cc = *source;
-        source.advance();
-        
-        if (cc != '&') {
-            result.append(cc);
-            continue;
-        }
-        
-        if (leaveUndecodableEntitiesUntouched)
-            sourceShadow = source;
-        bool notEnoughCharacters = false;
-        Vector<UChar, 16> decodedEntity;
-        bool success = consumeHTMLEntity(source, decodedEntity, notEnoughCharacters);
-        // We ignore notEnoughCharacters because we might as well use this loop
-        // to copy the remaining characters into |result|.
-        if (!success || (!leaveUndecodableEntitiesUntouched && decodedEntity.size() == 1 && decodedEntity[0] == 0xFFFD)) {
-            result.append('&');
-            if (leaveUndecodableEntitiesUntouched)
-                source = sourceShadow;
-        } else {
-            Vector<UChar>::const_iterator iter = decodedEntity.begin();
-            for (; iter != decodedEntity.end(); ++iter)
-                result.append(*iter);
-        }
-    }
-    
-    return String::adopt(result);
-}
-
-bool XSSAuditor::isSameOriginResource(const String& url) const
-{
-    // If the resource is loaded from the same URL as the enclosing page, it's
-    // probably not an XSS attack, so we reduce false positives by allowing the
-    // request. If the resource has a query string, we're more suspicious,
-    // however, because that's pretty rare and the attacker might be able to
-    // trick a server-side script into doing something dangerous with the query
-    // string.
-    KURL resourceURL(m_frame->document()->url(), url);
-    return (m_frame->document()->url().host() == resourceURL.host() && resourceURL.query().isEmpty());
-}
-
-XSSProtectionDisposition XSSAuditor::xssProtection() const
-{
-    DEFINE_STATIC_LOCAL(String, XSSProtectionHeader, ("X-XSS-Protection"));
-
-    Frame* frame = m_frame;
-    if (frame->document()->url() == blankURL())
-        frame = m_frame->tree()->parent();
-
-    return parseXSSProtectionHeader(frame->loader()->documentLoader()->response().httpHeaderField(XSSProtectionHeader));
-}
-
-bool XSSAuditor::findInRequest(const FindTask& task) const
-{
-    bool result = false;
-    Frame* parentFrame = m_frame->tree()->parent();
-    Frame* blockFrame = parentFrame;
-    if (parentFrame && m_frame->document()->url() == blankURL())
-        result = findInRequest(parentFrame, task);
-    if (!result) {
-        result = findInRequest(m_frame, task);
-        blockFrame = m_frame;
-    }
-    if (!result)
-        return false;
-
-    switch (xssProtection()) {
-    case XSSProtectionDisabled:
-        return false;
-    case XSSProtectionEnabled:
-        break;
-    case XSSProtectionBlockEnabled:
-        if (blockFrame) {
-            blockFrame->loader()->stopAllLoaders();
-            blockFrame->navigationScheduler()->scheduleLocationChange(blockFrame->document()->securityOrigin(), blankURL(), String());
-        }
-        break;
-    default:
-        ASSERT_NOT_REACHED();
-    }
-    return true;
-}
-
-bool XSSAuditor::findInRequest(Frame* frame, const FindTask& task) const
-{
-    ASSERT(frame->document());
-
-    if (!frame->document()->decoder()) {
-        // Note, JavaScript URLs do not have a charset.
-        return false;
-    }
-
-    if (task.string.isEmpty())
-        return false;
-
-    DocumentLoader *documentLoader = frame->loader()->documentLoader();
-    if (!documentLoader)
-        return false;
-
-    FormData* formDataObj = documentLoader->originalRequest().httpBody();
-    const bool hasFormData = formDataObj && !formDataObj->isEmpty();
-    String pageURL = frame->document()->url().string();
-
-    if (!hasFormData) {
-        // We clear out our form data caches, in case we're holding onto a bunch of memory.
-        m_formDataCache.clear();
-        m_formDataSuffixTree.clear();
-    }
-
-    String canonicalizedString;
-    if (!hasFormData && task.string.length() > 2 * pageURL.length()) {
-        // Q: Why do we bother to do this check at all?
-        // A: Canonicalizing large inline scripts can be expensive.  We want to
-        //    reduce the size of the string before we call canonicalize below,
-        //    since it could result in an unneeded allocation and memcpy.
-        //
-        // Q: Why do we multiply by two here?
-        // A: We attempt to detect reflected XSS even when the server
-        //    transforms the attacker's input with addSlashes.  The best the
-        //    attacker can do get the server to inflate his/her input by a
-        //    factor of two by sending " characters, which the server
-        //    transforms to \".
-        canonicalizedString = task.string.substring(0, 2 * pageURL.length());
-    } else
-        canonicalizedString = task.string;
-
-    if (frame->document()->url().protocolIsData())
-        return false;
-
-    canonicalizedString = canonicalize(canonicalizedString);
-    if (canonicalizedString.isEmpty())
-        return false;
-
-    if (!task.context.isEmpty())
-        canonicalizedString = task.context + canonicalizedString;
-
-    String decodedPageURL = m_pageURLCache.canonicalizeURL(pageURL, frame->document()->decoder()->encoding(), task.decodeEntities, task.decodeURLEscapeSequencesTwice);
-
-    if (task.allowRequestIfNoIllegalURICharacters && !hasFormData && decodedPageURL.find(&isIllegalURICharacter, 0) == notFound)
-        return false; // Injection is impossible because the request does not contain any illegal URI characters.
-
-    if (decodedPageURL.find(canonicalizedString, 0, false) != notFound)
-        return true; // We've found the string in the GET data.
-
-    if (hasFormData) {
-        String decodedFormData = m_formDataCache.canonicalizeURL(formDataObj, frame->document()->decoder()->encoding(), task.decodeEntities, task.decodeURLEscapeSequencesTwice);
-
-        if (m_generationOfSuffixTree != m_formDataCache.generation()) {
-            m_formDataSuffixTree = new SuffixTree<ASCIICodebook>(decodedFormData, 5);
-            m_generationOfSuffixTree = m_formDataCache.generation();
-        }
-
-        // Try a fast-reject via the suffixTree.
-        if (m_formDataSuffixTree && !m_formDataSuffixTree->mightContain(canonicalizedString))
-            return false;
-
-        if (decodedFormData.find(canonicalizedString, 0, false) != notFound)
-            return true; // We found the string in the POST data.
-    }
-
-    return false;
-}
-
-} // namespace WebCore
-
diff --git a/Source/WebCore/page/XSSAuditor.h b/Source/WebCore/page/XSSAuditor.h
deleted file mode 100644
index 5beed61..0000000
--- a/Source/WebCore/page/XSSAuditor.h
+++ /dev/null
@@ -1,181 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Daniel Bates (dbates@intudata.com)
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef XSSAuditor_h
-#define XSSAuditor_h
-
-#include "HTTPParsers.h"
-#include "PlatformString.h"
-#include "SuffixTree.h"
-#include "TextEncoding.h"
-
-namespace WebCore {
-
-    class FormData;
-    class Frame;
-    class ScriptSourceCode;
-
-    // The XSSAuditor class is used to prevent type 1 cross-site scripting
-    // vulnerabilities (also known as reflected vulnerabilities).
-    //
-    // More specifically, the XSSAuditor class decides whether the execution of
-    // a script is to be allowed or denied based on the content of any
-    // user-submitted data, including:
-    //
-    // * the URL.
-    // * the HTTP-POST data.
-    //
-    // If the source code of a script resembles any user-submitted data then it
-    // is denied execution.
-    //
-    // When you instantiate the XSSAuditor you must specify the Frame of the
-    // page that you wish to audit.
-    //
-    // Bindings
-    //
-    // An XSSAuditor is instantiated within the constructor of a
-    // ScriptController object and passed the Frame the script originated. The
-    // ScriptController calls back to the XSSAuditor to determine whether a
-    // JavaScript script is safe to execute before executing it. The following
-    // methods call into XSSAuditor:
-    //
-    // * ScriptController::evaluateInWorld - used to evaluate JavaScript scripts.
-    // * ScriptController::executeIfJavaScriptURL - used to evaluate JavaScript URLs.
-    // * ScriptEventListener::createAttributeEventListener - used to create JavaScript event handlers.
-    // * HTMLBaseElement::process - used to set the document base URL.
-    // * HTMLDocumentParser::shouldLoadExternalScriptFromSrc - used to load external JavaScript scripts.
-    // * SubframeLoader::requestObject - used to load <object>/<embed> elements.
-    //
-    class XSSAuditor {
-        WTF_MAKE_NONCOPYABLE(XSSAuditor); WTF_MAKE_FAST_ALLOCATED;
-    public:
-        XSSAuditor(Frame*);
-        ~XSSAuditor();
-
-        bool isEnabled() const;
-
-        // Determines whether the script should be allowed or denied execution
-        // based on the content of any user-submitted data.
-        bool canEvaluate(const String& code) const;
-
-        // Determines whether the JavaScript URL should be allowed or denied execution
-        // based on the content of any user-submitted data.
-        bool canEvaluateJavaScriptURL(const String& code) const;
-
-        // Determines whether the event listener should be created based on the
-        // content of any user-submitted data.
-        bool canCreateInlineEventListener(const String& functionName, const String& code) const;
-
-        // Determines whether the external script should be loaded based on the
-        // content of any user-submitted data.
-        bool canLoadExternalScriptFromSrc(const String& url) const;
-
-        // Determines whether object should be loaded based on the content of
-        // any user-submitted data.
-        //
-        // This method is called by SubframeLoader::requestObject.
-        bool canLoadObject(const String& url) const;
-
-        // Determines whether the base URL should be changed based on the content
-        // of any user-submitted data.
-        //
-        // This method is called by HTMLBaseElement::process.
-        bool canSetBaseElementURL(const String& url) const;
-
-    private:
-        class CachingURLCanonicalizer
-        {
-        public:
-            CachingURLCanonicalizer() : m_decodeEntities(false), m_decodeURLEscapeSequencesTwice(false), m_generation(0) { }
-            String canonicalizeURL(FormData*, const TextEncoding& encoding, bool decodeEntities, 
-                                   bool decodeURLEscapeSequencesTwice);
-            String canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities, 
-                                   bool decodeURLEscapeSequencesTwice);
-
-            void clear();
-
-            int generation() const { return m_generation; }
-
-        private:
-            // The parameters we were called with last.
-            String m_inputURL;
-            TextEncoding m_encoding;
-            bool m_decodeEntities;
-            bool m_decodeURLEscapeSequencesTwice;
-            RefPtr<FormData> m_formData;
-
-            // Incremented every time we see a new URL.
-            int m_generation;
-
-            // The cached result.
-            String m_cachedCanonicalizedURL;
-        };
-
-        struct FindTask {
-            FindTask()
-                : decodeEntities(true)
-                , allowRequestIfNoIllegalURICharacters(false)
-                , decodeURLEscapeSequencesTwice(false)
-            {
-            }
-
-            String context;
-            String string;
-            bool decodeEntities;
-            bool allowRequestIfNoIllegalURICharacters;
-            bool decodeURLEscapeSequencesTwice;
-        };
-
-        static String canonicalize(const String&);
-        static String decodeURL(const String& url, const TextEncoding& encoding, bool decodeEntities, 
-                                bool decodeURLEscapeSequencesTwice = false);
-        static String decodeHTMLEntities(const String&, bool leaveUndecodableEntitiesUntouched = true);
-
-        bool isSameOriginResource(const String& url) const;
-        bool findInRequest(const FindTask&) const;
-        bool findInRequest(Frame*, const FindTask&) const;
-
-        XSSProtectionDisposition xssProtection() const;
-
-        // The frame to audit.
-        Frame* m_frame;
-
-        // A state store to help us avoid canonicalizing the same URL repeated.
-        // When a page has form data, we need two caches: one to store the
-        // canonicalized URL and another to store the cannonicalized form
-        // data. If we only had one cache, we'd always generate a cache miss
-        // and load some pages extremely slowly.
-        // https://bugs.webkit.org/show_bug.cgi?id=35373
-        mutable CachingURLCanonicalizer m_pageURLCache;
-        mutable CachingURLCanonicalizer m_formDataCache;
-
-        mutable OwnPtr<SuffixTree<ASCIICodebook> > m_formDataSuffixTree;
-        mutable int m_generationOfSuffixTree;
-    };
-
-} // namespace WebCore
-
-#endif // XSSAuditor_h
diff --git a/Source/WebCore/page/animation/AnimationController.cpp b/Source/WebCore/page/animation/AnimationController.cpp
index e1281dd..dcdea03 100644
--- a/Source/WebCore/page/animation/AnimationController.cpp
+++ b/Source/WebCore/page/animation/AnimationController.cpp
@@ -145,16 +145,16 @@ void AnimationControllerPrivate::fireEventsAndUpdateStyle()
     bool updateStyle = !m_eventsToDispatch.isEmpty() || !m_nodeChangesToDispatch.isEmpty();
     
     // fire all the events
-    Vector<EventToDispatch>::const_iterator eventsToDispatchEnd = m_eventsToDispatch.end();
-    for (Vector<EventToDispatch>::const_iterator it = m_eventsToDispatch.begin(); it != eventsToDispatchEnd; ++it) {
+    Vector<EventToDispatch> eventsToDispatch = m_eventsToDispatch;
+    m_eventsToDispatch.clear();
+    Vector<EventToDispatch>::const_iterator eventsToDispatchEnd = eventsToDispatch.end();
+    for (Vector<EventToDispatch>::const_iterator it = eventsToDispatch.begin(); it != eventsToDispatchEnd; ++it) {
         if (it->eventType == eventNames().webkitTransitionEndEvent)
             it->element->dispatchEvent(WebKitTransitionEvent::create(it->eventType, it->name, it->elapsedTime));
         else
             it->element->dispatchEvent(WebKitAnimationEvent::create(it->eventType, it->name, it->elapsedTime));
     }
     
-    m_eventsToDispatch.clear();
-    
     // call setChanged on all the elements
     Vector<RefPtr<Node> >::const_iterator nodeChangesToDispatchEnd = m_nodeChangesToDispatch.end();
     for (Vector<RefPtr<Node> >::const_iterator it = m_nodeChangesToDispatch.begin(); it != nodeChangesToDispatchEnd; ++it)
diff --git a/Source/WebCore/page/chromium/FrameChromium.cpp b/Source/WebCore/page/chromium/FrameChromium.cpp
index f6f47a6..e9dc2a3 100644
--- a/Source/WebCore/page/chromium/FrameChromium.cpp
+++ b/Source/WebCore/page/chromium/FrameChromium.cpp
@@ -85,7 +85,7 @@ DragImageRef Frame::nodeImage(Node* node)
     if (!buffer)
         return 0;
     buffer->context()->translate(-paintingRect.x(), -paintingRect.y());
-    buffer->context()->clip(FloatRect(0, 0, paintingRect.right(), paintingRect.bottom()));
+    buffer->context()->clip(FloatRect(0, 0, paintingRect.maxX(), paintingRect.maxY()));
 
     m_view->paintContents(buffer->context(), paintingRect);
 
@@ -108,7 +108,7 @@ DragImageRef Frame::dragImageForSelection()
     if (!buffer)
         return 0;
     buffer->context()->translate(-paintingRect.x(), -paintingRect.y());
-    buffer->context()->clip(FloatRect(0, 0, paintingRect.right(), paintingRect.bottom()));
+    buffer->context()->clip(FloatRect(0, 0, paintingRect.maxX(), paintingRect.maxY()));
 
     m_view->paintContents(buffer->context(), paintingRect);
 
diff --git a/Source/WebCore/page/mac/WebCoreFrameView.h b/Source/WebCore/page/mac/WebCoreFrameView.h
index b76350d..93a0296 100644
--- a/Source/WebCore/page/mac/WebCoreFrameView.h
+++ b/Source/WebCore/page/mac/WebCoreFrameView.h
@@ -33,7 +33,7 @@ namespace WebCore {
 - (void)setScrollingModes:(WebCore::ScrollbarMode)hMode vertical:(WebCore::ScrollbarMode)vMode andLock:(BOOL)lock;
 - (void)scrollingModes:(WebCore::ScrollbarMode*)hMode vertical:(WebCore::ScrollbarMode*)vMode;
 - (void)setScrollBarsSuppressed:(BOOL)suppressed repaintOnUnsuppress:(BOOL)repaint;
-- (void)setScrollOrigin:(NSPoint)origin updatePosition:(BOOL)updatePosition;
+- (void)setScrollOrigin:(NSPoint)origin updatePositionAtAll:(BOOL)updatePositionAtAll immediately:(BOOL)updatePositionImmediately;
 - (NSPoint)scrollOrigin;
 @end
 
diff --git a/Source/WebCore/page/qt/FrameQt.cpp b/Source/WebCore/page/qt/FrameQt.cpp
index bb577e0..4d1dd1d 100644
--- a/Source/WebCore/page/qt/FrameQt.cpp
+++ b/Source/WebCore/page/qt/FrameQt.cpp
@@ -52,7 +52,7 @@ DragImageRef Frame::dragImageForSelection()
 
     GraphicsContext* context = buffer->context();
     context->translate(-paintingRect.x(), -paintingRect.y());
-    context->clip(FloatRect(0, 0, paintingRect.right(), paintingRect.bottom()));
+    context->clip(FloatRect(0, 0, paintingRect.maxX(), paintingRect.maxY()));
 
     PaintBehavior previousPaintBehavior = m_view->paintBehavior();
     m_view->setPaintBehavior(PaintBehaviorSelectionOnly);
diff --git a/Source/WebCore/page/wince/FrameWinCE.cpp b/Source/WebCore/page/wince/FrameWinCE.cpp
index 9eb487b..60e9aac 100644
--- a/Source/WebCore/page/wince/FrameWinCE.cpp
+++ b/Source/WebCore/page/wince/FrameWinCE.cpp
@@ -76,7 +76,7 @@ void computePageRectsForFrame(Frame* frame, const IntRect& printRect, float head
 
     float ratio = (float)printRect.height() / (float)printRect.width();
 
-    float pageWidth  = (float) root->rightLayoutOverflow();
+    float pageWidth  = (float) root->maxXLayoutOverflow();
     float pageHeight = pageWidth * ratio;
     outPageHeight = (int) pageHeight;   // this is the height of the page adjusted by margins
     pageHeight -= (headerHeight + footerHeight);
diff --git a/Source/WebCore/page/wx/DragControllerWx.cpp b/Source/WebCore/page/wx/DragControllerWx.cpp
index 4a4d064..5c19c47 100644
--- a/Source/WebCore/page/wx/DragControllerWx.cpp
+++ b/Source/WebCore/page/wx/DragControllerWx.cpp
@@ -52,7 +52,7 @@ bool DragController::isCopyKeyDown(DragData*)
 DragOperation DragController::dragOperation(DragData* dragData)
 {
     //FIXME: This logic is incomplete
-    if (dragData->containsURL())
+    if (dragData->containsURL(0))
         return DragOperationCopy;
         
     return DragOperationNone;
diff --git a/Source/WebCore/platform/AsyncFileSystem.cpp b/Source/WebCore/platform/AsyncFileSystem.cpp
index b85a487..b1a3fe2 100644
--- a/Source/WebCore/platform/AsyncFileSystem.cpp
+++ b/Source/WebCore/platform/AsyncFileSystem.cpp
@@ -46,7 +46,7 @@ bool AsyncFileSystem::isAvailable()
     return false;
 }
 
-PassOwnPtr<AsyncFileSystem> AsyncFileSystem::create(const String&)
+PassOwnPtr<AsyncFileSystem> AsyncFileSystem::create(Type, const String&)
 {
     notImplemented();
     return 0;
@@ -68,7 +68,7 @@ void AsyncFileSystem::openFileSystem(const String& basePath, const String& stora
     rootPath += typeString;
     rootPath.append(PlatformFilePathSeparator);
 
-    callbacks->didOpenFileSystem(name, AsyncFileSystem::create(rootPath));
+    callbacks->didOpenFileSystem(name, AsyncFileSystem::create(type, rootPath));
 }
 #endif
 
diff --git a/Source/WebCore/platform/AsyncFileSystem.h b/Source/WebCore/platform/AsyncFileSystem.h
index c34a644..f5207ce 100644
--- a/Source/WebCore/platform/AsyncFileSystem.h
+++ b/Source/WebCore/platform/AsyncFileSystem.h
@@ -65,7 +65,7 @@ public:
     virtual bool waitForOperationToComplete() { return false; }
 
     // Creates and returns a new platform-specific AsyncFileSystem instance if the platform has its own implementation.
-    static PassOwnPtr<AsyncFileSystem> create(const String& rootPath);
+    static PassOwnPtr<AsyncFileSystem> create(Type, const String& rootPath);
 
     // Opens a new file system. The create parameter specifies whether or not to create the path if it does not already exists.
     static void openFileSystem(const String& basePath, const String& storageIdentifier, Type, bool create, PassOwnPtr<AsyncFileSystemCallbacks>);
@@ -132,12 +132,16 @@ public:
     // Getter for this file system's root path.
     String root() const { return m_platformRootPath; }
 
+    Type type() const { return m_type; }
+
 protected:
-    AsyncFileSystem(const String& platformRootPath)
-        : m_platformRootPath(platformRootPath)
+    AsyncFileSystem(Type type, const String& platformRootPath)
+        : m_type(type)
+        , m_platformRootPath(platformRootPath)
     {
     }
 
+    Type m_type;
     String m_platformRootPath;
 };
 
diff --git a/Source/WebCore/platform/ContextMenuItem.h b/Source/WebCore/platform/ContextMenuItem.h
index 6e84131..6595711 100644
--- a/Source/WebCore/platform/ContextMenuItem.h
+++ b/Source/WebCore/platform/ContextMenuItem.h
@@ -65,6 +65,9 @@ namespace WebCore {
         ContextMenuItemTagOpenImageInNewWindow,
         ContextMenuItemTagDownloadImageToDisk,
         ContextMenuItemTagCopyImageToClipboard,
+#if PLATFORM(QT)
+        ContextMenuItemTagCopyImageUrlToClipboard,
+#endif
         ContextMenuItemTagOpenFrameInNewWindow,
         ContextMenuItemTagCopy,
         ContextMenuItemTagGoBack,
diff --git a/Source/WebCore/platform/DragData.h b/Source/WebCore/platform/DragData.h
index 42d0d3a..b89748e 100644
--- a/Source/WebCore/platform/DragData.h
+++ b/Source/WebCore/platform/DragData.h
@@ -31,6 +31,7 @@
 #include "IntPoint.h"
 
 #include <wtf/Forward.h>
+#include <wtf/HashMap.h>
 #include <wtf/Vector.h>
 
 #if PLATFORM(MAC)
@@ -51,6 +52,7 @@ QT_END_NAMESPACE
 typedef const QMimeData* DragDataRef;
 #elif PLATFORM(WIN)
 typedef struct IDataObject* DragDataRef;
+#include <wtf/text/WTFString.h>
 #elif PLATFORM(WX)
 typedef class wxDataObject* DragDataRef;
 #elif PLATFORM(GTK)
@@ -84,7 +86,11 @@ enum DragApplicationFlags {
     DragApplicationHasAttachedSheet = 4,
     DragApplicationIsCopyKeyDown = 8
 };
-    
+
+#if PLATFORM(WIN)
+typedef HashMap<UINT, Vector<String> > DragDataMap;
+#endif
+
 class DragData {
 public:
     enum FilenameConversionPolicy { DoNotConvertFilenames, ConvertFilenames };
@@ -92,7 +98,10 @@ public:
     // clientPosition is taken to be the position of the drag event within the target window, with (0,0) at the top left
     DragData(DragDataRef, const IntPoint& clientPosition, const IntPoint& globalPosition, DragOperation, DragApplicationFlags = DragApplicationNone);
     DragData(const String& dragStorageName, const IntPoint& clientPosition, const IntPoint& globalPosition, DragOperation, DragApplicationFlags = DragApplicationNone);
-
+#if PLATFORM(WIN)
+    DragData(const DragDataMap&, const IntPoint& clientPosition, const IntPoint& globalPosition, DragOperation sourceOperationMask, DragApplicationFlags = DragApplicationNone);
+    const DragDataMap& dragDataMap();
+#endif
     const IntPoint& clientPosition() const { return m_clientPosition; }
     const IntPoint& globalPosition() const { return m_globalPosition; }
     DragApplicationFlags flags() { return m_applicationFlags; }
@@ -119,6 +128,9 @@ private:
 #if PLATFORM(MAC)
     RetainPtr<NSPasteboard> m_pasteboard;
 #endif
+#if PLATFORM(WIN)
+    DragDataMap m_dragDataMap;
+#endif
 };
     
 }
diff --git a/Source/WebCore/platform/DragImage.cpp b/Source/WebCore/platform/DragImage.cpp
index 5fcafc1..64aaa0e 100644
--- a/Source/WebCore/platform/DragImage.cpp
+++ b/Source/WebCore/platform/DragImage.cpp
@@ -73,6 +73,13 @@ DragImageRef createDragImageForSelection(Frame* frame)
     return image;
 }
 
+#if !PLATFORM(MAC) && (!PLATFORM(WIN) || OS(WINCE))
+DragImageRef createDragImageForLink(KURL&, const String&, Frame*)
+{
+    return 0;
+}
+#endif
+
 } // namespace WebCore
 
 #endif // ENABLE(DRAG_SUPPORT)
diff --git a/Source/WebCore/platform/DragImage.h b/Source/WebCore/platform/DragImage.h
index a371821..fcb980a 100644
--- a/Source/WebCore/platform/DragImage.h
+++ b/Source/WebCore/platform/DragImage.h
@@ -96,6 +96,7 @@ namespace WebCore {
     DragImageRef createDragImageFromImage(Image*);
     DragImageRef createDragImageForSelection(Frame*);    
     DragImageRef createDragImageIconForCachedImage(CachedImage*);
+    DragImageRef createDragImageForLink(KURL&, const String& label, Frame*);
     void deleteDragImage(DragImageRef);
 }
 
diff --git a/Source/WebCore/platform/FileChooser.cpp b/Source/WebCore/platform/FileChooser.cpp
index 90dd567..7e6d4ae 100644
--- a/Source/WebCore/platform/FileChooser.cpp
+++ b/Source/WebCore/platform/FileChooser.cpp
@@ -42,13 +42,19 @@ inline FileChooser::FileChooser(FileChooserClient* client, const Vector<String>&
     , m_isInitializing(true)
 {
     m_filenames = initialFilenames;
+}
+
+void FileChooser::initialize()
+{
     loadIcon();
     m_isInitializing = false;
 }
 
 PassRefPtr<FileChooser> FileChooser::create(FileChooserClient* client, const Vector<String>& initialFilenames)
 {
-    return adoptRef(new FileChooser(client, initialFilenames));
+    RefPtr<FileChooser> chooser(adoptRef(new FileChooser(client, initialFilenames)));
+    chooser->initialize();
+    return chooser;
 }
 
 FileChooser::~FileChooser()
diff --git a/Source/WebCore/platform/FileChooser.h b/Source/WebCore/platform/FileChooser.h
index fa25406..ac5e0e6 100644
--- a/Source/WebCore/platform/FileChooser.h
+++ b/Source/WebCore/platform/FileChooser.h
@@ -81,6 +81,7 @@ public:
 
 private:
     FileChooser(FileChooserClient*, const Vector<String>& initialFilenames);
+    void initialize();
     void loadIcon();
 
     FileChooserClient* m_client;
diff --git a/Source/WebCore/platform/FileSystem.cpp b/Source/WebCore/platform/FileSystem.cpp
index 511f8aa..0f69b7f 100644
--- a/Source/WebCore/platform/FileSystem.cpp
+++ b/Source/WebCore/platform/FileSystem.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -101,4 +101,18 @@ String encodeForFileName(const String& inputStr)
     return String(buffer.data(), p - buffer.data());
 }
 
+#if !PLATFORM(MAC)
+
+bool canExcludeFromBackup()
+{
+    return false;
+}
+
+bool excludeFromBackup(const String&)
+{
+    return false;
+}
+
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/FileSystem.h b/Source/WebCore/platform/FileSystem.h
index 4f088e1..d923fe6 100644
--- a/Source/WebCore/platform/FileSystem.h
+++ b/Source/WebCore/platform/FileSystem.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Collabora, Ltd. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,6 +30,15 @@
 #ifndef FileSystem_h
 #define FileSystem_h
 
+#include "PlatformString.h"
+#include <time.h>
+#include <wtf/Forward.h>
+#include <wtf/Vector.h>
+
+#if PLATFORM(CF)
+#include <wtf/RetainPtr.h>
+#endif
+
 #if PLATFORM(QT)
 #include <QFile>
 #include <QLibrary>
@@ -39,15 +48,9 @@
 #endif
 
 #if PLATFORM(CF) || (PLATFORM(QT) && defined(Q_WS_MAC))
-#include <CoreFoundation/CFBundle.h>
-#endif
-
-#include "PlatformString.h"
-#include <time.h>
-#include <wtf/Forward.h>
-#include <wtf/Vector.h>
-
+typedef struct __CFBundle* CFBundleRef;
 typedef const struct __CFData* CFDataRef;
+#endif
 
 #if OS(WINDOWS)
 // These are to avoid including <winbase.h> in a header for Chromium
@@ -122,8 +125,6 @@ const PlatformFileHandle invalidPlatformFileHandle = reinterpret_cast<HANDLE>(-1
 #elif PLATFORM(BREWMP)
 typedef IFile* PlatformFileHandle;
 const PlatformFileHandle invalidPlatformFileHandle = 0;
-typedef void* PlatformModule;
-typedef unsigned PlatformModuleVersion;
 #elif PLATFORM(GTK)
 typedef GFileIOStream* PlatformFileHandle;
 const PlatformFileHandle invalidPlatformFileHandle = 0;
@@ -161,6 +162,9 @@ String homeDirectoryPath();
 String pathGetFileName(const String&);
 String directoryName(const String&);
 
+bool canExcludeFromBackup(); // Returns true if any file can ever be excluded from backup.
+bool excludeFromBackup(const String&); // Returns true if successful.
+
 Vector<String> listDirectory(const String& path, const String& filter = String());
 
 CString fileSystemRepresentation(const String&);
@@ -179,17 +183,18 @@ int writeToFile(PlatformFileHandle, const char* data, int length);
 // Returns number of bytes actually written if successful, -1 otherwise.
 int readFromFile(PlatformFileHandle, char* data, int length);
 
-// Methods for dealing with loadable modules
+// Functions for working with loadable modules.
 bool unloadModule(PlatformModule);
 
 // Encode a string for use within a file name.
 String encodeForFileName(const String&);
 
-#if PLATFORM(WIN)
-String localUserSpecificStorageDirectory();
-String roamingUserSpecificStorageDirectory();
+#if PLATFORM(CF)
+RetainPtr<CFURLRef> pathAsURL(const String&);
+#endif
 
-bool safeCreateFile(const String&, CFDataRef);
+#if PLATFORM(CHROMIUM)
+String pathGetDisplayFileName(const String&);
 #endif
 
 #if PLATFORM(GTK)
@@ -198,8 +203,10 @@ String filenameForDisplay(const String&);
 CString applicationDirectoryPath();
 #endif
 
-#if PLATFORM(CHROMIUM)
-String pathGetDisplayFileName(const String&);
+#if PLATFORM(WIN) && !OS(WINCE)
+String localUserSpecificStorageDirectory();
+String roamingUserSpecificStorageDirectory();
+bool safeCreateFile(const String&, CFDataRef);
 #endif
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/KURL.cpp b/Source/WebCore/platform/KURL.cpp
index 60049df..f6a66ef 100644
--- a/Source/WebCore/platform/KURL.cpp
+++ b/Source/WebCore/platform/KURL.cpp
@@ -322,6 +322,12 @@ KURL::KURL(ParsedURLStringTag, const String& url)
     ASSERT(url == m_string);
 }
 
+KURL::KURL(ParsedURLStringTag, const URLString& url)
+{
+    parse(url.string());
+    ASSERT(url.string() == m_string);
+}
+
 KURL::KURL(const KURL& base, const String& relative)
 {
     init(base, relative, UTF8Encoding());
@@ -921,11 +927,11 @@ String decodeURLEscapeSequences(const String& str, const TextEncoding& encoding)
                 && isASCIIHexDigit(str[encodedRunEnd + 1])
                 && isASCIIHexDigit(str[encodedRunEnd + 2]))
             encodedRunEnd += 3;
+        searchPosition = encodedRunEnd;
         if (encodedRunEnd == encodedRunPosition) {
             ++searchPosition;
             continue;
         }
-        searchPosition = encodedRunEnd;
 
         // Decode the %-escapes into bytes.
         unsigned runLength = (encodedRunEnd - encodedRunPosition) / 3;
@@ -962,6 +968,14 @@ bool KURL::isLocalFile() const
     return protocolIs("file");
 }
 
+// Caution: This function does not bounds check.
+static void appendEscapedChar(char*& buffer, unsigned char c)
+{
+    *buffer++ = '%';
+    *buffer++ = hexDigits[c >> 4];
+    *buffer++ = hexDigits[c & 0xF];
+}
+
 static void appendEscapingBadChars(char*& buffer, const char* strStart, size_t length)
 {
     char* p = buffer;
@@ -971,16 +985,37 @@ static void appendEscapingBadChars(char*& buffer, const char* strStart, size_t l
     while (str < strEnd) {
         unsigned char c = *str++;
         if (isBadChar(c)) {
-            if (c == '%' || c == '?') {
+            if (c == '%' || c == '?')
                 *p++ = c;
-            } else if (c != 0x09 && c != 0x0a && c != 0x0d) {
-                *p++ = '%';
-                *p++ = hexDigits[c >> 4];
-                *p++ = hexDigits[c & 0xF];
-            }
-        } else {
+            else if (c != 0x09 && c != 0x0a && c != 0x0d)
+                appendEscapedChar(p, c);
+        } else
             *p++ = c;
+    }
+
+    buffer = p;
+}
+
+static void escapeAndAppendFragment(char*& buffer, const char* strStart, size_t length)
+{
+    char* p = buffer;
+
+    const char* str = strStart;
+    const char* strEnd = strStart + length;
+    while (str < strEnd) {
+        unsigned char c = *str++;
+        // Strip CR, LF and Tab from fragments, per:
+        // https://bugs.webkit.org/show_bug.cgi?id=8770
+        if (c == 0x09 || c == 0x0a || c == 0x0d)
+            continue;
+
+        // Chrome and IE allow non-ascii characters in fragments, however doing
+        // so would hit an ASSERT in checkEncodedString, so for now we don't.
+        if (c < 0x20 || c >= 127) {
+            appendEscapedChar(p, c);
+            continue;
         }
+        *p++ = c;
     }
 
     buffer = p;
@@ -1021,11 +1056,6 @@ static int copyPathRemovingDots(char* dst, const char* src, int srcStart, int sr
                     baseStringPos += 3;
                     if (dst > bufferPathStart + 1)
                         dst--;
-                    // Note that these two while blocks differ subtly.
-                    // The first helps to remove multiple adjoining slashes as we rewind.
-                    // The +1 to bufferPathStart in the first while block prevents eating a leading slash
-                    while (dst > bufferPathStart + 1 && dst[-1] == '/')
-                        dst--;
                     while (dst > bufferPathStart && dst[-1] != '/')
                         dst--;
                     continue;
@@ -1070,6 +1100,38 @@ void KURL::parse(const String& string)
     parse(buffer.data(), &string);
 }
 
+static inline bool equal(const char* a, size_t lenA, const char* b, size_t lenB)
+{
+    if (lenA != lenB)
+        return false;
+    return !strncmp(a, b, lenA);
+}
+
+// List of default schemes is taken from google-url:
+// http://code.google.com/p/google-url/source/browse/trunk/src/url_canon_stdurl.cc#120
+static inline bool isDefaultPortForScheme(const char* port, size_t portLength, const char* scheme, size_t schemeLength)
+{
+    // This switch is theoretically a performance optimization.  It came over when
+    // the code was moved from google-url, but may be removed later.
+    switch (schemeLength) {
+    case 2:
+        return equal("ws", 2, scheme, schemeLength) && equal("80", 2, port, portLength);
+    case 3:
+        if (equal("ftp", 3, scheme, schemeLength))
+            return equal("21", 2, port, portLength);
+        if (equal("wss", 3, scheme, schemeLength))
+            return equal("443", 3, port, portLength);
+        break;
+    case 4:
+        return equal("http", 4, scheme, schemeLength) && equal("80", 2, port, portLength);
+    case 5:
+        return equal("https", 5, scheme, schemeLength) && equal("443", 3, port, portLength);
+    case 6:
+        return equal("gopher", 6, scheme, schemeLength) && equal("70", 2, port, portLength);
+    }
+    return false;
+}
+
 void KURL::parse(const char* url, const String* originalString)
 {
     if (!url || url[0] == '\0') {
@@ -1246,7 +1308,7 @@ void KURL::parse(const char* url, const String* originalString)
     // copy in the scheme
     const char *schemeEndPtr = url + schemeEnd;
     while (strPtr < schemeEndPtr)
-        *p++ = *strPtr++;
+        *p++ = toASCIILower(*strPtr++);
     m_schemeEnd = p - buffer.data();
 
     bool hostIsLocalHost = portEnd - userStart == 9
@@ -1305,13 +1367,16 @@ void KURL::parse(const char* url, const String* originalString)
         }
         m_hostEnd = p - buffer.data();
 
-        // copy in the port
+        // Copy in the port if the URL has one (and it's not default).
         if (hostEnd != portStart) {
-            *p++ = ':';
-            strPtr = url + portStart;
-            const char *portEndPtr = url + portEnd;
-            while (strPtr < portEndPtr)
-                *p++ = *strPtr++;
+            const char* portStr = url + portStart;
+            size_t portLength = portEnd - portStart;
+            if (portLength && !isDefaultPortForScheme(portStr, portLength, buffer.data(), m_schemeEnd)) {
+                *p++ = ':';
+                const char* portEndPtr = url + portEnd;
+                while (portStr < portEndPtr)
+                    *p++ = *portStr++;
+            }
         }
         m_portEnd = p - buffer.data();
     } else
@@ -1349,7 +1414,7 @@ void KURL::parse(const char* url, const String* originalString)
     // add fragment, escaping bad characters
     if (fragmentEnd != queryEnd) {
         *p++ = '#';
-        appendEscapingBadChars(p, url + fragmentStart, fragmentEnd - fragmentStart);
+        escapeAndAppendFragment(p, url + fragmentStart, fragmentEnd - fragmentStart);
     }
     m_fragmentEnd = p - buffer.data();
 
@@ -1415,11 +1480,9 @@ String encodeWithURLEscapeSequences(const String& notEncodedString)
     const char* strEnd = str + asUTF8.length();
     while (str < strEnd) {
         unsigned char c = *str++;
-        if (isBadChar(c)) {
-            *p++ = '%';
-            *p++ = hexDigits[c >> 4];
-            *p++ = hexDigits[c & 0xF];
-        } else
+        if (isBadChar(c))
+            appendEscapedChar(p, c);
+        else
             *p++ = c;
     }
 
diff --git a/Source/WebCore/platform/KURL.h b/Source/WebCore/platform/KURL.h
index cbf0d8b..521e7ca 100644
--- a/Source/WebCore/platform/KURL.h
+++ b/Source/WebCore/platform/KURL.h
@@ -27,6 +27,7 @@
 #define KURL_h
 
 #include "PlatformString.h"
+#include "URLString.h"
 #include <wtf/HashMap.h>
 
 #if PLATFORM(CF)
@@ -74,6 +75,7 @@ public:
     // It is usually best to avoid repeatedly parsing a string, unless memory saving outweigh the possible slow-downs.
     KURL(ParsedURLStringTag, const char*);
     KURL(ParsedURLStringTag, const String&);
+    KURL(ParsedURLStringTag, const URLString&);
 
     // Resolves the relative URL with the given base URL. If provided, the
     // TextEncoding is used to encode non-ASCII characers. The base URL can be
@@ -117,11 +119,13 @@ public:
     bool canSetHostOrPort() const { return isHierarchical(); }
 
     bool canSetPathname() const { return isHierarchical(); }
-    
+
 #if USE(GOOGLEURL)
     const String& string() const { return m_url.string(); }
+    URLString urlString() const { return URLString(m_url.string()); }
 #else
     const String& string() const { return m_string; }
+    URLString urlString() const { return URLString(m_string); }
 #endif
 
     String protocol() const;
diff --git a/Source/WebCore/platform/KURLGoogle.cpp b/Source/WebCore/platform/KURLGoogle.cpp
index 6d63734..0697b33 100644
--- a/Source/WebCore/platform/KURLGoogle.cpp
+++ b/Source/WebCore/platform/KURLGoogle.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2004, 2007, 2008, 2009 Apple Inc. All rights reserved.
- * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2008, 2009, 2011 Google Inc. All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -63,8 +63,7 @@ static const int invalidPortNumber = 0xFFFF;
 // canonicalizer.
 class KURLCharsetConverter : public url_canon::CharsetConverter {
 public:
-    // The encoding parameter may be NULL, but in this case the object must not
-    // be called.
+    // The encoding parameter may be 0, but in this case the object must not be called.
     KURLCharsetConverter(const TextEncoding* encoding)
         : m_encoding(encoding)
     {
@@ -96,8 +95,8 @@ static inline void assertProtocolIsGood(const char* protocol)
 }
 
 // Returns the characters for the given string, or a pointer to a static empty
-// string if the input string is NULL. This will always ensure we have a non-
-// NULL character pointer since ReplaceComponents has special meaning for NULL.
+// string if the input string is null. This will always ensure we have a non-
+// null character pointer since ReplaceComponents has special meaning for null.
 static inline const url_parse::UTF16Char* CharactersOrEmpty(const String& str)
 {
     static const url_parse::UTF16Char zero = 0;
@@ -194,15 +193,15 @@ void KURLGooglePrivate::init(const KURL& base,
     init(base, relative.characters(), relative.length(), queryEncoding);
 }
 
-// Note: code mostly duplicated below.
-void KURLGooglePrivate::init(const KURL& base, const char* rel, int relLength,
+template <typename CHAR>
+void KURLGooglePrivate::init(const KURL& base, const CHAR* rel, int relLength,
                              const TextEncoding* queryEncoding)
 {
-    // As a performance optimization, we do not use the charset converter if
-    // encoding is UTF-8 or other Unicode encodings. Note that this is
-    // per HTML5 2.5.3 (resolving URL). The URL canonicalizer will be
-    // more efficient with no charset converter object because it
-    // can do UTF-8 internally with no extra copies.
+    // As a performance optimization, we do not use the charset converter
+    // if encoding is UTF-8 or other Unicode encodings. Note that this is
+    // per HTML5 2.5.3 (resolving URL). The URL canonicalizer will be more
+    // efficient with no charset converter object because it can do UTF-8
+    // internally with no extra copies.
 
     // We feel free to make the charset converter object every time since it's
     // just a wrapper around a reference.
@@ -233,37 +232,11 @@ void KURLGooglePrivate::init(const KURL& base, const char* rel, int relLength,
         else
             setAscii(CString(output.data(), output.length()));
     } else {
-        // WebCore expects resolved URLs to be empty rather than NULL.
+        // WebCore expects resolved URLs to be empty rather than null.
         setUtf8(CString("", 0));
     }
 }
 
-// Note: code mostly duplicated above. See FIXMEs and comments there.
-void KURLGooglePrivate::init(const KURL& base, const UChar* rel, int relLength,
-                             const TextEncoding* queryEncoding)
-{
-    KURLCharsetConverter charsetConverterObject(queryEncoding);
-    KURLCharsetConverter* charsetConverter =
-        (!queryEncoding || isUnicodeEncoding(queryEncoding)) ? 0 :
-        &charsetConverterObject;
-
-    url_canon::RawCanonOutputT<char> output;
-    const CString& baseStr = base.m_url.utf8String();
-    m_isValid = url_util::ResolveRelative(baseStr.data(), baseStr.length(),
-                                          base.m_url.m_parsed, rel, relLength,
-                                          charsetConverter,
-                                          &output, &m_parsed);
-
-
-    if (m_isValid || output.length()) {
-        if (m_parsed.ref.is_nonempty())
-            setUtf8(CString(output.data(), output.length()));
-        else
-            setAscii(CString(output.data(), output.length()));
-    } else
-        setUtf8(CString("", 0));
-}
-
 void KURLGooglePrivate::initProtocolInHTTPFamily()
 {
     if (!m_isValid) {
@@ -295,8 +268,8 @@ void KURLGooglePrivate::copyTo(KURLGooglePrivate* dest) const
 String KURLGooglePrivate::componentString(const url_parse::Component& comp) const
 {
     if (!m_isValid || comp.len <= 0) {
-        // KURL returns a NULL string if the URL is itself a NULL string, and an
-        // empty string for other nonexistant entities.
+        // KURL returns a null string if the URL is itself a null string, and an
+        // empty string for other nonexistent entities.
         if (utf8String().isNull())
             return String();
         return String("", 0);
@@ -330,9 +303,9 @@ void KURLGooglePrivate::replaceComponents(const Replacements& replacements)
 const String& KURLGooglePrivate::string() const
 {
     if (!m_stringIsValid) {
-        // Must special case the NULL case, since constructing the
-        // string like we do below will generate an empty rather than
-        // a NULL string.
+        // Handle the null case separately. Otherwise, constructing
+        // the string like we do below would generate the empty string,
+        // not the null string.
         if (m_utf8.isNull())
             m_string = String();
         else if (m_utf8IsASCII)
@@ -346,17 +319,17 @@ const String& KURLGooglePrivate::string() const
 
 // KURL ------------------------------------------------------------------------
 
-// Creates with NULL-terminated string input representing an absolute URL.
+// Creates with null-terminated string input representing an absolute URL.
 // WebCore generally calls this only with hardcoded strings, so the input is
-// ASCII. We treat is as UTF-8 just in case.
+// ASCII. We treat it as UTF-8 just in case.
 KURL::KURL(ParsedURLStringTag, const char *url)
 {
-    // FIXME The Mac code checks for beginning with a slash and converting to a
+    // FIXME The Mac code checks for beginning with a slash and converts it to
     // file: URL. We will want to add this as well once we can compile on a
     // system like that.
     m_url.init(KURL(), url, strlen(url), 0);
 
-    // The one-argument constructors should never generate a NULL string.
+    // The one-argument constructors should never generate a null string.
     // This is a funny quirk of KURL.cpp (probably a bug) which we preserve.
     if (m_url.utf8String().isNull())
         m_url.setAscii(CString("", 0));
@@ -365,7 +338,7 @@ KURL::KURL(ParsedURLStringTag, const char *url)
 // Initializes with a string representing an absolute URL. No encoding
 // information is specified. This generally happens when a KURL is converted
 // to a string and then converted back. In this case, the URL is already
-// canonical and in proper escaped form so needs no encoding. We treat it was
+// canonical and in proper escaped form so needs no encoding. We treat it as
 // UTF-8 just in case.
 KURL::KURL(ParsedURLStringTag, const String& url)
 {
@@ -533,8 +506,8 @@ String KURL::user() const
 String KURL::fragmentIdentifier() const
 {
     // Empty but present refs ("foo.com/bar#") should result in the empty
-    // string, which m_url.componentString will produce. Nonexistant refs should be
-    // the NULL string.
+    // string, which m_url.componentString will produce. Nonexistent refs
+    // should be the null string.
     if (!m_url.m_parsed.ref.is_valid())
         return String();
 
@@ -745,7 +718,7 @@ void KURL::setQuery(const String& query)
 {
     KURLGooglePrivate::Replacements replacements;
     if (query.isNull()) {
-        // KURL.cpp sets to NULL to clear any query.
+        // KURL.cpp sets to null to clear any query.
         replacements.ClearQuery();
     } else if (query.length() > 0 && query[0] == '?') {
         // WebCore expects the query string to begin with a question mark, but
@@ -946,7 +919,7 @@ String decodeURLEscapeSequences(const String& str)
 }
 
 // In KURL.cpp's implementation, this is called by every component getter.
-// It will unescape every character, including NULL. This is scary, and may
+// It will unescape every character, including '\0'. This is scary, and may
 // cause security holes. We never call this function for components, and
 // just return the ASCII versions instead.
 //
@@ -1005,10 +978,10 @@ bool KURL::isLocalFile() const
 // will automatically do the correct escaping, this function does not have to
 // do any work.
 //
-// There is a possibility that a future called may use this function in other
+// There is a possibility that a future caller may use this function in other
 // ways, and may expect to get a valid URL string. The dangerous thing we want
-// to protect against here is accidentally getting NULLs in a string that is
-// not supposed to have NULLs. Therefore, we escape NULLs here to prevent this.
+// to protect against here is accidentally getting '\0' characters in a string
+// that is not supposed to have them. Therefore, we escape these characters.
 String encodeWithURLEscapeSequences(const String& notEncodedString)
 {
     CString utf8 = UTF8Encoding().encode(
@@ -1115,7 +1088,7 @@ bool protocolIs(const String& url, const char* protocol)
 
     // Check the scheme like GURL does.
     return url_util::FindAndCompareScheme(url.characters(), url.length(), 
-        protocol, NULL); 
+        protocol, 0);
 }
 
 inline bool KURL::protocolIs(const String& string, const char* protocol)
diff --git a/Source/WebCore/platform/KURLGooglePrivate.h b/Source/WebCore/platform/KURLGooglePrivate.h
index c71e56b..c74a6b4 100644
--- a/Source/WebCore/platform/KURLGooglePrivate.h
+++ b/Source/WebCore/platform/KURLGooglePrivate.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
+ * Copyright (c) 2008, 2009, 2011 Google Inc. All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -41,7 +41,7 @@ namespace WebCore {
     class KURL;
     class TextEncoding;
 
-    // Wraps the internals related to using Google-URL as the bnackend for KURL.
+    // Wraps the internals related to using Google-URL as the backend for KURL.
     // This maintains the state and has auxiliary functions so that we don't need
     // to uglify KURL.h while allowing Google-URL to be evaluated.
     class KURLGooglePrivate {
@@ -49,19 +49,17 @@ namespace WebCore {
         KURLGooglePrivate();
         KURLGooglePrivate(const url_parse::Parsed&, bool isValid);
 
-        // Initializes the object. This will call through to one of the backend
-        // initializers below depending on whether the string's internal
-        // representation is 8 or 16 bit.
+        // Initializes the object. This will call through the backend initializer
+        // below.
         void init(const KURL& base, const String& relative,
                   const TextEncoding* queryEncoding);
 
-        // Backend initializers. The query encoding parameters are optional and can
-        // be NULL (this implies UTF-8). These initializers require that the object
-        // has just been created and the strings are NULL. Do not call on an
+        // Backend initializer. The query encoding parameters are optional and can
+        // be 0 (this implies UTF-8). This initializer requires that the object
+        // has just been created and the strings are null. Do not call on an
         // already-constructed object.
-        void init(const KURL& base, const char* rel, int relLength,
-                  const TextEncoding* queryEncoding);
-        void init(const KURL& base, const UChar* rel, int relLength,
+        template <typename CHAR>
+        void init(const KURL& base, const CHAR* rel, int relLength,
                   const TextEncoding* queryEncoding);
 
         // Does a deep copy to the given output object.
diff --git a/Source/WebCore/platform/Length.cpp b/Source/WebCore/platform/Length.cpp
index e2fd9b8..323705a 100644
--- a/Source/WebCore/platform/Length.cpp
+++ b/Source/WebCore/platform/Length.cpp
@@ -28,6 +28,7 @@
 #include "PlatformString.h"
 #include <wtf/ASCIICType.h>
 #include <wtf/Assertions.h>
+#include <wtf/OwnArrayPtr.h>
 #include <wtf/text/StringBuffer.h>
 
 using namespace WTF;
@@ -83,7 +84,7 @@ static int countCharacter(const UChar* data, unsigned length, UChar character)
     return count;
 }
 
-Length* newCoordsArray(const String& string, int& len)
+PassOwnArrayPtr<Length> newCoordsArray(const String& string, int& len)
 {
     unsigned length = string.length();
     const UChar* data = string.characters();
@@ -100,7 +101,7 @@ Length* newCoordsArray(const String& string, int& len)
     str = str->simplifyWhiteSpace();
 
     len = countCharacter(str->characters(), str->length(), ' ') + 1;
-    Length* r = new Length[len];
+    OwnArrayPtr<Length> r = adoptArrayPtr(new Length[len]);
 
     int i = 0;
     unsigned pos = 0;
@@ -114,10 +115,10 @@ Length* newCoordsArray(const String& string, int& len)
 
     ASSERT(i == len - 1);
 
-    return r;
+    return r.release();
 }
 
-Length* newLengthArray(const String& string, int& len)
+PassOwnArrayPtr<Length> newLengthArray(const String& string, int& len)
 {
     RefPtr<StringImpl> str = string.impl()->simplifyWhiteSpace();
     if (!str->length()) {
@@ -126,7 +127,7 @@ Length* newLengthArray(const String& string, int& len)
     }
 
     len = countCharacter(str->characters(), str->length(), ',') + 1;
-    Length* r = new Length[len];
+    OwnArrayPtr<Length> r = adoptArrayPtr(new Length[len]);
 
     int i = 0;
     unsigned pos = 0;
@@ -145,7 +146,7 @@ Length* newLengthArray(const String& string, int& len)
     else
         len--;
 
-    return r;
+    return r.release();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/Length.h b/Source/WebCore/platform/Length.h
index 9da71c7..1571944 100644
--- a/Source/WebCore/platform/Length.h
+++ b/Source/WebCore/platform/Length.h
@@ -25,6 +25,7 @@
 #include <wtf/FastAllocBase.h>
 #include <wtf/Forward.h>
 #include <wtf/MathExtras.h>
+#include <wtf/PassOwnArrayPtr.h>
 
 namespace WebCore {
 
@@ -193,8 +194,8 @@ private:
     int m_value;
 };
 
-Length* newCoordsArray(const String&, int& len);
-Length* newLengthArray(const String&, int& len);
+PassOwnArrayPtr<Length> newCoordsArray(const String&, int& len);
+PassOwnArrayPtr<Length> newLengthArray(const String&, int& len);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/LinkHash.cpp b/Source/WebCore/platform/LinkHash.cpp
index ac3aa3c..a2acad1 100644
--- a/Source/WebCore/platform/LinkHash.cpp
+++ b/Source/WebCore/platform/LinkHash.cpp
@@ -197,7 +197,7 @@ static inline bool needsTrailingSlash(const UChar* characters, unsigned length)
 
 static ALWAYS_INLINE LinkHash visitedLinkHashInline(const UChar* url, unsigned length)
 {
-    return AlreadyHashed::avoidDeletedValue(StringImpl::computeHash(url, length));
+    return AlreadyHashed::avoidDeletedValue(WTF::StringHasher::createHash(url, length));
 }
 
 LinkHash visitedLinkHash(const UChar* url, unsigned length)
diff --git a/Source/WebCore/platform/LocalizationStrategy.h b/Source/WebCore/platform/LocalizationStrategy.h
index 5596c81..3ed84d9 100644
--- a/Source/WebCore/platform/LocalizationStrategy.h
+++ b/Source/WebCore/platform/LocalizationStrategy.h
@@ -55,6 +55,9 @@ public:
     virtual String contextMenuItemTagOpenImageInNewWindow() = 0;
     virtual String contextMenuItemTagDownloadImageToDisk() = 0;
     virtual String contextMenuItemTagCopyImageToClipboard() = 0;
+#if PLATFORM(QT)
+    virtual String contextMenuItemTagCopyImageUrlToClipboard() = 0;
+#endif
     virtual String contextMenuItemTagOpenFrameInNewWindow() = 0;
     virtual String contextMenuItemTagCopy() = 0;
     virtual String contextMenuItemTagGoBack() = 0;
diff --git a/Source/WebCore/platform/LocalizedStrings.cpp b/Source/WebCore/platform/LocalizedStrings.cpp
index f342c6d..77144a9 100644
--- a/Source/WebCore/platform/LocalizedStrings.cpp
+++ b/Source/WebCore/platform/LocalizedStrings.cpp
@@ -104,6 +104,13 @@ String contextMenuItemTagCopyImageToClipboard()
     return platformStrategies()->localizationStrategy()->contextMenuItemTagCopyImageToClipboard();
 }
 
+#if PLATFORM(QT)
+String contextMenuItemTagCopyImageUrlToClipboard()
+{
+    return platformStrategies()->localizationStrategy()->contextMenuItemTagCopyImageUrlToClipboard();
+}
+#endif
+
 String contextMenuItemTagOpenFrameInNewWindow()
 {
     return platformStrategies()->localizationStrategy()->contextMenuItemTagOpenFrameInNewWindow();
diff --git a/Source/WebCore/platform/LocalizedStrings.h b/Source/WebCore/platform/LocalizedStrings.h
index da0fe86..812300f 100644
--- a/Source/WebCore/platform/LocalizedStrings.h
+++ b/Source/WebCore/platform/LocalizedStrings.h
@@ -51,6 +51,9 @@ namespace WebCore {
     String contextMenuItemTagOpenImageInNewWindow();
     String contextMenuItemTagDownloadImageToDisk();
     String contextMenuItemTagCopyImageToClipboard();
+#if PLATFORM(QT)
+    String contextMenuItemTagCopyImageUrlToClipboard();
+#endif
     String contextMenuItemTagOpenFrameInNewWindow();
     String contextMenuItemTagCopy();
     String contextMenuItemTagGoBack();
diff --git a/Source/WebCore/platform/MIMETypeRegistry.cpp b/Source/WebCore/platform/MIMETypeRegistry.cpp
index 0f4cc0e..8017c90 100644
--- a/Source/WebCore/platform/MIMETypeRegistry.cpp
+++ b/Source/WebCore/platform/MIMETypeRegistry.cpp
@@ -27,9 +27,12 @@
 #include "config.h"
 #include "MIMETypeRegistry.h"
 
+<<<<<<< HEAD
 #if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
 #include "ArchiveFactory.h"
 #endif
+=======
+>>>>>>> webkit.org at r78450
 #include "MediaPlayer.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
@@ -46,6 +49,10 @@
 #include <qimagewriter.h>
 #endif
 
+#if ENABLE(WEB_ARCHIVE)
+#include "ArchiveFactory.h"
+#endif
+
 namespace WebCore {
 
 static HashSet<String>* supportedImageResourceMIMETypes;
@@ -249,7 +256,11 @@ static void initializeSupportedNonImageMimeTypes()
     for (size_t i = 0; i < WTF_ARRAY_LENGTH(types); ++i)
         supportedNonImageMIMETypes->add(types[i]);
 
+<<<<<<< HEAD
 #if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
+=======
+#if ENABLE(WEB_ARCHIVE)
+>>>>>>> webkit.org at r78450
     ArchiveFactory::registerKnownArchiveMIMETypes();
 #endif
 }
@@ -369,6 +380,13 @@ static MediaMIMETypeMap& mediaMIMETypeMap()
     return mediaMIMETypeForExtensionMap;
 }
 
+#if ENABLE(FILE_SYSTEM) && ENABLE(WORKERS)
+String MIMETypeRegistry::getMIMETypeForExtension(const String& extension)
+{
+    return getMIMETypeForExtensionThreadSafe(extension);
+}
+#endif
+
 String MIMETypeRegistry::getMediaMIMETypeForExtension(const String& ext)
 {
     // Look in the system-specific registry first.
diff --git a/Source/WebCore/platform/MIMETypeRegistry.h b/Source/WebCore/platform/MIMETypeRegistry.h
index 64abea8..d069035 100644
--- a/Source/WebCore/platform/MIMETypeRegistry.h
+++ b/Source/WebCore/platform/MIMETypeRegistry.h
@@ -36,6 +36,9 @@ namespace WebCore {
 class MIMETypeRegistry {
 public:
     static String getMIMETypeForExtension(const String& extension);
+#if ENABLE(FILE_SYSTEM) && ENABLE(WORKERS)
+    static String getMIMETypeForExtensionThreadSafe(const String& extension);
+#endif
     static Vector<String> getExtensionsForMIMEType(const String& type);
     static String getPreferredExtensionForMIMEType(const String& type);
     static String getMediaMIMETypeForExtension(const String& extension);
diff --git a/Source/WebCore/platform/PlatformGestureEvent.h b/Source/WebCore/platform/PlatformGestureEvent.h
new file mode 100644
index 0000000..99157e1
--- /dev/null
+++ b/Source/WebCore/platform/PlatformGestureEvent.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2011 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PlatformGestureEvent_h
+#define PlatformGestureEvent_h
+
+#if ENABLE(GESTURE_EVENTS)
+
+#include "IntPoint.h"
+
+namespace WebCore {
+
+class PlatformGestureEvent {
+public:
+    enum Type {
+        ScrollBeginType,
+        ScrollEndType,
+    };
+
+    PlatformGestureEvent()
+        : m_type(ScrollBeginType)
+        , m_timestamp(0)
+    {
+    }
+
+    Type type() const { return m_type; }
+
+    const IntPoint& position() const { return m_position; } // PlatformWindow coordinates.
+    const IntPoint& globalPosition() const { return m_globalPosition; } // Screen coordinates.
+
+    double timestamp() const { return m_timestamp; }
+
+protected:
+    Type m_type;
+    IntPoint m_position;
+    IntPoint m_globalPosition;
+    double m_timestamp;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(GESTURE_EVENTS)
+
+#endif // PlatformGestureEvent_h
diff --git a/Source/WebCore/platform/PlatformWheelEvent.h b/Source/WebCore/platform/PlatformWheelEvent.h
index 1e5cd53..2698e6e 100644
--- a/Source/WebCore/platform/PlatformWheelEvent.h
+++ b/Source/WebCore/platform/PlatformWheelEvent.h
@@ -98,7 +98,9 @@ namespace WebCore {
             , m_altKey(false)
             , m_metaKey(false)
 #if PLATFORM(MAC)
+            , m_hasPreciseScrollingDeltas(false)
             , m_phase(PlatformWheelEventPhaseNone)
+            , m_timestamp(0)
 #endif
         {
         }
@@ -151,6 +153,8 @@ namespace WebCore {
 #endif
 
         PlatformWheelEventPhase phase() const { return m_phase; }
+        bool hasPreciseScrollingDeltas() const { return m_hasPreciseScrollingDeltas; }
+        double timestamp() const { return m_timestamp; }
 #endif
 
 #if PLATFORM(QT)
@@ -186,7 +190,9 @@ namespace WebCore {
         bool m_altKey;
         bool m_metaKey;
 #if PLATFORM(MAC)
+        bool m_hasPreciseScrollingDeltas;
         PlatformWheelEventPhase m_phase;
+        double m_timestamp;
 #endif
     };
 
diff --git a/Source/WebCore/platform/PopupMenuStyle.h b/Source/WebCore/platform/PopupMenuStyle.h
index b9a7abc..3cb33cc 100644
--- a/Source/WebCore/platform/PopupMenuStyle.h
+++ b/Source/WebCore/platform/PopupMenuStyle.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2008, 2011 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,7 +35,7 @@ namespace WebCore {
 
 class PopupMenuStyle {
 public:
-    PopupMenuStyle(const Color& foreground, const Color& background, const Font& font, bool visible, bool isDisplayNone, Length textIndent, TextDirection textDirection)
+    PopupMenuStyle(const Color& foreground, const Color& background, const Font& font, bool visible, bool isDisplayNone, Length textIndent, TextDirection textDirection, bool hasTextDirectionOverride)
         : m_foregroundColor(foreground)
         , m_backgroundColor(background)
         , m_font(font)
@@ -43,6 +43,7 @@ public:
         , m_isDisplayNone(isDisplayNone)
         , m_textIndent(textIndent)
         , m_textDirection(textDirection)
+        , m_hasTextDirectionOverride(hasTextDirectionOverride)
     {
     }
     
@@ -53,6 +54,7 @@ public:
     bool isDisplayNone() const { return m_isDisplayNone; }
     Length textIndent() const { return m_textIndent; }
     TextDirection textDirection() const { return m_textDirection; }
+    bool hasTextDirectionOverride() const { return m_hasTextDirectionOverride; }
 
 private:
     Color m_foregroundColor;
@@ -62,6 +64,7 @@ private:
     bool m_isDisplayNone;
     Length m_textIndent;
     TextDirection m_textDirection;
+    bool m_hasTextDirectionOverride;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/SchemeRegistry.cpp b/Source/WebCore/platform/SchemeRegistry.cpp
index 71697cb..2bc655e 100644
--- a/Source/WebCore/platform/SchemeRegistry.cpp
+++ b/Source/WebCore/platform/SchemeRegistry.cpp
@@ -86,6 +86,24 @@ static URLSchemesMap& emptyDocumentSchemes()
     return emptyDocumentSchemes;
 }
 
+static URLSchemesMap& canDisplayOnlyIfCanRequestSchemes()
+{
+    DEFINE_STATIC_LOCAL(URLSchemesMap, canDisplayOnlyIfCanRequestSchemes, ());
+
+#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+    if (canDisplayOnlyIfCanRequestSchemes.isEmpty()) {
+#if ENABLE(BLOB)
+        canDisplayOnlyIfCanRequestSchemes.add("blob");
+#endif
+#if ENABLE(FILE_SYSTEM)
+        canDisplayOnlyIfCanRequestSchemes.add("filesystem");
+#endif
+    }
+#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+
+    return canDisplayOnlyIfCanRequestSchemes;
+}
+
 void SchemeRegistry::registerURLSchemeAsLocal(const String& scheme)
 {
     localURLSchemes().add(scheme);
@@ -121,6 +139,8 @@ void SchemeRegistry::registerURLSchemeAsNoAccess(const String& scheme)
 
 bool SchemeRegistry::shouldTreatURLSchemeAsNoAccess(const String& scheme)
 {
+    if (scheme.isEmpty())
+        return false;
     return schemesWithUniqueOrigins().contains(scheme);
 }
 
@@ -131,6 +151,8 @@ void SchemeRegistry::registerURLSchemeAsDisplayIsolated(const String& scheme)
 
 bool SchemeRegistry::shouldTreatURLSchemeAsDisplayIsolated(const String& scheme)
 {
+    if (scheme.isEmpty())
+        return false;
     return displayIsolatedURLSchemes().contains(scheme);
 }
 
@@ -141,6 +163,8 @@ void SchemeRegistry::registerURLSchemeAsSecure(const String& scheme)
 
 bool SchemeRegistry::shouldTreatURLSchemeAsSecure(const String& scheme)
 {
+    if (scheme.isEmpty())
+        return false;
     return secureSchemes().contains(scheme);
 }
 
@@ -151,7 +175,21 @@ void SchemeRegistry::registerURLSchemeAsEmptyDocument(const String& scheme)
 
 bool SchemeRegistry::shouldLoadURLSchemeAsEmptyDocument(const String& scheme)
 {
+    if (scheme.isEmpty())
+        return false;
     return emptyDocumentSchemes().contains(scheme);
 }
 
+bool SchemeRegistry::canDisplayOnlyIfCanRequest(const String& scheme)
+{
+    if (scheme.isEmpty())
+        return false;
+    return canDisplayOnlyIfCanRequestSchemes().contains(scheme);
+}
+
+void SchemeRegistry::registerAsCanDisplayOnlyIfCanRequest(const String& scheme)
+{
+    canDisplayOnlyIfCanRequestSchemes().add(scheme);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/SchemeRegistry.h b/Source/WebCore/platform/SchemeRegistry.h
index 530fcab..c9cb476 100644
--- a/Source/WebCore/platform/SchemeRegistry.h
+++ b/Source/WebCore/platform/SchemeRegistry.h
@@ -58,6 +58,11 @@ public:
 
     static void registerURLSchemeAsEmptyDocument(const String&);
     static bool shouldLoadURLSchemeAsEmptyDocument(const String&);
+
+    // Such schemes should delegate to SecurityOrigin::canRequest for any URL
+    // passed to SecurityOrigin::canDisplay.
+    static bool canDisplayOnlyIfCanRequest(const String& scheme);
+    static void registerAsCanDisplayOnlyIfCanRequest(const String& scheme);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/ScrollAnimator.cpp b/Source/WebCore/platform/ScrollAnimator.cpp
index 428a79d..6fc78e7 100644
--- a/Source/WebCore/platform/ScrollAnimator.cpp
+++ b/Source/WebCore/platform/ScrollAnimator.cpp
@@ -32,10 +32,13 @@
 #include "ScrollAnimator.h"
 
 #include "FloatPoint.h"
+#include "PlatformWheelEvent.h"
 #include "ScrollableArea.h"
 #include <algorithm>
 #include <wtf/PassOwnPtr.h>
 
+using namespace std;
+
 namespace WebCore {
 
 #if !ENABLE(SMOOTH_SCROLLING)
@@ -78,6 +81,44 @@ void ScrollAnimator::scrollToOffsetWithoutAnimation(const FloatPoint& offset)
     }
 }
 
+void ScrollAnimator::handleWheelEvent(PlatformWheelEvent& e)
+{
+    Scrollbar* horizontalScrollbar = m_scrollableArea->horizontalScrollbar();
+    Scrollbar* verticalScrollbar = m_scrollableArea->verticalScrollbar();
+
+    // Accept the event if we have a scrollbar in that direction and can still
+    // scroll any further.
+    float deltaX = horizontalScrollbar ? e.deltaX() : 0;
+    float deltaY = verticalScrollbar ? e.deltaY() : 0;
+
+    IntSize maxForwardScrollDelta = m_scrollableArea->maximumScrollPosition() - m_scrollableArea->scrollPosition();
+    IntSize maxBackwardScrollDelta = m_scrollableArea->scrollPosition() - m_scrollableArea->minimumScrollPosition();
+    if ((deltaX < 0 && maxForwardScrollDelta.width() > 0)
+        || (deltaX > 0 && maxBackwardScrollDelta.width() > 0)
+        || (deltaY < 0 && maxForwardScrollDelta.height() > 0)
+        || (deltaY > 0 && maxBackwardScrollDelta.height() > 0)) {
+        e.accept();
+        if (e.granularity() == ScrollByPageWheelEvent) {
+            ASSERT(!e.deltaX());
+            bool negative = deltaY < 0;
+            deltaY = max(max(static_cast<float>(m_scrollableArea->visibleHeight()) * Scrollbar::minFractionToStepWhenPaging(), static_cast<float>(m_scrollableArea->visibleHeight() - Scrollbar::maxOverlapBetweenPages())), 1.0f);
+            if (negative)
+                deltaY = -deltaY;
+        }
+
+        if (deltaY)
+            scroll(VerticalScrollbar, ScrollByPixel, verticalScrollbar->pixelStep(), -deltaY);
+        if (deltaX)
+            scroll(HorizontalScrollbar, ScrollByPixel, horizontalScrollbar->pixelStep(), -deltaX);
+    }
+}
+
+#if ENABLE(GESTURE_EVENTS)
+void ScrollAnimator::handleGestureEvent(const PlatformGestureEvent&)
+{
+}
+#endif
+
 FloatPoint ScrollAnimator::currentPosition() const
 {
     return FloatPoint(m_currentPosX, m_currentPosY);
diff --git a/Source/WebCore/platform/ScrollAnimator.h b/Source/WebCore/platform/ScrollAnimator.h
index 155c6e5..060511c 100644
--- a/Source/WebCore/platform/ScrollAnimator.h
+++ b/Source/WebCore/platform/ScrollAnimator.h
@@ -37,7 +37,13 @@
 namespace WebCore {
 
 class FloatPoint;
+class PlatformWheelEvent;
 class ScrollableArea;
+class Scrollbar;
+
+#if ENABLE(GESTURE_EVENTS)
+class PlatformGestureEvent;
+#endif
 
 class ScrollAnimator {
 public:
@@ -53,12 +59,34 @@ public:
 
     virtual void scrollToOffsetWithoutAnimation(const FloatPoint&);
 
+    ScrollableArea* scrollableArea() const { return m_scrollableArea; }
+
+    virtual void handleWheelEvent(PlatformWheelEvent&);
+#if ENABLE(GESTURE_EVENTS)
+    virtual void handleGestureEvent(const PlatformGestureEvent&);
+#endif
+
     FloatPoint currentPosition() const;
 
+    virtual void contentAreaWillPaint() const { }
+    virtual void mouseEnteredContentArea() const { }
+    virtual void mouseExitedContentArea() const { }
+    virtual void mouseMovedInContentArea() const { }
+    virtual void willStartLiveResize() { }
+    virtual void contentsResized() const { }
+    virtual void willEndLiveResize() { }
+    virtual void contentAreaDidShow() const { }
+    virtual void contentAreaDidHide() const { }
+
+    virtual void didAddVerticalScrollbar(Scrollbar*) { }
+    virtual void willRemoveVerticalScrollbar(Scrollbar*) { }
+    virtual void didAddHorizontalScrollbar(Scrollbar*) { }
+    virtual void willRemoveHorizontalScrollbar(Scrollbar*) { }
+
 protected:
     ScrollAnimator(ScrollableArea*);
 
-    void notityPositionChanged();
+    virtual void notityPositionChanged();
 
     ScrollableArea* m_scrollableArea;
     float m_currentPosX; // We avoid using a FloatPoint in order to reduce
diff --git a/Source/WebCore/platform/ScrollView.cpp b/Source/WebCore/platform/ScrollView.cpp
index b07c743..cab58e4 100644
--- a/Source/WebCore/platform/ScrollView.cpp
+++ b/Source/WebCore/platform/ScrollView.cpp
@@ -31,12 +31,12 @@
 #include "HostWindow.h"
 #include "PlatformMouseEvent.h"
 #include "PlatformWheelEvent.h"
+#include "ScrollAnimator.h"
 #include "Scrollbar.h"
 #include "ScrollbarTheme.h"
 #include <wtf/StdLibExtras.h>
 
-
-using std::max;
+using namespace std;
 
 namespace WebCore {
 
@@ -92,8 +92,10 @@ void ScrollView::setHasHorizontalScrollbar(bool hasBar)
     if (hasBar && !m_horizontalScrollbar) {
         m_horizontalScrollbar = createScrollbar(HorizontalScrollbar);
         addChild(m_horizontalScrollbar.get());
+        ScrollableArea::didAddHorizontalScrollbar(m_horizontalScrollbar.get());
         m_horizontalScrollbar->styleChanged();
     } else if (!hasBar && m_horizontalScrollbar) {
+        ScrollableArea::willRemoveHorizontalScrollbar(m_horizontalScrollbar.get());
         removeChild(m_horizontalScrollbar.get());
         m_horizontalScrollbar = 0;
     }
@@ -110,8 +112,10 @@ void ScrollView::setHasVerticalScrollbar(bool hasBar)
     if (hasBar && !m_verticalScrollbar) {
         m_verticalScrollbar = createScrollbar(VerticalScrollbar);
         addChild(m_verticalScrollbar.get());
+        ScrollableArea::didAddVerticalScrollbar(m_verticalScrollbar.get());
         m_verticalScrollbar->styleChanged();
     } else if (!hasBar && m_verticalScrollbar) {
+        ScrollableArea::willRemoveVerticalScrollbar(m_verticalScrollbar.get());
         removeChild(m_verticalScrollbar.get());
         m_verticalScrollbar = 0;
     }
@@ -344,16 +348,49 @@ IntPoint ScrollView::adjustScrollPositionWithinRange(const IntPoint& scrollPoint
     return newScrollPosition;
 }
 
+int ScrollView::scrollXForFixedPosition() const
+{
+    int x = scrollX();
+    if (x < 0)
+        x = 0;
+    else if (x > contentsWidth() - visibleContentRect().width())
+        x = contentsWidth() - visibleContentRect().width();
+    return x;
+}
+
+int ScrollView::scrollYForFixedPosition() const
+{
+    int y = scrollY();
+    if (y < 0)
+        y = 0;
+    else if (y > contentsHeight() - visibleContentRect().height())
+        y = contentsHeight() - visibleContentRect().height();
+    return y;
+}
+
+IntSize ScrollView::scrollOffsetForFixedPosition() const
+{
+    return IntSize(scrollXForFixedPosition(), scrollYForFixedPosition());
+}
+
 int ScrollView::scrollSize(ScrollbarOrientation orientation) const
 {
     Scrollbar* scrollbar = ((orientation == HorizontalScrollbar) ? m_horizontalScrollbar : m_verticalScrollbar).get();
     return scrollbar ? (scrollbar->totalSize() - scrollbar->visibleSize()) : 0;
 }
 
+void ScrollView::didCompleteRubberBand(const IntSize&) const
+{
+}
+
 void ScrollView::setScrollOffset(const IntPoint& offset)
 {
-    int horizontalOffset = std::max(std::min(offset.x(), contentsWidth() - visibleWidth()), 0);
-    int verticalOffset = std::max(std::min(offset.y(), contentsHeight() - visibleHeight()), 0);
+    int horizontalOffset = offset.x();
+    int verticalOffset = offset.y();
+    if (constrainsScrollingToContentEdge()) {
+        horizontalOffset = max(min(horizontalOffset, contentsWidth() - visibleWidth()), 0);
+        verticalOffset = max(min(verticalOffset, contentsHeight() - visibleHeight()), 0);
+    }
 
     IntSize newOffset = m_scrollOffset;
     newOffset.setWidth(horizontalOffset - m_scrollOrigin.x());
@@ -425,6 +462,22 @@ bool ScrollView::logicalScroll(ScrollLogicalDirection direction, ScrollGranulari
     return scroll(logicalToPhysical(direction, isVerticalDocument(), isFlippedDocument()), granularity);
 }
 
+IntSize ScrollView::overhangAmount() const
+{
+    IntSize stretch;
+    if (scrollY() < 0)
+        stretch.setHeight(scrollY());
+    else if (scrollY() > contentsHeight() - visibleContentRect().height())
+        stretch.setHeight(scrollY() - (contentsHeight() - visibleContentRect().height()));
+
+    if (scrollX() < 0)
+        stretch.setWidth(scrollX());
+    else if (scrollX() > contentsWidth() - visibleContentRect().width())
+        stretch.setWidth(scrollX() - (contentsWidth() - visibleContentRect().width()));
+
+    return stretch;
+}
+
 void ScrollView::windowResizerRectChanged()
 {
     if (platformWidget())
@@ -528,7 +581,7 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
 
     m_inUpdateScrollbars = true;
 
-    IntPoint scrollPoint = adjustScrollPositionWithinRange(IntPoint(desiredOffset.width(), desiredOffset.height()));
+    IntPoint scrollPoint = adjustScrollPositionWithinRange(IntPoint(desiredOffset));
     IntSize scroll(scrollPoint.x(), scrollPoint.y());
 
     if (m_horizontalScrollbar) {
@@ -580,6 +633,12 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
 
     ScrollableArea::scrollToOffsetWithoutAnimation(FloatPoint(scroll.width() + m_scrollOrigin.x(), scroll.height() + m_scrollOrigin.y()));
 
+    // Make sure the scrollbar offsets are up to date.
+    if (m_horizontalScrollbar)
+        m_horizontalScrollbar->offsetDidChange();
+    if (m_verticalScrollbar)
+        m_verticalScrollbar->offsetDidChange();
+
     m_inUpdateScrollbars = false;
 }
 
@@ -594,6 +653,14 @@ void ScrollView::scrollContents(const IntSize& scrollDelta)
     // with the clip rect every time to keep it smooth.
     IntRect clipRect = windowClipRect();
     IntRect scrollViewRect = convertToContainingWindow(IntRect(0, 0, visibleWidth(), visibleHeight()));
+    if (ScrollbarTheme::nativeTheme()->usesOverlayScrollbars()) {
+        int verticalScrollbarWidth = verticalScrollbar() ? verticalScrollbar()->width() : 0;
+        int horizontalScrollbarHeight = horizontalScrollbar() ? horizontalScrollbar()->height() : 0;
+
+        scrollViewRect.setWidth(scrollViewRect.width() - verticalScrollbarWidth);
+        scrollViewRect.setHeight(scrollViewRect.height() - horizontalScrollbarHeight);
+    }
+    
     IntRect updateRect = clipRect;
     updateRect.intersect(scrollViewRect);
 
@@ -761,32 +828,18 @@ void ScrollView::wheelEvent(PlatformWheelEvent& e)
         return;
     }
 
-    // Accept the event if we have a scrollbar in that direction and can still
-    // scroll any further.
-    float deltaX = m_horizontalScrollbar ? e.deltaX() : 0;
-    float deltaY = m_verticalScrollbar ? e.deltaY() : 0;
-    
-    IntSize maxForwardScrollDelta = maximumScrollPosition() - scrollPosition();
-    IntSize maxBackwardScrollDelta = scrollPosition() - minimumScrollPosition();
-    if ((deltaX < 0 && maxForwardScrollDelta.width() > 0)
-        || (deltaX > 0 && maxBackwardScrollDelta.width() >0)
-        || (deltaY < 0 && maxForwardScrollDelta.height() > 0)
-        || (deltaY > 0 && maxBackwardScrollDelta.height() > 0)) {
-        e.accept();
-        if (e.granularity() == ScrollByPageWheelEvent) {
-            ASSERT(!e.deltaX());
-            bool negative = deltaY < 0;
-            deltaY = max(max(static_cast<float>(visibleHeight()) * Scrollbar::minFractionToStepWhenPaging(), static_cast<float>(visibleHeight() - Scrollbar::maxOverlapBetweenPages())), 1.0f);
-            if (negative)
-                deltaY = -deltaY;
-        }
+    ScrollableArea::handleWheelEvent(e);
+}
 
-        if (deltaY)
-            ScrollableArea::scroll(ScrollUp, ScrollByPixel, deltaY);
-        if (deltaX)
-            ScrollableArea::scroll(ScrollLeft, ScrollByPixel, deltaX);
-    }
+#if ENABLE(GESTURE_EVENTS)
+void ScrollView::gestureEvent(const PlatformGestureEvent& gestureEvent)
+{
+    if (platformWidget())
+        return;
+
+    ScrollableArea::handleGestureEvent(gestureEvent);
 }
+#endif
 
 void ScrollView::setFrameRect(const IntRect& newRect)
 {
@@ -898,6 +951,8 @@ void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
     if (context->paintingDisabled() && !context->updatingControlTints())
         return;
 
+    scrollAnimator()->contentAreaWillPaint();
+    
     IntRect documentDirtyRect = rect;
     documentDirtyRect.intersect(frameRect());
 
@@ -917,6 +972,13 @@ void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
 
     context->restore();
 
+    IntRect horizontalOverhangRect;
+    IntRect verticalOverhangRect;
+    calculateOverhangAreasForPainting(horizontalOverhangRect, verticalOverhangRect);
+
+    if (rect.intersects(horizontalOverhangRect) || rect.intersects(verticalOverhangRect))
+        paintOverhangAreas(context, horizontalOverhangRect, verticalOverhangRect, rect);
+
     // Now paint the scrollbars.
     if (!m_scrollbarsSuppressed && (m_horizontalScrollbar || m_verticalScrollbar)) {
         context->save();
@@ -935,6 +997,55 @@ void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
         paintPanScrollIcon(context);
 }
 
+void ScrollView::calculateOverhangAreasForPainting(IntRect& horizontalOverhangRect, IntRect& verticalOverhangRect)
+{
+    bool hasOverlayScrollbars = ScrollbarTheme::nativeTheme()->usesOverlayScrollbars();
+    int verticalScrollbarWidth = (verticalScrollbar() && !hasOverlayScrollbars) ? verticalScrollbar()->width() : 0;
+    int horizontalScrollbarHeight = (horizontalScrollbar() && !hasOverlayScrollbars) ? horizontalScrollbar()->height() : 0;
+
+    if (scrollY() < 0) {
+        horizontalOverhangRect = frameRect();
+        horizontalOverhangRect.setHeight(-scrollY());
+    } else if (scrollY() > contentsHeight() - visibleContentRect().height()) {
+        int height = scrollY() - (contentsHeight() - visibleContentRect().height());
+        horizontalOverhangRect = frameRect();
+        horizontalOverhangRect.setY(frameRect().maxY() - height - horizontalScrollbarHeight);
+        horizontalOverhangRect.setHeight(height);
+    }
+
+    if (scrollX() < 0) {
+        verticalOverhangRect.setWidth(-scrollX());
+        verticalOverhangRect.setHeight(frameRect().height() - horizontalOverhangRect.height());
+        verticalOverhangRect.setX(frameRect().x());
+        if (horizontalOverhangRect.y() == frameRect().y())
+            verticalOverhangRect.setY(frameRect().y() + horizontalOverhangRect.height());
+        else
+            verticalOverhangRect.setY(frameRect().y());
+    } else if (scrollX() > contentsWidth() - visibleContentRect().width()) {
+        int width = scrollX() - (contentsWidth() - visibleContentRect().width());
+        verticalOverhangRect.setWidth(width);
+        verticalOverhangRect.setHeight(frameRect().height() - horizontalOverhangRect.height());
+        verticalOverhangRect.setX(frameRect().maxX() - width - verticalScrollbarWidth);
+        if (horizontalOverhangRect.y() == frameRect().y())
+            verticalOverhangRect.setY(frameRect().y() + horizontalOverhangRect.height());
+        else
+            verticalOverhangRect.setY(frameRect().y());
+    }
+}
+
+void ScrollView::paintOverhangAreas(GraphicsContext* context, const IntRect& horizontalOverhangRect, const IntRect& verticalOverhangRect, const IntRect&)
+{
+    // FIXME: This should be checking the dirty rect.
+
+    context->setFillColor(Color::white, ColorSpaceDeviceRGB);
+    if (!horizontalOverhangRect.isEmpty())
+        context->fillRect(horizontalOverhangRect);
+
+    context->setFillColor(Color::white, ColorSpaceDeviceRGB);
+    if (!verticalOverhangRect.isEmpty())
+        context->fillRect(verticalOverhangRect);
+}
+
 bool ScrollView::isPointInScrollbarCorner(const IntPoint& windowPoint)
 {
     if (!scrollbarCornerPresent())
@@ -1070,7 +1181,7 @@ void ScrollView::removePanScrollIcon()
     hostWindow()->invalidateContentsAndWindow(IntRect(m_panScrollIconPoint, IntSize(panIconSizeLength, panIconSizeLength)), true /*immediate*/);
 }
 
-void ScrollView::setScrollOrigin(const IntPoint& origin, bool updatePosition)
+void ScrollView::setScrollOrigin(const IntPoint& origin, bool updatePositionAtAll, bool updatePositionSynchronously)
 {
     if (m_scrollOrigin == origin)
         return;
@@ -1078,12 +1189,12 @@ void ScrollView::setScrollOrigin(const IntPoint& origin, bool updatePosition)
     m_scrollOrigin = origin;
 
     if (platformWidget()) {
-        platformSetScrollOrigin(origin, updatePosition);
+        platformSetScrollOrigin(origin, updatePositionAtAll, updatePositionSynchronously);
         return;
     }
     
     // Update if the scroll origin changes, since our position will be different if the content size did not change.
-    if (updatePosition)
+    if (updatePositionAtAll && updatePositionSynchronously)
         updateScrollbars(scrollOffset());
 }
 
@@ -1117,7 +1228,7 @@ void ScrollView::platformSetScrollbarsSuppressed(bool)
 {
 }
 
-void ScrollView::platformSetScrollOrigin(const IntPoint&, bool updatePosition)
+void ScrollView::platformSetScrollOrigin(const IntPoint&, bool updatePositionAtAll, bool updatePositionSynchronously)
 {
 }
 
diff --git a/Source/WebCore/platform/ScrollView.h b/Source/WebCore/platform/ScrollView.h
index cb895f6..2bd1447 100644
--- a/Source/WebCore/platform/ScrollView.h
+++ b/Source/WebCore/platform/ScrollView.h
@@ -51,7 +51,6 @@ class wxScrollWinEvent;
 namespace WebCore {
 
 class HostWindow;
-class PlatformWheelEvent;
 class Scrollbar;
 
 class ScrollView : public Widget, public ScrollableArea {
@@ -62,7 +61,8 @@ public:
     virtual int scrollSize(ScrollbarOrientation orientation) const;
     virtual int scrollPosition(Scrollbar*) const;
     virtual void setScrollOffset(const IntPoint&);
-    
+    virtual void didCompleteRubberBand(const IntSize&) const;
+
     // NOTE: This should only be called by the overriden setScrollOffset from ScrollableArea.
     virtual void scrollTo(const IntSize& newOffset);
 
@@ -162,6 +162,7 @@ public:
     int contentsWidth() const { return contentsSize().width(); }
     int contentsHeight() const { return contentsSize().height(); }
     virtual void setContentsSize(const IntSize&);
+<<<<<<< HEAD
    
 #if PLATFORM(ANDROID)
     int actualWidth() const;
@@ -169,6 +170,8 @@ public:
     int actualScrollX() const;
     int actualScrollY() const;
 #endif
+=======
+>>>>>>> webkit.org at r78450
 
     // Functions for querying the current scrolled position (both as a point, a size, or as individual X and Y values).
     IntPoint scrollPosition() const { return visibleContentRect().location(); }
@@ -179,7 +182,14 @@ public:
     IntPoint adjustScrollPositionWithinRange(const IntPoint&) const; 
     int scrollX() const { return scrollPosition().x(); }
     int scrollY() const { return scrollPosition().y(); }
-    
+
+    // Functions for querying the current scrolled position, negating the effects of overhang.
+    int scrollXForFixedPosition() const;
+    int scrollYForFixedPosition() const;
+    IntSize scrollOffsetForFixedPosition() const;
+
+    IntSize overhangAmount() const;
+
     // Functions for scrolling the view.
     void setScrollPosition(const IntPoint&);
     void scrollBy(const IntSize& s) { return setScrollPosition(scrollPosition() + s); }
@@ -235,6 +245,9 @@ public:
     // On Mac the underlying NSScrollView just does the scrolling, but on other platforms
     // (like Windows), we need this function in order to do the scroll ourselves.
     void wheelEvent(PlatformWheelEvent&);
+#if ENABLE(GESTURE_EVENTS)
+    void gestureEvent(const PlatformGestureEvent&);
+#endif
 
     IntPoint convertChildToSelf(const Widget* child, const IntPoint& point) const
     {
@@ -282,7 +295,10 @@ protected:
 
     virtual void repaintContentRectangle(const IntRect&, bool now = false);
     virtual void paintContents(GraphicsContext*, const IntRect& damageRect) = 0;
-    
+
+    void calculateOverhangAreasForPainting(IntRect& horizontalOverhangRect, IntRect& verticalOverhangRect);
+    virtual void paintOverhangAreas(GraphicsContext*, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect);
+
     virtual void contentsResized() = 0;
     virtual void visibleContentsResized() = 0;
 
@@ -299,7 +315,7 @@ protected:
     // Scroll the content by invalidating everything.
     virtual void scrollContentsSlowPath(const IntRect& updateRect);
 
-    void setScrollOrigin(const IntPoint&, bool updatePosition);
+    void setScrollOrigin(const IntPoint&, bool updatePositionAtAll, bool updatePositionSynchronously);
     IntPoint scrollOrigin() { return m_scrollOrigin; }
 
     // Subclassed by FrameView to check the writing-mode of the document.
@@ -383,7 +399,7 @@ private:
     void platformRepaintContentRectangle(const IntRect&, bool now);
     bool platformIsOffscreen() const;
    
-    void platformSetScrollOrigin(const IntPoint&, bool updatePosition);
+    void platformSetScrollOrigin(const IntPoint&, bool updatePositionAtAll, bool updatePositionSynchronously);
 
 #if PLATFORM(ANDROID)
     int platformActualWidth() const;
diff --git a/Source/WebCore/platform/ScrollableArea.cpp b/Source/WebCore/platform/ScrollableArea.cpp
index 176cb7e..00017bd 100644
--- a/Source/WebCore/platform/ScrollableArea.cpp
+++ b/Source/WebCore/platform/ScrollableArea.cpp
@@ -35,12 +35,15 @@
 #include "FloatPoint.h"
 #include "PlatformWheelEvent.h"
 #include "ScrollAnimator.h"
+#include "ScrollbarTheme.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
 ScrollableArea::ScrollableArea()
     : m_scrollAnimator(ScrollAnimator::create(this))
+    , m_constrainsScrollingToContentEdge(true)
+    , m_inLiveResize(false)
 {
 }
 
@@ -108,16 +111,72 @@ void ScrollableArea::scrollToYOffsetWithoutAnimation(float y)
     scrollToOffsetWithoutAnimation(FloatPoint(m_scrollAnimator->currentPosition().x(), y));
 }
 
+void ScrollableArea::handleWheelEvent(PlatformWheelEvent& wheelEvent)
+{
+    m_scrollAnimator->handleWheelEvent(wheelEvent);
+}
+
+#if ENABLE(GESTURE_EVENTS)
+void ScrollableArea::handleGestureEvent(const PlatformGestureEvent& gestureEvent)
+{
+    m_scrollAnimator->handleGestureEvent(gestureEvent);
+}
+#endif
+
 void ScrollableArea::setScrollOffsetFromAnimation(const IntPoint& offset)
 {
     // Tell the derived class to scroll its contents.
     setScrollOffset(offset);
 
+    bool hasOverlayScrollbars = ScrollbarTheme::nativeTheme()->usesOverlayScrollbars();
+
     // Tell the scrollbars to update their thumb postions.
-    if (Scrollbar* horizontalScrollbar = this->horizontalScrollbar())
+    if (Scrollbar* horizontalScrollbar = this->horizontalScrollbar()) {
         horizontalScrollbar->offsetDidChange();
-    if (Scrollbar* verticalScrollbar = this->verticalScrollbar())
+        if (hasOverlayScrollbars)
+            horizontalScrollbar->invalidate();
+    }
+    if (Scrollbar* verticalScrollbar = this->verticalScrollbar()) {
         verticalScrollbar->offsetDidChange();
+        if (hasOverlayScrollbars)
+            verticalScrollbar->invalidate();
+    }
+}
+
+void ScrollableArea::willStartLiveResize()
+{
+    if (m_inLiveResize)
+        return;
+    m_inLiveResize = true;
+    scrollAnimator()->willStartLiveResize();
+}
+
+void ScrollableArea::willEndLiveResize()
+{
+    if (!m_inLiveResize)
+        return;
+    m_inLiveResize = false;
+    scrollAnimator()->willEndLiveResize();
+}    
+
+void ScrollableArea::didAddVerticalScrollbar(Scrollbar* scrollbar)
+{
+    scrollAnimator()->didAddVerticalScrollbar(scrollbar);
+}
+
+void ScrollableArea::willRemoveVerticalScrollbar(Scrollbar* scrollbar)
+{
+    scrollAnimator()->willRemoveVerticalScrollbar(scrollbar);
+}
+
+void ScrollableArea::didAddHorizontalScrollbar(Scrollbar* scrollbar)
+{
+    scrollAnimator()->didAddHorizontalScrollbar(scrollbar);
+}
+
+void ScrollableArea::willRemoveHorizontalScrollbar(Scrollbar* scrollbar)
+{
+    scrollAnimator()->willRemoveHorizontalScrollbar(scrollbar);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/ScrollableArea.h b/Source/WebCore/platform/ScrollableArea.h
index 148ecdb..9839abc 100644
--- a/Source/WebCore/platform/ScrollableArea.h
+++ b/Source/WebCore/platform/ScrollableArea.h
@@ -33,6 +33,7 @@
 namespace WebCore {
 
 class FloatPoint;
+class PlatformGestureEvent;
 class PlatformWheelEvent;
 class ScrollAnimator;
 
@@ -47,6 +48,26 @@ public:
     void scrollToXOffsetWithoutAnimation(float x);
     void scrollToYOffsetWithoutAnimation(float x);
 
+    void handleWheelEvent(PlatformWheelEvent&);
+#if ENABLE(GESTURE_EVENTS)
+    void handleGestureEvent(const PlatformGestureEvent&);
+#endif
+
+    // Functions for controlling if you can scroll past the end of the document.
+    bool constrainsScrollingToContentEdge() const { return m_constrainsScrollingToContentEdge; }
+    void setConstrainsScrollingToContentEdge(bool constrainsScrollingToContentEdge) { m_constrainsScrollingToContentEdge = constrainsScrollingToContentEdge; }
+
+    bool inLiveResize() const { return m_inLiveResize; }
+    void willStartLiveResize();
+    void willEndLiveResize();
+
+    void didAddVerticalScrollbar(Scrollbar*);
+    void willRemoveVerticalScrollbar(Scrollbar*);
+    void didAddHorizontalScrollbar(Scrollbar*);
+    void willRemoveHorizontalScrollbar(Scrollbar*);
+
+    ScrollAnimator* scrollAnimator() const { return m_scrollAnimator.get(); }
+
     virtual int scrollSize(ScrollbarOrientation) const = 0;
     virtual int scrollPosition(Scrollbar*) const = 0;
     virtual void invalidateScrollbarRect(Scrollbar*, const IntRect&) = 0;
@@ -58,7 +79,6 @@ public:
     // scroll of the content.
     virtual void setScrollOffset(const IntPoint&) = 0;
 
-
     // Convert points and rects between the scrollbar and its containing view.
     // The client needs to implement these in order to be aware of layout effects
     // like CSS transforms.
@@ -82,12 +102,28 @@ public:
     virtual Scrollbar* horizontalScrollbar() const { return 0; }
     virtual Scrollbar* verticalScrollbar() const { return 0; }
 
+    virtual IntPoint scrollPosition() const { ASSERT_NOT_REACHED(); return IntPoint(); }
+    virtual IntPoint minimumScrollPosition() const { ASSERT_NOT_REACHED(); return IntPoint(); }
+    virtual IntPoint maximumScrollPosition() const { ASSERT_NOT_REACHED(); return IntPoint(); }
+    virtual IntRect visibleContentRect(bool = false) const { ASSERT_NOT_REACHED(); return IntRect(); }
+    virtual int visibleHeight() const { ASSERT_NOT_REACHED(); return 0; }
+    virtual int visibleWidth() const { ASSERT_NOT_REACHED(); return 0; }
+    virtual IntSize contentsSize() const { ASSERT_NOT_REACHED(); return IntSize(); }
+    virtual IntSize overhangAmount() const { ASSERT_NOT_REACHED(); return IntSize(); }
+    virtual IntPoint currentMousePosition() const { return IntPoint(); }
+    virtual void didCompleteRubberBand(const IntSize&) const { ASSERT_NOT_REACHED(); }
+
+    virtual bool scrollbarWillRenderIntoCompositingLayer() const { return false; }
+
 private:
     // NOTE: Only called from the ScrollAnimator.
     friend class ScrollAnimator;
     void setScrollOffsetFromAnimation(const IntPoint&);
 
     OwnPtr<ScrollAnimator> m_scrollAnimator;
+    bool m_constrainsScrollingToContentEdge;
+
+    bool m_inLiveResize;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/Scrollbar.cpp b/Source/WebCore/platform/Scrollbar.cpp
index 4c625f4..5d9a43d 100644
--- a/Source/WebCore/platform/Scrollbar.cpp
+++ b/Source/WebCore/platform/Scrollbar.cpp
@@ -196,7 +196,7 @@ void Scrollbar::autoscrollPressedPart(double delay)
     }
 
     // Handle the arrows and track.
-    if (scrollableArea()->scroll(pressedPartScrollDirection(), pressedPartScrollGranularity()))
+    if (m_scrollableArea && m_scrollableArea->scroll(pressedPartScrollDirection(), pressedPartScrollGranularity()))
         startTimerIfNeeded(delay);
 }
 
@@ -268,7 +268,8 @@ void Scrollbar::moveThumb(int pos)
     
     if (delta) {
         float newPosition = static_cast<float>(thumbPos + delta) * maximum() / (trackLen - thumbLen);
-        scrollableArea()->scrollToOffsetWithoutAnimation(m_orientation, newPosition);
+        if (m_scrollableArea)
+            m_scrollableArea->scrollToOffsetWithoutAnimation(m_orientation, newPosition);
     }
 }
 
@@ -300,9 +301,10 @@ void Scrollbar::setPressedPart(ScrollbarPart part)
 bool Scrollbar::mouseMoved(const PlatformMouseEvent& evt)
 {
     if (m_pressedPart == ThumbPart) {
-        if (theme()->shouldSnapBackToDragOrigin(this, evt))
-            scrollableArea()->scrollToOffsetWithoutAnimation(m_orientation, m_dragOrigin);
-        else {
+        if (theme()->shouldSnapBackToDragOrigin(this, evt)) {
+            if (m_scrollableArea)
+                m_scrollableArea->scrollToOffsetWithoutAnimation(m_orientation, m_dragOrigin);
+        } else {
             moveThumb(m_orientation == HorizontalScrollbar ? 
                       convertFromContainingWindow(evt.pos()).x() :
                       convertFromContainingWindow(evt.pos()).y());
@@ -393,14 +395,14 @@ void Scrollbar::setFrameRect(const IntRect& rect)
         IntRect resizerRect = view->convertFromContainingWindow(view->windowResizerRect());
         if (rect.intersects(resizerRect)) {
             if (orientation() == HorizontalScrollbar) {
-                int overlap = rect.right() - resizerRect.x();
-                if (overlap > 0 && resizerRect.right() >= rect.right()) {
+                int overlap = rect.maxX() - resizerRect.x();
+                if (overlap > 0 && resizerRect.maxX() >= rect.maxX()) {
                     adjustedRect.setWidth(rect.width() - overlap);
                     overlapsResizer = true;
                 }
             } else {
-                int overlap = rect.bottom() - resizerRect.y();
-                if (overlap > 0 && resizerRect.bottom() >= rect.bottom()) {
+                int overlap = rect.maxY() - resizerRect.y();
+                if (overlap > 0 && resizerRect.maxY() >= rect.maxY()) {
                     adjustedRect.setHeight(rect.height() - overlap);
                     overlapsResizer = true;
                 }
diff --git a/Source/WebCore/platform/ScrollbarThemeComposite.cpp b/Source/WebCore/platform/ScrollbarThemeComposite.cpp
index 7bc266f..26f1494 100644
--- a/Source/WebCore/platform/ScrollbarThemeComposite.cpp
+++ b/Source/WebCore/platform/ScrollbarThemeComposite.cpp
@@ -37,6 +37,8 @@
 #include "ScrollableArea.h"
 #include "Settings.h"
 
+using namespace std;
+
 namespace WebCore {
 
 #if PLATFORM(WIN)
@@ -246,18 +248,28 @@ void ScrollbarThemeComposite::splitTrack(Scrollbar* scrollbar, const IntRect& un
     if (scrollbar->orientation() == HorizontalScrollbar) {
         thumbRect = IntRect(trackRect.x() + thumbPos, trackRect.y() + (trackRect.height() - thickness) / 2, thumbLength(scrollbar), thickness); 
         beforeThumbRect = IntRect(trackRect.x(), trackRect.y(), thumbPos + thumbRect.width() / 2, trackRect.height()); 
-        afterThumbRect = IntRect(trackRect.x() + beforeThumbRect.width(), trackRect.y(), trackRect.right() - beforeThumbRect.right(), trackRect.height());
+        afterThumbRect = IntRect(trackRect.x() + beforeThumbRect.width(), trackRect.y(), trackRect.maxX() - beforeThumbRect.maxX(), trackRect.height());
     } else {
         thumbRect = IntRect(trackRect.x() + (trackRect.width() - thickness) / 2, trackRect.y() + thumbPos, thickness, thumbLength(scrollbar));
         beforeThumbRect = IntRect(trackRect.x(), trackRect.y(), trackRect.width(), thumbPos + thumbRect.height() / 2); 
-        afterThumbRect = IntRect(trackRect.x(), trackRect.y() + beforeThumbRect.height(), trackRect.width(), trackRect.bottom() - beforeThumbRect.bottom());
+        afterThumbRect = IntRect(trackRect.x(), trackRect.y() + beforeThumbRect.height(), trackRect.width(), trackRect.maxY() - beforeThumbRect.maxY());
     }
 }
 
+// Returns the size represented by track taking into account scrolling past
+// the end of the document.
+static float usedTotalSize(Scrollbar* scrollbar)
+{
+    float overhangAtStart = -scrollbar->currentPos();
+    float overhangAtEnd = scrollbar->currentPos() + scrollbar->visibleSize() - scrollbar->totalSize();
+    float overhang = max(0.0f, max(overhangAtStart, overhangAtEnd));
+    return scrollbar->totalSize() + overhang;
+}
+
 int ScrollbarThemeComposite::thumbPosition(Scrollbar* scrollbar)
 {
     if (scrollbar->enabled())
-        return scrollbar->currentPos() * (trackLength(scrollbar) - thumbLength(scrollbar)) / scrollbar->maximum();
+        return max(0.0f, scrollbar->currentPos()) * (trackLength(scrollbar) - thumbLength(scrollbar)) / (usedTotalSize(scrollbar) - scrollbar->visibleSize());
     return 0;
 }
 
@@ -266,7 +278,7 @@ int ScrollbarThemeComposite::thumbLength(Scrollbar* scrollbar)
     if (!scrollbar->enabled())
         return 0;
 
-    float proportion = (float)scrollbar->visibleSize() / scrollbar->totalSize();
+    float proportion = scrollbar->visibleSize() / usedTotalSize(scrollbar);
     int trackLen = trackLength(scrollbar);
     int length = proportion * trackLen;
     length = max(length, minimumThumbLength(scrollbar));
diff --git a/Source/WebCore/platform/URLString.h b/Source/WebCore/platform/URLString.h
new file mode 100644
index 0000000..78e4b33
--- /dev/null
+++ b/Source/WebCore/platform/URLString.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2011 Google, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef URLString_h
+#define URLString_h
+
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class KURL;
+
+class URLString {
+public:
+    const String& string() const { return m_string; }
+
+private:
+    friend class KURL;
+
+    explicit URLString(const String& string)
+        : m_string(string)
+    {
+    }
+    
+    String m_string;
+};
+
+}
+
+#endif
diff --git a/Source/WebCore/platform/android/TemporaryLinkStubs.cpp b/Source/WebCore/platform/android/TemporaryLinkStubs.cpp
index d3c8183..cf15462 100644
--- a/Source/WebCore/platform/android/TemporaryLinkStubs.cpp
+++ b/Source/WebCore/platform/android/TemporaryLinkStubs.cpp
@@ -76,6 +76,8 @@
 #include "Widget.h"
 #include <stdio.h>
 #include <stdlib.h>
+#include <wtf/Assertions.h>
+#include <wtf/MainThread.h>
 #include <wtf/text/CString.h>
 
 #if USE(JSC)
@@ -296,6 +298,16 @@ void* WebCore::Frame::dragImageForSelection()
     return 0;
 }
 
+<<<<<<< HEAD
+=======
+
+WTF::String WebCore::MIMETypeRegistry::getMIMETypeForExtension(WTF::String const&)
+{
+    ASSERT(isMainThread());
+    return WTF::String();
+}
+
+>>>>>>> webkit.org at r78450
 void WebCore::Pasteboard::writeImage(WebCore::Node*, WebCore::KURL const&, WTF::String const&) {}
 
 namespace WebCore {
diff --git a/Source/WebCore/platform/audio/FFTFrame.h b/Source/WebCore/platform/audio/FFTFrame.h
index 1a82ef0..f6e2066 100644
--- a/Source/WebCore/platform/audio/FFTFrame.h
+++ b/Source/WebCore/platform/audio/FFTFrame.h
@@ -35,12 +35,18 @@
 #include <Accelerate/Accelerate.h>
 #endif
 
-#if !OS(DARWIN) && USE(WEBAUDIO_MKL)
+#if !OS(DARWIN)
+#if USE(WEBAUDIO_MKL)
 #include "mkl_dfti.h"
+#endif // USE(WEBAUDIO_MKL)
+#if USE(WEBAUDIO_FFTW)
+#include "fftw3.h"
+#endif // USE(WEBAUDIO_FFTW)
 #endif
 
 #include <wtf/PassOwnPtr.h>
 #include <wtf/Platform.h>
+#include <wtf/Threading.h>
 
 namespace WebCore {
 
@@ -56,6 +62,7 @@ public:
     FFTFrame(const FFTFrame& frame);
     ~FFTFrame();
 
+    static void initialize();
     static void cleanup();
     void doFFT(float* data);
     void doInverseFFT(float* data);
@@ -98,8 +105,8 @@ private:
     DSPSplitComplex m_frame;
     AudioFloatArray m_realData;
     AudioFloatArray m_imagData;
-#endif // OS(DARWIN)
-#if !OS(DARWIN) && USE(WEBAUDIO_MKL)
+#else // !OS(DARWIN)
+#if USE(WEBAUDIO_MKL)
     // Interleaves the planar real and imaginary data and returns a
     // pointer to the resulting storage which can be used for in-place
     // or out-of-place operations. FIXME: ideally all of the MKL
@@ -115,7 +122,31 @@ private:
     AudioFloatArray m_complexData;
     AudioFloatArray m_realData;
     AudioFloatArray m_imagData;
-#endif // !OS(DARWIN) && USE(WEBAUDIO_MKL)
+#endif // USE(WEBAUDIO_MKL)
+#if USE(WEBAUDIO_FFTW)
+    fftwf_plan m_forwardPlan;
+    fftwf_plan m_backwardPlan;
+
+    enum Direction {
+        Forward,
+        Backward
+    };
+
+    // Both the real and imaginary data are stored here.
+    // The real data is stored first, followed by three float values of padding.
+    // The imaginary data is stored after the padding and is 16-byte aligned (if m_data itself is aligned).
+    // The reason we don't use separate arrays for real and imaginary is because the FFTW plans are shared
+    // between FFTFrame instances and require that the real and imaginary data pointers be the same distance apart.
+    AudioFloatArray m_data;
+
+    static Mutex *s_planLock;
+    static fftwf_plan* fftwForwardPlans;
+    static fftwf_plan* fftwBackwardPlans;
+
+    static fftwf_plan fftwPlanForSize(unsigned fftSize, Direction,
+                                      float*, float*, float*);
+#endif // USE(WEBAUDIO_FFTW)
+#endif // !OS(DARWIN)
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/audio/FFTFrameStub.cpp b/Source/WebCore/platform/audio/FFTFrameStub.cpp
index 17405c9..c76c0e2 100644
--- a/Source/WebCore/platform/audio/FFTFrameStub.cpp
+++ b/Source/WebCore/platform/audio/FFTFrameStub.cpp
@@ -36,9 +36,9 @@
 namespace WebCore {
 
 // Normal constructor: allocates for a given fftSize.
-FFTFrame::FFTFrame(unsigned fftSize)
-    : m_FFTSize(fftSize)
-    , m_log2FFTSize(static_cast<unsigned>(log2(fftSize)))
+FFTFrame::FFTFrame(unsigned /*fftSize*/)
+    : m_FFTSize(0)
+    , m_log2FFTSize(0)
 {
     ASSERT_NOT_REACHED();
 }
diff --git a/Source/WebCore/platform/audio/chromium/AudioBusChromium.cpp b/Source/WebCore/platform/audio/chromium/AudioBusChromium.cpp
index 83ab9bf..de44b1c 100644
--- a/Source/WebCore/platform/audio/chromium/AudioBusChromium.cpp
+++ b/Source/WebCore/platform/audio/chromium/AudioBusChromium.cpp
@@ -42,7 +42,7 @@ PassOwnPtr<AudioBus> AudioBus::loadPlatformResource(const char* name, double sam
 PassOwnPtr<AudioBus> createBusFromInMemoryAudioFile(const void* data, size_t dataSize, bool mixToMono, double sampleRate)
 {
     OwnPtr<AudioBus> audioBus = PlatformBridge::decodeAudioFileData(static_cast<const char*>(data), dataSize, sampleRate);
-    if (audioBus->numberOfChannels() == 2 && mixToMono) {
+    if (audioBus.get() && audioBus->numberOfChannels() == 2 && mixToMono) {
         OwnPtr<AudioBus> monoAudioBus = adoptPtr(new AudioBus(1, audioBus->length()));
 
         // FIXME: AudioBus::copyFrom() should be able to do a downmix to mono.
diff --git a/Source/WebCore/platform/audio/fftw/FFTFrameFFTW.cpp b/Source/WebCore/platform/audio/fftw/FFTFrameFFTW.cpp
new file mode 100644
index 0000000..878ed9f
--- /dev/null
+++ b/Source/WebCore/platform/audio/fftw/FFTFrameFFTW.cpp
@@ -0,0 +1,301 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// FFTFrame implementation using the FFTW library.
+
+#include "config.h"
+
+#if ENABLE(WEB_AUDIO)
+
+#include "FFTFrame.h"
+
+#include <wtf/MathExtras.h>
+
+namespace WebCore {
+
+const int kMaxFFTPow2Size = 24;
+
+fftwf_plan* FFTFrame::fftwForwardPlans = 0;
+fftwf_plan* FFTFrame::fftwBackwardPlans = 0;
+
+Mutex* FFTFrame::s_planLock = 0;
+
+namespace {
+
+unsigned unpackedFFTWDataSize(unsigned fftSize)
+{
+    return fftSize / 2 + 1;
+}
+
+} // anonymous namespace
+
+
+// Normal constructor: allocates for a given fftSize.
+FFTFrame::FFTFrame(unsigned fftSize)
+    : m_FFTSize(fftSize)
+    , m_log2FFTSize(static_cast<unsigned>(log2(fftSize)))
+    , m_forwardPlan(0)
+    , m_backwardPlan(0)
+    , m_data(2 * (3 + unpackedFFTWDataSize(fftSize))) // enough space for real and imaginary data plus 16-byte alignment padding
+{
+    // We only allow power of two.
+    ASSERT(1UL << m_log2FFTSize == m_FFTSize);
+
+    // FFTW won't create a plan without being able to look at non-null
+    // pointers for the input and output data; it wants to be able to
+    // see whether these arrays are aligned properly for vector
+    // operations. Ideally we would use fftw_malloc and fftw_free for
+    // the input and output arrays to ensure proper alignment for SIMD
+    // operations, so that we don't have to specify FFTW_UNALIGNED
+    // when creating the plan. However, since we don't have control
+    // over the alignment of the array passed to doFFT / doInverseFFT,
+    // we would need to memcpy it in to or out of the FFTFrame, adding
+    // overhead. For the time being, we just assume unaligned data and
+    // pass a temporary pointer down.
+
+    float temporary;
+    m_forwardPlan = fftwPlanForSize(fftSize, Forward,
+                                    &temporary, realData(), imagData());
+    m_backwardPlan = fftwPlanForSize(fftSize, Backward,
+                                     realData(), imagData(), &temporary);
+}
+
+// Creates a blank/empty frame (interpolate() must later be called).
+FFTFrame::FFTFrame()
+    : m_FFTSize(0)
+    , m_log2FFTSize(0)
+    , m_forwardPlan(0)
+    , m_backwardPlan(0)
+{
+}
+
+// Copy constructor.
+FFTFrame::FFTFrame(const FFTFrame& frame)
+    : m_FFTSize(frame.m_FFTSize)
+    , m_log2FFTSize(frame.m_log2FFTSize)
+    , m_forwardPlan(0)
+    , m_backwardPlan(0)
+    , m_data(2 * (3 + unpackedFFTWDataSize(fftSize()))) // enough space for real and imaginary data plus 16-byte alignment padding
+{
+    // See the normal constructor for an explanation of the temporary pointer.
+    float temporary;
+    m_forwardPlan = fftwPlanForSize(m_FFTSize, Forward,
+                                    &temporary, realData(), imagData());
+    m_backwardPlan = fftwPlanForSize(m_FFTSize, Backward,
+                                     realData(), imagData(), &temporary);
+
+    // Copy/setup frame data.
+    size_t nbytes = sizeof(float) * unpackedFFTWDataSize(fftSize());
+    memcpy(realData(), frame.realData(), nbytes);
+    memcpy(imagData(), frame.imagData(), nbytes);
+}
+
+FFTFrame::~FFTFrame()
+{
+}
+
+void FFTFrame::multiply(const FFTFrame& frame)
+{
+    FFTFrame& frame1 = *this;
+    FFTFrame& frame2 = const_cast<FFTFrame&>(frame);
+
+    float* realP1 = frame1.realData();
+    float* imagP1 = frame1.imagData();
+    const float* realP2 = frame2.realData();
+    const float* imagP2 = frame2.imagData();
+
+    // Scale accounts the peculiar scaling of vecLib on the Mac.
+    // This ensures the right scaling all the way back to inverse FFT.
+    // FIXME: if we change the scaling on the Mac then this scale
+    // factor will need to change too.
+    float scale = 0.5f;
+
+    // Multiply the packed DC/nyquist component
+    realP1[0] *= scale * realP2[0];
+    imagP1[0] *= scale * imagP2[0];
+
+    // Complex multiplication. If this loop turns out to be hot then
+    // we should use SSE or other intrinsics to accelerate it.
+    unsigned halfSize = fftSize() / 2;
+
+    for (unsigned i = 1; i < halfSize; ++i) {
+        float realResult = realP1[i] * realP2[i] - imagP1[i] * imagP2[i];
+        float imagResult = realP1[i] * imagP2[i] + imagP1[i] * realP2[i];
+
+        realP1[i] = scale * realResult;
+        imagP1[i] = scale * imagResult;
+    }
+}
+
+void FFTFrame::doFFT(float* data)
+{
+    fftwf_execute_split_dft_r2c(m_forwardPlan, data, realData(), imagData());
+
+    // Scale the frequency domain data to match vecLib's scale factor
+    // on the Mac. FIXME: if we change the definition of FFTFrame to
+    // eliminate this scale factor then this code will need to change.
+    // Also, if this loop turns out to be hot then we should use SSE
+    // or other intrinsics to accelerate it.
+    float scaleFactor = 2;
+    unsigned length = unpackedFFTWDataSize(fftSize());
+    float* realData = this->realData();
+    float* imagData = this->imagData();
+
+    for (unsigned i = 0; i < length; ++i) {
+        realData[i] = realData[i] * scaleFactor;
+        imagData[i] = imagData[i] * scaleFactor;
+    }
+
+    // Move the Nyquist component to the location expected by the
+    // FFTFrame API.
+    imagData[0] = realData[length - 1];
+}
+
+void FFTFrame::doInverseFFT(float* data)
+{
+    unsigned length = unpackedFFTWDataSize(fftSize());
+    float* realData = this->realData();
+    float* imagData = this->imagData();
+
+    // Move the Nyquist component to the location expected by FFTW.
+    realData[length - 1] = imagData[0];
+    imagData[length - 1] = 0;
+    imagData[0] = 0;
+
+    fftwf_execute_split_dft_c2r(m_backwardPlan, realData, imagData, data);
+
+    // Restore the original scaling of the time domain data.
+    // FIXME: if we change the definition of FFTFrame to eliminate the
+    // scale factor then this code will need to change. Also, if this
+    // loop turns out to be hot then we should use SSE or other
+    // intrinsics to accelerate it.
+    float scaleFactor = 1.0 / (2.0 * fftSize());
+    unsigned n = fftSize();
+    for (unsigned i = 0; i < n; ++i)
+        data[i] *= scaleFactor;
+
+    // Move the Nyquist component back to the location expected by the
+    // FFTFrame API.
+    imagData[0] = realData[length - 1];
+}
+
+void FFTFrame::initialize()
+{
+    if (!fftwForwardPlans) {
+        fftwForwardPlans = new fftwf_plan[kMaxFFTPow2Size];
+        fftwBackwardPlans = new fftwf_plan[kMaxFFTPow2Size];
+        for (int i = 0; i < kMaxFFTPow2Size; ++i) {
+            fftwForwardPlans[i] = 0;
+            fftwBackwardPlans[i] = 0;
+        }
+    }
+
+    if (!s_planLock)
+        s_planLock = new Mutex();
+}
+
+void FFTFrame::cleanup()
+{
+    if (!fftwForwardPlans)
+        return;
+
+    for (int i = 0; i < kMaxFFTPow2Size; ++i) {
+        if (fftwForwardPlans[i])
+            fftwf_destroy_plan(fftwForwardPlans[i]);
+        if (fftwBackwardPlans[i])
+            fftwf_destroy_plan(fftwBackwardPlans[i]);
+    }
+
+    delete[] fftwForwardPlans;
+    delete[] fftwBackwardPlans;
+
+    fftwForwardPlans = 0;
+    fftwBackwardPlans = 0;
+    
+    delete s_planLock;
+    s_planLock = 0;
+}
+
+float* FFTFrame::realData() const
+{
+    return const_cast<float*>(m_data.data());
+}
+
+float* FFTFrame::imagData() const
+{
+    // Imaginary data is stored following the real data with enough padding for 16-byte alignment.
+    return const_cast<float*>(realData() + unpackedFFTWDataSize(fftSize()) + 3);
+}
+
+fftwf_plan FFTFrame::fftwPlanForSize(unsigned fftSize, Direction direction,
+                                     float* data1, float* data2, float* data3)
+{
+    // initialize() must be called first.
+    ASSERT(fftwForwardPlans);
+    if (!fftwForwardPlans)
+        return 0;
+        
+    ASSERT(s_planLock);
+    if (!s_planLock)
+        return 0;
+    MutexLocker locker(*s_planLock);    
+        
+    ASSERT(fftSize);
+    int pow2size = static_cast<int>(log2(fftSize));
+    ASSERT(pow2size < kMaxFFTPow2Size);
+    fftwf_plan* plans = (direction == Forward) ? fftwForwardPlans : fftwBackwardPlans;
+    if (!plans[pow2size]) {
+        fftwf_iodim dimension;
+        dimension.n = fftSize;
+        dimension.is = 1;
+        dimension.os = 1;
+
+        // For the time being, we do not take the input data into
+        // account when choosing a plan, so that we can most easily
+        // reuse plans with different input data.
+
+        // FIXME: allocate input and output data inside this class to
+        // be able to take advantage of alignment and SIMD optimizations.
+        unsigned flags = FFTW_ESTIMATE | FFTW_PRESERVE_INPUT | FFTW_UNALIGNED;
+        switch (direction) {
+        case Forward:
+            plans[pow2size] = fftwf_plan_guru_split_dft_r2c(1, &dimension, 0, 0,
+                                                            data1, data2, data3,
+                                                            flags);
+            break;
+        case Backward:
+            plans[pow2size] = fftwf_plan_guru_split_dft_c2r(1, &dimension, 0, 0,
+                                                            data1, data2, data3,
+                                                            flags);
+            break;
+        }
+    }
+    ASSERT(plans[pow2size]);
+    return plans[pow2size];
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUDIO)
diff --git a/Source/WebCore/platform/audio/mac/FFTFrameMac.cpp b/Source/WebCore/platform/audio/mac/FFTFrameMac.cpp
index 0f7efb7..6456da2 100644
--- a/Source/WebCore/platform/audio/mac/FFTFrameMac.cpp
+++ b/Source/WebCore/platform/audio/mac/FFTFrameMac.cpp
@@ -162,6 +162,10 @@ FFTSetup FFTFrame::fftSetupForSize(unsigned fftSize)
     return fftSetups[pow2size];
 }
 
+void FFTFrame::initialize()
+{
+}
+
 void FFTFrame::cleanup()
 {
     if (!fftSetups)
diff --git a/Source/WebCore/platform/audio/mkl/FFTFrameMKL.cpp b/Source/WebCore/platform/audio/mkl/FFTFrameMKL.cpp
index f66a485..3ac6b36 100644
--- a/Source/WebCore/platform/audio/mkl/FFTFrameMKL.cpp
+++ b/Source/WebCore/platform/audio/mkl/FFTFrameMKL.cpp
@@ -200,6 +200,10 @@ void FFTFrame::doInverseFFT(float* data)
     ASSERT(DftiErrorClass(status, DFTI_NO_ERROR));
 }
 
+void FFTFrame::initialize()
+{
+}
+
 void FFTFrame::cleanup()
 {
     if (!descriptorHandles)
diff --git a/Source/WebCore/platform/brew/MIMETypeRegistryBrew.cpp b/Source/WebCore/platform/brew/MIMETypeRegistryBrew.cpp
index 0a538c2..eae4e3b 100644
--- a/Source/WebCore/platform/brew/MIMETypeRegistryBrew.cpp
+++ b/Source/WebCore/platform/brew/MIMETypeRegistryBrew.cpp
@@ -30,6 +30,8 @@
 #include "MIMETypeRegistry.h"
 
 #include "PlatformString.h"
+#include <wtf/Assertions.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore {
 
@@ -63,6 +65,8 @@ static const ExtensionMap extensionMap[] = {
 
 String MIMETypeRegistry::getMIMETypeForExtension(const String &ext)
 {
+    ASSERT(isMainThread());
+
     String str = ext.lower();
 
     const ExtensionMap* e = extensionMap;
diff --git a/Source/WebCore/platform/brew/SystemTimeBrew.cpp b/Source/WebCore/platform/brew/SystemTimeBrew.cpp
index c1e39fb..6e2fe7e 100644
--- a/Source/WebCore/platform/brew/SystemTimeBrew.cpp
+++ b/Source/WebCore/platform/brew/SystemTimeBrew.cpp
@@ -26,15 +26,16 @@
 #include "config.h"
 #include "SystemTime.h"
 
-#include <float.h>
+#include "NotImplemented.h"
+#include <limits>
 
 namespace WebCore {
 
 float userIdleTime()
 {
-    // return an arbitrarily high userIdleTime so that releasing pages from the page cache isn't postponed
-    return FLT_MAX;
-}
-
+    notImplemented();
+    // Return an arbitrarily high userIdleTime so that releasing pages from the page cache isn't postponed.
+    return std::numeric_limits<float>::max();
 }
 
+} // namespace WebCore
diff --git a/Source/WebCore/platform/cf/BinaryPropertyList.cpp b/Source/WebCore/platform/cf/BinaryPropertyList.cpp
index 27b44d4..41769e8 100644
--- a/Source/WebCore/platform/cf/BinaryPropertyList.cpp
+++ b/Source/WebCore/platform/cf/BinaryPropertyList.cpp
@@ -92,7 +92,7 @@ struct IntegerArrayHash {
 
 unsigned IntegerArrayHash::hash(const IntegerArray& array)
 {
-    return StringImpl::computeHash(reinterpret_cast<const UChar*>(array.integers()), array.size() / (sizeof(int) / sizeof(UChar)));
+    return WTF::StringHasher::createBlobHash(array.integers(), array.size());
 }
 
 bool IntegerArrayHash::equal(const IntegerArray& a, const IntegerArray& b)
diff --git a/Source/WebCore/platform/cf/FileSystemCF.cpp b/Source/WebCore/platform/cf/FileSystemCF.cpp
index e3a144c..a4b422b 100644
--- a/Source/WebCore/platform/cf/FileSystemCF.cpp
+++ b/Source/WebCore/platform/cf/FileSystemCF.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -25,12 +25,13 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
+
 #import "config.h"
 #import "FileSystem.h"
 
 #import "PlatformString.h"
-#import <wtf/text/CString.h>
 #import <wtf/RetainPtr.h>
+#import <wtf/text/CString.h>
 
 namespace WebCore {
 
@@ -54,4 +55,16 @@ CString fileSystemRepresentation(const String& path)
     return string;
 }
 
+RetainPtr<CFURLRef> pathAsURL(const String& path)
+{
+    CFURLPathStyle pathStyle;
+#if PLATFORM(WIN)
+    pathStyle = kCFURLWindowsPathStyle;
+#else
+    pathStyle = kCFURLPOSIXPathStyle;
+#endif
+    return RetainPtr<CFURLRef>(AdoptCF, CFURLCreateWithFileSystemPath(0,
+        RetainPtr<CFStringRef>(AdoptCF, path.createCFString()).get(), pathStyle, FALSE));
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/chromium/ChromiumDataObject.cpp b/Source/WebCore/platform/chromium/ChromiumDataObject.cpp
index 78b794b..f5732df 100644
--- a/Source/WebCore/platform/chromium/ChromiumDataObject.cpp
+++ b/Source/WebCore/platform/chromium/ChromiumDataObject.cpp
@@ -56,9 +56,9 @@ PassRefPtr<ChromiumDataObject> ChromiumDataObject::create(PassRefPtr<ChromiumDat
     return adoptRef(new ChromiumDataObject(data));
 }
 
-PassRefPtr<ChromiumDataObject> ChromiumDataObject::createReadable(Clipboard::ClipboardType clipboardType)
+PassRefPtr<ChromiumDataObject> ChromiumDataObject::createReadable(const Frame* frame, Clipboard::ClipboardType clipboardType)
 {
-    return adoptRef(new ChromiumDataObject(ReadableDataObject::create(clipboardType)));
+    return adoptRef(new ChromiumDataObject(ReadableDataObject::create(frame, clipboardType)));
 }
 
 PassRefPtr<ChromiumDataObject> ChromiumDataObject::createWritable(Clipboard::ClipboardType clipboardType)
diff --git a/Source/WebCore/platform/chromium/ChromiumDataObject.h b/Source/WebCore/platform/chromium/ChromiumDataObject.h
index 4aac5c9..919c269 100644
--- a/Source/WebCore/platform/chromium/ChromiumDataObject.h
+++ b/Source/WebCore/platform/chromium/ChromiumDataObject.h
@@ -41,7 +41,7 @@ namespace WebCore {
 class ChromiumDataObject : public RefCounted<ChromiumDataObject> {
 public:
     static PassRefPtr<ChromiumDataObject> create(PassRefPtr<ChromiumDataObjectLegacy> data);
-    static PassRefPtr<ChromiumDataObject> createReadable(Clipboard::ClipboardType);
+    static PassRefPtr<ChromiumDataObject> createReadable(const Frame*, Clipboard::ClipboardType);
     static PassRefPtr<ChromiumDataObject> createWritable(Clipboard::ClipboardType);
 
     void clearData(const String& type);
diff --git a/Source/WebCore/platform/chromium/ClipboardChromium.cpp b/Source/WebCore/platform/chromium/ClipboardChromium.cpp
index 46b4339..d6ba2d2 100644
--- a/Source/WebCore/platform/chromium/ClipboardChromium.cpp
+++ b/Source/WebCore/platform/chromium/ClipboardChromium.cpp
@@ -91,7 +91,7 @@ PassRefPtr<ClipboardChromium> ClipboardChromium::create(ClipboardType clipboardT
     RefPtr<ChromiumDataObject> dataObject =
         policy == ClipboardWritable ?
         ChromiumDataObject::createWritable(clipboardType) :
-        ChromiumDataObject::createReadable(clipboardType);
+        ChromiumDataObject::createReadable(frame, clipboardType);
     return adoptRef(new ClipboardChromium(clipboardType, dataObject, policy, frame));
 }
 
diff --git a/Source/WebCore/platform/chromium/MIMETypeRegistryChromium.cpp b/Source/WebCore/platform/chromium/MIMETypeRegistryChromium.cpp
index fec0e9b..91bfccb 100644
--- a/Source/WebCore/platform/chromium/MIMETypeRegistryChromium.cpp
+++ b/Source/WebCore/platform/chromium/MIMETypeRegistryChromium.cpp
@@ -42,6 +42,17 @@
 
 namespace WebCore {
 
+#if ENABLE(FILE_SYSTEM) && ENABLE(WORKERS)
+String MIMETypeRegistry::getMIMETypeForExtensionThreadSafe(const String &ext)
+{
+    return PlatformBridge::mimeTypeForExtension(ext);
+}
+#endif
+
+// NOTE: We have to define getMIMETypeForExtension() here though the shared
+// implementation has getMIMETypeForExtension() since we don't use the shared
+// implementation bits in MIMETypeRegistry.cpp.
+
 String MIMETypeRegistry::getMIMETypeForExtension(const String &ext)
 {
     return PlatformBridge::mimeTypeForExtension(ext);
diff --git a/Source/WebCore/platform/chromium/PlatformBridge.h b/Source/WebCore/platform/chromium/PlatformBridge.h
index f6a2564..9a09b90 100644
--- a/Source/WebCore/platform/chromium/PlatformBridge.h
+++ b/Source/WebCore/platform/chromium/PlatformBridge.h
@@ -109,9 +109,9 @@ public:
     static void clipboardWriteData(const String& type, const String& data, const String& metadata);
 
     // Interface for handling copy and paste, drag and drop, and selection copy.
-    static HashSet<String> clipboardReadAvailableTypes(PasteboardPrivate::ClipboardBuffer, bool* containsFilenames);
-    static bool clipboardReadData(PasteboardPrivate::ClipboardBuffer, const String& type, String& data, String& metadata);
-    static Vector<String> clipboardReadFilenames(PasteboardPrivate::ClipboardBuffer);
+    static HashSet<String> clipboardReadAvailableTypes(const Frame*, PasteboardPrivate::ClipboardBuffer, bool* containsFilenames);
+    static bool clipboardReadData(const Frame*, PasteboardPrivate::ClipboardBuffer, const String& type, String& data, String& metadata);
+    static Vector<String> clipboardReadFilenames(const Frame*, PasteboardPrivate::ClipboardBuffer);
 
     // Cookies ------------------------------------------------------------
     static void setCookies(const Document*, const KURL&, const String& value);
@@ -171,7 +171,6 @@ public:
 
     // IndexedDB ----------------------------------------------------------
     static PassRefPtr<IDBFactoryBackendInterface> idbFactory();
-    static void idbShutdown();
     // Extracts keyPath from values and returns the corresponding keys.
     static void createIDBKeysFromSerializedValuesAndKeyPath(const Vector<RefPtr<SerializedScriptValue> >& values, const String& keyPath, Vector<RefPtr<IDBKey> >& keys);
 
diff --git a/Source/WebCore/platform/chromium/PopupMenuChromium.cpp b/Source/WebCore/platform/chromium/PopupMenuChromium.cpp
index 075cef0..59441d0 100644
--- a/Source/WebCore/platform/chromium/PopupMenuChromium.cpp
+++ b/Source/WebCore/platform/chromium/PopupMenuChromium.cpp
@@ -32,7 +32,6 @@
 #include "config.h"
 #include "PopupMenuChromium.h"
 
-#include "CharacterNames.h"
 #include "Chrome.h"
 #include "ChromeClientChromium.h"
 #include "Font.h"
@@ -56,8 +55,8 @@
 #include "SystemTime.h"
 #include "TextRun.h"
 #include "UserGestureIndicator.h"
-
 #include <wtf/CurrentTime.h>
+#include <wtf/unicode/CharacterNames.h>
 
 using namespace WTF;
 using namespace Unicode;
@@ -74,17 +73,16 @@ static const int kMaxHeight = 500;
 static const int kBorderSize = 1;
 static const int kTextToLabelPadding = 10;
 static const int kLabelToIconPadding = 5;
+static const int kMinEndOfLinePadding = 2;
 static const TimeStamp kTypeAheadTimeoutMs = 1000;
 
 // The settings used for the drop down menu.
 // This is the delegate used if none is provided.
 static const PopupContainerSettings dropDownSettings = {
-    true,   // setTextOnIndexChange
-    true,   // acceptOnAbandon
-    false,  // loopSelectionNavigation
-    false,  // restrictWidthOfListBox
-    // display item text in its first strong directional character's directionality.
-    PopupContainerSettings::FirstStrongDirectionalCharacterDirection,
+    true, // setTextOnIndexChange
+    true, // acceptOnAbandon
+    false, // loopSelectionNavigation
+    false // restrictWidthOfListBox
 };
 
 // This class uses WebCore code to paint and handle events for a drop-down list
@@ -330,7 +328,7 @@ PopupContainer::~PopupContainer()
         removeChild(m_listBox.get());
 }
 
-IntRect PopupContainer::layoutAndCalculateWidgetRect(int targetControlHeight, const IntPoint& popupInitialCoordinate)
+IntRect PopupContainer::layoutAndCalculateWidgetRect(int targetControlHeight, int popupInitialY)
 {
     // Reset the max height to its default value, it will be recomputed below
     // if necessary.
@@ -350,8 +348,10 @@ IntRect PopupContainer::layoutAndCalculateWidgetRect(int targetControlHeight, co
         // If the popup would extend past the bottom of the screen, open upwards
         // instead.
         FloatRect screen = screenAvailableRect(m_frameView.get());
-        widgetRect = chromeClient->windowToScreen(IntRect(popupInitialCoordinate, targetSize));
-        if (widgetRect.bottom() > static_cast<int>(screen.bottom())) {
+        // Use this::x() for location because RTL position is considered
+        // in layout().
+        widgetRect = chromeClient->windowToScreen(IntRect(x(), popupInitialY, targetSize.width(), targetSize.height()));
+        if (widgetRect.maxY() > static_cast<int>(screen.maxY())) {
             if (widgetRect.y() - widgetRect.height() - targetControlHeight > 0) {
                 // There is enough room to open upwards.
                 widgetRect.move(0, -(widgetRect.height() + targetControlHeight));
@@ -359,7 +359,7 @@ IntRect PopupContainer::layoutAndCalculateWidgetRect(int targetControlHeight, co
                 // Figure whether upwards or downwards has more room and set the
                 // maximum number of items.
                 int spaceAbove = widgetRect.y() - targetControlHeight;
-                int spaceBelow = screen.bottom() - widgetRect.y();
+                int spaceBelow = screen.maxY() - widgetRect.y();
                 if (spaceAbove > spaceBelow)
                     m_listBox->setMaxHeight(spaceAbove);
                 else
@@ -383,7 +383,7 @@ void PopupContainer::showPopup(FrameView* view)
     ChromeClientChromium* chromeClient = chromeClientChromium();
     if (chromeClient) {
         IntRect popupRect = frameRect();
-        chromeClient->popupOpened(this, layoutAndCalculateWidgetRect(popupRect.height(), popupRect.location()), false);
+        chromeClient->popupOpened(this, layoutAndCalculateWidgetRect(popupRect.height(), popupRect.y()), false);
         m_popupOpen = true;
     }
 
@@ -399,34 +399,6 @@ void PopupContainer::showPopup(FrameView* view)
     invalidate();
 }
 
-void PopupContainer::showExternal(const IntRect& rect, FrameView* v, int index)
-{
-    if (!listBox())
-        return;
-
-    listBox()->setBaseWidth(rect.width());
-    listBox()->updateFromElement();
-
-    if (listBox()->numItems() < 1) {
-        hidePopup();
-        return;
-    }
-
-    // Adjust the popup position to account for scrolling.
-    IntPoint location = v->contentsToWindow(rect.location());
-    IntRect popupRect(location, rect.size());
-
-    // Get the ChromeClient and pass it the popup menu's listbox data.
-    m_frameView = v;
-    chromeClientChromium()->popupOpened(this, popupRect, true);
-
-    // The popup sends its "closed" notification through its parent. Set the
-    // parent, even though external popups have no real on-screen widget but a
-    // native menu (see |PopupListBox::hidePopup()|);
-    if (!m_listBox->parent())
-        addChild(m_listBox.get());
-}
-
 void PopupContainer::hidePopup()
 {
     listBox()->hidePopup();
@@ -581,7 +553,7 @@ void PopupContainer::refresh(const IntRect& targetControlRect)
     listBox()->updateFromElement();
     // Store the original height to check if we need to request the location.
     int originalHeight = height();
-    IntRect widgetRect = layoutAndCalculateWidgetRect(targetControlRect.height(), location);
+    IntRect widgetRect = layoutAndCalculateWidgetRect(targetControlRect.height(), location.y());
     if (originalHeight != widgetRect.height())
         setFrameRect(widgetRect);
 
@@ -967,20 +939,15 @@ void PopupListBox::paintRow(GraphicsContext* gc, const IntRect& rect, int rowInd
     }
 
     // Prepare the directionality to draw text.
-    bool rtl = false;
-    if (m_settings.itemTextDirectionalityHint == PopupContainerSettings::DOMElementDirection)
-        rtl = style.textDirection() == RTL;
-    else if (m_settings.itemTextDirectionalityHint ==
-             PopupContainerSettings::FirstStrongDirectionalCharacterDirection)
-        rtl = itemText.defaultWritingDirection() == WTF::Unicode::RightToLeft;
-    TextRun textRun(itemText.characters(), itemText.length(), false, 0, 0, rtl);
+    bool rtl = style.textDirection() == RTL;
+    TextRun textRun(itemText.characters(), itemText.length(), false, 0, 0, TextRun::AllowTrailingExpansion, rtl, style.hasTextDirectionOverride());
     // If the text is right-to-left, make it right-aligned by adjusting its
     // beginning position.
     if (rightAligned)
         textX += maxWidth - itemFont.width(textRun);
 
     // Draw the item text.
-    int textY = rowRect.y() + itemFont.ascent() + (rowRect.height() - itemFont.height()) / 2;
+    int textY = rowRect.y() + itemFont.fontMetrics().ascent() + (rowRect.height() - itemFont.fontMetrics().height()) / 2;
     gc->drawBidiText(itemFont, textRun, IntPoint(textX, textY));
 
     // We are using the left padding as the right padding includes room for the scroll-bar which
@@ -1001,7 +968,7 @@ void PopupListBox::paintRow(GraphicsContext* gc, const IntRect& rect, int rowInd
     // Draw the the label if applicable.
     if (itemLabel.isEmpty())
         return;
-    TextRun labelTextRun(itemLabel.characters(), itemLabel.length(), false, 0, 0, rtl);
+    TextRun labelTextRun(itemLabel.characters(), itemLabel.length(), false, 0, 0, TextRun::AllowTrailingExpansion, rtl, style.hasTextDirectionOverride());
     if (rightAligned)
         textX = max(0, m_popupClient->clientPaddingLeft() - m_popupClient->clientInsetLeft());
     else
@@ -1120,7 +1087,7 @@ int PopupListBox::getRowHeight(int index)
     String icon = m_popupClient->itemIcon(index);
     RefPtr<Image> image(Image::loadPlatformResource(icon.utf8().data()));
 
-    int fontHeight = getRowFont(index).height();
+    int fontHeight = getRowFont(index).fontMetrics().height();
     int iconHeight = (image && !image->isNull()) ? image->rect().height() : 0;
 
     return max(fontHeight, iconHeight);
@@ -1154,9 +1121,9 @@ void PopupListBox::scrollToRevealRow(int index)
     if (rowRect.y() < scrollY()) {
         // Row is above current scroll position, scroll up.
         ScrollView::setScrollPosition(IntPoint(0, rowRect.y()));
-    } else if (rowRect.bottom() > scrollY() + visibleHeight()) {
+    } else if (rowRect.maxY() > scrollY() + visibleHeight()) {
         // Row is below current scroll position, scroll down.
-        ScrollView::setScrollPosition(IntPoint(0, rowRect.bottom() - visibleHeight()));
+        ScrollView::setScrollPosition(IntPoint(0, rowRect.maxY() - visibleHeight()));
     }
 }
 
@@ -1267,6 +1234,9 @@ void PopupListBox::updateFromElement()
             type = PopupItem::TypeOption;
         m_items.append(new PopupItem(m_popupClient->itemText(i), type));
         m_items[i]->enabled = isSelectableItem(i);
+        PopupMenuStyle style = m_popupClient->itemStyle(i);
+        m_items[i]->textDirection = style.textDirection();
+        m_items[i]->hasTextDirectionOverride = style.hasTextDirectionOverride();
     }
 
     m_selectedIndex = m_popupClient->selectedIndex();
@@ -1277,9 +1247,12 @@ void PopupListBox::updateFromElement()
 
 void PopupListBox::layout()
 {
+    bool isRightAligned = m_popupClient->menuStyle().textDirection() == RTL;
+    
     // Size our child items.
     int baseWidth = 0;
     int paddingWidth = 0;
+    int lineEndPaddingWidth = 0;
     int y = 0;
     for (int i = 0; i < numItems(); ++i) {
         // Place the item vertically.
@@ -1312,58 +1285,56 @@ void PopupListBox::layout()
         // FIXME: http://b/1210481 We should get the padding of individual option elements.
         paddingWidth = max(paddingWidth,
             m_popupClient->clientPaddingLeft() + m_popupClient->clientPaddingRight());
+        lineEndPaddingWidth = max(lineEndPaddingWidth,
+            isRightAligned ? m_popupClient->clientPaddingLeft() : m_popupClient->clientPaddingRight());
     }
 
     // Calculate scroll bar width.
     int windowHeight = 0;
-
-#if OS(DARWIN)
-    // Set the popup's window to contain all available items on Mac only, which
-    // uses native controls that manage their own scrolling. This allows hit
-    // testing to work when selecting items in popups that have more menu entries
-    // than the maximum window size.
-    m_visibleRows = numItems();
-#else
     m_visibleRows = min(numItems(), kMaxVisibleRows);
-#endif
 
     for (int i = 0; i < m_visibleRows; ++i) {
         int rowHeight = getRowHeight(i);
 
-#if !OS(DARWIN)
         // Only clip the window height for non-Mac platforms.
         if (windowHeight + rowHeight > m_maxHeight) {
             m_visibleRows = i;
             break;
         }
-#endif
 
         windowHeight += rowHeight;
     }
 
     // Set our widget and scrollable contents sizes.
     int scrollbarWidth = 0;
-    if (m_visibleRows < numItems())
+    if (m_visibleRows < numItems()) {
         scrollbarWidth = ScrollbarTheme::nativeTheme()->scrollbarThickness();
 
+        // Use kMinEndOfLinePadding when there is a scrollbar so that we use
+        // as much as (lineEndPaddingWidth - kMinEndOfLinePadding) padding
+        // space for scrollbar and allow user to use CSS padding to make the
+        // popup listbox align with the select element.
+        paddingWidth = paddingWidth - lineEndPaddingWidth + kMinEndOfLinePadding;
+    }
+
     int windowWidth;
     int contentWidth;
     if (m_settings.restrictWidthOfListBox) {
         windowWidth = m_baseWidth;
-        contentWidth = m_baseWidth - scrollbarWidth - paddingWidth;
+        contentWidth = m_baseWidth - scrollbarWidth;
     } else {
         windowWidth = baseWidth + scrollbarWidth + paddingWidth;
-        contentWidth = baseWidth;
+        contentWidth = baseWidth + paddingWidth;
 
         if (windowWidth < m_baseWidth) {
             windowWidth = m_baseWidth;
-            contentWidth = m_baseWidth - scrollbarWidth - paddingWidth;
+            contentWidth = m_baseWidth - scrollbarWidth;
         } else
             m_baseWidth = baseWidth;
     }
 
     resize(windowWidth, windowHeight);
-    setContentsSize(IntSize(contentWidth, getRowBounds(numItems() - 1).bottom()));
+    setContentsSize(IntSize(contentWidth, getRowBounds(numItems() - 1).maxY()));
 
     if (hostWindow())
         scrollToRevealSelection();
@@ -1404,19 +1375,11 @@ PopupMenuChromium::~PopupMenuChromium()
     hide();
 }
 
-// The Mac Chromium implementation relies on external control (a Cocoa control)
-// to display, handle the input tracking and menu item selection for the popup.
-// Windows and Linux Chromium let our WebKit port handle the display, while
-// another process manages the popup window and input handling.
 void PopupMenuChromium::show(const IntRect& r, FrameView* v, int index)
 {
     if (!p.popup)
         p.popup = PopupContainer::create(client(), PopupContainer::Select, dropDownSettings);
-#if OS(DARWIN)
-    p.popup->showExternal(r, v, index);
-#else
     p.popup->show(r, v, index);
-#endif
 }
 
 void PopupMenuChromium::hide()
diff --git a/Source/WebCore/platform/chromium/PopupMenuChromium.h b/Source/WebCore/platform/chromium/PopupMenuChromium.h
index f326b48..43b8b0e 100644
--- a/Source/WebCore/platform/chromium/PopupMenuChromium.h
+++ b/Source/WebCore/platform/chromium/PopupMenuChromium.h
@@ -65,6 +65,8 @@ struct PopupItem {
     String label;
     Type type;
     int yOffset; // y offset of this item, relative to the top of the popup.
+    TextDirection textDirection;
+    bool hasTextDirectionOverride;
     bool enabled;
 };
 
@@ -97,22 +99,6 @@ struct PopupContainerSettings {
     // Whether we should restrict the width of the PopupListBox or not.
     // Autocomplete popups are restricted, combo-boxes (select tags) aren't.
     bool restrictWidthOfListBox;
-
-    // A hint on the display directionality of the item text in popup menu.
-    //
-    // We could either display the items in the drop-down using its DOM element's
-    // directionality, or we could display the items in the drop-down using heuristics:
-    // such as in its first strong directionality character's direction.
-    // Please refer to the discussion (especially comment #7 and #10) in
-    // https://bugs.webkit.org/show_bug.cgi?id=27889 for details.
-    enum DirectionalityHint {
-        // Use the DOM element's directionality to display the item text in popup menu.
-        DOMElementDirection,
-        // Use the item text's first strong-directional character's directionality
-        // to display the item text in popup menu.
-        FirstStrongDirectionalCharacterDirection,
-    };
-    DirectionalityHint itemTextDirectionalityHint;
 };
 
 class PopupContainer : public FramelessScrollView {
@@ -142,9 +128,6 @@ public:
     // Show the popup
     void showPopup(FrameView*);
 
-    // Used on Mac Chromium for HTML select popup menus.
-    void showExternal(const IntRect&, FrameView*, int index);
-
     // Show the popup in the specified rect for the specified frame.
     // Note: this code was somehow arbitrarily factored-out of the Popup class
     // so WebViewImpl can create a PopupContainer. This method is used for
@@ -194,7 +177,7 @@ private:
     void paintBorder(GraphicsContext*, const IntRect&);
 
     // Layout and calculate popup widget size and location and returns it as IntRect.
-    IntRect layoutAndCalculateWidgetRect(int targetControlHeight, const IntPoint& popupInitialCoordinate);
+    IntRect layoutAndCalculateWidgetRect(int targetControlHeight, int popupInitialY);
 
     // Returns the ChromeClient of the page this popup is associated with.
     ChromeClientChromium* chromeClientChromium();
diff --git a/Source/WebCore/platform/chromium/ReadableDataObject.cpp b/Source/WebCore/platform/chromium/ReadableDataObject.cpp
index dbf4739..484a1b3 100644
--- a/Source/WebCore/platform/chromium/ReadableDataObject.cpp
+++ b/Source/WebCore/platform/chromium/ReadableDataObject.cpp
@@ -43,13 +43,14 @@ static PasteboardPrivate::ClipboardBuffer clipboardBuffer(Clipboard::ClipboardTy
     return clipboardType == Clipboard::DragAndDrop ? PasteboardPrivate::DragBuffer : PasteboardPrivate::StandardBuffer;
 }
 
-PassRefPtr<ReadableDataObject> ReadableDataObject::create(Clipboard::ClipboardType clipboardType)
+PassRefPtr<ReadableDataObject> ReadableDataObject::create(const Frame* frame, Clipboard::ClipboardType clipboardType)
 {
-    return adoptRef(new ReadableDataObject(clipboardType));
+    return adoptRef(new ReadableDataObject(frame, clipboardType));
 }
 
-ReadableDataObject::ReadableDataObject(Clipboard::ClipboardType clipboardType)
-    : m_clipboardType(clipboardType)
+ReadableDataObject::ReadableDataObject(const Frame* frame, Clipboard::ClipboardType clipboardType)
+    : m_frame(frame)
+    , m_clipboardType(clipboardType)
     , m_containsFilenames(false)
     , m_isTypeCacheInitialized(false)
 {
@@ -93,7 +94,7 @@ String ReadableDataObject::getData(const String& type, bool& succeeded) const
         return data;
     }
     succeeded = PlatformBridge::clipboardReadData(
-        clipboardBuffer(m_clipboardType), type, data, ignoredMetadata);
+        m_frame, clipboardBuffer(m_clipboardType), type, data, ignoredMetadata);
     return data;
 }
 
@@ -102,7 +103,7 @@ String ReadableDataObject::urlTitle() const
     String ignoredData;
     String urlTitle;
     PlatformBridge::clipboardReadData(
-        clipboardBuffer(m_clipboardType), mimeTypeTextURIList, ignoredData, urlTitle);
+        m_frame, clipboardBuffer(m_clipboardType), mimeTypeTextURIList, ignoredData, urlTitle);
     return urlTitle;
 }
 
@@ -111,7 +112,7 @@ KURL ReadableDataObject::htmlBaseUrl() const
     String ignoredData;
     String htmlBaseUrl;
     PlatformBridge::clipboardReadData(
-        clipboardBuffer(m_clipboardType), mimeTypeTextHTML, ignoredData, htmlBaseUrl);
+        m_frame, clipboardBuffer(m_clipboardType), mimeTypeTextHTML, ignoredData, htmlBaseUrl);
     return KURL(ParsedURLString, htmlBaseUrl);
 }
 
@@ -123,7 +124,7 @@ bool ReadableDataObject::containsFilenames() const
 
 Vector<String> ReadableDataObject::filenames() const
 {
-    return PlatformBridge::clipboardReadFilenames(clipboardBuffer(m_clipboardType));
+    return PlatformBridge::clipboardReadFilenames(m_frame, clipboardBuffer(m_clipboardType));
 }
 
 void ReadableDataObject::ensureTypeCacheInitialized() const
@@ -132,7 +133,7 @@ void ReadableDataObject::ensureTypeCacheInitialized() const
         return;
 
     m_types = PlatformBridge::clipboardReadAvailableTypes(
-        clipboardBuffer(m_clipboardType), &m_containsFilenames);
+        m_frame, clipboardBuffer(m_clipboardType), &m_containsFilenames);
     m_isTypeCacheInitialized = true;
 }
 
diff --git a/Source/WebCore/platform/chromium/ReadableDataObject.h b/Source/WebCore/platform/chromium/ReadableDataObject.h
index 027e0ed..c6cc310 100644
--- a/Source/WebCore/platform/chromium/ReadableDataObject.h
+++ b/Source/WebCore/platform/chromium/ReadableDataObject.h
@@ -44,7 +44,7 @@ namespace WebCore {
 // browser to the renderer.
 class ReadableDataObject : public RefCounted<ReadableDataObject> {
 public:
-    static PassRefPtr<ReadableDataObject> create(Clipboard::ClipboardType);
+    static PassRefPtr<ReadableDataObject> create(const Frame*, Clipboard::ClipboardType);
 
     bool hasData() const;
     HashSet<String> types() const;
@@ -57,11 +57,14 @@ public:
     Vector<String> filenames() const;
 
 private:
-    explicit ReadableDataObject(Clipboard::ClipboardType);
+    explicit ReadableDataObject(const Frame*, Clipboard::ClipboardType);
 
     // This isn't always const... but most of the time it is.
     void ensureTypeCacheInitialized() const;
 
+    // The owner frame. Used to send IPCs back to the correspdonging view via WebFrameClient.
+    const Frame* m_frame;
+
     Clipboard::ClipboardType m_clipboardType;
 
     // To avoid making a lot of IPC calls for each drag event, we cache some
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromium.cpp b/Source/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
index b23e625..9e700c2 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
@@ -128,7 +128,7 @@ void ScrollbarThemeChromium::paintTickmarks(GraphicsContext* context, Scrollbar*
         const float percent = static_cast<float>(i->y()) / scrollbar->totalSize();
 
         // Calculate how far down (in pixels) the tick-mark should appear.
-        const int yPos = rect.topLeft().y() + (rect.height() * percent);
+        const int yPos = rect.y() + (rect.height() * percent);
 
         IntPoint tick(scrollbar->x(), yPos);
         context->drawImage(dash.get(), ColorSpaceDeviceRGB, tick);
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
index fe1a422..b0ba95d 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
@@ -450,11 +450,11 @@ bool ScrollbarThemeChromiumMac::paint(Scrollbar* scrollbar, GraphicsContext* con
               continue;
 
             // Calculate how far down (in pixels) the tick-mark should appear.
-            const int yPos = static_cast<int>((thumbArea.topLeft().y() + (thumbArea.height() * percent))) & ~1;
+            const int yPos = static_cast<int>((thumbArea.y() + (thumbArea.height() * percent))) & ~1;
 
             // Paint.
             const int indent = 2;
-            FloatRect tickRect(thumbArea.topLeft().x() + indent, yPos, thumbArea.width() - 2 * indent - 1, 2);
+            FloatRect tickRect(thumbArea.x() + indent, yPos, thumbArea.width() - 2 * indent - 1, 2);
             drawingContext->fillRect(tickRect);
             drawingContext->strokeRect(tickRect, 1);
         }
diff --git a/Source/WebCore/platform/efl/MIMETypeRegistryEfl.cpp b/Source/WebCore/platform/efl/MIMETypeRegistryEfl.cpp
index d0c95bf..d883e5d 100644
--- a/Source/WebCore/platform/efl/MIMETypeRegistryEfl.cpp
+++ b/Source/WebCore/platform/efl/MIMETypeRegistryEfl.cpp
@@ -31,6 +31,9 @@
 #include "config.h"
 #include "MIMETypeRegistry.h"
 
+#include <wtf/Assertions.h>
+#include <wtf/MainThread.h>
+
 namespace WebCore {
 
 struct ExtensionMap {
@@ -72,6 +75,8 @@ static const ExtensionMap extensionMap[] = {
 
 String MIMETypeRegistry::getMIMETypeForExtension(const String &ext)
 {
+    ASSERT(isMainThread());
+
     String s = ext.lower();
     const ExtensionMap *e = extensionMap;
     while (e->extension) {
diff --git a/Source/WebCore/platform/efl/RenderThemeEfl.cpp b/Source/WebCore/platform/efl/RenderThemeEfl.cpp
index 9df12e9..9102d17 100644
--- a/Source/WebCore/platform/efl/RenderThemeEfl.cpp
+++ b/Source/WebCore/platform/efl/RenderThemeEfl.cpp
@@ -1043,4 +1043,83 @@ bool RenderThemeEfl::paintProgressBar(RenderObject* o, const PaintInfo& i, const
 }
 #endif
 
+#if ENABLE(VIDEO)
+String RenderThemeEfl::extraMediaControlsStyleSheet()
+{
+    notImplemented();
+    return String();
+}
+
+String RenderThemeEfl::formatMediaControlsCurrentTime(float currentTime, float duration) const
+{
+    notImplemented();
+    return String();
+}
+
+bool RenderThemeEfl::paintMediaFullscreenButton(RenderObject* renderObject, const PaintInfo& paintInfo, const IntRect& rect)
+{
+    notImplemented();
+    return false;
+}
+
+bool RenderThemeEfl::paintMediaMuteButton(RenderObject* renderObject, const PaintInfo& paintInfo, const IntRect& rect)
+{
+    notImplemented();
+    return false;
+}
+
+bool RenderThemeEfl::paintMediaPlayButton(RenderObject* renderObject, const PaintInfo& paintInfo, const IntRect& rect)
+{
+    notImplemented();
+    return false;
+}
+
+bool RenderThemeEfl::paintMediaSeekBackButton(RenderObject* renderObject, const PaintInfo& paintInfo, const IntRect& rect)
+{
+    notImplemented();
+    return false;
+}
+
+bool RenderThemeEfl::paintMediaSeekForwardButton(RenderObject* renderObject, const PaintInfo& paintInfo, const IntRect& rect)
+{
+    notImplemented();
+    return false;
+}
+
+bool RenderThemeEfl::paintMediaSliderTrack(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
+{
+    notImplemented();
+    return false;
+}
+
+bool RenderThemeEfl::paintMediaSliderThumb(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
+{
+    notImplemented();
+    return false;
+}
+
+bool RenderThemeEfl::paintMediaVolumeSliderContainer(RenderObject*, const PaintInfo& paintInfo, const IntRect& rect)
+{
+    notImplemented();
+    return false;
+}
+
+bool RenderThemeEfl::paintMediaVolumeSliderTrack(RenderObject* renderObject, const PaintInfo& paintInfo, const IntRect& rect)
+{
+    notImplemented();
+    return false;
+}
+
+bool RenderThemeEfl::paintMediaVolumeSliderThumb(RenderObject* renderObject, const PaintInfo& paintInfo, const IntRect& rect)
+{
+    notImplemented();
+    return false;
+}
+
+bool RenderThemeEfl::paintMediaCurrentTime(RenderObject* renderObject, const PaintInfo& paintInfo, const IntRect& rect)
+{
+    notImplemented();
+    return false;
+}
+#endif
 }
diff --git a/Source/WebCore/platform/efl/RenderThemeEfl.h b/Source/WebCore/platform/efl/RenderThemeEfl.h
index 087e2aa..d4887cf 100644
--- a/Source/WebCore/platform/efl/RenderThemeEfl.h
+++ b/Source/WebCore/platform/efl/RenderThemeEfl.h
@@ -153,6 +153,23 @@ public:
     virtual bool paintProgressBar(RenderObject*, const PaintInfo&, const IntRect&);
 #endif
 
+#if ENABLE(VIDEO)
+    virtual String extraMediaControlsStyleSheet();
+    virtual String formatMediaControlsCurrentTime(float currentTime, float duration) const;
+
+    virtual bool paintMediaFullscreenButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaPlayButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaMuteButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSeekBackButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSeekForwardButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaVolumeSliderContainer(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaVolumeSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaVolumeSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaCurrentTime(RenderObject*, const PaintInfo&, const IntRect&);
+#endif
+
 protected:
     static float defaultFontSize;
 
diff --git a/Source/WebCore/platform/efl/SystemTimeEfl.cpp b/Source/WebCore/platform/efl/SystemTimeEfl.cpp
index de8c87c..ec6d662 100644
--- a/Source/WebCore/platform/efl/SystemTimeEfl.cpp
+++ b/Source/WebCore/platform/efl/SystemTimeEfl.cpp
@@ -28,7 +28,9 @@
 #include "config.h"
 #include "SystemTime.h"
 
+#include "NotImplemented.h"
 #include <Ecore.h>
+#include <limits>
 
 namespace WebCore {
 
@@ -37,4 +39,11 @@ double currentTime()
     return ecore_time_get();
 }
 
+float userIdleTime()
+{
+    notImplemented();
+    // Return an arbitrarily high userIdleTime so that releasing pages from the page cache isn't postponed.
+    return std::numeric_limits<float>::max();
 }
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/efl/TemporaryLinkStubs.cpp b/Source/WebCore/platform/efl/TemporaryLinkStubs.cpp
index ef6e6f7..07ea2e6 100644
--- a/Source/WebCore/platform/efl/TemporaryLinkStubs.cpp
+++ b/Source/WebCore/platform/efl/TemporaryLinkStubs.cpp
@@ -56,12 +56,6 @@ String signedPublicKeyAndChallengeString(unsigned keySizeIndex, const String &ch
     return String();
 }
 
-float userIdleTime()
-{
-    notImplemented();
-    return FLT_MAX;
-}
-
 void setCookieStoragePrivateBrowsingEnabled(bool)
 {
     notImplemented();
diff --git a/Source/WebCore/platform/graphics/ANGLEWebKitBridge.cpp b/Source/WebCore/platform/graphics/ANGLEWebKitBridge.cpp
index f416b47..9e64904 100644
--- a/Source/WebCore/platform/graphics/ANGLEWebKitBridge.cpp
+++ b/Source/WebCore/platform/graphics/ANGLEWebKitBridge.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "ANGLEWebKitBridge.h"
 #include <wtf/OwnArrayPtr.h>
@@ -93,7 +93,7 @@ bool ANGLEWebKitBridge::validateShaderSource(const char* shaderSource, ANGLEShad
         int logSize = 0;
         ShGetInfo(compiler, SH_INFO_LOG_LENGTH, &logSize);
         if (logSize > 1) {
-            OwnArrayPtr<char> logBuffer(new char[logSize]);
+            OwnArrayPtr<char> logBuffer = adoptArrayPtr(new char[logSize]);
             if (logBuffer) {
                 ShGetInfoLog(compiler, logBuffer.get());
                 shaderValidationLog = logBuffer.get();
@@ -105,7 +105,7 @@ bool ANGLEWebKitBridge::validateShaderSource(const char* shaderSource, ANGLEShad
     int translationLength = 0;
     ShGetInfo(compiler, SH_OBJECT_CODE_LENGTH, &translationLength);
     if (translationLength > 1) {
-        OwnArrayPtr<char> translationBuffer(new char[translationLength]);
+        OwnArrayPtr<char> translationBuffer = adoptArrayPtr(new char[translationLength]);
         if (!translationBuffer)
             return false;
         ShGetObjectCode(compiler, translationBuffer.get());
@@ -117,4 +117,4 @@ bool ANGLEWebKitBridge::validateShaderSource(const char* shaderSource, ANGLEShad
 
 }
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/ContextShadow.h b/Source/WebCore/platform/graphics/ContextShadow.h
index a1fba5c..c0571f0 100644
--- a/Source/WebCore/platform/graphics/ContextShadow.h
+++ b/Source/WebCore/platform/graphics/ContextShadow.h
@@ -68,6 +68,8 @@ typedef void* PlatformContext;
 // This class should be copyable since GraphicsContextQt keeps a stack of
 // the shadow state for savePlatformState and restorePlatformState.
 
+// This class is Deprecated. Platforms should migrate to ShadowBlur.
+
 class ContextShadow {
 public:
     enum {
diff --git a/Source/WebCore/platform/graphics/Extensions3D.h b/Source/WebCore/platform/graphics/Extensions3D.h
index 1a2b7a1..6d6efe5 100644
--- a/Source/WebCore/platform/graphics/Extensions3D.h
+++ b/Source/WebCore/platform/graphics/Extensions3D.h
@@ -52,6 +52,7 @@ public:
     //   GL_ANGLE_framebuffer_blit / GL_ANGLE_framebuffer_multisample
     //   GL_OES_texture_float
     //   GL_OES_standard_derivatives
+    //   GL_OES_rgb8_rgba8
 
     // Takes full name of extension; for example,
     // "GL_EXT_texture_format_BGRA8888".
@@ -87,6 +88,10 @@ public:
 
         // GL_OES_standard_derivatives names
         FRAGMENT_SHADER_DERIVATIVE_HINT_OES = 0x8B8B,
+
+        // GL_OES_rgb8_rgba8 names
+        RGB8_OES = 0x8051,
+        RGBA8_OES = 0x8058,
     };
 
     // GL_ARB_robustness
diff --git a/Source/WebCore/platform/graphics/FloatQuad.h b/Source/WebCore/platform/graphics/FloatQuad.h
index 6cd86f6..e913723 100644
--- a/Source/WebCore/platform/graphics/FloatQuad.h
+++ b/Source/WebCore/platform/graphics/FloatQuad.h
@@ -54,9 +54,9 @@ public:
 
     FloatQuad(const FloatRect& inRect)
         : m_p1(inRect.location())
-        , m_p2(inRect.right(), inRect.y())
-        , m_p3(inRect.right(), inRect.bottom())
-        , m_p4(inRect.x(), inRect.bottom())
+        , m_p2(inRect.maxX(), inRect.y())
+        , m_p3(inRect.maxX(), inRect.maxY())
+        , m_p4(inRect.x(), inRect.maxY())
     {
     }
 
diff --git a/Source/WebCore/platform/graphics/FloatRect.cpp b/Source/WebCore/platform/graphics/FloatRect.cpp
index 0d8a24e..36f3d3a 100644
--- a/Source/WebCore/platform/graphics/FloatRect.cpp
+++ b/Source/WebCore/platform/graphics/FloatRect.cpp
@@ -51,22 +51,22 @@ bool FloatRect::intersects(const FloatRect& other) const
 {
     // Checking emptiness handles negative widths as well as zero.
     return !isEmpty() && !other.isEmpty()
-        && x() < other.right() && other.x() < right()
-        && y() < other.bottom() && other.y() < bottom();
+        && x() < other.maxX() && other.x() < maxX()
+        && y() < other.maxY() && other.y() < maxY();
 }
 
 bool FloatRect::contains(const FloatRect& other) const
 {
-    return x() <= other.x() && right() >= other.right()
-        && y() <= other.y() && bottom() >= other.bottom();
+    return x() <= other.x() && maxX() >= other.maxX()
+        && y() <= other.y() && maxY() >= other.maxY();
 }
 
 void FloatRect::intersect(const FloatRect& other)
 {
     float l = max(x(), other.x());
     float t = max(y(), other.y());
-    float r = min(right(), other.right());
-    float b = min(bottom(), other.bottom());
+    float r = min(maxX(), other.maxX());
+    float b = min(maxY(), other.maxY());
 
     // Return a clean empty rectangle for non-intersecting cases.
     if (l >= r || t >= b) {
@@ -91,8 +91,8 @@ void FloatRect::unite(const FloatRect& other)
 
     float l = min(x(), other.x());
     float t = min(y(), other.y());
-    float r = max(right(), other.right());
-    float b = max(bottom(), other.bottom());
+    float r = max(maxX(), other.maxX());
+    float b = max(maxY(), other.maxY());
 
     setLocationAndSizeFromEdges(l, t, r, b);
 }
@@ -180,8 +180,8 @@ IntRect enclosingIntRect(const FloatRect& rect)
 {
     float left = floorf(rect.x());
     float top = floorf(rect.y());
-    float width = ceilf(rect.right()) - left;
-    float height = ceilf(rect.bottom()) - top;
+    float width = ceilf(rect.maxX()) - left;
+    float height = ceilf(rect.maxY()) - top;
     return IntRect(safeFloatToInt(left), safeFloatToInt(top), 
                    safeFloatToInt(width), safeFloatToInt(height));
 }
diff --git a/Source/WebCore/platform/graphics/FloatRect.h b/Source/WebCore/platform/graphics/FloatRect.h
index 10ad838..733f7cc 100644
--- a/Source/WebCore/platform/graphics/FloatRect.h
+++ b/Source/WebCore/platform/graphics/FloatRect.h
@@ -90,6 +90,8 @@ public:
 
     float x() const { return m_location.x(); }
     float y() const { return m_location.y(); }
+    float maxX() const { return x() + width(); }
+    float maxY() const { return y() + height(); }
     float width() const { return m_size.width(); }
     float height() const { return m_size.height(); }
 
@@ -100,11 +102,6 @@ public:
 
     bool isEmpty() const { return m_size.isEmpty(); }
 
-    float left() const { return x(); }
-    float right() const { return x() + width(); }
-    float top() const { return y(); }
-    float bottom() const { return y() + height(); }
-
     FloatPoint center() const { return FloatPoint(x() + width() / 2, y() + height() / 2); }
 
     void move(const FloatSize& delta) { m_location += delta; } 
@@ -119,10 +116,9 @@ public:
     // Note, this doesn't match what IntRect::contains(IntPoint&) does; the int version
     // is really checking for containment of 1x1 rect, but that doesn't make sense with floats.
     bool contains(float px, float py) const
-        { return px >= x() && px <= right() && py >= y() && py <= bottom(); }
+        { return px >= x() && px <= maxX() && py >= y() && py <= maxY(); }
     bool contains(const FloatPoint& point) const { return contains(point.x(), point.y()); }
 
-
     void inflateX(float dx) {
         m_location.setX(m_location.x() - dx);
         m_size.setWidth(m_size.width() + dx + dx);
diff --git a/Source/WebCore/platform/graphics/Font.cpp b/Source/WebCore/platform/graphics/Font.cpp
index 394de35..6bdddfc 100644
--- a/Source/WebCore/platform/graphics/Font.cpp
+++ b/Source/WebCore/platform/graphics/Font.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2006, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2010, 2011 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -247,21 +247,15 @@ bool Font::isSVGFont() const
 }
 #endif
 
-String Font::normalizeSpaces(const String& string)
+String Font::normalizeSpaces(const UChar* characters, unsigned length)
 {
-    const UChar* characters = string.characters();
-    unsigned length = string.length();
-    Vector<UChar, 256> buffer(length);
-    bool didReplacement = false;
-
-    for (unsigned i = 0; i < length; ++i) {
-        UChar originalCharacter = characters[i];
-        buffer[i] = normalizeSpaces(originalCharacter);
-        if (buffer[i] != originalCharacter)
-            didReplacement = true;
-    }
+    UChar* buffer;
+    String normalized = String::createUninitialized(length, buffer);
+
+    for (unsigned i = 0; i < length; ++i)
+        buffer[i] = normalizeSpaces(characters[i]);
 
-    return didReplacement ? String(buffer.data(), length) : string;
+    return normalized;
 }
 
 static bool shouldUseFontSmoothing = true;
@@ -293,7 +287,7 @@ Font::CodePath Font::codePath(const TextRun& run) const
         return s_codePath;
 
 #if PLATFORM(QT)
-    if (run.padding() || run.rtl() || isSmallCaps() || wordSpacing() || letterSpacing())
+    if (run.expansion() || run.rtl() || isSmallCaps() || wordSpacing() || letterSpacing())
         return Complex;
 #endif
 
@@ -458,6 +452,56 @@ bool Font::isCJKIdeographOrSymbol(UChar32 c)
     return isCJKIdeograph(c);
 }
 
+unsigned Font::expansionOpportunityCount(const UChar* characters, size_t length, TextDirection direction, bool& isAfterExpansion)
+{
+    static bool expandAroundIdeographs = canExpandAroundIdeographsInComplexText();
+    unsigned count = 0;
+    if (direction == LTR) {
+        for (size_t i = 0; i < length; ++i) {
+            UChar32 character = characters[i];
+            if (treatAsSpace(character)) {
+                count++;
+                isAfterExpansion = true;
+                continue;
+            }
+            if (U16_IS_LEAD(character) && i + 1 < length && U16_IS_TRAIL(characters[i + 1])) {
+                character = U16_GET_SUPPLEMENTARY(character, characters[i + 1]);
+                i++;
+            }
+            if (expandAroundIdeographs && isCJKIdeographOrSymbol(character)) {
+                if (!isAfterExpansion)
+                    count++;
+                count++;
+                isAfterExpansion = true;
+                continue;
+            }
+            isAfterExpansion = false;
+        }
+    } else {
+        for (size_t i = length; i > 0; --i) {
+            UChar32 character = characters[i - 1];
+            if (treatAsSpace(character)) {
+                count++;
+                isAfterExpansion = true;
+                continue;
+            }
+            if (U16_IS_TRAIL(character) && i > 1 && U16_IS_LEAD(characters[i - 2])) {
+                character = U16_GET_SUPPLEMENTARY(characters[i - 2], character);
+                i--;
+            }
+            if (expandAroundIdeographs && isCJKIdeographOrSymbol(character)) {
+                if (!isAfterExpansion)
+                    count++;
+                count++;
+                isAfterExpansion = true;
+                continue;
+            }
+            isAfterExpansion = false;
+        }
+    }
+    return count;
+}
+
 bool Font::canReceiveTextEmphasis(UChar32 c)
 {
     CharCategory category = Unicode::category(c);
diff --git a/Source/WebCore/platform/graphics/Font.h b/Source/WebCore/platform/graphics/Font.h
index 2957c0a..258240b 100644
--- a/Source/WebCore/platform/graphics/Font.h
+++ b/Source/WebCore/platform/graphics/Font.h
@@ -2,7 +2,7 @@
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2006, 2007, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2007, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Holger Hans Peter Freyther
  *
  * This library is free software; you can redistribute it and/or
@@ -25,14 +25,15 @@
 #ifndef Font_h
 #define Font_h
 
-#include "CharacterNames.h"
 #include "FontDescription.h"
 #include "FontFallbackList.h"
 #include "SimpleFontData.h"
+#include "TextDirection.h"
 #include "TypesettingFeatures.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/MathExtras.h>
+#include <wtf/unicode/CharacterNames.h>
 
 #if PLATFORM(QT)
 #include <QFont>
@@ -43,7 +44,7 @@ namespace WebCore {
 class FloatPoint;
 class FloatRect;
 class FontData;
-class FontFallbackList;
+class FontMetrics;
 class FontPlatformData;
 class FontSelector;
 class GlyphBuffer;
@@ -54,8 +55,6 @@ class TextRun;
 
 struct GlyphData;
 
-const unsigned defaultUnitsPerEm = 1000;
-
 struct GlyphOverflow {
     GlyphOverflow()
         : left(0)
@@ -124,17 +123,12 @@ public:
 
     bool italic() const { return m_fontDescription.italic(); }
     FontWeight weight() const { return m_fontDescription.weight(); }
+    FontWidthVariant widthVariant() const { return m_fontDescription.widthVariant(); }
 
     bool isPlatformFont() const { return m_isPlatformFont; }
 
     // Metrics that we query the FontFallbackList for.
-    int ascent(FontBaseline baselineType = AlphabeticBaseline) const { return primaryFont()->ascent(baselineType); }
-    int descent(FontBaseline baselineType = AlphabeticBaseline) const { return primaryFont()->descent(baselineType); }
-    int height() const { return ascent() + descent(); }
-    int lineSpacing() const { return primaryFont()->lineSpacing(); }
-    int lineGap() const { return primaryFont()->lineGap(); }
-    float xHeight() const { return primaryFont()->xHeight(); }
-    unsigned unitsPerEm() const { return primaryFont()->unitsPerEm(); }
+    const FontMetrics& fontMetrics() const { return primaryFont()->fontMetrics(); }
     int spaceWidth() const { return (int)ceilf(primaryFont()->adjustedSpaceWidth() + m_letterSpacing); }
     float tabWidth(const SimpleFontData& fontData) const { return 8 * ceilf(fontData.adjustedSpaceWidth() + letterSpacing()); }
     int emphasisMarkAscent(const AtomicString&) const;
@@ -150,7 +144,9 @@ public:
 
     static bool isCJKIdeograph(UChar32);
     static bool isCJKIdeographOrSymbol(UChar32);
-    
+
+    static unsigned expansionOpportunityCount(const UChar*, size_t length, TextDirection, bool& isAfterExpansion);
+
 #if PLATFORM(QT)
     QFont font() const;
 #endif
@@ -185,6 +181,7 @@ private:
     bool getEmphasisMarkGlyphData(const AtomicString&, GlyphData&) const;
 
     static bool canReturnFallbackFontsForComplexText();
+    static bool canExpandAroundIdeographsInComplexText();
 
     CodePath codePath(const TextRun&) const;
 
@@ -226,7 +223,7 @@ public:
         return character;
     }
 
-    static String normalizeSpaces(const String&);
+    static String normalizeSpaces(const UChar*, unsigned length);
 
 #if ENABLE(SVG_FONTS)
     bool isSVGFont() const;
diff --git a/Source/WebCore/platform/graphics/FontCache.cpp b/Source/WebCore/platform/graphics/FontCache.cpp
index cfca980..ca82ebd 100644
--- a/Source/WebCore/platform/graphics/FontCache.cpp
+++ b/Source/WebCore/platform/graphics/FontCache.cpp
@@ -57,7 +57,7 @@ struct FontPlatformDataCacheKey {
     WTF_MAKE_FAST_ALLOCATED;
 public:
     FontPlatformDataCacheKey(const AtomicString& family = AtomicString(), unsigned size = 0, unsigned weight = 0, bool italic = false,
-                             bool isPrinterFont = false, FontRenderingMode renderingMode = NormalRenderingMode, FontOrientation orientation = Horizontal)
+                             bool isPrinterFont = false, FontRenderingMode renderingMode = NormalRenderingMode, FontOrientation orientation = Horizontal, FontWidthVariant widthVariant = RegularWidth)
         : m_size(size)
         , m_weight(weight)
         , m_family(family)
@@ -65,6 +65,7 @@ public:
         , m_printerFont(isPrinterFont)
         , m_renderingMode(renderingMode)
         , m_orientation(orientation)
+        , m_widthVariant(widthVariant)
     {
     }
 
@@ -75,7 +76,7 @@ public:
     {
         return equalIgnoringCase(m_family, other.m_family) && m_size == other.m_size && 
                m_weight == other.m_weight && m_italic == other.m_italic && m_printerFont == other.m_printerFont &&
-               m_renderingMode == other.m_renderingMode && m_orientation == other.m_orientation;
+               m_renderingMode == other.m_renderingMode && m_orientation == other.m_orientation && m_widthVariant == other.m_widthVariant;
     }
 
     unsigned m_size;
@@ -85,6 +86,7 @@ public:
     bool m_printerFont;
     FontRenderingMode m_renderingMode;
     FontOrientation m_orientation;
+    FontWidthVariant m_widthVariant;
 
 private:
     static unsigned hashTableDeletedSize() { return 0xFFFFFFFFU; }
@@ -92,10 +94,11 @@ private:
 
 inline unsigned computeHash(const FontPlatformDataCacheKey& fontKey)
 {
-    unsigned hashCodes[4] = {
+    unsigned hashCodes[5] = {
         CaseFoldingHash::hash(fontKey.m_family),
         fontKey.m_size,
         fontKey.m_weight,
+        fontKey.m_widthVariant,
         static_cast<unsigned>(fontKey.m_orientation) << 3 | static_cast<unsigned>(fontKey.m_italic) << 2 | static_cast<unsigned>(fontKey.m_printerFont) << 1 | static_cast<unsigned>(fontKey.m_renderingMode)
     };
     return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
@@ -195,7 +198,7 @@ FontPlatformData* FontCache::getCachedFontPlatformData(const FontDescription& fo
     }
 
     FontPlatformDataCacheKey key(familyName, fontDescription.computedPixelSize(), fontDescription.weight(), fontDescription.italic(),
-                                 fontDescription.usePrinterFont(), fontDescription.renderingMode(), fontDescription.orientation());
+                                 fontDescription.usePrinterFont(), fontDescription.renderingMode(), fontDescription.orientation(), fontDescription.widthVariant());
     FontPlatformData* result = 0;
     bool foundResult;
     FontPlatformDataCache::iterator it = gFontPlatformDataCache->find(key);
diff --git a/Source/WebCore/platform/graphics/FontDescription.h b/Source/WebCore/platform/graphics/FontDescription.h
index 12900bf..283d297 100644
--- a/Source/WebCore/platform/graphics/FontDescription.h
+++ b/Source/WebCore/platform/graphics/FontDescription.h
@@ -30,6 +30,7 @@
 #include "FontRenderingMode.h"
 #include "FontSmoothingMode.h"
 #include "FontTraitsMask.h"
+#include "FontWidthVariant.h"
 #include "TextRenderingMode.h"
 
 namespace WebCore {
@@ -57,6 +58,7 @@ public:
         : m_specifiedSize(0)
         , m_computedSize(0)
         , m_orientation(Horizontal)
+        , m_widthVariant(RegularWidth)
         , m_italic(false)
         , m_smallCaps(false)
         , m_isAbsoluteSize(false)
@@ -97,6 +99,7 @@ public:
     FontTraitsMask traitsMask() const;
     bool isSpecifiedFont() const { return m_isSpecifiedFont; }
     FontOrientation orientation() const { return m_orientation; }
+    FontWidthVariant widthVariant() const { return m_widthVariant; }
 
     void setFamily(const FontFamily& family) { m_familyList = family; }
     void setComputedSize(float s) { m_computedSize = s; }
@@ -117,6 +120,7 @@ public:
     void setTextRenderingMode(TextRenderingMode rendering) { m_textRendering = rendering; }
     void setIsSpecifiedFont(bool isSpecifiedFont) { m_isSpecifiedFont = isSpecifiedFont; }
     void setOrientation(FontOrientation orientation) { m_orientation = orientation; }
+    void setWidthVariant(FontWidthVariant widthVariant) { m_widthVariant = widthVariant; }
 
 private:
     FontFamily m_familyList; // The list of font families to be used.
@@ -126,6 +130,8 @@ private:
     float m_computedSize;    // Computed size adjusted for the minimum font size and the zoom factor.  
 
     FontOrientation m_orientation;
+    
+    FontWidthVariant m_widthVariant;
 
     bool m_italic : 1;
     bool m_smallCaps : 1;
@@ -162,7 +168,8 @@ inline bool FontDescription::operator==(const FontDescription& other) const
         && m_fontSmoothing == other.m_fontSmoothing
         && m_textRendering == other.m_textRendering
         && m_isSpecifiedFont == other.m_isSpecifiedFont
-        && m_orientation == other.m_orientation;
+        && m_orientation == other.m_orientation
+        && m_widthVariant == other.m_widthVariant;
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/FontFastPath.cpp b/Source/WebCore/platform/graphics/FontFastPath.cpp
index f927c13..034ac22 100644
--- a/Source/WebCore/platform/graphics/FontFastPath.cpp
+++ b/Source/WebCore/platform/graphics/FontFastPath.cpp
@@ -23,7 +23,6 @@
 #include "config.h"
 #include "Font.h"
 
-#include "CharacterNames.h"
 #include "FloatRect.h"
 #include "FontCache.h"
 #include "FontFallbackList.h"
@@ -32,8 +31,8 @@
 #include "SimpleFontData.h"
 #include "TextRun.h"
 #include "WidthIterator.h"
-
 #include <wtf/MathExtras.h>
+#include <wtf/unicode/CharacterNames.h>
 #include <wtf/unicode/Unicode.h>
 
 using namespace WTF;
@@ -252,7 +251,7 @@ int Font::emphasisMarkAscent(const AtomicString& mark) const
     if (!markFontData)
         return 0;
 
-    return markFontData->ascent();
+    return markFontData->fontMetrics().ascent();
 }
 
 int Font::emphasisMarkDescent(const AtomicString& mark) const
@@ -266,7 +265,7 @@ int Font::emphasisMarkDescent(const AtomicString& mark) const
     if (!markFontData)
         return 0;
 
-    return markFontData->descent();
+    return markFontData->fontMetrics().descent();
 }
 
 int Font::emphasisMarkHeight(const AtomicString& mark) const
@@ -280,7 +279,7 @@ int Font::emphasisMarkHeight(const AtomicString& mark) const
     if (!markFontData)
         return 0;
 
-    return markFontData->height();
+    return markFontData->fontMetrics().height();
 }
 
 float Font::getGlyphsAndAdvancesForSimpleText(const TextRun& run, int from, int to, GlyphBuffer& glyphBuffer, ForTextEmphasisOrNot forTextEmphasis) const
@@ -414,8 +413,8 @@ float Font::floatWidthForSimpleText(const TextRun& run, GlyphBuffer* glyphBuffer
     it.advance(run.length(), glyphBuffer);
 
     if (glyphOverflow) {
-        glyphOverflow->top = max<int>(glyphOverflow->top, ceilf(-it.minGlyphBoundingBoxY()) - ascent());
-        glyphOverflow->bottom = max<int>(glyphOverflow->bottom, ceilf(it.maxGlyphBoundingBoxY()) - descent());
+        glyphOverflow->top = max<int>(glyphOverflow->top, ceilf(-it.minGlyphBoundingBoxY()) - fontMetrics().ascent());
+        glyphOverflow->bottom = max<int>(glyphOverflow->bottom, ceilf(it.maxGlyphBoundingBoxY()) - fontMetrics().descent());
         glyphOverflow->left = ceilf(it.firstGlyphOverflow());
         glyphOverflow->right = ceilf(it.lastGlyphOverflow());
     }
diff --git a/Source/WebCore/platform/graphics/FontMetrics.h b/Source/WebCore/platform/graphics/FontMetrics.h
new file mode 100644
index 0000000..89c5545
--- /dev/null
+++ b/Source/WebCore/platform/graphics/FontMetrics.h
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) Research In Motion Limited 2010-2011. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef FontMetrics_h
+#define FontMetrics_h
+
+#include <wtf/MathExtras.h>
+
+namespace WebCore {
+
+const unsigned gDefaultUnitsPerEm = 1000;
+
+class FontMetrics {
+public:
+    FontMetrics()
+        : m_unitsPerEm(gDefaultUnitsPerEm)
+        , m_ascent(0)
+        , m_descent(0)
+        , m_lineGap(0)
+        , m_lineSpacing(0)
+        , m_xHeight(0)
+    {
+    }
+
+    unsigned unitsPerEm() const { return m_unitsPerEm; }
+    void setUnitsPerEm(unsigned unitsPerEm) { m_unitsPerEm = unitsPerEm; }
+
+    float floatAscent(FontBaseline baselineType = AlphabeticBaseline) const
+    {
+        if (baselineType == AlphabeticBaseline)
+            return m_ascent;
+        return floatHeight() / 2;
+    }
+
+    void setAscent(float ascent) { m_ascent = ascent; }
+
+    float floatDescent(FontBaseline baselineType = AlphabeticBaseline) const
+    {
+        if (baselineType == AlphabeticBaseline)
+            return m_descent;
+        return floatHeight() / 2;
+    }
+
+    void setDescent(float descent) { m_descent = descent; }
+
+    float floatHeight(FontBaseline baselineType = AlphabeticBaseline) const
+    {
+        return floatAscent(baselineType) + floatDescent(baselineType);
+    }
+
+    float floatLineGap() const { return m_lineGap; }
+    void setLineGap(float lineGap) { m_lineGap = lineGap; }
+
+    float floatLineSpacing() const { return m_lineSpacing; }
+    void setLineSpacing(float lineSpacing) { m_lineSpacing = lineSpacing; }
+
+    float xHeight() const { return m_xHeight; }
+    void setXHeight(float xHeight) { m_xHeight = xHeight; }
+
+    // Integer variants of certain metrics, used for HTML rendering.
+    int ascent(FontBaseline baselineType = AlphabeticBaseline) const
+    {
+        if (baselineType == AlphabeticBaseline)
+            return lroundf(m_ascent);
+        return height() - height() / 2;
+    }
+
+    int descent(FontBaseline baselineType = AlphabeticBaseline) const
+    {
+        if (baselineType == AlphabeticBaseline)
+            return lroundf(m_descent);
+        return height() / 2;
+    }
+
+    int height(FontBaseline baselineType = AlphabeticBaseline) const
+    {
+        return ascent(baselineType) + descent(baselineType);
+    }
+
+    int lineGap() const { return lroundf(m_lineGap); }
+    int lineSpacing() const { return lroundf(m_lineSpacing); }
+
+private:
+    friend class SimpleFontData;
+
+    void reset()
+    {
+        m_unitsPerEm = gDefaultUnitsPerEm;
+        m_ascent = 0;
+        m_descent = 0;
+        m_lineGap = 0;
+        m_lineSpacing = 0;
+        m_xHeight = 0;
+    }
+
+    unsigned m_unitsPerEm;
+    float m_ascent;
+    float m_descent;
+    float m_lineGap;
+    float m_lineSpacing;
+    float m_xHeight;
+};
+
+} // namespace WebCore
+
+#endif // FontMetrics_h
diff --git a/Source/WebCore/platform/graphics/FontWidthVariant.h b/Source/WebCore/platform/graphics/FontWidthVariant.h
new file mode 100644
index 0000000..bbc98ee
--- /dev/null
+++ b/Source/WebCore/platform/graphics/FontWidthVariant.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef FontWidthVariant_h
+#define FontWidthVariant_h
+
+namespace WebCore {
+
+enum FontWidthVariant { RegularWidth, HalfWidth, ThirdWidth, QuarterWidth };
+
+} // namespace WebCore
+
+#endif // FontWidthVariant_h
diff --git a/Source/WebCore/platform/graphics/GlyphBuffer.h b/Source/WebCore/platform/graphics/GlyphBuffer.h
index 6f1fe7b..7aac1e3 100644
--- a/Source/WebCore/platform/graphics/GlyphBuffer.h
+++ b/Source/WebCore/platform/graphics/GlyphBuffer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2009, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2007-2008 Torch Mobile Inc.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -187,7 +187,20 @@ public:
         m_advances.append(advance);
     }
 #endif
-    
+
+    void expandLastAdvance(float width)
+    {
+        ASSERT(!isEmpty());
+        GlyphBufferAdvance& lastAdvance = m_advances.last();
+#if PLATFORM(CG) || (PLATFORM(WX) && OS(DARWIN))
+        lastAdvance.width += width;
+#elif OS(WINCE)
+        lastAdvance += width;
+#else
+        lastAdvance += FloatSize(width, 0);
+#endif
+    }
+
 private:
     Vector<const SimpleFontData*, 2048> m_fontData;
     Vector<GlyphBufferGlyph, 2048> m_glyphs;
diff --git a/Source/WebCore/platform/graphics/GlyphPageTreeNode.cpp b/Source/WebCore/platform/graphics/GlyphPageTreeNode.cpp
index 3df14b9..e7ed193 100644
--- a/Source/WebCore/platform/graphics/GlyphPageTreeNode.cpp
+++ b/Source/WebCore/platform/graphics/GlyphPageTreeNode.cpp
@@ -29,12 +29,12 @@
 #include "config.h"
 #include "GlyphPageTreeNode.h"
 
-#include "CharacterNames.h"
 #include "PlatformString.h"
 #include "SegmentedFontData.h"
 #include "SimpleFontData.h"
 #include <stdio.h>
 #include <wtf/text/CString.h>
+#include <wtf/unicode/CharacterNames.h>
 #include <wtf/unicode/Unicode.h>
 
 namespace WebCore {
diff --git a/Source/WebCore/platform/graphics/GraphicsContext.cpp b/Source/WebCore/platform/graphics/GraphicsContext.cpp
index 9f94ac9..a0a7ea9 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext.cpp
+++ b/Source/WebCore/platform/graphics/GraphicsContext.cpp
@@ -142,6 +142,18 @@ void GraphicsContext::setShadow(const FloatSize& offset, float blur, const Color
     setPlatformShadow(offset, blur, color, colorSpace);
 }
 
+void GraphicsContext::setLegacyShadow(const FloatSize& offset, float blur, const Color& color, ColorSpace colorSpace)
+{
+    m_state.shadowOffset = offset;
+    m_state.shadowBlur = blur;
+    m_state.shadowColor = color;
+    m_state.shadowColorSpace = colorSpace;
+#if PLATFORM(CG)
+    m_state.shadowsUseLegacyRadius = true;
+#endif
+    setPlatformShadow(offset, blur, color, colorSpace);
+}
+
 void GraphicsContext::clearShadow()
 {
     m_state.shadowOffset = FloatSize();
@@ -532,10 +544,10 @@ void GraphicsContext::drawImageBuffer(ImageBuffer* image, ColorSpace styleColorS
         InterpolationQuality previousInterpolationQuality = imageInterpolationQuality();
         // FIXME: Should be InterpolationLow
         setImageInterpolationQuality(InterpolationNone);
-        image->draw(this, styleColorSpace, dest, src, op, useLowQualityScale);
+        image->draw(this, styleColorSpace, FloatRect(dest.location(), FloatSize(tw, th)), FloatRect(src.location(), FloatSize(tsw, tsh)), op, useLowQualityScale);
         setImageInterpolationQuality(previousInterpolationQuality);
     } else
-        image->draw(this, styleColorSpace, dest, src, op, useLowQualityScale);
+        image->draw(this, styleColorSpace, FloatRect(dest.location(), FloatSize(tw, th)), FloatRect(src.location(), FloatSize(tsw, tsh)), op, useLowQualityScale);
 }
 
 void GraphicsContext::addRoundedRectClip(const RoundedIntRect& rect)
@@ -565,6 +577,14 @@ void GraphicsContext::clipToImageBuffer(ImageBuffer* buffer, const FloatRect& re
     buffer->clip(this, rect);
 }
 
+#if !PLATFORM(CG)
+IntRect GraphicsContext::clipBounds() const
+{
+    ASSERT_NOT_REACHED();
+    return IntRect();
+}
+#endif
+
 TextDrawingModeFlags GraphicsContext::textDrawingMode() const
 {
     return m_state.textDrawingMode;
@@ -590,6 +610,34 @@ void GraphicsContext::fillRoundedRect(const RoundedIntRect& rect, const Color& c
     fillRoundedRect(rect.rect(), rect.radii().topLeft(), rect.radii().topRight(), rect.radii().bottomLeft(), rect.radii().bottomRight(), color, colorSpace);
 }
 
+#if !PLATFORM(CG)
+void GraphicsContext::fillRectWithRoundedHole(const IntRect& rect, const RoundedIntRect& roundedHoleRect, const Color& color, ColorSpace colorSpace)
+{
+    if (paintingDisabled())
+        return;
+
+    Path path;
+    path.addRect(rect);
+
+    if (!roundedHoleRect.radii().isZero())
+        path.addRoundedRect(roundedHoleRect.rect(), roundedHoleRect.radii().topLeft(), roundedHoleRect.radii().topRight(), roundedHoleRect.radii().bottomLeft(), roundedHoleRect.radii().bottomRight());
+    else
+        path.addRect(roundedHoleRect.rect());
+
+    WindRule oldFillRule = fillRule();
+    Color oldFillColor = fillColor();
+    ColorSpace oldFillColorSpace = fillColorSpace();
+    
+    setFillRule(RULE_EVENODD);
+    setFillColor(color, colorSpace);
+
+    fillPath(path);
+    
+    setFillRule(oldFillRule);
+    setFillColor(oldFillColor, oldFillColorSpace);
+}
+#endif
+
 void GraphicsContext::setCompositeOperation(CompositeOperator compositeOperation)
 {
     m_state.compositeOperator = compositeOperation;
diff --git a/Source/WebCore/platform/graphics/GraphicsContext.h b/Source/WebCore/platform/graphics/GraphicsContext.h
index 77321e2..21a9067 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext.h
+++ b/Source/WebCore/platform/graphics/GraphicsContext.h
@@ -176,6 +176,11 @@ namespace WebCore {
             , shouldSmoothFonts(true)
             , paintingDisabled(false)
             , shadowsIgnoreTransforms(false)
+#if PLATFORM(CG)
+            // Core Graphics incorrectly renders shadows with radius > 8px (<rdar://problem/8103442>),
+            // but we need to preserve this buggy behavior for canvas and -webkit-box-shadow.
+            , shadowsUseLegacyRadius(false)
+#endif
         {
         }
 
@@ -212,6 +217,9 @@ namespace WebCore {
         bool shouldSmoothFonts : 1;
         bool paintingDisabled : 1;
         bool shadowsIgnoreTransforms : 1;
+#if PLATFORM(CG)
+        bool shadowsUseLegacyRadius : 1;
+#endif
     };
 
     class GraphicsContext {
@@ -320,6 +328,7 @@ namespace WebCore {
         void fillRect(const FloatRect&, Generator&);
         void fillRoundedRect(const IntRect&, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color&, ColorSpace);
         void fillRoundedRect(const RoundedIntRect&, const Color&, ColorSpace);
+        void fillRectWithRoundedHole(const IntRect&, const RoundedIntRect& roundedHoleRect, const Color&, ColorSpace);
 
         void clearRect(const FloatRect&);
 
@@ -355,6 +364,8 @@ namespace WebCore {
         void clipPath(const Path&, WindRule);
         void clipConvexPolygon(size_t numPoints, const FloatPoint*, bool antialias = true);
         void clipToImageBuffer(ImageBuffer*, const FloatRect&);
+        
+        IntRect clipBounds() const;
 
         TextDrawingModeFlags textDrawingMode() const;
         void setTextDrawingMode(TextDrawingModeFlags);
@@ -385,6 +396,10 @@ namespace WebCore {
 
         bool hasShadow() const;
         void setShadow(const FloatSize&, float blur, const Color&, ColorSpace);
+        // Legacy shadow blur radius is used for canvas, and -webkit-box-shadow.
+        // It has different treatment of radii > 8px.
+        void setLegacyShadow(const FloatSize&, float blur, const Color&, ColorSpace);
+
         bool getShadow(FloatSize&, float&, Color&, ColorSpace&) const;
         void clearShadow();
 
@@ -404,16 +419,11 @@ namespace WebCore {
         void setCompositeOperation(CompositeOperator);
         CompositeOperator compositeOperation() const;
 
-#if PLATFORM(SKIA)
-        void beginPath();
-        void addPath(const Path&);
-#endif
-
         void clip(const Path&);
 
         // This clip function is used only by <canvas> code. It allows
         // implementations to handle clipping on the canvas differently since
-        // the disipline is different.
+        // the discipline is different.
         void canvasClip(const Path&);
         void clipOut(const Path&);
 
@@ -500,7 +510,6 @@ namespace WebCore {
         bool inTransparencyLayer() const;
         void pushTransparencyLayerInternal(const QRect &rect, qreal opacity, QPixmap& alphaMask);
         void takeOwnershipOfPlatformContext();
-        static QPainter::CompositionMode toQtCompositionMode(CompositeOperator op);
 #endif
 
 #if PLATFORM(QT) || PLATFORM(CAIRO)
diff --git a/Source/WebCore/platform/graphics/GraphicsContext3D.cpp b/Source/WebCore/platform/graphics/GraphicsContext3D.cpp
index f7c5a66..324fed8 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext3D.cpp
+++ b/Source/WebCore/platform/graphics/GraphicsContext3D.cpp
@@ -26,7 +26,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "GraphicsContext3D.h"
 
@@ -1437,4 +1437,4 @@ bool GraphicsContext3D::packPixels(const uint8_t* sourceData,
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/GraphicsContext3D.h b/Source/WebCore/platform/graphics/GraphicsContext3D.h
index 24827e5..d6c1cec 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/Source/WebCore/platform/graphics/GraphicsContext3D.h
@@ -47,7 +47,9 @@
 typedef unsigned int GC3Denum;
 typedef unsigned char GC3Dboolean;
 typedef unsigned int GC3Dbitfield;
+typedef signed char GC3Dbyte;
 typedef unsigned char GC3Dubyte;
+typedef short GC3Dshort;
 typedef unsigned short GC3Dushort;
 typedef int GC3Dint;
 typedef int GC3Dsizei;
@@ -117,7 +119,7 @@ class GraphicsContext3DInternal;
 
 class GraphicsContext3D : public RefCounted<GraphicsContext3D> {
 public:
-    enum WebGLEnumType {
+    enum {
         DEPTH_BUFFER_BIT = 0x00000100,
         STENCIL_BUFFER_BIT = 0x00000400,
         COLOR_BUFFER_BIT = 0x00004000,
@@ -452,6 +454,14 @@ public:
         RenderDirectlyToHostWindow
     };
 
+    class ContextLostCallback {
+    public:
+        virtual void onContextLost() = 0;
+        virtual ~ContextLostCallback() {}
+    };
+
+    void setContextLostCallback(PassOwnPtr<ContextLostCallback>);
+
     static PassRefPtr<GraphicsContext3D> create(Attributes, HostWindow*, RenderStyle = RenderOffscreen);
     ~GraphicsContext3D();
 
@@ -487,10 +497,6 @@ public:
     void prepareTexture();
 #endif
 
-    // Helper to return the size in bytes of OpenGL data types
-    // like GL_FLOAT, GL_INT, etc.
-    unsigned int sizeInBytes(GC3Denum type);
-
     // Helper to texImage2D with pixel==0 case: pixels are initialized to 0.
     // Return true if no GL error is synthesized.
     // By default, alignment is 4, the OpenGL default setting.
diff --git a/Source/WebCore/platform/graphics/Icon.h b/Source/WebCore/platform/graphics/Icon.h
index c83685f..2797133 100644
--- a/Source/WebCore/platform/graphics/Icon.h
+++ b/Source/WebCore/platform/graphics/Icon.h
@@ -42,6 +42,7 @@ typedef struct _GdkPixbuf GdkPixbuf;
 #elif PLATFORM(EFL)
 typedef struct _Evas_Object Evas_Object;
 #elif PLATFORM(CHROMIUM)
+#include "Image.h"
 #include "PlatformIcon.h"
 #endif
 
@@ -60,6 +61,8 @@ public:
 
 #if PLATFORM(WIN)
     static PassRefPtr<Icon> create(HICON hIcon) { return adoptRef(new Icon(hIcon)); }
+#elif PLATFORM(CHROMIUM)
+    static PassRefPtr<Icon> create(PassRefPtr<PlatformIcon> icon) { return adoptRef(new Icon(icon)); }
 #endif
 
 private:
@@ -79,8 +82,8 @@ private:
     Icon();
     Evas_Object* m_icon;
 #elif PLATFORM(CHROMIUM)
-    Icon(const PlatformIcon&);
-    PlatformIcon m_icon;
+    Icon(PassRefPtr<PlatformIcon>);
+    RefPtr<PlatformIcon> m_icon;
 #endif
 };
 
diff --git a/Source/WebCore/platform/graphics/IntRect.cpp b/Source/WebCore/platform/graphics/IntRect.cpp
index 188b5f9..7591c41 100644
--- a/Source/WebCore/platform/graphics/IntRect.cpp
+++ b/Source/WebCore/platform/graphics/IntRect.cpp
@@ -44,22 +44,22 @@ bool IntRect::intersects(const IntRect& other) const
 {
     // Checking emptiness handles negative widths as well as zero.
     return !isEmpty() && !other.isEmpty()
-        && x() < other.right() && other.x() < right()
-        && y() < other.bottom() && other.y() < bottom();
+        && x() < other.maxX() && other.x() < maxX()
+        && y() < other.maxY() && other.y() < maxY();
 }
 
 bool IntRect::contains(const IntRect& other) const
 {
-    return x() <= other.x() && right() >= other.right()
-        && y() <= other.y() && bottom() >= other.bottom();
+    return x() <= other.x() && maxX() >= other.maxX()
+        && y() <= other.y() && maxY() >= other.maxY();
 }
 
 void IntRect::intersect(const IntRect& other)
 {
     int l = max(x(), other.x());
     int t = max(y(), other.y());
-    int r = min(right(), other.right());
-    int b = min(bottom(), other.bottom());
+    int r = min(maxX(), other.maxX());
+    int b = min(maxY(), other.maxY());
 
     // Return a clean empty rectangle for non-intersecting cases.
     if (l >= r || t >= b) {
@@ -87,8 +87,8 @@ void IntRect::unite(const IntRect& other)
 
     int l = min(x(), other.x());
     int t = min(y(), other.y());
-    int r = max(right(), other.right());
-    int b = max(bottom(), other.bottom());
+    int r = max(maxX(), other.maxX());
+    int b = max(maxY(), other.maxY());
 
     m_location.setX(l);
     m_location.setY(t);
diff --git a/Source/WebCore/platform/graphics/IntRect.h b/Source/WebCore/platform/graphics/IntRect.h
index 638db75..3a2433d 100644
--- a/Source/WebCore/platform/graphics/IntRect.h
+++ b/Source/WebCore/platform/graphics/IntRect.h
@@ -91,6 +91,8 @@ public:
 
     int x() const { return m_location.x(); }
     int y() const { return m_location.y(); }
+    int maxX() const { return x() + width(); }
+    int maxY() const { return y() + height(); }
     int width() const { return m_size.width(); }
     int height() const { return m_size.height(); }
 
@@ -99,18 +101,8 @@ public:
     void setWidth(int width) { m_size.setWidth(width); }
     void setHeight(int height) { m_size.setHeight(height); }
 
-    // Be careful with these functions.  The point is considered to be to the right and below.  These are not
-    // substitutes for right() and bottom().
-    IntPoint topLeft() const { return m_location; }
-    IntPoint topRight() const { return IntPoint(right() - 1, y()); }
-    IntPoint bottomLeft() const { return IntPoint(x(), bottom() - 1); }
-    IntPoint bottomRight() const { return IntPoint(right() - 1, bottom() - 1); }
-
     bool isEmpty() const { return m_size.isEmpty(); }
 
-    int right() const { return x() + width(); }
-    int bottom() const { return y() + height(); }
-
     // NOTE: The result is rounded to integer values, and thus may be not the exact
     // center point.
     IntPoint center() const { return IntPoint(x() + width() / 2, y() + height() / 2); }
@@ -118,26 +110,26 @@ public:
     void move(const IntSize& s) { m_location += s; } 
     void move(int dx, int dy) { m_location.move(dx, dy); } 
     
-    void shiftLeftEdgeTo(int edge)
+    void shiftXEdgeTo(int edge)
     {
         int delta = edge - x();
         setX(edge);
         setWidth(std::max(0, width() - delta));
     }
-    void shiftRightEdgeTo(int edge)
+    void shiftMaxXEdgeTo(int edge)
     {
-        int delta = edge - right();
+        int delta = edge - maxX();
         setWidth(std::max(0, width() + delta));
     }
-    void shiftTopEdgeTo(int edge)
+    void shiftYEdgeTo(int edge)
     {
         int delta = edge - y();
         setY(edge);
         setHeight(std::max(0, height() - delta));
     }
-    void shiftBottomEdgeTo(int edge)
+    void shiftMaxYEdgeTo(int edge)
     {
-        int delta = edge - bottom();
+        int delta = edge - maxY();
         setHeight(std::max(0, height() + delta));
     }
 
@@ -147,7 +139,7 @@ public:
     // This checks to see if the rect contains x,y in the traditional sense.
     // Equivalent to checking if the rect contains a 1x1 rect below and to the right of (px,py).
     bool contains(int px, int py) const
-        { return px >= x() && px < right() && py >= y() && py < bottom(); }
+        { return px >= x() && px < maxX() && py >= y() && py < maxY(); }
     bool contains(const IntPoint& point) const { return contains(point.x(), point.y()); }
 
     void intersect(const IntRect&);
diff --git a/Source/WebCore/platform/graphics/IntRectHash.h b/Source/WebCore/platform/graphics/IntRectHash.h
new file mode 100644
index 0000000..7138f33
--- /dev/null
+++ b/Source/WebCore/platform/graphics/IntRectHash.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ 
+#ifndef IntRectHash_h
+#define IntRectHash_h
+
+#include "IntPointHash.h"
+#include "IntRect.h"
+#include "IntSizeHash.h"
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+
+namespace WTF {
+
+template<> struct IntHash<WebCore::IntRect> {
+    static unsigned hash(const WebCore::IntRect& key)
+    {
+        return intHash(static_cast<uint64_t>(DefaultHash<WebCore::IntPoint>::Hash::hash(key.location())) << 32 | DefaultHash<WebCore::IntSize>::Hash::hash(key.size()));
+    }
+    static bool equal(const WebCore::IntRect& a, const WebCore::IntRect& b)
+    {
+        return DefaultHash<WebCore::IntPoint>::Hash::equal(a.location(), b.location()) && DefaultHash<WebCore::IntSize>::Hash::equal(a.size(), b.size());
+    }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+template<> struct DefaultHash<WebCore::IntRect> { typedef IntHash<WebCore::IntRect> Hash; };
+
+template<> struct HashTraits<WebCore::IntRect> : GenericHashTraits<WebCore::IntRect> {
+    static const bool emptyValueIsZero = true;
+    static const bool needsDestruction = false;
+    static void constructDeletedValue(WebCore::IntRect& slot) { new (&slot) WebCore::IntRect(-1, -1, -1, -1); }
+    static bool isDeletedValue(const WebCore::IntRect& value) { return value.x() == -1 && value.y() == -1 && value.width() == -1 && value.height() == -1; }
+};
+
+}
+
+#endif
diff --git a/Source/WebCore/platform/graphics/IntSizeHash.h b/Source/WebCore/platform/graphics/IntSizeHash.h
index ad6eac3..0cca000 100644
--- a/Source/WebCore/platform/graphics/IntSizeHash.h
+++ b/Source/WebCore/platform/graphics/IntSizeHash.h
@@ -24,22 +24,20 @@
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 
-using WebCore::IntSize;
-
 namespace WTF {
 
-    template<> struct IntHash<IntSize> {
-        static unsigned hash(const IntSize& key) { return intHash((static_cast<uint64_t>(key.width()) << 32 | key.height())); }
-        static bool equal(const IntSize& a, const IntSize& b) { return a == b; }
+    template<> struct IntHash<WebCore::IntSize> {
+        static unsigned hash(const WebCore::IntSize& key) { return intHash((static_cast<uint64_t>(key.width()) << 32 | key.height())); }
+        static bool equal(const WebCore::IntSize& a, const WebCore::IntSize& b) { return a == b; }
         static const bool safeToCompareToEmptyOrDeleted = true;
     };
-    template<> struct DefaultHash<IntSize> { typedef IntHash<IntSize> Hash; };
+    template<> struct DefaultHash<WebCore::IntSize> { typedef IntHash<WebCore::IntSize> Hash; };
     
-    template<> struct HashTraits<IntSize> : GenericHashTraits<IntSize> {
+    template<> struct HashTraits<WebCore::IntSize> : GenericHashTraits<WebCore::IntSize> {
         static const bool emptyValueIsZero = true;
         static const bool needsDestruction = false;
-        static void constructDeletedValue(IntSize& slot) { new (&slot) IntSize(-1, -1); }
-        static bool isDeletedValue(const IntSize& value) { return value.width() == -1 && value.height() == -1; }
+        static void constructDeletedValue(WebCore::IntSize& slot) { new (&slot) WebCore::IntSize(-1, -1); }
+        static bool isDeletedValue(const WebCore::IntSize& value) { return value.width() == -1 && value.height() == -1; }
     };
 } // namespace WTF
 
diff --git a/Source/WebCore/platform/graphics/MediaPlayer.cpp b/Source/WebCore/platform/graphics/MediaPlayer.cpp
index 60f55a5..8eed0d2 100644
--- a/Source/WebCore/platform/graphics/MediaPlayer.cpp
+++ b/Source/WebCore/platform/graphics/MediaPlayer.cpp
@@ -698,6 +698,26 @@ double MediaPlayer::maximumDurationToCacheMediaTime() const
     return m_private->maximumDurationToCacheMediaTime();
 }
 
+unsigned long MediaPlayer::decodedFrames() const
+{
+    return m_private->decodedFrames();
+}
+
+unsigned long MediaPlayer::droppedFrames() const
+{
+    return m_private->droppedFrames();
+}
+
+unsigned long MediaPlayer::audioBytesDecoded() const
+{
+    return m_private->audioBytesDecoded();
+}
+
+unsigned long MediaPlayer::videoBytesDecoded() const
+{
+    return m_private->videoBytesDecoded();
+}
+
 void MediaPlayer::reloadTimerFired(Timer<MediaPlayer>*)
 {
     m_private->cancelLoad();
diff --git a/Source/WebCore/platform/graphics/MediaPlayer.h b/Source/WebCore/platform/graphics/MediaPlayer.h
index ef0b3eb..1112148 100644
--- a/Source/WebCore/platform/graphics/MediaPlayer.h
+++ b/Source/WebCore/platform/graphics/MediaPlayer.h
@@ -287,6 +287,11 @@ public:
 
     double maximumDurationToCacheMediaTime() const;
 
+    unsigned long decodedFrames() const;
+    unsigned long droppedFrames() const;
+    unsigned long audioBytesDecoded() const;
+    unsigned long videoBytesDecoded() const;
+
 private:
     MediaPlayer(MediaPlayerClient*);
     void loadWithNextMediaEngine(MediaPlayerFactory*);
diff --git a/Source/WebCore/platform/graphics/MediaPlayerPrivate.h b/Source/WebCore/platform/graphics/MediaPlayerPrivate.h
index 6abe258..04b2612 100644
--- a/Source/WebCore/platform/graphics/MediaPlayerPrivate.h
+++ b/Source/WebCore/platform/graphics/MediaPlayerPrivate.h
@@ -136,6 +136,10 @@ public:
     // it is OK to calculate movie time before refreshing the cached time.
     virtual double maximumDurationToCacheMediaTime() const { return 0; }
 
+    virtual unsigned long decodedFrames() const { return 0; }
+    virtual unsigned long droppedFrames() const { return 0; }
+    virtual unsigned long audioBytesDecoded() const { return 0; }
+    virtual unsigned long videoBytesDecoded() const { return 0; }
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/ShadowBlur.cpp b/Source/WebCore/platform/graphics/ShadowBlur.cpp
new file mode 100644
index 0000000..f61ecff
--- /dev/null
+++ b/Source/WebCore/platform/graphics/ShadowBlur.cpp
@@ -0,0 +1,733 @@
+/*
+ * Copyright (C) 2011 Apple Inc.
+ * Copyright (C) 2010 Sencha, Inc.
+ * Copyright (C) 2010 Igalia S.L.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ShadowBlur.h"
+
+#include "AffineTransform.h"
+#include "FloatQuad.h"
+#include "GraphicsContext.h"
+#include "ImageBuffer.h"
+#include "Timer.h"
+#include <wtf/MathExtras.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/UnusedParam.h>
+
+using namespace std;
+
+namespace WebCore {
+
+static inline int roundUpToMultipleOf32(int d)
+{
+    return (1 + (d >> 5)) << 5;
+}
+
+// ShadowBlur needs a scratch image as the buffer for the blur filter.
+// Instead of creating and destroying the buffer for every operation,
+// we create a buffer which will be automatically purged via a timer.
+class ScratchBuffer {
+public:
+    ScratchBuffer()
+        : m_purgeTimer(this, &ScratchBuffer::timerFired)
+#if !ASSERT_DISABLED
+        , m_bufferInUse(false)
+#endif
+    {
+    }
+    
+    ImageBuffer* getScratchBuffer(const IntSize& size)
+    {
+        ASSERT(!m_bufferInUse);
+#if !ASSERT_DISABLED
+        m_bufferInUse = true;
+#endif
+        // We do not need to recreate the buffer if the current buffer is large enough.
+        if (m_imageBuffer && m_imageBuffer->width() >= size.width() && m_imageBuffer->height() >= size.height())
+            return m_imageBuffer.get();
+
+        // Round to the nearest 32 pixels so we do not grow the buffer for similar sized requests.
+        IntSize roundedSize(roundUpToMultipleOf32(size.width()), roundUpToMultipleOf32(size.height()));
+
+        m_imageBuffer = ImageBuffer::create(roundedSize);
+        return m_imageBuffer.get();
+    }
+
+    void scheduleScratchBufferPurge()
+    {
+#if !ASSERT_DISABLED
+        m_bufferInUse = false;
+#endif
+        if (m_purgeTimer.isActive())
+            m_purgeTimer.stop();
+
+        const double scratchBufferPurgeInterval = 2;
+        m_purgeTimer.startOneShot(scratchBufferPurgeInterval);
+    }
+    
+    static ScratchBuffer& shared();
+
+private:
+    void timerFired(Timer<ScratchBuffer>*)
+    {
+        clearScratchBuffer();
+    }
+    
+    void clearScratchBuffer()
+    {
+        m_imageBuffer = 0;
+    }
+
+    OwnPtr<ImageBuffer> m_imageBuffer;
+    Timer<ScratchBuffer> m_purgeTimer;
+#if !ASSERT_DISABLED
+    bool m_bufferInUse;
+#endif
+};
+
+ScratchBuffer& ScratchBuffer::shared()
+{
+    DEFINE_STATIC_LOCAL(ScratchBuffer, scratchBuffer, ());
+    return scratchBuffer;
+}
+
+static const int templateSideLength = 1;
+
+ShadowBlur::ShadowBlur(float radius, const FloatSize& offset, const Color& color, ColorSpace colorSpace)
+    : m_color(color)
+    , m_colorSpace(colorSpace)
+    , m_blurRadius(radius)
+    , m_offset(offset)
+    , m_layerImage(0)
+    , m_shadowsIgnoreTransforms(false)
+{
+    // Limit blur radius to 128 to avoid lots of very expensive blurring.
+    m_blurRadius = min<float>(m_blurRadius, 128);
+
+    // The type of shadow is decided by the blur radius, shadow offset, and shadow color.
+    if (!m_color.isValid() || !color.alpha()) {
+        // Can't paint the shadow with invalid or invisible color.
+        m_type = NoShadow;
+    } else if (m_blurRadius > 0) {
+        // Shadow is always blurred, even the offset is zero.
+        m_type = BlurShadow;
+    } else if (!m_offset.width() && !m_offset.height()) {
+        // Without blur and zero offset means the shadow is fully hidden.
+        m_type = NoShadow;
+    } else
+        m_type = SolidShadow;
+}
+
+// Instead of integer division, we use 17.15 for fixed-point division.
+static const int blurSumShift = 15;
+static const float gaussianKernelFactor = 3 / 4.f * sqrtf(2 * piFloat);
+
+void ShadowBlur::blurLayerImage(unsigned char* imageData, const IntSize& size, int rowStride)
+{
+    const int channels[4] =
+#if CPU(BIG_ENDIAN)
+        { 0, 3, 2, 0 };
+#elif CPU(MIDDLE_ENDIAN)
+        { 1, 2, 3, 1 };
+#else
+        { 3, 0, 1, 3 };
+#endif
+
+    int diameter;
+    if (m_shadowsIgnoreTransforms)
+        diameter = max(2, static_cast<int>(floorf((2 / 3.f) * m_blurRadius))); // Canvas shadow. FIXME: we should adjust the blur radius higher up.
+    else {
+        // http://dev.w3.org/csswg/css3-background/#box-shadow
+        // Approximate a Gaussian blur with a standard deviation equal to half the blur radius,
+        // which http://www.w3.org/TR/SVG/filters.html#feGaussianBlurElement tell us how to do.
+        // However, shadows rendered according to that spec will extend a little further than m_blurRadius,
+        // so we apply a fudge factor to bring the radius down slightly.
+        float stdDev = m_blurRadius / 2;
+        const float fudgeFactor = 0.88f;
+        diameter = max(2, static_cast<int>(floorf(stdDev * gaussianKernelFactor * fudgeFactor + 0.5f)));
+    }
+
+    enum {
+        leftLobe = 0,
+        rightLobe = 1
+    };
+
+    int lobes[3][2]; // indexed by pass, and left/right lobe
+    
+    if (diameter & 1) {
+        // if d is odd, use three box-blurs of size 'd', centered on the output pixel.
+        int lobeSize = (diameter - 1) / 2;
+        lobes[0][leftLobe] = lobeSize;
+        lobes[0][rightLobe] = lobeSize;
+        lobes[1][leftLobe] = lobeSize;
+        lobes[1][rightLobe] = lobeSize;
+        lobes[2][leftLobe] = lobeSize;
+        lobes[2][rightLobe] = lobeSize;
+    } else {
+        // if d is even, two box-blurs of size 'd' (the first one centered on the pixel boundary
+        // between the output pixel and the one to the left, the second one centered on the pixel
+        // boundary between the output pixel and the one to the right) and one box blur of size 'd+1' centered on the output pixel
+        int lobeSize = diameter / 2;
+        lobes[0][leftLobe] = lobeSize;
+        lobes[0][rightLobe] = lobeSize - 1;
+        lobes[1][leftLobe] = lobeSize - 1;
+        lobes[1][rightLobe] = lobeSize;
+        lobes[2][leftLobe] = lobeSize;
+        lobes[2][rightLobe] = lobeSize;
+    }
+
+    // First pass is horizontal.
+    int stride = 4;
+    int delta = rowStride;
+    int final = size.height();
+    int dim = size.width();
+
+    // Two stages: horizontal and vertical
+    for (int pass = 0; pass < 2; ++pass) {
+        unsigned char* pixels = imageData;
+
+        for (int j = 0; j < final; ++j, pixels += delta) {
+            // For each step, we blur the alpha in a channel and store the result
+            // in another channel for the subsequent step.
+            // We use sliding window algorithm to accumulate the alpha values.
+            // This is much more efficient than computing the sum of each pixels
+            // covered by the box kernel size for each x.
+            for (int step = 0; step < 3; ++step) {
+                int side1 = lobes[step][leftLobe];
+                int side2 = lobes[step][rightLobe];
+                int pixelCount = side1 + 1 + side2;
+                int invCount = ((1 << blurSumShift) + pixelCount - 1) / pixelCount;
+                int ofs = 1 + side2;
+                int alpha1 = pixels[channels[step]];
+                int alpha2 = pixels[(dim - 1) * stride + channels[step]];
+
+                unsigned char* ptr = pixels + channels[step + 1];
+                unsigned char* prev = pixels + stride + channels[step];
+                unsigned char* next = pixels + ofs * stride + channels[step];
+
+                int i;
+                int sum = side1 * alpha1 + alpha1;
+                int limit = (dim < side2 + 1) ? dim : side2 + 1;
+
+                for (i = 1; i < limit; ++i, prev += stride)
+                    sum += *prev;
+
+                if (limit <= side2)
+                    sum += (side2 - limit + 1) * alpha2;
+
+                limit = (side1 < dim) ? side1 : dim;
+                for (i = 0; i < limit; ptr += stride, next += stride, ++i, ++ofs) {
+                    *ptr = (sum * invCount) >> blurSumShift;
+                    sum += ((ofs < dim) ? *next : alpha2) - alpha1;
+                }
+                
+                prev = pixels + channels[step];
+                for (; ofs < dim; ptr += stride, prev += stride, next += stride, ++i, ++ofs) {
+                    *ptr = (sum * invCount) >> blurSumShift;
+                    sum += (*next) - (*prev);
+                }
+                
+                for (; i < dim; ptr += stride, prev += stride, ++i) {
+                    *ptr = (sum * invCount) >> blurSumShift;
+                    sum += alpha2 - (*prev);
+                }
+            }
+        }
+
+        // Last pass is vertical.
+        stride = rowStride;
+        delta = 4;
+        final = size.width();
+        dim = size.height();
+    }
+}
+
+void ShadowBlur::adjustBlurRadius(GraphicsContext* context)
+{
+    if (!m_shadowsIgnoreTransforms)
+        return;
+
+    const AffineTransform transform = context->getCTM();
+
+    // Adjust blur if we're scaling, since the radius must not be affected by transformations.
+    // FIXME: use AffineTransform::isIdentityOrTranslationOrFlipped()?
+    if (transform.isIdentity())
+        return;
+
+    // Calculate transformed unit vectors.
+    const FloatQuad unitQuad(FloatPoint(0, 0), FloatPoint(1, 0),
+                             FloatPoint(0, 1), FloatPoint(1, 1));
+    const FloatQuad transformedUnitQuad = transform.mapQuad(unitQuad);
+
+    // Calculate X axis scale factor.
+    const FloatSize xUnitChange = transformedUnitQuad.p2() - transformedUnitQuad.p1();
+    const float xAxisScale = sqrtf(xUnitChange.width() * xUnitChange.width()
+                                   + xUnitChange.height() * xUnitChange.height());
+
+    // Calculate Y axis scale factor.
+    const FloatSize yUnitChange = transformedUnitQuad.p3() - transformedUnitQuad.p1();
+    const float yAxisScale = sqrtf(yUnitChange.width() * yUnitChange.width()
+                                   + yUnitChange.height() * yUnitChange.height());
+
+    // blurLayerImage() does not support per-axis blurring, so calculate a balanced scaling.
+    // FIXME: does AffineTransform.xScale()/yScale() help?
+    const float scale = sqrtf(xAxisScale * yAxisScale);
+    m_blurRadius = roundf(m_blurRadius / scale);
+}
+
+IntRect ShadowBlur::calculateLayerBoundingRect(GraphicsContext* context, const FloatRect& shadowedRect, const IntRect& clipRect)
+{
+    const float roundedRadius = ceilf(m_blurRadius);
+
+    // Calculate the destination of the blurred and/or transformed layer.
+    FloatRect layerRect;
+    float inflation = 0;
+
+    const AffineTransform transform = context->getCTM();
+    if (m_shadowsIgnoreTransforms && !transform.isIdentity()) {
+        FloatQuad transformedPolygon = transform.mapQuad(FloatQuad(shadowedRect));
+        transformedPolygon.move(m_offset);
+        layerRect = transform.inverse().mapQuad(transformedPolygon).boundingBox();
+    } else {
+        layerRect = shadowedRect;
+        layerRect.move(m_offset);
+    }
+
+    // We expand the area by the blur radius to give extra space for the blur transition.
+    if (m_type == BlurShadow) {
+        layerRect.inflate(roundedRadius);
+        inflation = roundedRadius;
+    }
+
+    FloatRect unclippedLayerRect = layerRect;
+
+    if (!clipRect.contains(enclosingIntRect(layerRect))) {
+        // If we are totally outside the clip region, we aren't painting at all.
+        if (intersection(layerRect, clipRect).isEmpty())
+            return IntRect();
+
+        IntRect inflatedClip = clipRect;
+        // Pixels at the edges can be affected by pixels outside the buffer,
+        // so intersect with the clip inflated by the blur.
+        if (m_type == BlurShadow)
+            inflatedClip.inflate(roundedRadius);
+        
+        layerRect.intersect(inflatedClip);
+    }
+
+    const float frameSize = inflation * 2;
+    m_sourceRect = FloatRect(0, 0, shadowedRect.width() + frameSize, shadowedRect.height() + frameSize);
+    m_layerOrigin = FloatPoint(layerRect.x(), layerRect.y());
+    m_layerSize = layerRect.size();
+
+    const FloatPoint unclippedLayerOrigin = FloatPoint(unclippedLayerRect.x(), unclippedLayerRect.y());
+    const FloatSize clippedOut = unclippedLayerOrigin - m_layerOrigin;
+
+    // Set the origin as the top left corner of the scratch image, or, in case there's a clipped
+    // out region, set the origin accordingly to the full bounding rect's top-left corner.
+    float translationX = -shadowedRect.x() + inflation - fabsf(clippedOut.width());
+    float translationY = -shadowedRect.y() + inflation - fabsf(clippedOut.height());
+    m_layerContextTranslation = FloatSize(translationX, translationY);
+
+    return enclosingIntRect(layerRect);
+}
+
+GraphicsContext* ShadowBlur::beginShadowLayer(GraphicsContext* graphicsContext, const IntRect& layerRect)
+{
+    adjustBlurRadius(graphicsContext);
+
+    // Don't paint if we are totally outside the clip region.
+    if (layerRect.isEmpty())
+        return 0;
+
+    m_layerImage = ScratchBuffer::shared().getScratchBuffer(layerRect.size());
+    GraphicsContext* layerContext = m_layerImage->context();
+
+    layerContext->save(); // Balanced by restore() in endShadowLayer().
+
+    // Always clear the surface first. FIXME: we could avoid the clear on first allocation.
+    // Add a pixel to avoid later edge aliasing when rotated.
+    layerContext->clearRect(FloatRect(0, 0, m_layerSize.width() + 1, m_layerSize.height() + 1));
+    layerContext->translate(m_layerContextTranslation);
+
+    return layerContext;
+}
+
+void ShadowBlur::endShadowLayer(GraphicsContext* graphicsContext)
+{
+    if (!m_layerImage)
+        return;
+        
+    m_layerImage->context()->restore();
+
+    if (m_type == BlurShadow) {
+        IntRect blurRect = enclosingIntRect(FloatRect(FloatPoint(), m_layerSize));
+        RefPtr<ByteArray> layerData = m_layerImage->getUnmultipliedImageData(blurRect);
+        blurLayerImage(layerData->data(), blurRect.size(), blurRect.width() * 4);
+        m_layerImage->putUnmultipliedImageData(layerData.get(), blurRect.size(), blurRect, IntPoint());
+    }
+
+    graphicsContext->save();
+
+    IntSize bufferSize = m_layerImage->size();
+    if (bufferSize != m_layerSize) {
+        // The rect passed to clipToImageBuffer() has to be the size of the entire buffer,
+        // but we may not have cleared it all, so clip to the filled part first.
+        graphicsContext->clip(FloatRect(m_layerOrigin, m_layerSize));
+    }
+    graphicsContext->clipToImageBuffer(m_layerImage, FloatRect(m_layerOrigin, bufferSize));
+    graphicsContext->setFillColor(m_color, m_colorSpace);
+
+    graphicsContext->clearShadow();
+    graphicsContext->fillRect(FloatRect(m_layerOrigin, m_sourceRect.size()));
+    
+    graphicsContext->restore();
+
+    m_layerImage = 0;
+
+    // Schedule a purge of the scratch buffer. We do not need to destroy the surface.
+    ScratchBuffer::shared().scheduleScratchBufferPurge();
+}
+
+static void computeSliceSizesFromRadii(int twiceRadius, const RoundedIntRect::Radii& radii, int& leftSlice, int& rightSlice, int& topSlice, int& bottomSlice)
+{
+    leftSlice = twiceRadius + max(radii.topLeft().width(), radii.bottomLeft().width()); 
+    rightSlice = twiceRadius + max(radii.topRight().width(), radii.bottomRight().width()); 
+
+    topSlice = twiceRadius + max(radii.topLeft().height(), radii.topRight().height());
+    bottomSlice = twiceRadius + max(radii.bottomLeft().height(), radii.bottomRight().height());
+}
+
+IntSize ShadowBlur::templateSize(const RoundedIntRect::Radii& radii) const
+{
+    const int templateSideLength = 1;
+
+    int leftSlice;
+    int rightSlice;
+    int topSlice;
+    int bottomSlice;
+    computeSliceSizesFromRadii(2 * ceilf(m_blurRadius), radii, leftSlice, rightSlice, topSlice, bottomSlice);
+    
+    return IntSize(templateSideLength + leftSlice + rightSlice,
+                   templateSideLength + topSlice + bottomSlice);
+}
+
+void ShadowBlur::drawRectShadow(GraphicsContext* graphicsContext, const FloatRect& shadowedRect, const RoundedIntRect::Radii& radii)
+{
+    IntRect layerRect = calculateLayerBoundingRect(graphicsContext, shadowedRect, graphicsContext->clipBounds());
+    if (layerRect.isEmpty())
+        return;
+
+    // drawRectShadowWithTiling does not work with rotations.
+    // https://bugs.webkit.org/show_bug.cgi?id=45042
+    if (!graphicsContext->getCTM().isIdentityOrTranslationOrFlipped() || m_type != BlurShadow) {
+        drawRectShadowWithoutTiling(graphicsContext, shadowedRect, radii, layerRect);
+        return;
+    }
+
+    IntSize templateSize = this->templateSize(radii);
+
+    if (templateSize.width() > shadowedRect.width() || templateSize.height() > shadowedRect.height()
+        || (templateSize.width() * templateSize.height() > m_sourceRect.width() * m_sourceRect.height())) {
+        drawRectShadowWithoutTiling(graphicsContext, shadowedRect, radii, layerRect);
+        return;
+    }
+
+    drawRectShadowWithTiling(graphicsContext, shadowedRect, radii, templateSize);
+}
+
+void ShadowBlur::drawInsetShadow(GraphicsContext* graphicsContext, const FloatRect& rect, const FloatRect& holeRect, const RoundedIntRect::Radii& holeRadii)
+{
+    IntRect layerRect = calculateLayerBoundingRect(graphicsContext, rect, graphicsContext->clipBounds());
+    if (layerRect.isEmpty())
+        return;
+
+    // drawInsetShadowWithTiling does not work with rotations.
+    // https://bugs.webkit.org/show_bug.cgi?id=45042
+    if (!graphicsContext->getCTM().isIdentityOrTranslationOrFlipped() || m_type != BlurShadow) {
+        drawInsetShadowWithoutTiling(graphicsContext, rect, holeRect, holeRadii, layerRect);
+        return;
+    }
+
+    IntSize templateSize = this->templateSize(holeRadii);
+
+    if (templateSize.width() > holeRect.width() || templateSize.height() > holeRect.height()
+        || (templateSize.width() * templateSize.height() > holeRect.width() * holeRect.height())) {
+        drawInsetShadowWithoutTiling(graphicsContext, rect, holeRect, holeRadii, layerRect);
+        return;
+    }
+
+    drawInsetShadowWithTiling(graphicsContext, rect, holeRect, holeRadii, templateSize);
+}
+
+void ShadowBlur::drawRectShadowWithoutTiling(GraphicsContext* graphicsContext, const FloatRect& shadowedRect, const RoundedIntRect::Radii& radii, const IntRect& layerRect)
+{
+    GraphicsContext* shadowContext = beginShadowLayer(graphicsContext, layerRect);
+    if (!shadowContext)
+        return;
+
+    Path path;
+    path.addRoundedRect(shadowedRect, radii.topLeft(), radii.topRight(), radii.bottomLeft(), radii.bottomRight());
+
+    shadowContext->setFillColor(Color::black, ColorSpaceDeviceRGB);
+    shadowContext->fillPath(path);
+    
+    endShadowLayer(graphicsContext);
+}
+
+void ShadowBlur::drawInsetShadowWithoutTiling(GraphicsContext* graphicsContext, const FloatRect& rect, const FloatRect& holeRect, const RoundedIntRect::Radii& holeRadii, const IntRect& layerRect)
+{
+    GraphicsContext* shadowContext = beginShadowLayer(graphicsContext, layerRect);
+    if (!shadowContext)
+        return;
+
+    Path path;
+    path.addRect(rect);
+    path.addRoundedRect(holeRect, holeRadii.topLeft(), holeRadii.topRight(), holeRadii.bottomLeft(), holeRadii.bottomRight());
+
+    shadowContext->setFillRule(RULE_EVENODD);
+    shadowContext->setFillColor(Color::black, ColorSpaceDeviceRGB);
+    shadowContext->fillPath(path);
+
+    endShadowLayer(graphicsContext);
+}
+
+/*
+  These functions use tiling to improve the performance of the shadow
+  drawing of rounded rectangles. The code basically does the following
+  steps:
+
+     1. Calculate the size of the shadow template, a rectangle that
+     contains all the necessary tiles to draw the complete shadow.
+
+     2. If that size is smaller than the real rectangle render the new
+     template rectangle and its shadow in a new surface, in other case
+     render the shadow of the real rectangle in the destination
+     surface.
+
+     3. Calculate the sizes and positions of the tiles and their
+     destinations and use drawPattern to render the final shadow. The
+     code divides the rendering in 8 tiles:
+
+        1 | 2 | 3
+       -----------
+        4 |   | 5
+       -----------
+        6 | 7 | 8
+
+     The corners are directly copied from the template rectangle to the
+     real one and the side tiles are 1 pixel width, we use them as
+     tiles to cover the destination side. The corner tiles are bigger
+     than just the side of the rounded corner, we need to increase it
+     because the modifications caused by the corner over the blur
+     effect. We fill the central or outer part with solid color to complete
+     the shadow.
+ */
+
+void ShadowBlur::drawInsetShadowWithTiling(GraphicsContext* graphicsContext, const FloatRect& rect, const FloatRect& holeRect, const RoundedIntRect::Radii& radii, const IntSize& templateSize)
+{
+    graphicsContext->save();
+    graphicsContext->clearShadow();
+
+    const float roundedRadius = ceilf(m_blurRadius);
+    const float twiceRadius = roundedRadius * 2;
+
+    m_layerImage = ScratchBuffer::shared().getScratchBuffer(templateSize);
+
+    // Draw the rectangle with hole.
+    FloatRect templateBounds(0, 0, templateSize.width(), templateSize.height());
+    FloatRect templateHole = FloatRect(roundedRadius, roundedRadius, templateSize.width() - twiceRadius, templateSize.height() - twiceRadius);
+    Path path;
+    path.addRect(templateBounds);
+    path.addRoundedRect(templateHole, radii.topLeft(), radii.topRight(), radii.bottomLeft(), radii.bottomRight());
+
+    // Draw shadow into a new ImageBuffer.
+    GraphicsContext* shadowContext = m_layerImage->context();
+    shadowContext->save();
+    shadowContext->clearRect(templateBounds);
+    shadowContext->setFillRule(RULE_EVENODD);
+    shadowContext->setFillColor(Color::black, ColorSpaceDeviceRGB);
+    shadowContext->fillPath(path);
+    blurAndColorShadowBuffer(templateSize);
+    shadowContext->restore();
+
+    FloatRect boundingRect = rect;
+    boundingRect.move(m_offset);
+
+    FloatRect destHoleRect = holeRect;
+    destHoleRect.move(m_offset);
+    FloatRect destHoleBounds = destHoleRect;
+    destHoleBounds.inflate(roundedRadius);
+
+    // Fill the external part of the shadow (which may be visible because of offset).
+    Path exteriorPath;
+    exteriorPath.addRect(boundingRect);
+    exteriorPath.addRect(destHoleBounds);
+
+    graphicsContext->save();
+    graphicsContext->setFillRule(RULE_EVENODD);
+    graphicsContext->setFillColor(m_color, m_colorSpace);
+    graphicsContext->fillPath(exteriorPath);
+    graphicsContext->restore();
+    
+    drawLayerPieces(graphicsContext, destHoleBounds, radii, roundedRadius, templateSize, InnerShadow);
+
+    graphicsContext->restore();
+
+    m_layerImage = 0;
+    // Schedule a purge of the scratch buffer.
+    ScratchBuffer::shared().scheduleScratchBufferPurge();
+}
+
+void ShadowBlur::drawRectShadowWithTiling(GraphicsContext* graphicsContext, const FloatRect& shadowedRect, const RoundedIntRect::Radii& radii, const IntSize& templateSize)
+{
+    graphicsContext->save();
+    graphicsContext->clearShadow();
+
+    const float roundedRadius = ceilf(m_blurRadius);
+    const float twiceRadius = roundedRadius * 2;
+
+    m_layerImage = ScratchBuffer::shared().getScratchBuffer(templateSize);
+
+    // Draw the rectangle.
+    FloatRect templateShadow = FloatRect(roundedRadius, roundedRadius, templateSize.width() - twiceRadius, templateSize.height() - twiceRadius);
+    Path path;
+    path.addRoundedRect(templateShadow, radii.topLeft(), radii.topRight(), radii.bottomLeft(), radii.bottomRight());
+
+    // Draw shadow into the ImageBuffer.
+    GraphicsContext* shadowContext = m_layerImage->context();
+    shadowContext->save();
+    shadowContext->clearRect(FloatRect(0, 0, templateSize.width(), templateSize.height()));
+    shadowContext->setFillColor(Color::black, ColorSpaceDeviceRGB);
+    shadowContext->fillPath(path);
+    blurAndColorShadowBuffer(templateSize);
+    shadowContext->restore();
+
+    FloatRect shadowBounds = shadowedRect;
+    shadowBounds.move(m_offset.width(), m_offset.height());
+    shadowBounds.inflate(roundedRadius);
+
+    drawLayerPieces(graphicsContext, shadowBounds, radii, roundedRadius, templateSize, OuterShadow);
+
+    graphicsContext->restore();
+
+    m_layerImage = 0;
+    // Schedule a purge of the scratch buffer.
+    ScratchBuffer::shared().scheduleScratchBufferPurge();
+}
+
+void ShadowBlur::drawLayerPieces(GraphicsContext* graphicsContext, const FloatRect& shadowBounds, const RoundedIntRect::Radii& radii, float roundedRadius, const IntSize& templateSize, ShadowDirection direction)
+{
+    const float twiceRadius = roundedRadius * 2;
+
+    int leftSlice;
+    int rightSlice;
+    int topSlice;
+    int bottomSlice;
+    computeSliceSizesFromRadii(twiceRadius, radii, leftSlice, rightSlice, topSlice, bottomSlice);
+
+    int centerWidth = shadowBounds.width() - leftSlice - rightSlice;
+    int centerHeight = shadowBounds.height() - topSlice - bottomSlice;
+
+    if (direction == OuterShadow) {
+        FloatRect shadowInterior(shadowBounds.x() + leftSlice, shadowBounds.y() + topSlice, centerWidth, centerHeight);
+        if (!shadowInterior.isEmpty()) {
+            graphicsContext->save();
+            
+            graphicsContext->setFillColor(m_color, m_colorSpace);
+            graphicsContext->fillRect(shadowInterior);
+            
+            graphicsContext->restore();
+        }
+    }
+
+    // Note that drawing the ImageBuffer is faster than creating a Image and drawing that,
+    // because ImageBuffer::draw() knows that it doesn't have to copy the image bits.
+    
+    // Top side.
+    FloatRect tileRect = FloatRect(leftSlice, 0, templateSideLength, topSlice);
+    FloatRect destRect = FloatRect(shadowBounds.x() + leftSlice, shadowBounds.y(), centerWidth, topSlice);
+    graphicsContext->drawImageBuffer(m_layerImage, ColorSpaceDeviceRGB, destRect, tileRect);
+
+    // Draw the bottom side.
+    tileRect.setY(templateSize.height() - bottomSlice);
+    tileRect.setHeight(bottomSlice);
+    destRect.setY(shadowBounds.maxY() - bottomSlice);
+    destRect.setHeight(bottomSlice);
+    graphicsContext->drawImageBuffer(m_layerImage, ColorSpaceDeviceRGB, destRect, tileRect);
+
+    // Left side.
+    tileRect = FloatRect(0, topSlice, leftSlice, templateSideLength);
+    destRect = FloatRect(shadowBounds.x(), shadowBounds.y() + topSlice, leftSlice, centerHeight);
+    graphicsContext->drawImageBuffer(m_layerImage, ColorSpaceDeviceRGB, destRect, tileRect);
+
+    // Right side.
+    tileRect.setX(templateSize.width() - rightSlice);
+    tileRect.setWidth(rightSlice);
+    destRect.setX(shadowBounds.maxX() - rightSlice);
+    destRect.setWidth(rightSlice);
+    graphicsContext->drawImageBuffer(m_layerImage, ColorSpaceDeviceRGB, destRect, tileRect);
+
+    // Top left corner.
+    tileRect = FloatRect(0, 0, leftSlice, topSlice);
+    destRect = FloatRect(shadowBounds.x(), shadowBounds.y(), leftSlice, topSlice);
+    graphicsContext->drawImageBuffer(m_layerImage, ColorSpaceDeviceRGB, destRect, tileRect);
+
+    // Top right corner.
+    tileRect = FloatRect(templateSize.width() - rightSlice, 0, rightSlice, topSlice);
+    destRect = FloatRect(shadowBounds.maxX() - rightSlice, shadowBounds.y(), rightSlice, topSlice);
+    graphicsContext->drawImageBuffer(m_layerImage, ColorSpaceDeviceRGB, destRect, tileRect);
+
+    // Bottom right corner.
+    tileRect = FloatRect(templateSize.width() - rightSlice, templateSize.height() - bottomSlice, rightSlice, bottomSlice);
+    destRect = FloatRect(shadowBounds.maxX() - rightSlice, shadowBounds.maxY() - bottomSlice, rightSlice, bottomSlice);
+    graphicsContext->drawImageBuffer(m_layerImage, ColorSpaceDeviceRGB, destRect, tileRect);
+
+    // Bottom left corner.
+    tileRect = FloatRect(0, templateSize.height() - bottomSlice, leftSlice, bottomSlice);
+    destRect = FloatRect(shadowBounds.x(), shadowBounds.maxY() - bottomSlice, leftSlice, bottomSlice);
+    graphicsContext->drawImageBuffer(m_layerImage, ColorSpaceDeviceRGB, destRect, tileRect);
+}
+
+
+void ShadowBlur::blurAndColorShadowBuffer(const IntSize& templateSize)
+{
+    {
+        IntRect blurRect(IntPoint(), templateSize);
+        RefPtr<ByteArray> layerData = m_layerImage->getUnmultipliedImageData(blurRect);
+        blurLayerImage(layerData->data(), blurRect.size(), blurRect.width() * 4);
+        m_layerImage->putUnmultipliedImageData(layerData.get(), blurRect.size(), blurRect, IntPoint());
+    }
+
+    // Mask the image with the shadow color.
+    GraphicsContext* shadowContext = m_layerImage->context();
+    shadowContext->setCompositeOperation(CompositeSourceIn);
+    shadowContext->setFillColor(m_color, m_colorSpace);
+    shadowContext->fillRect(FloatRect(0, 0, templateSize.width(), templateSize.height()));
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/ShadowBlur.h b/Source/WebCore/platform/graphics/ShadowBlur.h
new file mode 100644
index 0000000..e52d6dc
--- /dev/null
+++ b/Source/WebCore/platform/graphics/ShadowBlur.h
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2011 Apple Inc.
+ * Copyright (C) 2010 Sencha, Inc.
+ * Copyright (C) 2010 Igalia S.L.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ShadowBlur_h
+#define ShadowBlur_h
+
+#include "Color.h"
+#include "ColorSpace.h"
+#include "FloatRect.h"
+#include "RoundedIntRect.h"
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+class AffineTransform;
+class GraphicsContext;
+class ImageBuffer;
+
+class ShadowBlur {
+    WTF_MAKE_NONCOPYABLE(ShadowBlur);
+public:
+    ShadowBlur(float radius, const FloatSize& offset, const Color&, ColorSpace);
+
+    void setShadowsIgnoreTransforms(bool ignoreTransforms) { m_shadowsIgnoreTransforms = ignoreTransforms; }
+    bool shadowsIgnoreTransforms() const { return m_shadowsIgnoreTransforms; }
+
+    void drawRectShadow(GraphicsContext*, const FloatRect&, const RoundedIntRect::Radii&);
+    void drawInsetShadow(GraphicsContext*, const FloatRect&, const FloatRect& holeRect, const RoundedIntRect::Radii& holeRadii);
+
+private:
+    GraphicsContext* beginShadowLayer(GraphicsContext*, const IntRect& layerRect);
+    void endShadowLayer(GraphicsContext*);
+
+    void adjustBlurRadius(GraphicsContext*);
+    void blurLayerImage(unsigned char*, const IntSize&, int stride);
+    
+    enum ShadowDirection {
+        OuterShadow,
+        InnerShadow
+    };
+    
+    IntRect calculateLayerBoundingRect(GraphicsContext*, const FloatRect& layerArea, const IntRect& clipRect);
+    IntSize templateSize(const RoundedIntRect::Radii&) const;
+
+    void drawRectShadowWithoutTiling(GraphicsContext*, const FloatRect&, const RoundedIntRect::Radii&, const IntRect& layerRect);
+    void drawRectShadowWithTiling(GraphicsContext*, const FloatRect&, const RoundedIntRect::Radii&, const IntSize& shadowTemplateSize);
+
+    void drawInsetShadowWithoutTiling(GraphicsContext*, const FloatRect&, const FloatRect& holeRect, const RoundedIntRect::Radii&, const IntRect& layerRect);
+    void drawInsetShadowWithTiling(GraphicsContext*, const FloatRect&, const FloatRect& holeRect, const RoundedIntRect::Radii&, const IntSize& shadowTemplateSize);
+    
+    void drawLayerPieces(GraphicsContext*, const FloatRect& shadowBounds, const RoundedIntRect::Radii&, float roundedRadius, const IntSize& templateSize, ShadowDirection);
+    
+    void blurAndColorShadowBuffer(const IntSize& templateSize);
+    
+    enum ShadowType {
+        NoShadow,
+        SolidShadow,
+        BlurShadow
+    };
+    
+    ShadowType m_type;
+
+    Color m_color;
+    ColorSpace m_colorSpace;
+    float m_blurRadius;
+    FloatSize m_offset;
+
+    ImageBuffer* m_layerImage; // Buffer to where the temporary shadow will be drawn to.
+
+    FloatRect m_sourceRect; // Sub-rect of m_layerImage that contains the shadow pixels.
+    FloatPoint m_layerOrigin; // Top-left corner of the (possibly clipped) bounding rect to draw the shadow to.
+    FloatSize m_layerSize; // Size of m_layerImage pixels that need blurring.
+    FloatSize m_layerContextTranslation; // Translation to apply to m_layerContext for the shadow to be correctly clipped.
+
+    bool m_shadowsIgnoreTransforms;
+};
+
+} // namespace WebCore
+
+#endif // ShadowBlur_h
diff --git a/Source/WebCore/platform/graphics/SimpleFontData.cpp b/Source/WebCore/platform/graphics/SimpleFontData.cpp
index e773880..2693609 100644
--- a/Source/WebCore/platform/graphics/SimpleFontData.cpp
+++ b/Source/WebCore/platform/graphics/SimpleFontData.cpp
@@ -50,7 +50,6 @@ namespace WebCore {
 SimpleFontData::SimpleFontData(const FontPlatformData& platformData, bool isCustomFont, bool isLoading)
     : m_maxCharWidth(-1)
     , m_avgCharWidth(-1)
-    , m_unitsPerEm(defaultUnitsPerEm)
     , m_orientation(platformData.orientation())
     , m_platformData(platformData)
     , m_treatAsFixedPitch(false)
@@ -74,31 +73,36 @@ SimpleFontData::SimpleFontData(PassOwnPtr<SVGFontData> svgFontData, int size, bo
     , m_isBrokenIdeographFont(false)
 {
     SVGFontFaceElement* svgFontFaceElement = m_svgFontData->svgFontFaceElement();
-    m_unitsPerEm = svgFontFaceElement->unitsPerEm();
-
-    double scale = size;
-    if (m_unitsPerEm)
-        scale /= m_unitsPerEm;
-
-    m_ascent = static_cast<int>(svgFontFaceElement->ascent() * scale);
-    m_descent = static_cast<int>(svgFontFaceElement->descent() * scale);
-    m_xHeight = static_cast<int>(svgFontFaceElement->xHeight() * scale);
-    m_lineGap = 0.1f * size;
-    m_lineSpacing = m_ascent + m_descent + m_lineGap;
+    unsigned unitsPerEm = svgFontFaceElement->unitsPerEm();
+
+    float scale = size;
+    if (unitsPerEm)
+        scale /= unitsPerEm;
+
+    float xHeight = svgFontFaceElement->xHeight() * scale;
+    float ascent = svgFontFaceElement->ascent() * scale;
+    float descent = svgFontFaceElement->descent() * scale;
+    float lineGap = 0.1f * size;
+    m_fontMetrics.setUnitsPerEm(unitsPerEm);
+    m_fontMetrics.setAscent(ascent);
+    m_fontMetrics.setDescent(descent);
+    m_fontMetrics.setLineGap(lineGap);
+    m_fontMetrics.setLineSpacing(roundf(ascent) + roundf(descent) + roundf(lineGap));
+    m_fontMetrics.setXHeight(xHeight);
 
     SVGFontElement* associatedFontElement = svgFontFaceElement->associatedFontElement();
 
     Vector<SVGGlyphIdentifier> spaceGlyphs;
     associatedFontElement->getGlyphIdentifiersForString(String(" ", 1), spaceGlyphs);
-    m_spaceWidth = spaceGlyphs.isEmpty() ? m_xHeight : static_cast<float>(spaceGlyphs.first().horizontalAdvanceX * scale);
+    m_spaceWidth = spaceGlyphs.isEmpty() ? xHeight : spaceGlyphs.first().horizontalAdvanceX * scale;
 
     Vector<SVGGlyphIdentifier> numeralZeroGlyphs;
     associatedFontElement->getGlyphIdentifiersForString(String("0", 1), numeralZeroGlyphs);
-    m_avgCharWidth = numeralZeroGlyphs.isEmpty() ? m_spaceWidth : static_cast<float>(numeralZeroGlyphs.first().horizontalAdvanceX * scale);
+    m_avgCharWidth = numeralZeroGlyphs.isEmpty() ? m_spaceWidth : numeralZeroGlyphs.first().horizontalAdvanceX * scale;
 
     Vector<SVGGlyphIdentifier> letterWGlyphs;
     associatedFontElement->getGlyphIdentifiersForString(String("W", 1), letterWGlyphs);
-    m_maxCharWidth = letterWGlyphs.isEmpty() ? m_ascent : static_cast<float>(letterWGlyphs.first().horizontalAdvanceX * scale);
+    m_maxCharWidth = letterWGlyphs.isEmpty() ? ascent : letterWGlyphs.first().horizontalAdvanceX * scale;
 
     // FIXME: is there a way we can get the space glyph from the SVGGlyphIdentifier above?
     m_spaceGlyph = 0;
@@ -126,10 +130,10 @@ void SimpleFontData::initCharWidths()
 
     // If we can't retrieve the width of a '0', fall back to the x height.
     if (m_avgCharWidth <= 0.f)
-        m_avgCharWidth = m_xHeight;
+        m_avgCharWidth = m_fontMetrics.xHeight();
 
     if (m_maxCharWidth <= 0.f)
-        m_maxCharWidth = max<float>(m_avgCharWidth, m_ascent);
+        m_maxCharWidth = max(m_avgCharWidth, m_fontMetrics.floatAscent());
 }
 
 void SimpleFontData::platformGlyphInit()
diff --git a/Source/WebCore/platform/graphics/SimpleFontData.h b/Source/WebCore/platform/graphics/SimpleFontData.h
index 90713af..07c2bd1 100644
--- a/Source/WebCore/platform/graphics/SimpleFontData.h
+++ b/Source/WebCore/platform/graphics/SimpleFontData.h
@@ -26,6 +26,7 @@
 
 #include "FontBaseline.h"
 #include "FontData.h"
+#include "FontMetrics.h"
 #include "FontPlatformData.h"
 #include "FloatRect.h"
 #include "GlyphMetricsMap.h"
@@ -101,15 +102,9 @@ public:
     // FIXME: Use the actual metrics for fonts with vertical tables instead of just hard-coding.  If the font is horizontally oriented or
     // a broken ideographic font, then just hard-code to split ascent/descent down the middle.  Otherwise we should actually use the metrics
     // from the font itself.
-    int ascent(FontBaseline baselineType = AlphabeticBaseline) const { return baselineType == AlphabeticBaseline ? m_ascent : height() - height() / 2; }
-    int descent(FontBaseline baselineType = AlphabeticBaseline) const { return baselineType == AlphabeticBaseline ? m_descent : height() / 2; }
-    int height() const { return m_ascent + m_descent; }
-    int lineSpacing() const { return m_lineSpacing; }
-    int lineGap() const { return m_lineGap; }
+    const FontMetrics& fontMetrics() const { return m_fontMetrics; }
     float maxCharWidth() const { return m_maxCharWidth; }
     float avgCharWidth() const { return m_avgCharWidth; }
-    float xHeight() const { return m_xHeight; }
-    unsigned unitsPerEm() const { return m_unitsPerEm; }
 
     FloatRect boundsForGlyph(Glyph) const;
     float widthForGlyph(Glyph glyph) const;
@@ -211,14 +206,9 @@ private:
     float widthForGDIGlyph(Glyph glyph) const;
 #endif
 
-    int m_ascent;
-    int m_descent;
-    int m_lineSpacing;
-    int m_lineGap;
+    FontMetrics m_fontMetrics;
     float m_maxCharWidth;
     float m_avgCharWidth;
-    float m_xHeight;
-    unsigned m_unitsPerEm;
     
     FontOrientation m_orientation; // This is our supported orientation according to the tables in the font.  FontPlatformData will just always have the desired orientation.
                                    // This value represents what we actually support.
diff --git a/Source/WebCore/platform/graphics/StringTruncator.cpp b/Source/WebCore/platform/graphics/StringTruncator.cpp
index 65325f0..8468188 100644
--- a/Source/WebCore/platform/graphics/StringTruncator.cpp
+++ b/Source/WebCore/platform/graphics/StringTruncator.cpp
@@ -29,12 +29,12 @@
 #include "config.h"
 #include "StringTruncator.h"
 
-#include "CharacterNames.h"
 #include "Font.h"
 #include "TextBreakIterator.h"
 #include "TextRun.h"
 #include <wtf/Assertions.h>
 #include <wtf/Vector.h>
+#include <wtf/unicode/CharacterNames.h>
 
 namespace WebCore {
 
diff --git a/Source/WebCore/platform/graphics/TextRun.h b/Source/WebCore/platform/graphics/TextRun.h
index dce5535..ef434bd 100644
--- a/Source/WebCore/platform/graphics/TextRun.h
+++ b/Source/WebCore/platform/graphics/TextRun.h
@@ -2,7 +2,7 @@
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2006, 2007 Apple Computer, Inc.
+ * Copyright (C) 2003, 2006, 2007, 2011 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -33,12 +33,18 @@ class RenderSVGResource;
 
 class TextRun {
 public:
-    TextRun(const UChar* c, int len, bool allowTabs = false, int xpos = 0, int padding = 0, bool rtl = false, bool directionalOverride = false,
+    enum TrailingExpansionBehavior {
+        AllowTrailingExpansion,
+        ForbidTrailingExpansion
+    };
+
+    TextRun(const UChar* c, int len, bool allowTabs = false, int xpos = 0, int expansion = 0, TrailingExpansionBehavior trailingExpansionBehavior = AllowTrailingExpansion, bool rtl = false, bool directionalOverride = false,
               bool applyRunRounding = true, bool applyWordRounding = true)
         : m_characters(c)
         , m_len(len)
         , m_xpos(xpos)
-        , m_padding(padding)
+        , m_expansion(expansion)
+        , m_trailingExpansionBehavior(trailingExpansionBehavior)
 #if ENABLE(SVG)
         , m_horizontalGlyphStretch(1)
 #endif
@@ -55,12 +61,13 @@ public:
     {
     }
 
-    TextRun(const String& s, bool allowTabs = false, int xpos = 0, int padding = 0, bool rtl = false, bool directionalOverride = false,
+    TextRun(const String& s, bool allowTabs = false, int xpos = 0, int expansion = 0, TrailingExpansionBehavior trailingExpansionBehavior = AllowTrailingExpansion, bool rtl = false, bool directionalOverride = false,
               bool applyRunRounding = true, bool applyWordRounding = true)
         : m_characters(s.characters())
         , m_len(s.length())
         , m_xpos(xpos)
-        , m_padding(padding)
+        , m_expansion(expansion)
+        , m_trailingExpansionBehavior(trailingExpansionBehavior)
 #if ENABLE(SVG)
         , m_horizontalGlyphStretch(1)
 #endif
@@ -92,7 +99,8 @@ public:
 
     bool allowTabs() const { return m_allowTabs; }
     int xPos() const { return m_xpos; }
-    int padding() const { return m_padding; }
+    int expansion() const { return m_expansion; }
+    bool allowsTrailingExpansion() const { return m_trailingExpansionBehavior == AllowTrailingExpansion; }
     bool rtl() const { return m_rtl; }
     bool ltr() const { return !m_rtl; }
     bool directionalOverride() const { return m_directionalOverride; }
@@ -121,7 +129,8 @@ private:
     // start of the containing block. In the case of right alignment or center alignment, left start of
     // the text line is not the same as left start of the containing block.
     int m_xpos;  
-    int m_padding;
+    int m_expansion;
+    TrailingExpansionBehavior m_trailingExpansionBehavior;
 #if ENABLE(SVG)
     float m_horizontalGlyphStretch;
 #endif
diff --git a/Source/WebCore/platform/graphics/TiledBackingStore.cpp b/Source/WebCore/platform/graphics/TiledBackingStore.cpp
index 1d6f237..f6921ef 100644
--- a/Source/WebCore/platform/graphics/TiledBackingStore.cpp
+++ b/Source/WebCore/platform/graphics/TiledBackingStore.cpp
@@ -73,8 +73,8 @@ void TiledBackingStore::invalidate(const IntRect& contentsDirtyRect)
 {
     IntRect dirtyRect(mapFromContents(contentsDirtyRect));
     
-    Tile::Coordinate topLeft = tileCoordinateForPoint(dirtyRect.topLeft());
-    Tile::Coordinate bottomRight = tileCoordinateForPoint(dirtyRect.bottomRight());
+    Tile::Coordinate topLeft = tileCoordinateForPoint(dirtyRect.location());
+    Tile::Coordinate bottomRight = tileCoordinateForPoint(IntPoint(dirtyRect.maxX(), dirtyRect.maxY()));
     
     for (unsigned yCoordinate = topLeft.y(); yCoordinate <= bottomRight.y(); ++yCoordinate) {
         for (unsigned xCoordinate = topLeft.x(); xCoordinate <= bottomRight.x(); ++xCoordinate) {
@@ -93,6 +93,8 @@ void TiledBackingStore::updateTileBuffers()
     if (m_contentsFrozen)
         return;
     
+    m_client->tiledBackingStorePaintBegin();
+
     Vector<IntRect> paintedArea;
     Vector<RefPtr<Tile> > dirtyTiles;
     TileMap::iterator end = m_tiles.end();
@@ -104,10 +106,10 @@ void TiledBackingStore::updateTileBuffers()
         paintedArea.append(mapToContents(it->second->rect()));
     }
     
-    if (dirtyTiles.isEmpty())
+    if (dirtyTiles.isEmpty()) {
+        m_client->tiledBackingStorePaintEnd(paintedArea);
         return;
-    
-    m_client->tiledBackingStorePaintBegin();
+    }
 
     // FIXME: In single threaded case, tile back buffers could be updated asynchronously 
     // one by one and then swapped to front in one go. This would minimize the time spent
@@ -132,8 +134,8 @@ void TiledBackingStore::paint(GraphicsContext* context, const IntRect& rect)
     
     IntRect dirtyRect = mapFromContents(rect);
     
-    Tile::Coordinate topLeft = tileCoordinateForPoint(dirtyRect.topLeft());
-    Tile::Coordinate bottomRight = tileCoordinateForPoint(dirtyRect.bottomRight());
+    Tile::Coordinate topLeft = tileCoordinateForPoint(dirtyRect.location());
+    Tile::Coordinate bottomRight = tileCoordinateForPoint(IntPoint(dirtyRect.maxX(), dirtyRect.maxY()));
 
     for (unsigned yCoordinate = topLeft.y(); yCoordinate <= bottomRight.y(); ++yCoordinate) {
         for (unsigned xCoordinate = topLeft.x(); xCoordinate <= bottomRight.x(); ++xCoordinate) {
@@ -227,8 +229,8 @@ void TiledBackingStore::createTiles()
     double shortestDistance = std::numeric_limits<double>::infinity();
     Vector<Tile::Coordinate> tilesToCreate;
     unsigned requiredTileCount = 0;
-    Tile::Coordinate topLeft = tileCoordinateForPoint(coverRect.topLeft());
-    Tile::Coordinate bottomRight = tileCoordinateForPoint(coverRect.bottomRight());
+    Tile::Coordinate topLeft = tileCoordinateForPoint(coverRect.location());
+    Tile::Coordinate bottomRight = tileCoordinateForPoint(IntPoint(coverRect.maxX(), coverRect.maxY()));
     for (unsigned yCoordinate = topLeft.y(); yCoordinate <= bottomRight.y(); ++yCoordinate) {
         for (unsigned xCoordinate = topLeft.x(); xCoordinate <= bottomRight.x(); ++xCoordinate) {
             Tile::Coordinate currentCoordinate(xCoordinate, yCoordinate);
diff --git a/Source/WebCore/platform/graphics/WidthIterator.cpp b/Source/WebCore/platform/graphics/WidthIterator.cpp
index 412c86e..a1a88da 100644
--- a/Source/WebCore/platform/graphics/WidthIterator.cpp
+++ b/Source/WebCore/platform/graphics/WidthIterator.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Holger Hans Peter Freyther
  *
  * This library is free software; you can redistribute it and/or
@@ -47,6 +47,7 @@ WidthIterator::WidthIterator(const Font* font, const TextRun& run, HashSet<const
     , m_end(run.length())
     , m_currentCharacter(0)
     , m_runWidthSoFar(0)
+    , m_isAfterExpansion(true)
     , m_finalRoundingWidth(0)
     , m_fallbackFonts(fallbackFonts)
     , m_accountForGlyphBounds(accountForGlyphBounds)
@@ -58,20 +59,19 @@ WidthIterator::WidthIterator(const Font* font, const TextRun& run, HashSet<const
 {
     // If the padding is non-zero, count the number of spaces in the run
     // and divide that by the padding for per space addition.
-    m_padding = m_run.padding();
-    if (!m_padding)
-        m_padPerSpace = 0;
+    m_expansion = m_run.expansion();
+    if (!m_expansion)
+        m_expansionPerOpportunity = 0;
     else {
-        int numSpaces = 0;
-        for (int i = 0; i < run.length(); i++) {
-            if (Font::treatAsSpace(m_run[i]))
-                numSpaces++;
-        }
+        bool isAfterExpansion = true;
+        unsigned expansionOpportunityCount = Font::expansionOpportunityCount(m_run.characters(), m_end, m_run.ltr() ? LTR : RTL, isAfterExpansion);
+        if (isAfterExpansion && !m_run.allowsTrailingExpansion())
+            expansionOpportunityCount--;
 
-        if (!numSpaces)
-            m_padPerSpace = 0;
+        if (!expansionOpportunityCount)
+            m_expansionPerOpportunity = 0;
         else
-            m_padPerSpace = m_padding / numSpaces;
+            m_expansionPerOpportunity = m_expansion / expansionOpportunityCount;
     }
 }
 
@@ -84,7 +84,7 @@ void WidthIterator::advance(int offset, GlyphBuffer* glyphBuffer)
     const UChar* cp = m_run.data(currentCharacter);
 
     bool rtl = m_run.rtl();
-    bool hasExtraSpacing = (m_font->letterSpacing() || m_font->wordSpacing() || m_padding) && !m_run.spacingDisabled();
+    bool hasExtraSpacing = (m_font->letterSpacing() || m_font->wordSpacing() || m_expansion) && !m_run.spacingDisabled();
 
     float widthSinceLastRounding = m_runWidthSoFar;
     m_runWidthSoFar = floorf(m_runWidthSoFar);
@@ -173,26 +173,34 @@ void WidthIterator::advance(int offset, GlyphBuffer* glyphBuffer)
             if (width && m_font->letterSpacing())
                 width += m_font->letterSpacing();
 
-            if (Font::treatAsSpace(c)) {
-                // Account for padding. WebCore uses space padding to justify text.
-                // We distribute the specified padding over the available spaces in the run.
-                if (m_padding) {
-                    // Use left over padding if not evenly divisible by number of spaces.
-                    if (m_padding < m_padPerSpace) {
-                        width += m_padding;
-                        m_padding = 0;
-                    } else {
-                        float previousPadding = m_padding;
-                        m_padding -= m_padPerSpace;
-                        width += roundf(previousPadding) - roundf(m_padding);
+            static bool expandAroundIdeographs = Font::canExpandAroundIdeographsInComplexText();
+            bool treatAsSpace = Font::treatAsSpace(c);
+            if (treatAsSpace || (expandAroundIdeographs && Font::isCJKIdeographOrSymbol(c))) {
+                // Distribute the run's total expansion evenly over all expansion opportunities in the run.
+                if (m_expansion && (m_run.allowsTrailingExpansion() || (m_run.ltr() && currentCharacter + clusterLength < static_cast<size_t>(m_run.length()))
+                    || (m_run.rtl() && currentCharacter))) {
+                    float previousExpansion = m_expansion;
+                    if (!treatAsSpace && !m_isAfterExpansion) {
+                        // Take the expansion opportunity before this ideograph.
+                        m_expansion -= m_expansionPerOpportunity;
+                        int expansion = roundf(previousExpansion) - roundf(m_expansion);
+                        m_runWidthSoFar += expansion;
+                        if (glyphBuffer)
+                            glyphBuffer->expandLastAdvance(expansion);
+                        previousExpansion = m_expansion;
                     }
-                }
+                    m_expansion -= m_expansionPerOpportunity;
+                    width += roundf(previousExpansion) - roundf(m_expansion);
+                    m_isAfterExpansion = true;
+                } else
+                    m_isAfterExpansion = false;
 
                 // Account for word spacing.
                 // We apply additional space between "words" by adding width to the space character.
-                if (currentCharacter != 0 && !Font::treatAsSpace(cp[-1]) && m_font->wordSpacing())
+                if (treatAsSpace && currentCharacter && !Font::treatAsSpace(cp[-1]) && m_font->wordSpacing())
                     width += m_font->wordSpacing();
-            }
+            } else
+                m_isAfterExpansion = false;
         }
 
         if (m_accountForGlyphBounds) {
@@ -247,9 +255,9 @@ void WidthIterator::advance(int offset, GlyphBuffer* glyphBuffer)
         lastRoundingWidth = width - oldWidth;
 
         if (m_accountForGlyphBounds) {
-            m_maxGlyphBoundingBoxY = max(m_maxGlyphBoundingBoxY, bounds.bottom());
+            m_maxGlyphBoundingBoxY = max(m_maxGlyphBoundingBoxY, bounds.maxY());
             m_minGlyphBoundingBoxY = min(m_minGlyphBoundingBoxY, bounds.y());
-            m_lastGlyphOverflow = max<float>(0, bounds.right() - width);
+            m_lastGlyphOverflow = max<float>(0, bounds.maxX() - width);
         }
     }
 
@@ -260,13 +268,13 @@ void WidthIterator::advance(int offset, GlyphBuffer* glyphBuffer)
 
 bool WidthIterator::advanceOneCharacter(float& width, GlyphBuffer* glyphBuffer)
 {
-    glyphBuffer->clear();
+    int oldSize = glyphBuffer->size();
     advance(m_currentCharacter + 1, glyphBuffer);
     float w = 0;
-    for (int i = 0; i < glyphBuffer->size(); ++i)
+    for (int i = oldSize; i < glyphBuffer->size(); ++i)
         w += glyphBuffer->advanceAt(i);
     width = w;
-    return !glyphBuffer->isEmpty();
+    return glyphBuffer->size() > oldSize;
 }
 
 UChar32 WidthIterator::normalizeVoicingMarks(int currentCharacter)
diff --git a/Source/WebCore/platform/graphics/WidthIterator.h b/Source/WebCore/platform/graphics/WidthIterator.h
index 8b3c067..2b4f051 100644
--- a/Source/WebCore/platform/graphics/WidthIterator.h
+++ b/Source/WebCore/platform/graphics/WidthIterator.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2008, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Holger Hans Peter Freyther
  *
  * This library is free software; you can redistribute it and/or
@@ -50,8 +50,9 @@ struct WidthIterator {
 
     unsigned m_currentCharacter;
     float m_runWidthSoFar;
-    float m_padding;
-    float m_padPerSpace;
+    float m_expansion;
+    float m_expansionPerOpportunity;
+    bool m_isAfterExpansion;
     float m_finalRoundingWidth;
 
 private:
diff --git a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
index 01e25e9..2b4a39e 100644
--- a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
+++ b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
@@ -1507,7 +1507,7 @@ void GraphicsLayerCA::pauseCAAnimationOnLayer(AnimatedPropertyID property, const
         return;
 
     // Animations on the layer are immutable, so we have to clone and modify.
-    RefPtr<PlatformCAAnimation> newAnim = PlatformCAAnimation::create(curAnim.get());
+    RefPtr<PlatformCAAnimation> newAnim = curAnim->copy();
 
     newAnim->setSpeed(0);
     newAnim->setTimeOffset(timeOffset);
@@ -1646,7 +1646,7 @@ void GraphicsLayerCA::setupAnimation(PlatformCAAnimation* propertyAnim, const An
 
     float repeatCount = anim->iterationCount();
     if (repeatCount == Animation::IterationCountInfinite)
-        repeatCount = FLT_MAX;
+        repeatCount = numeric_limits<float>::max();
     else if (anim->direction() == Animation::AnimationDirectionAlternate)
         repeatCount /= 2;
 
diff --git a/Source/WebCore/platform/graphics/ca/PlatformCAAnimation.h b/Source/WebCore/platform/graphics/ca/PlatformCAAnimation.h
index 4bfce63..a8528fd 100644
--- a/Source/WebCore/platform/graphics/ca/PlatformCAAnimation.h
+++ b/Source/WebCore/platform/graphics/ca/PlatformCAAnimation.h
@@ -63,13 +63,14 @@ public:
     enum ValueFunctionType { NoValueFunction, RotateX, RotateY, RotateZ, ScaleX, ScaleY, ScaleZ, Scale, TranslateX, TranslateY, TranslateZ, Translate };
 
     static PassRefPtr<PlatformCAAnimation> create(AnimationType, const String& keyPath);
-    static PassRefPtr<PlatformCAAnimation> create(PlatformAnimationRef animation);
-    static PassRefPtr<PlatformCAAnimation> create(const PlatformCAAnimation* animation);
+    static PassRefPtr<PlatformCAAnimation> create(PlatformAnimationRef);
 
     ~PlatformCAAnimation();
     
     static bool supportsValueFunction();
     
+    PassRefPtr<PlatformCAAnimation> copy() const;
+
     PlatformAnimationRef platformAnimation() const;
     
     AnimationType animationType() const { return m_type; }
@@ -136,8 +137,7 @@ public:
     
 protected:
     PlatformCAAnimation(AnimationType, const String& keyPath);
-    PlatformCAAnimation(PlatformAnimationRef animation);
-    PlatformCAAnimation(const PlatformCAAnimation* animation);
+    PlatformCAAnimation(PlatformAnimationRef);
     
 private:
     AnimationType m_type;
diff --git a/Source/WebCore/platform/graphics/ca/mac/PlatformCAAnimationMac.mm b/Source/WebCore/platform/graphics/ca/mac/PlatformCAAnimationMac.mm
index 2a00857..506bd40 100644
--- a/Source/WebCore/platform/graphics/ca/mac/PlatformCAAnimationMac.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/PlatformCAAnimationMac.mm
@@ -159,11 +159,6 @@ PassRefPtr<PlatformCAAnimation> PlatformCAAnimation::create(PlatformAnimationRef
     return adoptRef(new PlatformCAAnimation(animation));
 }
 
-PassRefPtr<PlatformCAAnimation> PlatformCAAnimation::create(const PlatformCAAnimation* animation)
-{
-    return adoptRef(new PlatformCAAnimation(animation));
-}
-
 PlatformCAAnimation::PlatformCAAnimation(AnimationType type, const String& keyPath)
     : m_type(type)
 {
@@ -187,38 +182,36 @@ PlatformCAAnimation::PlatformCAAnimation(PlatformAnimationRef animation)
     m_animation = static_cast<CAPropertyAnimation*>(animation);
 }
 
-PlatformCAAnimation::PlatformCAAnimation(const PlatformCAAnimation* animation)
+PassRefPtr<PlatformCAAnimation> PlatformCAAnimation::copy() const
 {
-    PlatformCAAnimation* newAnimation = new PlatformCAAnimation(animation->animationType(), animation->keyPath());
-
-    newAnimation->setBeginTime(animation->beginTime());
-    newAnimation->setDuration(animation->duration());
-    newAnimation->setSpeed(animation->speed());
-    newAnimation->setTimeOffset(animation->timeOffset());
-    newAnimation->setRepeatCount(animation->repeatCount());
-    newAnimation->setAutoreverses(animation->autoreverses());
-    newAnimation->setFillMode(animation->fillMode());
-    newAnimation->setRemovedOnCompletion(animation->isRemovedOnCompletion());
-    newAnimation->setAdditive(animation->isAdditive());
-    newAnimation->copyTimingFunctionFrom(animation);
-
-#if HAVE_MODERN_QUARTZCORE
-    newAnimation->setValueFunction(animation->valueFunction());
-#endif
-
-    setNonZeroBeginTimeFlag(newAnimation, hasNonZeroBeginTimeFlag(animation));
+    RefPtr<PlatformCAAnimation> animation = create(animationType(), keyPath());
+    
+    animation->setBeginTime(beginTime());
+    animation->setDuration(duration());
+    animation->setSpeed(speed());
+    animation->setTimeOffset(timeOffset());
+    animation->setRepeatCount(repeatCount());
+    animation->setAutoreverses(autoreverses());
+    animation->setFillMode(fillMode());
+    animation->setRemovedOnCompletion(isRemovedOnCompletion());
+    animation->setAdditive(isAdditive());
+    animation->copyTimingFunctionFrom(this);
+    animation->setValueFunction(valueFunction());
+
+    setNonZeroBeginTimeFlag(animation.get(), hasNonZeroBeginTimeFlag(this));
     
     // Copy the specific Basic or Keyframe values
-    if (animation->animationType() == Keyframe) {
-        newAnimation->copyValuesFrom(animation);
-        newAnimation->copyKeyTimesFrom(animation);
-        newAnimation->copyTimingFunctionsFrom(animation);
+    if (animationType() == Keyframe) {
+        animation->copyValuesFrom(this);
+        animation->copyKeyTimesFrom(this);
+        animation->copyTimingFunctionsFrom(this);
     } else {
-        newAnimation->copyFromValueFrom(animation);
-        newAnimation->copyToValueFrom(animation);
+        animation->copyFromValueFrom(this);
+        animation->copyToValueFrom(this);
     }
+    
+    return animation;
 }
-
 PlatformCAAnimation::~PlatformCAAnimation()
 {
 }
diff --git a/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.cpp b/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.cpp
index 1d27608..9dc30ea 100644
--- a/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.cpp
+++ b/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.cpp
@@ -28,49 +28,22 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
+#include "CACFLayerTreeHostClient.h"
 #include "LayerChangesFlusher.h"
+#include "LegacyCACFLayerTreeHost.h"
 #include "PlatformCALayer.h"
+#include "WKCACFViewLayerTreeHost.h"
 #include "WebCoreInstanceHandle.h"
-#include <WebKitSystemInterface/WebKitSystemInterface.h>
 #include <limits.h>
 #include <wtf/CurrentTime.h>
-#include <wtf/HashMap.h>
 #include <wtf/OwnArrayPtr.h>
-#include <wtf/OwnPtr.h>
-#include <wtf/PassOwnPtr.h>
-#include <wtf/StdLibExtras.h>
 
-#ifndef NDEBUG
-#define D3D_DEBUG_INFO
-#endif
-
-#include <d3d9.h>
-#include <d3dx9.h>
-
-using namespace std;
-
-#pragma comment(lib, "d3d9")
-#pragma comment(lib, "d3dx9")
 #ifdef DEBUG_ALL
 #pragma comment(lib, "QuartzCore_debug")
 #else
 #pragma comment(lib, "QuartzCore")
 #endif
 
-static IDirect3D9* s_d3d = 0;
-static IDirect3D9* d3d()
-{
-    if (s_d3d)
-        return s_d3d;
-
-    if (!LoadLibrary(TEXT("d3d9.dll")))
-        return 0;
-
-    s_d3d = Direct3DCreate9(D3D_SDK_VERSION);
-
-    return s_d3d;
-}
-
 inline static CGRect winRectToCGRect(RECT rc)
 {
     return CGRectMake(rc.left, rc.top, (rc.right - rc.left), (rc.bottom - rc.top));
@@ -83,40 +56,6 @@ inline static CGRect winRectToCGRect(RECT rc, RECT relativeToRect)
 
 namespace WebCore {
 
-static D3DPRESENT_PARAMETERS initialPresentationParameters()
-{
-    D3DPRESENT_PARAMETERS parameters = {0};
-    parameters.Windowed = TRUE;
-    parameters.SwapEffect = D3DSWAPEFFECT_COPY;
-    parameters.BackBufferCount = 1;
-    parameters.BackBufferFormat = D3DFMT_A8R8G8B8;
-    parameters.MultiSampleType = D3DMULTISAMPLE_NONE;
-
-    return parameters;
-}
-
-// FIXME: <rdar://6507851> Share this code with CoreAnimation.
-static bool hardwareCapabilitiesIndicateCoreAnimationSupport(const D3DCAPS9& caps)
-{
-    // CoreAnimation needs two or more texture units.
-    if (caps.MaxTextureBlendStages < 2)
-        return false;
-
-    // CoreAnimation needs non-power-of-two textures.
-    if ((caps.TextureCaps & D3DPTEXTURECAPS_POW2) && !(caps.TextureCaps & D3DPTEXTURECAPS_NONPOW2CONDITIONAL))
-        return false;
-
-    // CoreAnimation needs vertex shader 2.0 or greater.
-    if (D3DSHADER_VERSION_MAJOR(caps.VertexShaderVersion) < 2)
-        return false;
-
-    // CoreAnimation needs pixel shader 2.0 or greater.
-    if (D3DSHADER_VERSION_MAJOR(caps.PixelShaderVersion) < 2)
-        return false;
-
-    return true;
-}
-
 bool CACFLayerTreeHost::acceleratedCompositingAvailable()
 {
     static bool available;
@@ -158,7 +97,7 @@ bool CACFLayerTreeHost::acceleratedCompositingAvailable()
     wcex.hInstance = WebCore::instanceHandle();
     wcex.lpszClassName = L"CoreAnimationTesterWindowClass";
     ::RegisterClassEx(&wcex);
-    HWND testWindow = ::CreateWindow(L"CoreAnimationTesterWindowClass", L"CoreAnimationTesterWindow", WS_POPUP, -500, -500, 0, 0, 0, 0, 0, 0);
+    HWND testWindow = ::CreateWindow(L"CoreAnimationTesterWindowClass", L"CoreAnimationTesterWindow", WS_POPUP, -500, -500, 20, 20, 0, 0, 0, 0);
 
     if (!testWindow) {
         available = false;
@@ -168,6 +107,7 @@ bool CACFLayerTreeHost::acceleratedCompositingAvailable()
     RefPtr<CACFLayerTreeHost> host = CACFLayerTreeHost::create();
     host->setWindow(testWindow);
     available = host->createRenderer();
+    host->setWindow(0);
     ::DestroyWindow(testWindow);
 
     return available;
@@ -177,22 +117,29 @@ PassRefPtr<CACFLayerTreeHost> CACFLayerTreeHost::create()
 {
     if (!acceleratedCompositingAvailable())
         return 0;
-    return adoptRef(new CACFLayerTreeHost());
+    RefPtr<CACFLayerTreeHost> host = WKCACFViewLayerTreeHost::create();
+    if (!host)
+        host = LegacyCACFLayerTreeHost::create();
+    host->initialize();
+    return host.release();
 }
 
 CACFLayerTreeHost::CACFLayerTreeHost()
     : m_client(0)
-    , m_mightBeAbleToCreateDeviceLater(true)
     , m_rootLayer(PlatformCALayer::create(PlatformCALayer::LayerTypeRootLayer, 0))
-    , m_context(wkCACFContextCreate())
     , m_window(0)
-    , m_renderTimer(this, &CACFLayerTreeHost::renderTimerFired)
-    , m_mustResetLostDeviceBeforeRendering(false)
     , m_shouldFlushPendingGraphicsLayerChanges(false)
     , m_isFlushingLayerChanges(false)
+#if !ASSERT_DISABLED
+    , m_state(WindowNotSet)
+#endif
+{
+}
+
+void CACFLayerTreeHost::initialize()
 {
     // Point the CACFContext to this
-    wkCACFContextSetUserData(m_context, this);
+    initializeContext(this, m_rootLayer.get());
 
     // Under the root layer, we have a clipping layer to clip the content,
     // that contains a scroll layer that we use for scrolling the content.
@@ -212,20 +159,11 @@ CACFLayerTreeHost::CACFLayerTreeHost()
     m_rootLayer->setBackgroundColor(debugColor);
     CGColorRelease(debugColor);
 #endif
-
-    if (m_context)
-        wkCACFContextSetLayer(m_context, m_rootLayer->platformLayer());
-
-#ifndef NDEBUG
-    char* printTreeFlag = getenv("CA_PRINT_TREE");
-    m_printTree = printTreeFlag && atoi(printTreeFlag);
-#endif
 }
 
 CACFLayerTreeHost::~CACFLayerTreeHost()
 {
-    setWindow(0);
-    wkCACFContextDestroy(m_context);
+    ASSERT_WITH_MESSAGE(m_state != WindowSet, "Must call setWindow(0) before destroying CACFLayerTreeHost");
 }
 
 void CACFLayerTreeHost::setWindow(HWND window)
@@ -233,13 +171,28 @@ void CACFLayerTreeHost::setWindow(HWND window)
     if (window == m_window)
         return;
 
+#if !ASSERT_DISABLED
+    switch (m_state) {
+    case WindowNotSet:
+        ASSERT_ARG(window, window);
+        ASSERT(!m_window);
+        m_state = WindowSet;
+        break;
+    case WindowSet:
+        ASSERT_ARG(window, !window);
+        ASSERT(m_window);
+        m_state = WindowCleared;
+        break;
+    case WindowCleared:
+        ASSERT_NOT_REACHED();
+        break;
+    }
+#endif
+
     if (m_window)
         destroyRenderer();
 
     m_window = window;
-
-    if (m_window)
-        createRenderer();
 }
 
 PlatformCALayer* CACFLayerTreeHost::rootLayer() const
@@ -275,109 +228,11 @@ void CACFLayerTreeHost::layerTreeDidChange()
     LayerChangesFlusher::shared().flushPendingLayerChangesSoon(this);
 }
 
-bool CACFLayerTreeHost::createRenderer()
-{
-    if (m_d3dDevice || !m_mightBeAbleToCreateDeviceLater)
-        return m_d3dDevice;
-
-    m_mightBeAbleToCreateDeviceLater = false;
-    D3DPRESENT_PARAMETERS parameters = initialPresentationParameters();
-
-    if (!d3d() || !::IsWindow(m_window))
-        return false;
-
-    // D3D doesn't like to make back buffers for 0 size windows. We skirt this problem if we make the
-    // passed backbuffer width and height non-zero. The window will necessarily get set to a non-zero
-    // size eventually, and then the backbuffer size will get reset.
-    RECT rect;
-    GetClientRect(m_window, &rect);
-
-    if (rect.left-rect.right == 0 || rect.bottom-rect.top == 0) {
-        parameters.BackBufferWidth = 1;
-        parameters.BackBufferHeight = 1;
-    }
-
-    D3DCAPS9 d3dCaps;
-    if (FAILED(d3d()->GetDeviceCaps(D3DADAPTER_DEFAULT, D3DDEVTYPE_HAL, &d3dCaps)))
-        return false;
-
-    DWORD behaviorFlags = D3DCREATE_FPU_PRESERVE;
-    if ((d3dCaps.DevCaps & D3DDEVCAPS_HWTRANSFORMANDLIGHT) && d3dCaps.VertexProcessingCaps)
-        behaviorFlags |= D3DCREATE_HARDWARE_VERTEXPROCESSING;
-    else
-        behaviorFlags |= D3DCREATE_SOFTWARE_VERTEXPROCESSING;
-
-    COMPtr<IDirect3DDevice9> device;
-    if (FAILED(d3d()->CreateDevice(D3DADAPTER_DEFAULT, D3DDEVTYPE_HAL, m_window, behaviorFlags, &parameters, &device))) {
-        // In certain situations (e.g., shortly after waking from sleep), Direct3DCreate9() will
-        // return an IDirect3D9 for which IDirect3D9::CreateDevice will always fail. In case we
-        // have one of these bad IDirect3D9s, get rid of it so we'll fetch a new one the next time
-        // we want to call CreateDevice.
-        s_d3d->Release();
-        s_d3d = 0;
-
-        // Even if we don't have a bad IDirect3D9, in certain situations (e.g., shortly after
-        // waking from sleep), CreateDevice will fail, but will later succeed if called again.
-        m_mightBeAbleToCreateDeviceLater = true;
-
-        return false;
-    }
-
-    // Now that we've created the IDirect3DDevice9 based on the capabilities we
-    // got from the IDirect3D9 global object, we requery the device for its
-    // actual capabilities. The capabilities returned by the device can
-    // sometimes be more complete, for example when using software vertex
-    // processing.
-    D3DCAPS9 deviceCaps;
-    if (FAILED(device->GetDeviceCaps(&deviceCaps)))
-        return false;
-
-    if (!hardwareCapabilitiesIndicateCoreAnimationSupport(deviceCaps))
-        return false;
-
-    m_d3dDevice = device;
-
-    initD3DGeometry();
-
-    wkCACFContextSetD3DDevice(m_context, m_d3dDevice.get());
-
-    if (IsWindow(m_window))
-        m_rootLayer->setBounds(bounds());
-
-    return true;
-}
-
 void CACFLayerTreeHost::destroyRenderer()
 {
-    LayerChangesFlusher::shared().cancelPendingFlush(this);
-
-    wkCACFContextSetLayer(m_context, 0);
-
-    wkCACFContextSetD3DDevice(m_context, 0);
-    m_d3dDevice = 0;
-    if (s_d3d)
-        s_d3d->Release();
-
-    s_d3d = 0;
     m_rootLayer = 0;
     m_rootChildLayer = 0;
-
-    m_mightBeAbleToCreateDeviceLater = true;
-}
-
-void CACFLayerTreeHost::resize()
-{
-    if (!m_d3dDevice)
-        return;
-
-    // Resetting the device might fail here. But that's OK, because if it does it we will attempt to
-    // reset the device the next time we try to render.
-    resetDevice(ChangedWindowSize);
-
-    if (m_rootLayer) {
-        m_rootLayer->setBounds(bounds());
-        wkCACFContextFlush(m_context);
-    }
+    LayerChangesFlusher::shared().cancelPendingFlush(this);
 }
 
 static void getDirtyRects(HWND window, Vector<CGRect>& outRects)
@@ -398,7 +253,7 @@ static void getDirtyRects(HWND window, Vector<CGRect>& outRects)
     }
 
     DWORD dataSize = GetRegionData(region.get(), 0, 0);
-    OwnArrayPtr<unsigned char> regionDataBuffer(new unsigned char[dataSize]);
+    OwnArrayPtr<unsigned char> regionDataBuffer = adoptArrayPtr(new unsigned char[dataSize]);
     RGNDATA* regionData = reinterpret_cast<RGNDATA*>(regionDataBuffer.get());
     if (!GetRegionData(region.get(), dataSize, regionData))
         return;
@@ -410,120 +265,13 @@ static void getDirtyRects(HWND window, Vector<CGRect>& outRects)
         outRects[i] = winRectToCGRect(*rect, clientRect);
 }
 
-void CACFLayerTreeHost::renderTimerFired(Timer<CACFLayerTreeHost>*)
-{
-    paint();
-}
-
 void CACFLayerTreeHost::paint()
 {
-    createRenderer();
-    if (!m_d3dDevice) {
-        if (m_mightBeAbleToCreateDeviceLater)
-            renderSoon();
-        return;
-    }
-
     Vector<CGRect> dirtyRects;
     getDirtyRects(m_window, dirtyRects);
     render(dirtyRects);
 }
 
-void CACFLayerTreeHost::render(const Vector<CGRect>& windowDirtyRects)
-{
-    ASSERT(m_d3dDevice);
-
-    if (m_mustResetLostDeviceBeforeRendering && !resetDevice(LostDevice)) {
-        // We can't reset the device right now. Try again soon.
-        renderSoon();
-        return;
-    }
-
-    // All pending animations will have been started with the flush. Fire the animationStarted calls
-    double currentTime = WTF::currentTime();
-    double currentMediaTime = CACurrentMediaTime();
-    double t = currentTime + wkCACFContextGetLastCommitTime(m_context) - currentMediaTime;
-    ASSERT(t <= currentTime);
-
-    HashSet<RefPtr<PlatformCALayer> >::iterator end = m_pendingAnimatedLayers.end();
-    for (HashSet<RefPtr<PlatformCALayer> >::iterator it = m_pendingAnimatedLayers.begin(); it != end; ++it) {
-        PlatformCALayerClient* owner = (*it)->owner();
-        owner->platformCALayerAnimationStarted(t);
-    }
-
-    m_pendingAnimatedLayers.clear();
-
-    CGRect bounds = this->bounds();
-
-    // Give the renderer some space to use. This needs to be valid until the
-    // wkCACFContextFinishUpdate() call below.
-    char space[4096];
-    if (!wkCACFContextBeginUpdate(m_context, space, sizeof(space), currentMediaTime, bounds, windowDirtyRects.data(), windowDirtyRects.size()))
-        return;
-
-    HRESULT err = S_OK;
-    CFTimeInterval timeToNextRender = numeric_limits<CFTimeInterval>::infinity();
-
-    do {
-        // FIXME: don't need to clear dirty region if layer tree is opaque.
-
-        WKCACFUpdateRectEnumerator* e = wkCACFContextCopyUpdateRectEnumerator(m_context);
-        if (!e)
-            break;
-
-        Vector<D3DRECT, 64> rects;
-        for (const CGRect* r = wkCACFUpdateRectEnumeratorNextRect(e); r; r = wkCACFUpdateRectEnumeratorNextRect(e)) {
-            D3DRECT rect;
-            rect.x1 = r->origin.x;
-            rect.x2 = rect.x1 + r->size.width;
-            rect.y1 = bounds.origin.y + bounds.size.height - (r->origin.y + r->size.height);
-            rect.y2 = rect.y1 + r->size.height;
-
-            rects.append(rect);
-        }
-        wkCACFUpdateRectEnumeratorRelease(e);
-
-        timeToNextRender = wkCACFContextGetNextUpdateTime(m_context);
-
-        if (rects.isEmpty())
-            break;
-
-        m_d3dDevice->Clear(rects.size(), rects.data(), D3DCLEAR_TARGET, 0, 1.0f, 0);
-
-        m_d3dDevice->BeginScene();
-        wkCACFContextRenderUpdate(m_context);
-        m_d3dDevice->EndScene();
-
-        err = m_d3dDevice->Present(0, 0, 0, 0);
-
-        if (err == D3DERR_DEVICELOST) {
-            wkCACFContextAddUpdateRect(m_context, bounds);
-            if (!resetDevice(LostDevice)) {
-                // We can't reset the device right now. Try again soon.
-                renderSoon();
-                return;
-            }
-        }
-    } while (err == D3DERR_DEVICELOST);
-
-    wkCACFContextFinishUpdate(m_context);
-
-#ifndef NDEBUG
-    if (m_printTree)
-        m_rootLayer->printTree();
-#endif
-
-    // If timeToNextRender is not infinity, it means animations are running, so queue up to render again
-    if (timeToNextRender != numeric_limits<CFTimeInterval>::infinity())
-        renderSoon();
-}
-
-void CACFLayerTreeHost::renderSoon()
-{
-    if (!m_renderTimer.isActive())
-        m_renderTimer.startOneShot(0);
-}
-
 void CACFLayerTreeHost::flushPendingGraphicsLayerChangesSoon()
 {
     m_shouldFlushPendingGraphicsLayerChanges = true;
@@ -545,75 +293,36 @@ void CACFLayerTreeHost::flushPendingLayerChangesNow()
     }
 
     // Flush changes stored up in PlatformCALayers to the context so they will be rendered.
-    wkCACFContextFlush(m_context);
-
-    renderSoon();
+    flushContext();
 
     m_isFlushingLayerChanges = false;
 }
 
-CGRect CACFLayerTreeHost::bounds() const
+void CACFLayerTreeHost::contextDidChange()
 {
-    RECT clientRect;
-    GetClientRect(m_window, &clientRect);
-
-    return winRectToCGRect(clientRect);
+    // All pending animations will have been started with the flush. Fire the animationStarted calls.
+    notifyAnimationsStarted();
 }
 
-void CACFLayerTreeHost::initD3DGeometry()
+void CACFLayerTreeHost::notifyAnimationsStarted()
 {
-    ASSERT(m_d3dDevice);
-
-    CGRect bounds = this->bounds();
-
-    float x0 = bounds.origin.x;
-    float y0 = bounds.origin.y;
-    float x1 = x0 + bounds.size.width;
-    float y1 = y0 + bounds.size.height;
+    double currentTime = WTF::currentTime();
+    double time = currentTime + lastCommitTime() - CACurrentMediaTime();
+    ASSERT(time <= currentTime);
 
-    D3DXMATRIXA16 projection;
-    D3DXMatrixOrthoOffCenterRH(&projection, x0, x1, y0, y1, -1.0f, 1.0f);
+    HashSet<RefPtr<PlatformCALayer> >::iterator end = m_pendingAnimatedLayers.end();
+    for (HashSet<RefPtr<PlatformCALayer> >::iterator it = m_pendingAnimatedLayers.begin(); it != end; ++it)
+        (*it)->animationStarted(time);
 
-    m_d3dDevice->SetTransform(D3DTS_PROJECTION, &projection);
+    m_pendingAnimatedLayers.clear();
 }
 
-bool CACFLayerTreeHost::resetDevice(ResetReason reason)
+CGRect CACFLayerTreeHost::bounds() const
 {
-    ASSERT(m_d3dDevice);
-    ASSERT(m_context);
-
-    HRESULT hr = m_d3dDevice->TestCooperativeLevel();
-
-    if (hr == D3DERR_DEVICELOST || hr == D3DERR_DRIVERINTERNALERROR) {
-        // The device cannot be reset at this time. Try again soon.
-        m_mustResetLostDeviceBeforeRendering = true;
-        return false;
-    }
-
-    m_mustResetLostDeviceBeforeRendering = false;
-
-    if (reason == LostDevice && hr == D3D_OK) {
-        // The device wasn't lost after all.
-        return true;
-    }
-
-    // We can reset the device.
-
-    // We have to release the context's D3D resrouces whenever we reset the IDirect3DDevice9 in order to
-    // destroy any D3DPOOL_DEFAULT resources that Core Animation has allocated (e.g., textures used
-    // for mask layers). See <http://msdn.microsoft.com/en-us/library/bb174425(v=VS.85).aspx>.
-    wkCACFContextReleaseD3DResources(m_context);
-
-    D3DPRESENT_PARAMETERS parameters = initialPresentationParameters();
-    hr = m_d3dDevice->Reset(&parameters);
-
-    // TestCooperativeLevel told us the device may be reset now, so we should
-    // not be told here that the device is lost.
-    ASSERT(hr != D3DERR_DEVICELOST);
-
-    initD3DGeometry();
+    RECT clientRect;
+    GetClientRect(m_window, &clientRect);
 
-    return true;
+    return winRectToCGRect(clientRect);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.h b/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.h
index fc61f39..6d91a73 100644
--- a/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.h
+++ b/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.h
@@ -47,75 +47,59 @@ typedef struct CGImage* CGImageRef;
 
 namespace WebCore {
 
+class CACFLayerTreeHostClient;
 class PlatformCALayer;
 
-class CACFLayerTreeHostClient {
-public:
-    virtual ~CACFLayerTreeHostClient() { }
-    virtual void flushPendingGraphicsLayerChanges() { }
-};
-
-// FIXME: Currently there is a CACFLayerTreeHost for each WebView and each
-// has its own CARenderOGLContext and Direct3DDevice9, which is inefficient.
-// (https://bugs.webkit.org/show_bug.cgi?id=31855)
 class CACFLayerTreeHost : public RefCounted<CACFLayerTreeHost> {
     friend PlatformCALayer;
 
 public:
     static PassRefPtr<CACFLayerTreeHost> create();
-    ~CACFLayerTreeHost();
+    virtual ~CACFLayerTreeHost();
 
     static bool acceleratedCompositingAvailable();
 
     void setClient(CACFLayerTreeHostClient* client) { m_client = client; }
 
     void setRootChildLayer(PlatformCALayer*);
-    void layerTreeDidChange();
     void setWindow(HWND);
-    void paint();
-    void resize();
+    virtual void paint();
+    virtual void resize() = 0;
     void flushPendingGraphicsLayerChangesSoon();
     void flushPendingLayerChangesNow();
 
 protected:
-    PlatformCALayer* rootLayer() const;
-    void addPendingAnimatedLayer(PassRefPtr<PlatformCALayer>);
-
-private:
     CACFLayerTreeHost();
 
-    bool createRenderer();
-    void destroyRenderer();
-    void renderSoon();
-    void renderTimerFired(Timer<CACFLayerTreeHost>*);
-
     CGRect bounds() const;
+    PlatformCALayer* rootLayer() const;
+    HWND window() const { return m_window; }
+    void notifyAnimationsStarted();
 
-    void initD3DGeometry();
+    virtual bool createRenderer() = 0;
+    virtual void destroyRenderer();
+    virtual void contextDidChange();
 
-    // Call this when the device window has changed size or when IDirect3DDevice9::Present returns
-    // D3DERR_DEVICELOST. Returns true if the device was recovered, false if rendering must be
-    // aborted and reattempted soon.
-    enum ResetReason { ChangedWindowSize, LostDevice };
-    bool resetDevice(ResetReason);
+private:
+    void initialize();
+    void addPendingAnimatedLayer(PassRefPtr<PlatformCALayer>);
+    void layerTreeDidChange();
 
-    void render(const Vector<CGRect>& dirtyRects = Vector<CGRect>());
+    virtual void flushContext() = 0;
+    virtual CFTimeInterval lastCommitTime() const = 0;
+    virtual void render(const Vector<CGRect>& dirtyRects = Vector<CGRect>()) = 0;
+    virtual void initializeContext(void* userData, PlatformCALayer*) = 0;
 
     CACFLayerTreeHostClient* m_client;
-    bool m_mightBeAbleToCreateDeviceLater;
-    COMPtr<IDirect3DDevice9> m_d3dDevice;
     RefPtr<PlatformCALayer> m_rootLayer;
     RefPtr<PlatformCALayer> m_rootChildLayer;
-    WKCACFContext* m_context;
+    HashSet<RefPtr<PlatformCALayer> > m_pendingAnimatedLayers;
     HWND m_window;
-    Timer<CACFLayerTreeHost> m_renderTimer;
-    bool m_mustResetLostDeviceBeforeRendering;
     bool m_shouldFlushPendingGraphicsLayerChanges;
     bool m_isFlushingLayerChanges;
-    HashSet<RefPtr<PlatformCALayer> > m_pendingAnimatedLayers;
 
-#ifndef NDEBUG
-    bool m_printTree;
+#if !ASSERT_DISABLED
+    enum { WindowNotSet, WindowSet, WindowCleared } m_state;
 #endif
 };
 
diff --git a/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHostClient.h b/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHostClient.h
new file mode 100644
index 0000000..845f934
--- /dev/null
+++ b/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHostClient.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CACFLayerTreeHostClient_h
+#define CACFLayerTreeHostClient_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+namespace WebCore {
+
+class CACFLayerTreeHostClient {
+public:
+    virtual ~CACFLayerTreeHostClient() { }
+    virtual void flushPendingGraphicsLayerChanges() { }
+};
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // CACFLayerTreeHostClient_h
diff --git a/Source/WebCore/platform/graphics/ca/win/LegacyCACFLayerTreeHost.cpp b/Source/WebCore/platform/graphics/ca/win/LegacyCACFLayerTreeHost.cpp
new file mode 100644
index 0000000..772244b
--- /dev/null
+++ b/Source/WebCore/platform/graphics/ca/win/LegacyCACFLayerTreeHost.cpp
@@ -0,0 +1,401 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "LegacyCACFLayerTreeHost.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "PlatformCALayer.h"
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
+
+#ifndef NDEBUG
+#define D3D_DEBUG_INFO
+#endif
+
+#include <d3d9.h>
+#include <d3dx9.h>
+
+#pragma comment(lib, "d3d9")
+#pragma comment(lib, "d3dx9")
+
+using namespace std;
+
+namespace WebCore {
+
+static IDirect3D9* s_d3d = 0;
+static IDirect3D9* d3d()
+{
+    if (s_d3d)
+        return s_d3d;
+
+    if (!LoadLibrary(TEXT("d3d9.dll")))
+        return 0;
+
+    s_d3d = Direct3DCreate9(D3D_SDK_VERSION);
+
+    return s_d3d;
+}
+
+static D3DPRESENT_PARAMETERS initialPresentationParameters()
+{
+    D3DPRESENT_PARAMETERS parameters = {0};
+    parameters.Windowed = TRUE;
+    parameters.SwapEffect = D3DSWAPEFFECT_COPY;
+    parameters.BackBufferCount = 1;
+    parameters.BackBufferFormat = D3DFMT_A8R8G8B8;
+    parameters.MultiSampleType = D3DMULTISAMPLE_NONE;
+
+    return parameters;
+}
+
+// FIXME: <rdar://6507851> Share this code with CoreAnimation.
+static bool hardwareCapabilitiesIndicateCoreAnimationSupport(const D3DCAPS9& caps)
+{
+    // CoreAnimation needs two or more texture units.
+    if (caps.MaxTextureBlendStages < 2)
+        return false;
+
+    // CoreAnimation needs non-power-of-two textures.
+    if ((caps.TextureCaps & D3DPTEXTURECAPS_POW2) && !(caps.TextureCaps & D3DPTEXTURECAPS_NONPOW2CONDITIONAL))
+        return false;
+
+    // CoreAnimation needs vertex shader 2.0 or greater.
+    if (D3DSHADER_VERSION_MAJOR(caps.VertexShaderVersion) < 2)
+        return false;
+
+    // CoreAnimation needs pixel shader 2.0 or greater.
+    if (D3DSHADER_VERSION_MAJOR(caps.PixelShaderVersion) < 2)
+        return false;
+
+    return true;
+}
+
+PassRefPtr<LegacyCACFLayerTreeHost> LegacyCACFLayerTreeHost::create()
+{
+    return adoptRef(new LegacyCACFLayerTreeHost);
+}
+
+LegacyCACFLayerTreeHost::LegacyCACFLayerTreeHost()
+    : m_renderTimer(this, &LegacyCACFLayerTreeHost::renderTimerFired)
+    , m_context(wkCACFContextCreate())
+    , m_mightBeAbleToCreateDeviceLater(true)
+    , m_mustResetLostDeviceBeforeRendering(false)
+{
+#ifndef NDEBUG
+    char* printTreeFlag = getenv("CA_PRINT_TREE");
+    m_printTree = printTreeFlag && atoi(printTreeFlag);
+#endif
+}
+
+LegacyCACFLayerTreeHost::~LegacyCACFLayerTreeHost()
+{
+    wkCACFContextDestroy(m_context);
+}
+
+void LegacyCACFLayerTreeHost::initializeContext(void* userData, PlatformCALayer* layer)
+{
+    wkCACFContextSetUserData(m_context, userData);
+    wkCACFContextSetLayer(m_context, layer->platformLayer());
+}
+
+bool LegacyCACFLayerTreeHost::createRenderer()
+{
+    if (m_d3dDevice || !m_mightBeAbleToCreateDeviceLater)
+        return m_d3dDevice;
+
+    m_mightBeAbleToCreateDeviceLater = false;
+    D3DPRESENT_PARAMETERS parameters = initialPresentationParameters();
+
+    if (!d3d() || !::IsWindow(window()))
+        return false;
+
+    // D3D doesn't like to make back buffers for 0 size windows. We skirt this problem if we make the
+    // passed backbuffer width and height non-zero. The window will necessarily get set to a non-zero
+    // size eventually, and then the backbuffer size will get reset.
+    RECT rect;
+    GetClientRect(window(), &rect);
+
+    if (rect.left-rect.right == 0 || rect.bottom-rect.top == 0) {
+        parameters.BackBufferWidth = 1;
+        parameters.BackBufferHeight = 1;
+    }
+
+    D3DCAPS9 d3dCaps;
+    if (FAILED(d3d()->GetDeviceCaps(D3DADAPTER_DEFAULT, D3DDEVTYPE_HAL, &d3dCaps)))
+        return false;
+
+    DWORD behaviorFlags = D3DCREATE_FPU_PRESERVE;
+    if ((d3dCaps.DevCaps & D3DDEVCAPS_HWTRANSFORMANDLIGHT) && d3dCaps.VertexProcessingCaps)
+        behaviorFlags |= D3DCREATE_HARDWARE_VERTEXPROCESSING;
+    else
+        behaviorFlags |= D3DCREATE_SOFTWARE_VERTEXPROCESSING;
+
+    COMPtr<IDirect3DDevice9> device;
+    if (FAILED(d3d()->CreateDevice(D3DADAPTER_DEFAULT, D3DDEVTYPE_HAL, window(), behaviorFlags, &parameters, &device))) {
+        // In certain situations (e.g., shortly after waking from sleep), Direct3DCreate9() will
+        // return an IDirect3D9 for which IDirect3D9::CreateDevice will always fail. In case we
+        // have one of these bad IDirect3D9s, get rid of it so we'll fetch a new one the next time
+        // we want to call CreateDevice.
+        s_d3d->Release();
+        s_d3d = 0;
+
+        // Even if we don't have a bad IDirect3D9, in certain situations (e.g., shortly after
+        // waking from sleep), CreateDevice will fail, but will later succeed if called again.
+        m_mightBeAbleToCreateDeviceLater = true;
+
+        return false;
+    }
+
+    // Now that we've created the IDirect3DDevice9 based on the capabilities we
+    // got from the IDirect3D9 global object, we requery the device for its
+    // actual capabilities. The capabilities returned by the device can
+    // sometimes be more complete, for example when using software vertex
+    // processing.
+    D3DCAPS9 deviceCaps;
+    if (FAILED(device->GetDeviceCaps(&deviceCaps)))
+        return false;
+
+    if (!hardwareCapabilitiesIndicateCoreAnimationSupport(deviceCaps))
+        return false;
+
+    m_d3dDevice = device;
+
+    initD3DGeometry();
+
+    wkCACFContextSetD3DDevice(m_context, m_d3dDevice.get());
+
+    if (IsWindow(window())) {
+        rootLayer()->setBounds(bounds());
+        flushContext();
+    }
+
+    return true;
+}
+
+void LegacyCACFLayerTreeHost::destroyRenderer()
+{
+    wkCACFContextSetLayer(m_context, 0);
+
+    wkCACFContextSetD3DDevice(m_context, 0);
+    m_d3dDevice = 0;
+    if (s_d3d)
+        s_d3d->Release();
+
+    s_d3d = 0;
+    m_mightBeAbleToCreateDeviceLater = true;
+
+    CACFLayerTreeHost::destroyRenderer();
+}
+
+void LegacyCACFLayerTreeHost::resize()
+{
+    if (!m_d3dDevice)
+        return;
+
+    // Resetting the device might fail here. But that's OK, because if it does it we will attempt to
+    // reset the device the next time we try to render.
+    resetDevice(ChangedWindowSize);
+
+    if (rootLayer()) {
+        rootLayer()->setBounds(bounds());
+        flushContext();
+    }
+}
+
+void LegacyCACFLayerTreeHost::renderTimerFired(Timer<LegacyCACFLayerTreeHost>*)
+{
+    paint();
+}
+
+void LegacyCACFLayerTreeHost::paint()
+{
+    createRenderer();
+    if (!m_d3dDevice) {
+        if (m_mightBeAbleToCreateDeviceLater)
+            renderSoon();
+        return;
+    }
+
+    CACFLayerTreeHost::paint();
+}
+
+void LegacyCACFLayerTreeHost::render(const Vector<CGRect>& windowDirtyRects)
+{
+    ASSERT(m_d3dDevice);
+
+    if (m_mustResetLostDeviceBeforeRendering && !resetDevice(LostDevice)) {
+        // We can't reset the device right now. Try again soon.
+        renderSoon();
+        return;
+    }
+
+    CGRect bounds = this->bounds();
+
+    // Give the renderer some space to use. This needs to be valid until the
+    // wkCACFContextFinishUpdate() call below.
+    char space[4096];
+    if (!wkCACFContextBeginUpdate(m_context, space, sizeof(space), CACurrentMediaTime(), bounds, windowDirtyRects.data(), windowDirtyRects.size()))
+        return;
+
+    HRESULT err = S_OK;
+    CFTimeInterval timeToNextRender = numeric_limits<CFTimeInterval>::infinity();
+
+    do {
+        // FIXME: don't need to clear dirty region if layer tree is opaque.
+
+        WKCACFUpdateRectEnumerator* e = wkCACFContextCopyUpdateRectEnumerator(m_context);
+        if (!e)
+            break;
+
+        Vector<D3DRECT, 64> rects;
+        for (const CGRect* r = wkCACFUpdateRectEnumeratorNextRect(e); r; r = wkCACFUpdateRectEnumeratorNextRect(e)) {
+            D3DRECT rect;
+            rect.x1 = r->origin.x;
+            rect.x2 = rect.x1 + r->size.width;
+            rect.y1 = bounds.origin.y + bounds.size.height - (r->origin.y + r->size.height);
+            rect.y2 = rect.y1 + r->size.height;
+
+            rects.append(rect);
+        }
+        wkCACFUpdateRectEnumeratorRelease(e);
+
+        timeToNextRender = wkCACFContextGetNextUpdateTime(m_context);
+
+        if (rects.isEmpty())
+            break;
+
+        m_d3dDevice->Clear(rects.size(), rects.data(), D3DCLEAR_TARGET, 0, 1.0f, 0);
+
+        m_d3dDevice->BeginScene();
+        wkCACFContextRenderUpdate(m_context);
+        m_d3dDevice->EndScene();
+
+        err = m_d3dDevice->Present(0, 0, 0, 0);
+
+        if (err == D3DERR_DEVICELOST) {
+            wkCACFContextAddUpdateRect(m_context, bounds);
+            if (!resetDevice(LostDevice)) {
+                // We can't reset the device right now. Try again soon.
+                renderSoon();
+                return;
+            }
+        }
+    } while (err == D3DERR_DEVICELOST);
+
+    wkCACFContextFinishUpdate(m_context);
+
+#ifndef NDEBUG
+    if (m_printTree)
+        rootLayer()->printTree();
+#endif
+
+    // If timeToNextRender is not infinity, it means animations are running, so queue up to render again
+    if (timeToNextRender != numeric_limits<CFTimeInterval>::infinity())
+        renderSoon();
+}
+
+void LegacyCACFLayerTreeHost::renderSoon()
+{
+    if (!m_renderTimer.isActive())
+        m_renderTimer.startOneShot(0);
+}
+
+void LegacyCACFLayerTreeHost::flushContext()
+{
+    wkCACFContextFlush(m_context);
+    contextDidChange();
+}
+
+void LegacyCACFLayerTreeHost::contextDidChange()
+{
+    renderSoon();
+    CACFLayerTreeHost::contextDidChange();
+}
+
+CFTimeInterval LegacyCACFLayerTreeHost::lastCommitTime() const
+{
+    return wkCACFContextGetLastCommitTime(m_context);
+}
+
+void LegacyCACFLayerTreeHost::initD3DGeometry()
+{
+    ASSERT(m_d3dDevice);
+
+    CGRect bounds = this->bounds();
+
+    float x0 = bounds.origin.x;
+    float y0 = bounds.origin.y;
+    float x1 = x0 + bounds.size.width;
+    float y1 = y0 + bounds.size.height;
+
+    D3DXMATRIXA16 projection;
+    D3DXMatrixOrthoOffCenterRH(&projection, x0, x1, y0, y1, -1.0f, 1.0f);
+
+    m_d3dDevice->SetTransform(D3DTS_PROJECTION, &projection);
+}
+
+bool LegacyCACFLayerTreeHost::resetDevice(ResetReason reason)
+{
+    ASSERT(m_d3dDevice);
+    ASSERT(m_context);
+
+    HRESULT hr = m_d3dDevice->TestCooperativeLevel();
+
+    if (hr == D3DERR_DEVICELOST || hr == D3DERR_DRIVERINTERNALERROR) {
+        // The device cannot be reset at this time. Try again soon.
+        m_mustResetLostDeviceBeforeRendering = true;
+        return false;
+    }
+
+    m_mustResetLostDeviceBeforeRendering = false;
+
+    if (reason == LostDevice && hr == D3D_OK) {
+        // The device wasn't lost after all.
+        return true;
+    }
+
+    // We can reset the device.
+
+    // We have to release the context's D3D resrouces whenever we reset the IDirect3DDevice9 in order to
+    // destroy any D3DPOOL_DEFAULT resources that Core Animation has allocated (e.g., textures used
+    // for mask layers). See <http://msdn.microsoft.com/en-us/library/bb174425(v=VS.85).aspx>.
+    wkCACFContextReleaseD3DResources(m_context);
+
+    D3DPRESENT_PARAMETERS parameters = initialPresentationParameters();
+    hr = m_d3dDevice->Reset(&parameters);
+
+    // TestCooperativeLevel told us the device may be reset now, so we should
+    // not be told here that the device is lost.
+    ASSERT(hr != D3DERR_DEVICELOST);
+
+    initD3DGeometry();
+
+    return true;
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/ca/win/LegacyCACFLayerTreeHost.h b/Source/WebCore/platform/graphics/ca/win/LegacyCACFLayerTreeHost.h
new file mode 100644
index 0000000..bfa530b
--- /dev/null
+++ b/Source/WebCore/platform/graphics/ca/win/LegacyCACFLayerTreeHost.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LegacyCACFLayerTreeHost_h
+#define LegacyCACFLayerTreeHost_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "CACFLayerTreeHost.h"
+
+namespace WebCore {
+
+// FIXME: Currently there is a LegacyCACFLayerTreeHost for each WebView and each
+// has its own WKCACFContext and Direct3DDevice9, which is inefficient.
+// (https://bugs.webkit.org/show_bug.cgi?id=31855)
+class LegacyCACFLayerTreeHost : public CACFLayerTreeHost {
+public:
+    static PassRefPtr<LegacyCACFLayerTreeHost> create();
+    virtual ~LegacyCACFLayerTreeHost();
+
+private:
+    LegacyCACFLayerTreeHost();
+
+    void initD3DGeometry();
+
+    // Call this when the device window has changed size or when IDirect3DDevice9::Present returns
+    // D3DERR_DEVICELOST. Returns true if the device was recovered, false if rendering must be
+    // aborted and reattempted soon.
+    enum ResetReason { ChangedWindowSize, LostDevice };
+    bool resetDevice(ResetReason);
+
+    void renderSoon();
+    void renderTimerFired(Timer<LegacyCACFLayerTreeHost>*);
+
+    virtual void initializeContext(void* userData, PlatformCALayer*);
+    virtual void resize();
+    virtual bool createRenderer();
+    virtual void destroyRenderer();
+    virtual CFTimeInterval lastCommitTime() const;
+    virtual void flushContext();
+    virtual void contextDidChange();
+    virtual void paint();
+    virtual void render(const Vector<CGRect>& dirtyRects = Vector<CGRect>());
+
+    Timer<LegacyCACFLayerTreeHost> m_renderTimer;
+    COMPtr<IDirect3DDevice9> m_d3dDevice;
+    WKCACFContext* m_context;
+    bool m_mightBeAbleToCreateDeviceLater;
+    bool m_mustResetLostDeviceBeforeRendering;
+
+#ifndef NDEBUG
+    bool m_printTree;
+#endif
+};
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // LegacyCACFLayerTreeHost_h
diff --git a/Source/WebCore/platform/graphics/ca/win/PlatformCAAnimationWin.cpp b/Source/WebCore/platform/graphics/ca/win/PlatformCAAnimationWin.cpp
index 228bb01..6e3011b 100644
--- a/Source/WebCore/platform/graphics/ca/win/PlatformCAAnimationWin.cpp
+++ b/Source/WebCore/platform/graphics/ca/win/PlatformCAAnimationWin.cpp
@@ -145,11 +145,6 @@ PassRefPtr<PlatformCAAnimation> PlatformCAAnimation::create(PlatformAnimationRef
     return adoptRef(new PlatformCAAnimation(animation));
 }
 
-PassRefPtr<PlatformCAAnimation> PlatformCAAnimation::create(const PlatformCAAnimation* animation)
-{
-    return adoptRef(new PlatformCAAnimation(animation));
-}
-
 PlatformCAAnimation::PlatformCAAnimation(AnimationType type, const String& keyPath)
     : m_type(type)
 {
@@ -176,33 +171,33 @@ PlatformCAAnimation::PlatformCAAnimation(PlatformAnimationRef animation)
     m_animation = animation;
 }
 
-PlatformCAAnimation::PlatformCAAnimation(const PlatformCAAnimation* animation)
+PassRefPtr<PlatformCAAnimation> PlatformCAAnimation::copy() const
 {
-    m_animation.adoptCF(CACFAnimationCreate((animation->animationType() == Basic) ? kCACFBasicAnimation : kCACFKeyframeAnimation));
-    RetainPtr<CFStringRef> keyPath(AdoptCF, animation->keyPath().createCFString());
-    CACFAnimationSetKeyPath(m_animation.get(), keyPath.get());
-
-    setBeginTime(animation->beginTime());
-    setDuration(animation->duration());
-    setSpeed(animation->speed());
-    setTimeOffset(animation->timeOffset());
-    setRepeatCount(animation->repeatCount());
-    setAutoreverses(animation->autoreverses());
-    setFillMode(animation->fillMode());
-    setRemovedOnCompletion(animation->isRemovedOnCompletion());
-    setAdditive(animation->isAdditive());
-    copyTimingFunctionFrom(animation);
-    setValueFunction(animation->valueFunction());
-
+    RefPtr<PlatformCAAnimation> animation = create(animationType(), keyPath());
+    
+    animation->setBeginTime(beginTime());
+    animation->setDuration(duration());
+    animation->setSpeed(speed());
+    animation->setTimeOffset(timeOffset());
+    animation->setRepeatCount(repeatCount());
+    animation->setAutoreverses(autoreverses());
+    animation->setFillMode(fillMode());
+    animation->setRemovedOnCompletion(isRemovedOnCompletion());
+    animation->setAdditive(isAdditive());
+    animation->copyTimingFunctionFrom(this);
+    animation->setValueFunction(valueFunction());
+    
     // Copy the specific Basic or Keyframe values
-    if (animation->animationType() == Keyframe) {
-        copyValuesFrom(animation);
-        copyKeyTimesFrom(animation);
-        copyTimingFunctionsFrom(animation);
+    if (animationType() == Keyframe) {
+        animation->copyValuesFrom(this);
+        animation->copyKeyTimesFrom(this);
+        animation->copyTimingFunctionsFrom(this);
     } else {
-        copyFromValueFrom(animation);
-        copyToValueFrom(animation);
+        animation->copyFromValueFrom(this);
+        animation->copyToValueFrom(this);
     }
+    
+    return animation;
 }
 
 PlatformCAAnimation::~PlatformCAAnimation()
diff --git a/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp b/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp
new file mode 100644
index 0000000..e672c2d
--- /dev/null
+++ b/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp
@@ -0,0 +1,160 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WKCACFViewLayerTreeHost.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "PlatformCALayer.h"
+#include "SoftLinking.h"
+#include <wtf/CurrentTime.h>
+
+typedef struct _CACFLayer* CACFLayerRef;
+
+namespace WebCore {
+
+#ifdef DEBUG_ALL
+SOFT_LINK_DEBUG_LIBRARY(WebKitQuartzCoreAdditions)
+#else
+SOFT_LINK_LIBRARY(WebKitQuartzCoreAdditions)
+#endif
+
+SOFT_LINK(WebKitQuartzCoreAdditions, WKCACFViewCreate, WKCACFViewRef, __cdecl, (), ())
+SOFT_LINK(WebKitQuartzCoreAdditions, WKCACFViewSetLayer, void, __cdecl, (WKCACFViewRef view, CACFLayerRef layer), (view, layer))
+SOFT_LINK(WebKitQuartzCoreAdditions, WKCACFViewUpdate, void, __cdecl, (WKCACFViewRef view, HWND window, const CGRect* bounds), (view, window, bounds))
+SOFT_LINK(WebKitQuartzCoreAdditions, WKCACFViewCanDraw, bool, __cdecl, (WKCACFViewRef view), (view))
+SOFT_LINK(WebKitQuartzCoreAdditions, WKCACFViewDraw, void, __cdecl, (WKCACFViewRef view), (view))
+SOFT_LINK(WebKitQuartzCoreAdditions, WKCACFViewFlushContext, void, __cdecl, (WKCACFViewRef view), (view))
+SOFT_LINK(WebKitQuartzCoreAdditions, WKCACFViewInvalidateRects, void, __cdecl, (WKCACFViewRef view, const CGRect rects[], size_t count), (view, rects, count))
+typedef void (*WKCACFViewContextDidChangeCallback)(WKCACFViewRef view, void* info);
+SOFT_LINK(WebKitQuartzCoreAdditions, WKCACFViewSetContextDidChangeCallback, void, __cdecl, (WKCACFViewRef view, WKCACFViewContextDidChangeCallback callback, void* info), (view, callback, info))
+SOFT_LINK(WebKitQuartzCoreAdditions, WKCACFViewGetLastCommitTime, CFTimeInterval, __cdecl, (WKCACFViewRef view), (view))
+SOFT_LINK(WebKitQuartzCoreAdditions, WKCACFViewSetContextUserData, void, __cdecl, (WKCACFViewRef view, void* userData), (view, userData))
+
+PassRefPtr<WKCACFViewLayerTreeHost> WKCACFViewLayerTreeHost::create()
+{
+    if (!WebKitQuartzCoreAdditionsLibrary())
+        return 0;
+
+    return adoptRef(new WKCACFViewLayerTreeHost);
+}
+
+WKCACFViewLayerTreeHost::WKCACFViewLayerTreeHost()
+    : m_view(AdoptCF, WKCACFViewCreate())
+    , m_viewNeedsUpdate(true)
+{
+}
+
+void WKCACFViewLayerTreeHost::updateViewIfNeeded()
+{
+    if (!m_viewNeedsUpdate)
+        return;
+    m_viewNeedsUpdate = false;
+
+    CGRect layerBounds = rootLayer()->bounds();
+
+    CGRect bounds = this->bounds();
+    WKCACFViewUpdate(m_view.get(), window(), &bounds);
+
+    if (CGRectEqualToRect(layerBounds, rootLayer()->bounds()))
+        return;
+
+    // Flush the context so the layer's rendered bounds will match our bounds.
+    flushContext();
+}
+
+void WKCACFViewLayerTreeHost::contextDidChangeCallback(WKCACFViewRef view, void* info)
+{
+    ASSERT_ARG(view, view);
+    ASSERT_ARG(info, info);
+
+    WKCACFViewLayerTreeHost* host = static_cast<WKCACFViewLayerTreeHost*>(info);
+    ASSERT_ARG(view, view == host->m_view);
+    host->contextDidChange();
+}
+
+void WKCACFViewLayerTreeHost::contextDidChange()
+{
+    // Tell the WKCACFView to start rendering now that we have some contents to render.
+    updateViewIfNeeded();
+
+    CACFLayerTreeHost::contextDidChange();
+}
+
+void WKCACFViewLayerTreeHost::initializeContext(void* userData, PlatformCALayer* layer)
+{
+    WKCACFViewSetContextUserData(m_view.get(), userData);
+    WKCACFViewSetLayer(m_view.get(), layer->platformLayer());
+    WKCACFViewSetContextDidChangeCallback(m_view.get(), contextDidChangeCallback, this);
+}
+
+void WKCACFViewLayerTreeHost::resize()
+{
+    m_viewNeedsUpdate = true;
+}
+
+bool WKCACFViewLayerTreeHost::createRenderer()
+{
+    updateViewIfNeeded();
+    return WKCACFViewCanDraw(m_view.get());
+}
+
+void WKCACFViewLayerTreeHost::destroyRenderer()
+{
+    m_viewNeedsUpdate = true;
+    WKCACFViewUpdate(m_view.get(), 0, 0);
+    WKCACFViewSetContextUserData(m_view.get(), 0);
+    WKCACFViewSetLayer(m_view.get(), 0);
+    WKCACFViewSetContextDidChangeCallback(m_view.get(), 0, 0);
+
+    CACFLayerTreeHost::destroyRenderer();
+}
+
+CFTimeInterval WKCACFViewLayerTreeHost::lastCommitTime() const
+{
+    return WKCACFViewGetLastCommitTime(m_view.get());
+}
+
+void WKCACFViewLayerTreeHost::flushContext()
+{
+    WKCACFViewFlushContext(m_view.get());
+}
+
+void WKCACFViewLayerTreeHost::paint()
+{
+    updateViewIfNeeded();
+    CACFLayerTreeHost::paint();
+}
+
+void WKCACFViewLayerTreeHost::render(const Vector<CGRect>& dirtyRects)
+{
+    WKCACFViewInvalidateRects(m_view.get(), dirtyRects.data(), dirtyRects.size());
+    WKCACFViewDraw(m_view.get());
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.h b/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.h
new file mode 100644
index 0000000..af09f76
--- /dev/null
+++ b/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WKCACFViewLayerTreeHost_h
+#define WKCACFViewLayerTreeHost_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "CACFLayerTreeHost.h"
+
+typedef struct _WKCACFView* WKCACFViewRef;
+
+namespace WebCore {
+
+class WKCACFViewLayerTreeHost : public CACFLayerTreeHost {
+public:
+    static PassRefPtr<WKCACFViewLayerTreeHost> create();
+
+private:
+    WKCACFViewLayerTreeHost();
+
+    void updateViewIfNeeded();
+    static void contextDidChangeCallback(WKCACFViewRef, void* info);
+
+    virtual void initializeContext(void* userData, PlatformCALayer*);
+    virtual void resize();
+    virtual bool createRenderer();
+    virtual void destroyRenderer();
+    virtual void flushContext();
+    virtual void contextDidChange();
+    virtual void paint();
+    virtual void render(const Vector<CGRect>& dirtyRects = Vector<CGRect>());
+    virtual CFTimeInterval lastCommitTime() const;
+
+    RetainPtr<WKCACFViewRef> m_view;
+    bool m_viewNeedsUpdate;
+};
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // WKCACFViewLayerTreeHost_h
diff --git a/Source/WebCore/platform/graphics/cairo/CairoUtilities.cpp b/Source/WebCore/platform/graphics/cairo/CairoUtilities.cpp
index 013a4af..ee159a1 100644
--- a/Source/WebCore/platform/graphics/cairo/CairoUtilities.cpp
+++ b/Source/WebCore/platform/graphics/cairo/CairoUtilities.cpp
@@ -106,7 +106,11 @@ cairo_operator_t toCairoOperator(CompositeOperator op)
     case CompositeXOR:
         return CAIRO_OPERATOR_XOR;
     case CompositePlusDarker:
+#if CAIRO_VERSION >= CAIRO_VERSION_ENCODE(1, 10, 0)
+        return CAIRO_OPERATOR_DARKEN;
+#else
         return CAIRO_OPERATOR_SATURATE;
+#endif
     case CompositeHighlight:
         // There is no Cairo equivalent for CompositeHighlight.
         return CAIRO_OPERATOR_OVER;
diff --git a/Source/WebCore/platform/graphics/cairo/FontCustomPlatformData.h b/Source/WebCore/platform/graphics/cairo/FontCustomPlatformData.h
index 50ea00f..5807102 100644
--- a/Source/WebCore/platform/graphics/cairo/FontCustomPlatformData.h
+++ b/Source/WebCore/platform/graphics/cairo/FontCustomPlatformData.h
@@ -24,6 +24,7 @@
 
 #include "FontOrientation.h"
 #include "FontRenderingMode.h"
+#include "FontWidthVariant.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 
@@ -40,7 +41,7 @@ struct FontCustomPlatformData {
 public:
     FontCustomPlatformData(FT_Face, SharedBuffer*);
     ~FontCustomPlatformData();
-    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontRenderingMode = NormalRenderingMode);
+    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
     static bool supportsFormat(const String&);
 
 private:
diff --git a/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp b/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
index 51b5ee6..f7d6040 100644
--- a/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
@@ -173,7 +173,7 @@ PassRefPtr<ByteArray> getImageData(const IntRect& rect, const ImageBufferData& d
         destx = -originx;
         originx = 0;
     }
-    int endx = rect.right();
+    int endx = rect.maxX();
     if (endx > size.width())
         endx = size.width();
     int numColumns = endx - originx;
@@ -184,7 +184,7 @@ PassRefPtr<ByteArray> getImageData(const IntRect& rect, const ImageBufferData& d
         desty = -originy;
         originy = 0;
     }
-    int endy = rect.bottom();
+    int endy = rect.maxY();
     if (endy > size.height())
         endy = size.height();
     int numRows = endy - originy;
@@ -239,9 +239,9 @@ void putImageData(ByteArray*& source, const IntSize& sourceSize, const IntRect&
     ASSERT(destx >= 0);
     ASSERT(destx < size.width());
     ASSERT(originx >= 0);
-    ASSERT(originx <= sourceRect.right());
+    ASSERT(originx <= sourceRect.maxX());
 
-    int endx = destPoint.x() + sourceRect.right();
+    int endx = destPoint.x() + sourceRect.maxX();
     ASSERT(endx <= size.width());
 
     int numColumns = endx - destx;
@@ -251,9 +251,9 @@ void putImageData(ByteArray*& source, const IntSize& sourceSize, const IntRect&
     ASSERT(desty >= 0);
     ASSERT(desty < size.height());
     ASSERT(originy >= 0);
-    ASSERT(originy <= sourceRect.bottom());
+    ASSERT(originy <= sourceRect.maxY());
 
-    int endy = destPoint.y() + sourceRect.bottom();
+    int endy = destPoint.y() + sourceRect.maxY();
     ASSERT(endy <= size.height());
     int numRows = endy - desty;
 
diff --git a/Source/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp b/Source/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp
index c19bd72..187d296 100644
--- a/Source/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp
@@ -26,7 +26,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "GraphicsContext3D.h"
 #include "GraphicsContextCG.h"
@@ -105,7 +105,7 @@ bool GraphicsContext3D::getImageData(Image* image,
         decoder.setData(image->data(), true);
         if (!decoder.frameCount())
             return false;
-        decodedImage = decoder.createFrameAtIndex(0);
+        decodedImage.adoptCF(decoder.createFrameAtIndex(0));
         cgImage = decodedImage.get();
     } else
         cgImage = image->nativeImageForCurrentFrame();
@@ -116,6 +116,34 @@ bool GraphicsContext3D::getImageData(Image* image,
     size_t height = CGImageGetHeight(cgImage);
     if (!width || !height)
         return false;
+
+    // See whether the image is using an indexed color space, and if
+    // so, re-render it into an RGB color space. The image re-packing
+    // code requires color data, not color table indices, for the
+    // image data.
+    CGColorSpaceRef colorSpace = CGImageGetColorSpace(cgImage);
+    CGColorSpaceModel model = CGColorSpaceGetModel(colorSpace);
+    if (model == kCGColorSpaceModelIndexed) {
+        RetainPtr<CGContextRef> bitmapContext;
+        // FIXME: we should probably manually convert the image by indexing into
+        // the color table, which would allow us to avoid premultiplying the
+        // alpha channel. Creation of a bitmap context with an alpha channel
+        // doesn't seem to work unless it's premultiplied.
+        bitmapContext.adoptCF(CGBitmapContextCreate(0, width, height, 8, width * 4,
+                                                    deviceRGBColorSpaceRef(),
+                                                    kCGImageAlphaPremultipliedFirst | kCGBitmapByteOrder32Host));
+        if (!bitmapContext)
+            return false;
+
+        CGContextSetBlendMode(bitmapContext.get(), kCGBlendModeCopy);
+        CGContextSetInterpolationQuality(bitmapContext.get(), kCGInterpolationNone);
+        CGContextDrawImage(bitmapContext.get(), CGRectMake(0, 0, width, height), cgImage);
+
+        // Now discard the original CG image and replace it with a copy from the bitmap context.
+        decodedImage.adoptCF(CGBitmapContextCreateImage(bitmapContext.get()));
+        cgImage = decodedImage.get();
+    }
+
     size_t bitsPerComponent = CGImageGetBitsPerComponent(cgImage);
     size_t bitsPerPixel = CGImageGetBitsPerPixel(cgImage);
     if (bitsPerComponent != 8 && bitsPerComponent != 16)
@@ -168,10 +196,11 @@ bool GraphicsContext3D::getImageData(Image* image,
     AlphaFormat alphaFormat = AlphaFormatNone;
     switch (CGImageGetAlphaInfo(cgImage)) {
     case kCGImageAlphaPremultipliedFirst:
-        // This path is only accessible for MacOS earlier than 10.6.4.
         // This is a special case for texImage2D with HTMLCanvasElement input,
-        // in which case image->data() should be null.
-        ASSERT(!image->data());
+        // in which case image->data() should be null, or indexed color models,
+        // where we need premultiplied alpha to create the bitmap context
+        // successfully.
+        ASSERT(!image->data() || model == kCGColorSpaceModelIndexed);
         if (!premultiplyAlpha)
             neededAlphaOp = AlphaDoUnmultiply;
         alphaFormat = AlphaFormatFirst;
@@ -254,4 +283,4 @@ void GraphicsContext3D::paintToCanvas(const unsigned char* imagePixels, int imag
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp b/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
index bcfc37b..3591479 100644
--- a/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
@@ -35,6 +35,7 @@
 #include "KURL.h"
 #include "Path.h"
 #include "Pattern.h"
+#include "ShadowBlur.h"
 
 #include <CoreGraphics/CoreGraphics.h>
 #include <wtf/MathExtras.h>
@@ -165,9 +166,9 @@ void GraphicsContext::drawRect(const IntRect& rect)
             setCGFillColor(context, strokeColor(), strokeColorSpace());
         CGRect rects[4] = {
             FloatRect(rect.x(), rect.y(), rect.width(), 1),
-            FloatRect(rect.x(), rect.bottom() - 1, rect.width(), 1),
+            FloatRect(rect.x(), rect.maxY() - 1, rect.width(), 1),
             FloatRect(rect.x(), rect.y() + 1, 1, rect.height() - 2),
-            FloatRect(rect.right() - 1, rect.y() + 1, 1, rect.height() - 2)
+            FloatRect(rect.maxX() - 1, rect.y() + 1, 1, rect.height() - 2)
         };
         CGContextFillRects(context, rects, 4);
         if (oldFillColor != strokeColor())
@@ -563,7 +564,7 @@ void GraphicsContext::fillPath(const Path& path)
                 CGContextClip(layerContext);
 
             m_state.fillGradient->paint(layerContext);
-            CGContextDrawLayerAtPoint(context, CGPointMake(rect.left(), rect.top()), layer);
+            CGContextDrawLayerAtPoint(context, CGPointMake(rect.x(), rect.y()), layer);
             CGLayerRelease(layer);
         } else {
             CGContextBeginPath(context);
@@ -616,6 +617,16 @@ void GraphicsContext::strokePath(const Path& path)
     CGContextStrokePath(context);
 }
 
+static float radiusToLegacyRadius(float radius)
+{
+    return radius > 8 ? 8 + 4 * sqrt((radius - 8) / 2) : radius;
+}
+
+static bool hasBlurredShadow(const GraphicsContextState& state)
+{
+    return state.shadowColor.isValid() && state.shadowColor.alpha() && state.shadowBlur;
+}
+
 void GraphicsContext::fillRect(const FloatRect& rect)
 {
     if (paintingDisabled())
@@ -626,11 +637,16 @@ void GraphicsContext::fillRect(const FloatRect& rect)
     if (m_state.fillGradient) {
         CGContextSaveGState(context);
         if (hasShadow()) {
-            CGContextConcatCTM(context, m_state.fillGradient->gradientSpaceTransform());
             CGLayerRef layer = CGLayerCreateWithContext(context, CGSizeMake(rect.width(), rect.height()), 0);
             CGContextRef layerContext = CGLayerGetContext(layer);
+
+            CGContextTranslateCTM(layerContext, -rect.x(), -rect.y());
+            CGContextAddRect(layerContext, rect);
+            CGContextClip(layerContext);
+
+            CGContextConcatCTM(layerContext, m_state.fillGradient->gradientSpaceTransform());
             m_state.fillGradient->paint(layerContext);
-            CGContextDrawLayerAtPoint(context, CGPointMake(rect.left(), rect.top()), layer);
+            CGContextDrawLayerAtPoint(context, CGPointMake(rect.x(), rect.y()), layer);
             CGLayerRelease(layer);
         } else {
             CGContextClipToRect(context, rect);
@@ -643,7 +659,22 @@ void GraphicsContext::fillRect(const FloatRect& rect)
 
     if (m_state.fillPattern)
         applyFillPattern();
+
+    bool drawOwnShadow = hasBlurredShadow(m_state) && !m_state.shadowsIgnoreTransforms; // Don't use ShadowBlur for canvas yet.
+    if (drawOwnShadow) {
+        float shadowBlur = m_state.shadowsUseLegacyRadius ? radiusToLegacyRadius(m_state.shadowBlur) : m_state.shadowBlur;
+        // Turn off CG shadows.
+        CGContextSaveGState(context);
+        CGContextSetShadowWithColor(platformContext(), CGSizeZero, 0, 0);
+
+        ShadowBlur contextShadow(shadowBlur, m_state.shadowOffset, m_state.shadowColor, m_state.shadowColorSpace);
+        contextShadow.drawRectShadow(this, rect, RoundedIntRect::Radii());
+    }
+
     CGContextFillRect(context, rect);
+
+    if (drawOwnShadow)
+        CGContextRestoreGState(context);
 }
 
 void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
@@ -658,7 +689,21 @@ void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorS
     if (oldFillColor != color || oldColorSpace != colorSpace)
         setCGFillColor(context, color, colorSpace);
 
+    bool drawOwnShadow = hasBlurredShadow(m_state) && !m_state.shadowsIgnoreTransforms; // Don't use ShadowBlur for canvas yet.
+    if (drawOwnShadow) {
+        float shadowBlur = m_state.shadowsUseLegacyRadius ? radiusToLegacyRadius(m_state.shadowBlur) : m_state.shadowBlur;
+        // Turn off CG shadows.
+        CGContextSaveGState(context);
+        CGContextSetShadowWithColor(platformContext(), CGSizeZero, 0, 0);
+
+        ShadowBlur contextShadow(shadowBlur, m_state.shadowOffset, m_state.shadowColor, m_state.shadowColorSpace);
+        contextShadow.drawRectShadow(this, rect, RoundedIntRect::Radii());
+    }
+
     CGContextFillRect(context, rect);
+    
+    if (drawOwnShadow)
+        CGContextRestoreGState(context);
 
     if (oldFillColor != color || oldColorSpace != colorSpace)
         setCGFillColor(context, oldFillColor, oldColorSpace);
@@ -678,12 +723,72 @@ void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLef
 
     Path path;
     path.addRoundedRect(rect, topLeft, topRight, bottomLeft, bottomRight);
+
+    bool drawOwnShadow = hasBlurredShadow(m_state) && !m_state.shadowsIgnoreTransforms; // Don't use ShadowBlur for canvas yet.
+    if (drawOwnShadow) {
+        float shadowBlur = m_state.shadowsUseLegacyRadius ? radiusToLegacyRadius(m_state.shadowBlur) : m_state.shadowBlur;
+
+        // Turn off CG shadows.
+        CGContextSaveGState(context);
+        CGContextSetShadowWithColor(platformContext(), CGSizeZero, 0, 0);
+
+        ShadowBlur contextShadow(shadowBlur, m_state.shadowOffset, m_state.shadowColor, m_state.shadowColorSpace);
+        contextShadow.drawRectShadow(this, rect, RoundedIntRect::Radii(topLeft, topRight, bottomLeft, bottomRight));
+    }
+
     fillPath(path);
 
+    if (drawOwnShadow)
+        CGContextRestoreGState(context);
+
     if (oldFillColor != color || oldColorSpace != colorSpace)
         setCGFillColor(context, oldFillColor, oldColorSpace);
 }
 
+void GraphicsContext::fillRectWithRoundedHole(const IntRect& rect, const RoundedIntRect& roundedHoleRect, const Color& color, ColorSpace colorSpace)
+{
+    if (paintingDisabled())
+        return;
+
+    CGContextRef context = platformContext();
+
+    Path path;
+    path.addRect(rect);
+
+    if (!roundedHoleRect.radii().isZero())
+        path.addRoundedRect(roundedHoleRect.rect(), roundedHoleRect.radii().topLeft(), roundedHoleRect.radii().topRight(), roundedHoleRect.radii().bottomLeft(), roundedHoleRect.radii().bottomRight());
+    else
+        path.addRect(roundedHoleRect.rect());
+
+    WindRule oldFillRule = fillRule();
+    Color oldFillColor = fillColor();
+    ColorSpace oldFillColorSpace = fillColorSpace();
+    
+    setFillRule(RULE_EVENODD);
+    setFillColor(color, colorSpace);
+
+    // fillRectWithRoundedHole() assumes that the edges of rect are clipped out, so we only care about shadows cast around inside the hole.
+    bool drawOwnShadow = hasBlurredShadow(m_state) && !m_state.shadowsIgnoreTransforms;
+    if (drawOwnShadow) {
+        float shadowBlur = m_state.shadowsUseLegacyRadius ? radiusToLegacyRadius(m_state.shadowBlur) : m_state.shadowBlur;
+
+        // Turn off CG shadows.
+        CGContextSaveGState(context);
+        CGContextSetShadowWithColor(platformContext(), CGSizeZero, 0, 0);
+
+        ShadowBlur contextShadow(shadowBlur, m_state.shadowOffset, m_state.shadowColor, m_state.shadowColorSpace);
+        contextShadow.drawInsetShadow(this, rect, roundedHoleRect.rect(), roundedHoleRect.radii());
+    }
+
+    fillPath(path);
+
+    if (drawOwnShadow)
+        CGContextRestoreGState(context);
+    
+    setFillRule(oldFillRule);
+    setFillColor(oldFillColor, oldFillColorSpace);
+}
+
 void GraphicsContext::clip(const FloatRect& rect)
 {
     if (paintingDisabled())
@@ -722,6 +827,11 @@ void GraphicsContext::clipPath(const Path& path, WindRule clipRule)
         CGContextClip(context);
 }
 
+IntRect GraphicsContext::clipBounds() const
+{
+    return enclosingIntRect(CGContextGetClipBoundingBox(platformContext()));
+}
+
 void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect, int thickness)
 {
     if (paintingDisabled())
@@ -766,6 +876,9 @@ void GraphicsContext::setPlatformShadow(const FloatSize& offset, float blur, con
 {
     if (paintingDisabled())
         return;
+    
+    // FIXME: we could avoid the shadow setup cost when we know we'll render the shadow ourselves.
+
     CGFloat xOffset = offset.width();
     CGFloat yOffset = offset.height();
     CGFloat blurRadius = blur;
diff --git a/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp b/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
index 295f632..ab5907e 100644
--- a/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
@@ -267,7 +267,7 @@ PassRefPtr<ByteArray> getImageData(const IntRect& rect, const ImageBufferData& i
     RefPtr<ByteArray> result = ByteArray::create(rect.width() * rect.height() * 4);
     unsigned char* data = result->data();
 
-    if (rect.x() < 0 || rect.y() < 0 || rect.right() > size.width() || rect.bottom() > size.height())
+    if (rect.x() < 0 || rect.y() < 0 || rect.maxX() > size.width() || rect.maxY() > size.height())
         memset(data, 0, result->length());
 
     int originx = rect.x();
@@ -276,7 +276,7 @@ PassRefPtr<ByteArray> getImageData(const IntRect& rect, const ImageBufferData& i
         destx = -originx;
         originx = 0;
     }
-    int endx = rect.right();
+    int endx = rect.maxX();
     if (endx > size.width())
         endx = size.width();
     int numColumns = endx - originx;
@@ -287,7 +287,7 @@ PassRefPtr<ByteArray> getImageData(const IntRect& rect, const ImageBufferData& i
         desty = -originy;
         originy = 0;
     }
-    int endy = rect.bottom();
+    int endy = rect.maxY();
     if (endy > size.height())
         endy = size.height();
     int numRows = endy - originy;
@@ -377,9 +377,9 @@ void putImageData(ByteArray*& source, const IntSize& sourceSize, const IntRect&
     ASSERT(destx >= 0);
     ASSERT(destx < size.width());
     ASSERT(originx >= 0);
-    ASSERT(originx <= sourceRect.right());
+    ASSERT(originx <= sourceRect.maxX());
 
-    int endx = destPoint.x() + sourceRect.right();
+    int endx = destPoint.x() + sourceRect.maxX();
     ASSERT(endx <= size.width());
 
     int numColumns = endx - destx;
@@ -389,9 +389,9 @@ void putImageData(ByteArray*& source, const IntSize& sourceSize, const IntRect&
     ASSERT(desty >= 0);
     ASSERT(desty < size.height());
     ASSERT(originy >= 0);
-    ASSERT(originy <= sourceRect.bottom());
+    ASSERT(originy <= sourceRect.maxY());
 
-    int endy = destPoint.y() + sourceRect.bottom();
+    int endy = destPoint.y() + sourceRect.maxY();
     ASSERT(endy <= size.height());
     int numRows = endy - desty;
 
diff --git a/Source/WebCore/platform/graphics/cg/ImageCG.cpp b/Source/WebCore/platform/graphics/cg/ImageCG.cpp
index dfee96a..08f65bd 100644
--- a/Source/WebCore/platform/graphics/cg/ImageCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/ImageCG.cpp
@@ -204,7 +204,7 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& destRect, const F
             adjustedDestRect.setHeight(subimageRect.height() / yScale);
 
             image.adoptCF(CGImageCreateWithImageInRect(image.get(), subimageRect));
-            if (currHeight < srcRect.bottom()) {
+            if (currHeight < srcRect.maxY()) {
                 ASSERT(CGImageGetHeight(image.get()) == currHeight - CGRectIntegral(srcRect).origin.y);
                 adjustedDestRect.setHeight(CGImageGetHeight(image.get()) / yScale);
             }
@@ -224,7 +224,7 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& destRect, const F
 
     // Flip the coords.
     CGContextScaleCTM(context, 1, -1);
-    adjustedDestRect.setY(-adjustedDestRect.bottom());
+    adjustedDestRect.setY(-adjustedDestRect.maxY());
 
     // Adjust the color space.
     image = imageWithColorSpace(image.get(), styleColorSpace);
diff --git a/Source/WebCore/platform/graphics/chromium/ComplexTextControllerLinux.cpp b/Source/WebCore/platform/graphics/chromium/ComplexTextControllerLinux.cpp
index 92861fc..4598602 100644
--- a/Source/WebCore/platform/graphics/chromium/ComplexTextControllerLinux.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ComplexTextControllerLinux.cpp
@@ -146,7 +146,10 @@ void ComplexTextController::reset(unsigned offset)
 // TextRun has been reached.
 bool ComplexTextController::nextScriptRun()
 {
-    if (!hb_utf16_script_run_next(&m_numCodePoints, &m_item.item, m_run.characters(), m_run.length(), &m_indexOfNextScriptRun))
+    // Ensure we're not pointing at the small caps buffer.
+    m_item.string = m_run.characters();
+
+    if (!hb_utf16_script_run_next(0, &m_item.item, m_run.characters(), m_run.length(), &m_indexOfNextScriptRun))
         return false;
 
     // It is actually wrong to consider script runs at all in this code.
@@ -184,11 +187,33 @@ float ComplexTextController::widthOfFullRun()
 
 void ComplexTextController::setupFontForScriptRun()
 {
-    const FontData* fontData = m_font->glyphDataForCharacter(m_item.string[m_item.item.pos], false).fontData;
+    FontDataVariant fontDataVariant = AutoVariant;
+    // Determine if this script run needs to be converted to small caps.
+    // nextScriptRun() will always send us a run of the same case, because a
+    // case change while in small-caps mode always results in different
+    // FontData, so we only need to check the first character's case.
+    if (m_font->isSmallCaps() && u_islower(m_item.string[m_item.item.pos])) {
+        m_smallCapsString = String(m_run.data(m_item.item.pos), m_item.item.length);
+        m_smallCapsString.makeUpper();
+        m_item.string = m_smallCapsString.characters();
+        m_item.item.pos = 0;
+        fontDataVariant = SmallCapsVariant;
+    }
+    const FontData* fontData = m_font->glyphDataForCharacter(m_item.string[m_item.item.pos], false, fontDataVariant).fontData;
     const FontPlatformData& platformData = fontData->fontDataForCharacter(' ')->platformData();
     m_item.face = platformData.harfbuzzFace();
     void* opaquePlatformData = const_cast<FontPlatformData*>(&platformData);
     m_item.font->userData = opaquePlatformData;
+
+    int size = platformData.size();
+    m_item.font->x_ppem = size;
+    m_item.font->y_ppem = size;
+    // x_ and y_scale are the conversion factors from font design space (fEmSize) to 1/64th of device pixels in 16.16 format.
+    const int devicePixelFraction = 64;
+    const int multiplyFor16Dot16 = 1 << 16;
+    int scale = devicePixelFraction * size * multiplyFor16Dot16 / platformData.emSizeInFontUnits();
+    m_item.font->x_scale = scale;
+    m_item.font->y_scale = scale;
 }
 
 HB_FontRec* ComplexTextController::allocHarfbuzzFont()
@@ -197,13 +222,6 @@ HB_FontRec* ComplexTextController::allocHarfbuzzFont()
     memset(font, 0, sizeof(HB_FontRec));
     font->klass = &harfbuzzSkiaClass;
     font->userData = 0;
-    // The values which harfbuzzSkiaClass returns are already scaled to
-    // pixel units, so we just set all these to one to disable further
-    // scaling.
-    font->x_ppem = 1;
-    font->y_ppem = 1;
-    font->x_scale = 1;
-    font->y_scale = 1;
 
     return font;
 }
@@ -369,7 +387,7 @@ const TextRun& ComplexTextController::getNormalizedTextRun(const TextRun& origin
         sourceText = normalizedString.getBuffer();
     }
 
-    normalizedBuffer.set(new UChar[normalizedBufferLength + 1]);
+    normalizedBuffer = adoptArrayPtr(new UChar[normalizedBufferLength + 1]);
 
     normalizeSpacesAndMirrorChars(sourceText, originalRun.rtl(), normalizedBuffer.get(), normalizedBufferLength);
 
diff --git a/Source/WebCore/platform/graphics/chromium/ComplexTextControllerLinux.h b/Source/WebCore/platform/graphics/chromium/ComplexTextControllerLinux.h
index a2aea60..6a93878 100644
--- a/Source/WebCore/platform/graphics/chromium/ComplexTextControllerLinux.h
+++ b/Source/WebCore/platform/graphics/chromium/ComplexTextControllerLinux.h
@@ -111,7 +111,7 @@ public:
     const unsigned short* logClusters() const { return m_item.log_clusters; }
 
     // return the number of code points in the current script run
-    const unsigned numCodePoints() const { return m_numCodePoints; }
+    const unsigned numCodePoints() const { return m_item.item.length; }
 
     // Return the current pixel position of the controller.
     const unsigned offsetX() const { return m_offsetX; }
@@ -141,7 +141,6 @@ private:
     ssize_t m_indexOfNextScriptRun; // Indexes the script run in |m_run|.
     unsigned m_offsetX; // Offset in pixels to the start of the next script run.
     unsigned m_pixelWidth; // Width (in px) of the current script run.
-    unsigned m_numCodePoints; // Code points in current script run.
     unsigned m_glyphsArrayCapacity; // Current size of all the Harfbuzz arrays.
 
     OwnPtr<TextRun> m_normalizedRun;
@@ -155,6 +154,7 @@ private:
                       // each word break we accumulate error. This is the
                       // number of pixels that we are behind so far.
     int m_letterSpacing; // pixels to be added after each glyph.
+    String m_smallCapsString; // substring of m_run converted to small caps.
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
index d00faf8..a38f6bd 100644
--- a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
@@ -343,7 +343,7 @@ void ContentLayerChromium::draw()
     ASSERT(sv && sv->initialized());
     GraphicsContext3D* context = layerRendererContext();
     GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE0));
-    m_contentsTexture->bindTexture();
+    bindContentsTexture();
     layerRenderer()->useShader(sv->contentShaderProgram());
     GLC(context, context->uniform1i(sv->shaderSamplerLocation(), 0));
 
@@ -361,8 +361,21 @@ void ContentLayerChromium::draw()
                          drawOpacity(), sv->shaderMatrixLocation(),
                          sv->shaderAlphaLocation());
     }
-    m_contentsTexture->unreserve();
+    unreserveContentsTexture();
+}
+
+void ContentLayerChromium::unreserveContentsTexture()
+{
+    if (m_contentsTexture)
+        m_contentsTexture->unreserve();
 }
 
+void ContentLayerChromium::bindContentsTexture()
+{
+    if (m_contentsTexture)
+        m_contentsTexture->bindTexture();
+}
+
+
 }
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
index dc1630b..3363518 100644
--- a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
@@ -50,6 +50,9 @@ public:
     virtual ~ContentLayerChromium();
 
     virtual void updateContentsIfDirty();
+    virtual void unreserveContentsTexture();
+    virtual void bindContentsTexture();
+
     virtual void draw();
     virtual bool drawsContent() { return m_owner && m_owner->drawsContent(); }
 
diff --git a/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp b/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
index 2d4ca41..d956841 100644
--- a/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
@@ -36,12 +36,20 @@
 #include "GraphicsContext3D.h"
 #include "SharedGraphicsContext3D.h"
 
+#if ENABLE(SKIA_GPU)
+#include "GrContext.h"
+#endif
+
 #if USE(ACCELERATED_COMPOSITING)
 #include "Canvas2DLayerChromium.h"
 #endif
 
 namespace WebCore {
 
+#if ENABLE(SKIA_GPU)
+extern GrContext* GetGlobalGrContext();
+#endif
+
 struct DrawingBufferInternal {
     unsigned offscreenColorTexture;
 #if USE(ACCELERATED_COMPOSITING)
@@ -72,7 +80,7 @@ DrawingBuffer::DrawingBuffer(GraphicsContext3D* context,
                              bool multisampleExtensionSupported,
                              bool packedDepthStencilExtensionSupported)
     : m_context(context)
-    , m_size(-1, -1)
+    , m_size(size)
     , m_multisampleExtensionSupported(multisampleExtensionSupported)
     , m_packedDepthStencilExtensionSupported(packedDepthStencilExtensionSupported)
     , m_fbo(0)
@@ -119,6 +127,8 @@ void DrawingBuffer::publishToPlatformLayer()
         
     if (m_callback)
         m_callback->willPublish();
+    if (multisample())
+        commit();
     unsigned parentTexture = m_internal->platformLayer->textureId();
     // FIXME: We do the copy in the canvas' (child) context so that it executes in the correct order relative to
     // other commands in the child context.  This ensures that the parent texture always contains a complete
@@ -126,6 +136,9 @@ void DrawingBuffer::publishToPlatformLayer()
     // happens before the compositor draws.  This means we might draw stale frames sometimes.  Ideally this
     // would insert a fence into the child command stream that the compositor could wait for.
     m_context->makeContextCurrent();
+#if ENABLE(SKIA_GPU)
+    GetGlobalGrContext()->flush(false);
+#endif
     static_cast<Extensions3DChromium*>(m_context->getExtensions())->copyTextureToParentTextureCHROMIUM(m_colorBuffer, parentTexture);
     m_context->flush();
 }
diff --git a/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h b/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
index d120424..92fb7b3 100644
--- a/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
@@ -44,8 +44,8 @@ public:
     virtual bool supports(const String&);
     virtual void ensureEnabled(const String&);
     virtual int getGraphicsResetStatusARB();
-    virtual void blitFramebuffer(long srcX0, long srcY0, long srcX1, long srcY1, long dstX0, long dstY0, long dstX1, long dstY1, unsigned long mask, unsigned long filter) { }
-    virtual void renderbufferStorageMultisample(unsigned long target, unsigned long samples, unsigned long internalformat, unsigned long width, unsigned long height) { }
+    virtual void blitFramebuffer(long srcX0, long srcY0, long srcX1, long srcY1, long dstX0, long dstY0, long dstX1, long dstY1, unsigned long mask, unsigned long filter);
+    virtual void renderbufferStorageMultisample(unsigned long target, unsigned long samples, unsigned long internalformat, unsigned long width, unsigned long height);
 
     enum {
         // GL_CHROMIUM_map_sub (enums inherited from GL_ARB_vertex_buffer_object)
diff --git a/Source/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp b/Source/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp
index f4c0dee..33ebc59 100644
--- a/Source/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp
@@ -399,6 +399,28 @@ static int CALLBACK traitsInFamilyEnumProc(CONST LOGFONT* logFont, CONST TEXTMET
     return 1;
 }
 
+struct GetLastResortFallbackFontProcData {
+    GetLastResortFallbackFontProcData(FontCache* fontCache, const FontDescription* fontDescription, wchar_t* fontName)
+        : m_fontCache(fontCache)
+        , m_fontDescription(fontDescription)
+        , m_fontName(fontName)
+        , m_fontData(0)
+    {
+    }
+
+    FontCache* m_fontCache;
+    const FontDescription* m_fontDescription;
+    wchar_t* m_fontName;
+    SimpleFontData* m_fontData;
+};
+
+static int CALLBACK getLastResortFallbackFontProc(const LOGFONT* logFont, const TEXTMETRIC* metrics, DWORD fontType, LPARAM lParam)
+{
+    GetLastResortFallbackFontProcData* procData = reinterpret_cast<GetLastResortFallbackFontProcData*>(lParam);
+    procData->m_fontData = fontDataFromDescriptionAndLogFont(procData->m_fontCache, *procData->m_fontDescription, *logFont, procData->m_fontName);
+    return !procData->m_fontData;
+}
+
 void FontCache::platformInit()
 {
     // Not needed on Windows.
@@ -548,6 +570,21 @@ SimpleFontData* FontCache::getLastResortFallbackFont(const FontDescription& desc
             return simpleFont;
     }
 
+    // Fall back to all the fonts installed in this PC. When a font has a
+    // localized name according to the system locale as well as an English name,
+    // both GetTextFace() and EnumFontFamilies() return the localized name. So,
+    // FontCache::createFontPlatformData() does not filter out the fonts
+    // returned by this EnumFontFamilies() call.
+    HDC dc = GetDC(0);
+    if (dc) {
+        GetLastResortFallbackFontProcData procData(this, &description, fallbackFontName);
+        EnumFontFamilies(dc, 0, getLastResortFallbackFontProc, reinterpret_cast<LPARAM>(&procData));
+        ReleaseDC(0, dc);
+
+        if (procData.m_fontData)
+            return procData.m_fontData;
+    }
+
     ASSERT_NOT_REACHED();
     return 0;
 }
diff --git a/Source/WebCore/platform/graphics/chromium/FontChromiumWin.cpp b/Source/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
index 5da4d5a..e57a84c 100644
--- a/Source/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
@@ -246,10 +246,11 @@ IntRect TransparencyAwareGlyphPainter::estimateTextBounds()
     for (int i = 0; i < m_numGlyphs; i++)
         totalWidth += lroundf(m_glyphBuffer.advanceAt(m_from + i));
 
-    return IntRect(m_point.x() - (m_font->ascent() + m_font->descent()) / 2,
-                   m_point.y() - m_font->ascent() - m_font->lineGap(),
-                   totalWidth + m_font->ascent() + m_font->descent(),
-                   m_font->lineSpacing()); 
+    const FontMetrics& fontMetrics = m_font->fontMetrics();
+    return IntRect(m_point.x() - (fontMetrics.ascent() + fontMetrics.descent()) / 2,
+                   m_point.y() - fontMetrics.ascent() - fontMetrics.lineGap(),
+                   totalWidth + fontMetrics.ascent() + fontMetrics.descent(),
+                   fontMetrics.lineSpacing()); 
 }
 
 bool TransparencyAwareGlyphPainter::drawGlyphs(int numGlyphs,
@@ -270,7 +271,7 @@ bool TransparencyAwareGlyphPainter::drawGlyphs(int numGlyphs,
     // Windows' origin is the top-left of the bounding box, so we have
     // to subtract off the font ascent to get it.
     int x = lroundf(m_point.x() + startAdvance);
-    int y = lroundf(m_point.y() - m_font->ascent());
+    int y = lroundf(m_point.y() - m_font->fontMetrics().ascent());
 
     // If there is a non-blur shadow and both the fill color and shadow color 
     // are opaque, handle without skia. 
@@ -354,10 +355,11 @@ IntRect TransparencyAwareUniscribePainter::estimateTextBounds()
     // This algorithm for estimating how much extra space we need (the text may
     // go outside the selection rect) is based roughly on
     // TransparencyAwareGlyphPainter::estimateTextBounds above.
-    return IntRect(left - (m_font->ascent() + m_font->descent()) / 2,
-                   m_point.y() - m_font->ascent() - m_font->lineGap(),
-                   (right - left) + m_font->ascent() + m_font->descent(),
-                   m_font->lineSpacing());
+    const FontMetrics& fontMetrics = m_font->fontMetrics();
+    return IntRect(left - (fontMetrics.ascent() + fontMetrics.descent()) / 2,
+                   m_point.y() - fontMetrics.ascent() - fontMetrics.lineGap(),
+                   (right - left) + fontMetrics.ascent() + fontMetrics.descent(),
+                   fontMetrics.lineSpacing());
 }
 
 }  // namespace
@@ -367,6 +369,11 @@ bool Font::canReturnFallbackFontsForComplexText()
     return false;
 }
 
+bool Font::canExpandAroundIdeographsInComplexText()
+{
+    return false;
+}
+
 void Font::drawGlyphs(GraphicsContext* graphicsContext,
                       const SimpleFontData* font,
                       const GlyphBuffer& glyphBuffer,
@@ -496,14 +503,14 @@ void Font::drawComplexText(GraphicsContext* graphicsContext,
         COLORREF savedTextColor = GetTextColor(hdc);
         SetTextColor(hdc, textColor);
         state.draw(graphicsContext, hdc, static_cast<int>(point.x()) + shadowOffset.width(),
-                   static_cast<int>(point.y() - ascent()) + shadowOffset.height(), from, to);
+                   static_cast<int>(point.y() - fontMetrics().ascent()) + shadowOffset.height(), from, to);
         SetTextColor(hdc, savedTextColor); 
     }
 
     // Uniscribe counts the coordinates from the upper left, while WebKit uses
     // the baseline, so we have to subtract off the ascent.
     state.draw(graphicsContext, hdc, static_cast<int>(point.x()),
-               static_cast<int>(point.y() - ascent()), from, to);
+               static_cast<int>(point.y() - fontMetrics().ascent()), from, to);
 
     context->canvas()->endPlatformPaint();
 }
diff --git a/Source/WebCore/platform/graphics/chromium/FontLinux.cpp b/Source/WebCore/platform/graphics/chromium/FontLinux.cpp
index 822bbbb..823dbc9 100644
--- a/Source/WebCore/platform/graphics/chromium/FontLinux.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FontLinux.cpp
@@ -55,6 +55,11 @@ bool Font::canReturnFallbackFontsForComplexText()
     return false;
 }
 
+bool Font::canExpandAroundIdeographsInComplexText()
+{
+    return false;
+}
+
 static bool isCanvasMultiLayered(SkCanvas* canvas)
 {
     SkCanvas::LayerIter layerIterator(canvas, false);
@@ -204,7 +209,7 @@ void Font::drawComplexText(GraphicsContext* gc, const TextRun& run,
     ComplexTextController controller(run, point.x(), this);
     controller.setWordSpacingAdjustment(wordSpacing());
     controller.setLetterSpacingAdjustment(letterSpacing());
-    controller.setPadding(run.padding());
+    controller.setPadding(run.expansion());
 
     if (run.rtl()) {
         // FIXME: this causes us to shape the text twice -- once to compute the width and then again
@@ -213,7 +218,7 @@ void Font::drawComplexText(GraphicsContext* gc, const TextRun& run,
         controller.reset(point.x() + controller.widthOfFullRun());
         // We need to set the padding again because ComplexTextController layout consumed the value.
         // Fixing the above problem would help here too.
-        controller.setPadding(run.padding());
+        controller.setPadding(run.expansion());
     }
 
     while (controller.nextScriptRun()) {
@@ -241,7 +246,7 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
     ComplexTextController controller(run, 0, this);
     controller.setWordSpacingAdjustment(wordSpacing());
     controller.setLetterSpacingAdjustment(letterSpacing());
-    controller.setPadding(run.padding());
+    controller.setPadding(run.expansion());
     return controller.widthOfFullRun();
 }
 
@@ -275,11 +280,11 @@ int Font::offsetForPositionForComplexText(const TextRun& run, float xFloat,
     ComplexTextController controller(run, 0, this);
     controller.setWordSpacingAdjustment(wordSpacing());
     controller.setLetterSpacingAdjustment(letterSpacing());
-    controller.setPadding(run.padding());
+    controller.setPadding(run.expansion());
     if (run.rtl()) {
         // See FIXME in drawComplexText.
         controller.reset(controller.widthOfFullRun());
-        controller.setPadding(run.padding());
+        controller.setPadding(run.expansion());
     }
 
     unsigned basePosition = 0;
@@ -326,11 +331,11 @@ FloatRect Font::selectionRectForComplexText(const TextRun& run,
     ComplexTextController controller(run, 0, this);
     controller.setWordSpacingAdjustment(wordSpacing());
     controller.setLetterSpacingAdjustment(letterSpacing());
-    controller.setPadding(run.padding());
+    controller.setPadding(run.expansion());
     if (run.rtl()) {
         // See FIXME in drawComplexText.
         controller.reset(controller.widthOfFullRun());
-        controller.setPadding(run.padding());
+        controller.setPadding(run.expansion());
     }
 
     // Iterate through the script runs in logical order, searching for the run covering the positions of interest.
diff --git a/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp b/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp
index a1ea012..6f9009f 100644
--- a/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp
@@ -36,6 +36,7 @@
 #include "PlatformBridge.h"
 #include "PlatformString.h"
 
+#include "SkAdvancedTypefaceMetrics.h"
 #include "SkPaint.h"
 #include "SkTypeface.h"
 
@@ -71,6 +72,7 @@ FontPlatformData::FontPlatformData(const FontPlatformData& src)
     : m_typeface(src.m_typeface)
     , m_family(src.m_family)
     , m_textSize(src.m_textSize)
+    , m_emSizeInFontUnits(src.m_emSizeInFontUnits)
     , m_fakeBold(src.m_fakeBold)
     , m_fakeItalic(src.m_fakeItalic)
     , m_orientation(src.m_orientation)
@@ -84,6 +86,7 @@ FontPlatformData::FontPlatformData(SkTypeface* tf, const char* family, float tex
     : m_typeface(tf)
     , m_family(family)
     , m_textSize(textSize)
+    , m_emSizeInFontUnits(0)
     , m_fakeBold(fakeBold)
     , m_fakeItalic(fakeItalic)
     , m_orientation(orientation)
@@ -96,6 +99,7 @@ FontPlatformData::FontPlatformData(const FontPlatformData& src, float textSize)
     : m_typeface(src.m_typeface)
     , m_family(src.m_family)
     , m_textSize(textSize)
+    , m_emSizeInFontUnits(src.m_emSizeInFontUnits)
     , m_fakeBold(src.m_fakeBold)
     , m_fakeItalic(src.m_fakeItalic)
     , m_harfbuzzFace(src.m_harfbuzzFace)
@@ -109,6 +113,17 @@ FontPlatformData::~FontPlatformData()
     SkSafeUnref(m_typeface);
 }
 
+int FontPlatformData::emSizeInFontUnits() const
+{
+    if (m_emSizeInFontUnits)
+        return m_emSizeInFontUnits;
+
+    SkAdvancedTypefaceMetrics* metrics = m_typeface->getAdvancedTypefaceMetrics(false);
+    m_emSizeInFontUnits = metrics->fEmSize;
+    metrics->unref();
+    return m_emSizeInFontUnits;
+}
+
 FontPlatformData& FontPlatformData::operator=(const FontPlatformData& src)
 {
     SkRefCnt_SafeAssign(m_typeface, src.m_typeface);
@@ -120,6 +135,7 @@ FontPlatformData& FontPlatformData::operator=(const FontPlatformData& src)
     m_harfbuzzFace = src.m_harfbuzzFace;
     m_orientation = src.m_orientation;
     m_style = src.m_style;
+    m_emSizeInFontUnits = src.m_emSizeInFontUnits;
 
     return *this;
 }
diff --git a/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.h b/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.h
index 43771d7..d9ebb61 100644
--- a/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.h
+++ b/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.h
@@ -63,6 +63,7 @@ public:
     FontPlatformData(WTF::HashTableDeletedValueType)
         : m_typeface(hashTableDeletedFontValue())
         , m_textSize(0)
+        , m_emSizeInFontUnits(0)
         , m_fakeBold(false)
         , m_fakeItalic(false)
         { }
@@ -70,6 +71,7 @@ public:
     FontPlatformData()
         : m_typeface(0)
         , m_textSize(0)
+        , m_emSizeInFontUnits(0)
         , m_fakeBold(false)
         , m_fakeItalic(false)
         , m_orientation(Horizontal)
@@ -78,6 +80,7 @@ public:
     FontPlatformData(float textSize, bool fakeBold, bool fakeItalic)
         : m_typeface(0)
         , m_textSize(textSize)
+        , m_emSizeInFontUnits(0)
         , m_fakeBold(fakeBold)
         , m_fakeItalic(fakeItalic)
         , m_orientation(Horizontal)
@@ -107,6 +110,7 @@ public:
 
     unsigned hash() const;
     float size() const { return m_textSize; }
+    int emSizeInFontUnits() const;
 
     FontOrientation orientation() const { return m_orientation; }
 
@@ -153,6 +157,7 @@ private:
     SkTypeface* m_typeface;
     CString m_family;
     float m_textSize;
+    mutable int m_emSizeInFontUnits;
     bool m_fakeBold;
     bool m_fakeItalic;
     FontOrientation m_orientation;
diff --git a/Source/WebCore/platform/graphics/chromium/GLES2Canvas.cpp b/Source/WebCore/platform/graphics/chromium/GLES2Canvas.cpp
index 4393f97..953ee2f 100644
--- a/Source/WebCore/platform/graphics/chromium/GLES2Canvas.cpp
+++ b/Source/WebCore/platform/graphics/chromium/GLES2Canvas.cpp
@@ -83,6 +83,22 @@ struct GLES2Canvas::State {
     AffineTransform m_ctm;
     WTF::Vector<Path> m_clippingPaths;
     bool m_clippingEnabled;
+
+    // Helper function for applying the state's alpha value to the given input
+    // color to produce a new output color. The logic is the same as
+    // PlatformContextSkia::State::applyAlpha(), but the type is different.
+    Color applyAlpha(const Color& c)
+    {
+        int s = roundf(m_alpha * 256);
+        if (s >= 256)
+            return c;
+        if (s < 0)
+            return Color();
+
+        int a = (c.alpha() * s) >> 8;
+        return Color(c.red(), c.green(), c.blue(), a);
+    }
+
 };
 
 static inline FloatPoint operator*(const FloatPoint& f, float scale)
@@ -192,7 +208,7 @@ void GLES2Canvas::fillPath(const Path& path)
 {
     m_context->applyCompositeOperator(m_state->m_compositeOp);
     applyClipping(m_state->m_clippingEnabled);
-    fillPath(path, m_state->m_fillColor);
+    fillPath(path, m_state->applyAlpha(m_state->m_fillColor));
 }
 
 void GLES2Canvas::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
@@ -214,7 +230,7 @@ void GLES2Canvas::fillRect(const FloatRect& rect, const Color& color, ColorSpace
 
 void GLES2Canvas::fillRect(const FloatRect& rect)
 {
-    fillRect(rect, m_state->m_fillColor, ColorSpaceDeviceRGB);
+    fillRect(rect, m_state->applyAlpha(m_state->m_fillColor), ColorSpaceDeviceRGB);
 }
 
 void GLES2Canvas::setFillColor(const Color& color, ColorSpace colorSpace)
@@ -322,8 +338,8 @@ void GLES2Canvas::drawTexturedRect(Texture* texture, const FloatRect& srcRect, c
     m_context->useQuadVertices();
     m_context->setActiveTexture(GraphicsContext3D::TEXTURE0);
 
-    for (int y = tileIdxRect.y(); y <= tileIdxRect.bottom(); y++) {
-        for (int x = tileIdxRect.x(); x <= tileIdxRect.right(); x++)
+    for (int y = tileIdxRect.y(); y <= tileIdxRect.maxY(); y++) {
+        for (int x = tileIdxRect.x(); x <= tileIdxRect.maxX(); x++)
             drawTexturedRectTile(texture, tiles.tileIndex(x, y), srcRect, dstRect, transform, alpha);
     }
 }
diff --git a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
index 5e8d148..488230c 100644
--- a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
@@ -263,6 +263,17 @@ void GraphicsLayerChromium::setContentsOpaque(bool opaque)
     updateContentsOpaque();
 }
 
+void GraphicsLayerChromium::setMaskLayer(GraphicsLayer* maskLayer)
+{
+    if (maskLayer == m_maskLayer)
+        return;
+
+    GraphicsLayer::setMaskLayer(maskLayer);
+
+    LayerChromium* maskLayerChromium = m_maskLayer ? m_maskLayer->platformLayer() : 0;
+    m_layer->setMaskLayer(maskLayerChromium);
+}
+
 void GraphicsLayerChromium::setBackfaceVisibility(bool visible)
 {
     if (m_backfaceVisibility == visible)
@@ -283,6 +294,15 @@ void GraphicsLayerChromium::setOpacity(float opacity)
     primaryLayer()->setOpacity(opacity);
 }
 
+void GraphicsLayerChromium::setReplicatedByLayer(GraphicsLayer* layer)
+{
+    GraphicsLayerChromium* layerChromium = static_cast<GraphicsLayerChromium*>(layer);
+    GraphicsLayer::setReplicatedByLayer(layer);
+    LayerChromium* replicaLayer = layerChromium ? layerChromium->primaryLayer() : 0;
+    primaryLayer()->setReplicaLayer(replicaLayer);
+}
+
+
 void GraphicsLayerChromium::setContentsNeedsDisplay()
 {
     if (m_contentsLayer)
@@ -494,6 +514,7 @@ void GraphicsLayerChromium::updateAnchorPoint()
 {
     primaryLayer()->setAnchorPoint(FloatPoint(m_anchorPoint.x(), m_anchorPoint.y()));
     primaryLayer()->setAnchorPointZ(m_anchorPoint.z());
+
     updateLayerPosition();
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
index 130c25c..92c61fe 100644
--- a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
@@ -67,6 +67,7 @@ public:
     virtual void setPreserves3D(bool);
     virtual void setMasksToBounds(bool);
     virtual void setDrawsContent(bool);
+    virtual void setMaskLayer(GraphicsLayer*);
 
     virtual void setBackgroundColor(const Color&);
     virtual void clearBackgroundColor();
@@ -74,6 +75,8 @@ public:
     virtual void setContentsOpaque(bool);
     virtual void setBackfaceVisibility(bool);
 
+    virtual void setReplicatedByLayer(GraphicsLayer*);
+
     virtual void setOpacity(float);
 
     virtual void setNeedsDisplay();
diff --git a/Source/WebCore/platform/graphics/chromium/HarfbuzzSkia.cpp b/Source/WebCore/platform/graphics/chromium/HarfbuzzSkia.cpp
index 056d8eb..26ca64e 100644
--- a/Source/WebCore/platform/graphics/chromium/HarfbuzzSkia.cpp
+++ b/Source/WebCore/platform/graphics/chromium/HarfbuzzSkia.cpp
@@ -94,7 +94,7 @@ static void glyphsToAdvances(HB_Font hbFont, const HB_Glyph* glyphs, hb_uint32 n
     font->setupPaint(&paint);
     paint.setTextEncoding(SkPaint::kGlyphID_TextEncoding);
 
-    OwnArrayPtr<uint16_t> glyphs16(new uint16_t[numGlyphs]);
+    OwnArrayPtr<uint16_t> glyphs16 = adoptArrayPtr(new uint16_t[numGlyphs]);
     if (!glyphs16.get())
         return;
     for (unsigned i = 0; i < numGlyphs; ++i)
@@ -120,7 +120,7 @@ static HB_Bool canRender(HB_Font hbFont, const HB_UChar16* characters, hb_uint32
     font->setupPaint(&paint);
     paint.setTextEncoding(SkPaint::kUTF16_TextEncoding);
 
-    OwnArrayPtr<uint16_t> glyphs16(new uint16_t[length]);
+    OwnArrayPtr<uint16_t> glyphs16 = adoptArrayPtr(new uint16_t[length]);
     if (!glyphs16.get())
         return 0;
     int numGlyphs = paint.textToGlyphs(characters, length * sizeof(uint16_t), glyphs16.get());
diff --git a/Source/WebCore/platform/graphics/chromium/IconChromiumWin.cpp b/Source/WebCore/platform/graphics/chromium/IconChromium.cpp
index e958d4a..398cc3b 100644
--- a/Source/WebCore/platform/graphics/chromium/IconChromiumWin.cpp
+++ b/Source/WebCore/platform/graphics/chromium/IconChromium.cpp
@@ -1,10 +1,10 @@
 /*
- * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
- * 
+ * Copyright (c) 2011, Google Inc. All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -31,25 +31,18 @@
 #include "config.h"
 #include "Icon.h"
 
-#include <windows.h>
-#include <shellapi.h>
-
 #include "GraphicsContext.h"
-#include "PlatformContextSkia.h"
 #include "PlatformString.h"
-#include "SkiaUtils.h"
 
 namespace WebCore {
 
-Icon::Icon(const PlatformIcon& icon)
+Icon::Icon(PassRefPtr<PlatformIcon> icon)
     : m_icon(icon)
 {
 }
 
 Icon::~Icon()
 {
-    if (m_icon)
-        DestroyIcon(m_icon);
 }
 
 void Icon::paint(GraphicsContext* context, const IntRect& rect)
@@ -57,9 +50,9 @@ void Icon::paint(GraphicsContext* context, const IntRect& rect)
     if (context->paintingDisabled())
         return;
 
-    HDC hdc = context->platformContext()->canvas()->beginPlatformPaint();
-    DrawIconEx(hdc, rect.x(), rect.y(), m_icon, rect.width(), rect.height(), 0, 0, DI_NORMAL);
-    context->platformContext()->canvas()->endPlatformPaint();
+    // An Icon doesn't know the color space of the file upload control.
+    // So use ColorSpaceDeviceRGB.
+    context->drawImage(m_icon.get(), ColorSpaceDeviceRGB, rect);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
index b7ab098..8d01d9b 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
@@ -143,6 +143,7 @@ PassRefPtr<LayerChromium> LayerChromium::create(GraphicsLayerChromium* owner)
 LayerChromium::LayerChromium(GraphicsLayerChromium* owner)
     : m_owner(owner)
     , m_contentsDirty(false)
+    , m_maskLayer(0)
     , m_targetRenderSurface(0)
     , m_superlayer(0)
     , m_anchorPoint(0.5, 0.5)
@@ -162,6 +163,7 @@ LayerChromium::LayerChromium(GraphicsLayerChromium* owner)
     , m_drawDepth(0)
     , m_layerRenderer(0)
     , m_renderSurface(0)
+    , m_replicaLayer(0)
 {
 }
 
@@ -433,9 +435,7 @@ void LayerChromium::drawTexturedQuad(GraphicsContext3D* context, const Transform
     renderMatrix.scale3d(width, height, 1);
 
     // Apply the projection matrix before sending the transform over to the shader.
-    renderMatrix.multiply(projectionMatrix);
-
-    toGLMatrix(&glMatrix[0], renderMatrix);
+    toGLMatrix(&glMatrix[0], projectionMatrix * renderMatrix);
 
     GLC(context, context->uniformMatrix4fv(matrixLocation, false, &glMatrix[0], 1));
 
@@ -457,8 +457,7 @@ void LayerChromium::drawDebugBorder()
     layerRenderer()->useShader(sv->borderShaderProgram());
     TransformationMatrix renderMatrix = drawTransform();
     renderMatrix.scale3d(bounds().width(), bounds().height(), 1);
-    renderMatrix.multiply(layerRenderer()->projectionMatrix());
-    toGLMatrix(&glMatrix[0], renderMatrix);
+    toGLMatrix(&glMatrix[0], layerRenderer()->projectionMatrix() * renderMatrix);
     GraphicsContext3D* context = layerRendererContext();
     GLC(context, context->uniformMatrix4fv(sv->borderShaderMatrixLocation(), false, &glMatrix[0], 1));
 
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.h b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
index a0a690f..5c7e2b1 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
@@ -112,6 +112,9 @@ public:
     void setName(const String& name) { m_name = name; }
     String name() const { return m_name; }
 
+    void setMaskLayer(LayerChromium* maskLayer) { m_maskLayer = maskLayer; }
+    LayerChromium* maskLayer() const { return m_maskLayer.get(); }
+
     void setNeedsDisplay(const FloatRect& dirtyRect);
     void setNeedsDisplay();
     const FloatRect& dirtyRect() const { return m_dirtyRect; }
@@ -152,12 +155,17 @@ public:
 
     void setOwner(GraphicsLayerChromium* owner) { m_owner = owner; }
 
+    void setReplicaLayer(LayerChromium* layer) { m_replicaLayer = layer; }
+    LayerChromium* replicaLayer() { return m_replicaLayer; }
+
     // Returns the rect containtaining this layer in the current view's coordinate system.
     const IntRect getDrawRect() const;
 
     // These methods typically need to be overwritten by derived classes.
     virtual bool drawsContent() { return false; }
     virtual void updateContentsIfDirty() { }
+    virtual void unreserveContentsTexture() { }
+    virtual void bindContentsTexture() { }
     virtual void draw() { }
 
     void drawDebugBorder();
@@ -222,6 +230,8 @@ protected:
     FloatRect m_dirtyRect;
     bool m_contentsDirty;
 
+    RefPtr<LayerChromium> m_maskLayer;
+
     // Render surface this layer draws into. This is a surface that can belong
     // either to this layer (if m_targetRenderSurface == m_renderSurface) or
     // to an ancestor of this layer. The target render surface determines the
@@ -298,6 +308,9 @@ private:
     // Hierarchical bounding rect containing the layer and its descendants.
     IntRect m_drawableContentRect;
 
+    // Replica layer used for reflections.
+    LayerChromium* m_replicaLayer;
+
     String m_name;
 };
 
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
index 90eac74..f5548c9 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
@@ -143,20 +143,19 @@ void LayerRendererChromium::useShader(unsigned programId)
 
 IntRect LayerRendererChromium::verticalScrollbarRect(const IntRect& visibleRect, const IntRect& contentRect)
 {
-    IntRect verticalScrollbar(IntPoint(contentRect.right(), contentRect.y()), IntSize(visibleRect.width() - contentRect.width(), visibleRect.height()));
+    IntRect verticalScrollbar(IntPoint(contentRect.maxX(), contentRect.y()), IntSize(visibleRect.width() - contentRect.width(), visibleRect.height()));
     return verticalScrollbar;
 }
 
 IntRect LayerRendererChromium::horizontalScrollbarRect(const IntRect& visibleRect, const IntRect& contentRect)
 {
-    IntRect horizontalScrollbar(IntPoint(contentRect.x(), contentRect.bottom()), IntSize(visibleRect.width(), visibleRect.height() - contentRect.height()));
+    IntRect horizontalScrollbar(IntPoint(contentRect.x(), contentRect.maxY()), IntSize(visibleRect.width(), visibleRect.height() - contentRect.height()));
     return horizontalScrollbar;
 }
 
 void LayerRendererChromium::invalidateRootLayerRect(const IntRect& dirtyRect, const IntRect& visibleRect, const IntRect& contentRect)
 {
-    if (contentRect.intersects(dirtyRect))
-        m_rootLayerTiler->invalidateRect(dirtyRect);
+    m_rootLayerTiler->invalidateRect(dirtyRect);
     if (m_horizontalScrollbarTiler) {
         IntRect scrollbar = horizontalScrollbarRect(visibleRect, contentRect);
         if (dirtyRect.intersects(scrollbar)) {
@@ -266,6 +265,11 @@ void LayerRendererChromium::drawLayers(const IntRect& visibleRect, const IntRect
     // Re-enable color writes to layers, which may be partially transparent.
     m_context->colorMask(true, true, true, true);
 
+    // Recheck that we still have a root layer.  This may become null if
+    // compositing gets turned off during a paint operation.
+    if (!m_rootLayer)
+        return;
+
     // Set the root visible/content rects --- used by subsequent drawLayers calls.
     m_rootVisibleRect = visibleRect;
     m_rootContentRect = contentRect;
@@ -346,8 +350,8 @@ void LayerRendererChromium::setRootLayer(PassRefPtr<LayerChromium> layer)
 
 void LayerRendererChromium::getFramebufferPixels(void *pixels, const IntRect& rect)
 {
-    ASSERT(rect.right() <= rootLayerTextureSize().width()
-           && rect.bottom() <= rootLayerTextureSize().height());
+    ASSERT(rect.maxX() <= rootLayerTextureSize().width()
+           && rect.maxY() <= rootLayerTextureSize().height());
 
     if (!pixels)
         return;
@@ -388,7 +392,7 @@ bool LayerRendererChromium::isLayerVisible(LayerChromium* layer, const Transform
     // bounds into clip space.
     TransformationMatrix renderMatrix = matrix;
     renderMatrix.scale3d(layer->bounds().width(), layer->bounds().height(), 1);
-    renderMatrix.multiply(m_projectionMatrix);
+    renderMatrix = m_projectionMatrix * renderMatrix;
 
     FloatRect layerRect(-0.5, -0.5, 1, 1);
     FloatRect mappedRect = renderMatrix.mapRect(layerRect);
@@ -434,12 +438,12 @@ void LayerRendererChromium::updateLayersRecursive(LayerChromium* layer, const Tr
     // LT = Tr[l]
     layerLocalTransform.translate3d(position.x(), position.y(), layer->anchorPointZ());
     // LT = Tr[l] * M[l]
-    layerLocalTransform.multLeft(layer->transform());
+    layerLocalTransform.multiply(layer->transform());
     // LT = Tr[l] * M[l] * Tr[c]
     layerLocalTransform.translate3d(centerOffsetX, centerOffsetY, -layer->anchorPointZ());
 
     TransformationMatrix combinedTransform = parentMatrix;
-    combinedTransform = combinedTransform.multLeft(layerLocalTransform);
+    combinedTransform = combinedTransform.multiply(layerLocalTransform);
 
     FloatRect layerRect(-0.5 * layer->bounds().width(), -0.5 * layer->bounds().height(), layer->bounds().width(), layer->bounds().height());
     IntRect transformedLayerRect;
@@ -448,12 +452,17 @@ void LayerRendererChromium::updateLayersRecursive(LayerChromium* layer, const Tr
     // these conditions hold:
     // 1. The layer clips its descendants and its transform is not a simple translation.
     // 2. If the layer has opacity != 1 and does not have a preserves-3d transform style.
+    // 3. The layer uses a mask
+    // 4. The layer has a replica (used for reflections)
     // If a layer preserves-3d then we don't create a RenderSurface for it to avoid flattening
     // out its children. The opacity value of the children layers is multiplied by the opacity
     // of their parent.
     bool useSurfaceForClipping = layer->masksToBounds() && !isScaleOrTranslation(combinedTransform);
     bool useSurfaceForOpacity = layer->opacity() != 1 && !layer->preserves3D();
-    if ((useSurfaceForClipping || useSurfaceForOpacity) && layer->descendantsDrawContent()) {
+    bool useSurfaceForMasking = layer->maskLayer();
+    bool useSurfaceForReflection = layer->replicaLayer();
+    if (((useSurfaceForClipping || useSurfaceForOpacity) && layer->descendantsDrawContent())
+        || useSurfaceForMasking || useSurfaceForReflection) {
         RenderSurfaceChromium* renderSurface = layer->m_renderSurface.get();
         if (!renderSurface)
             renderSurface = layer->createRenderSurface();
@@ -487,6 +496,18 @@ void LayerRendererChromium::updateLayersRecursive(LayerChromium* layer, const Tr
 
         renderSurface->m_layerList.clear();
 
+        if (layer->maskLayer()) {
+            renderSurface->m_maskLayer = layer->maskLayer();
+            layer->maskLayer()->setLayerRenderer(this);
+            layer->maskLayer()->m_targetRenderSurface = renderSurface;
+        } else
+            renderSurface->m_maskLayer = 0;
+
+        if (layer->replicaLayer() && layer->replicaLayer()->maskLayer()) {
+            layer->replicaLayer()->maskLayer()->setLayerRenderer(this);
+            layer->replicaLayer()->maskLayer()->m_targetRenderSurface = renderSurface;
+        }
+
         renderSurfaceLayerList.append(layer);
     } else {
         // DT = M[p] * LT
@@ -540,7 +561,7 @@ void LayerRendererChromium::updateLayersRecursive(LayerChromium* layer, const Tr
     }
 
     // Apply the sublayer transform at the center of the layer.
-    sublayerMatrix.multLeft(layer->sublayerTransform());
+    sublayerMatrix.multiply(layer->sublayerTransform());
 
     // The origin of the sublayers is the top left corner of the layer, not the
     // center. The matrix passed down to the sublayers is therefore:
@@ -558,16 +579,13 @@ void LayerRendererChromium::updateLayersRecursive(LayerChromium* layer, const Tr
 
         if (sublayer->m_renderSurface) {
             RenderSurfaceChromium* sublayerRenderSurface = sublayer->m_renderSurface.get();
-            const IntRect& contentRect = sublayerRenderSurface->contentRect();
-            FloatRect sublayerRect(-0.5 * contentRect.width(), -0.5 * contentRect.height(),
-                                   contentRect.width(), contentRect.height());
-            layer->m_drawableContentRect.unite(enclosingIntRect(sublayerRenderSurface->m_drawTransform.mapRect(sublayerRect)));
+            layer->m_drawableContentRect.unite(enclosingIntRect(sublayerRenderSurface->drawableContentRect()));
             descendants.append(sublayer);
         } else
             layer->m_drawableContentRect.unite(sublayer->m_drawableContentRect);
     }
 
-    if (layer->masksToBounds())
+    if (layer->masksToBounds() || useSurfaceForMasking)
         layer->m_drawableContentRect.intersect(transformedLayerRect);
 
     if (layer->m_renderSurface && layer != m_rootLayer) {
@@ -577,9 +595,13 @@ void LayerRendererChromium::updateLayersRecursive(LayerChromium* layer, const Tr
 
         // Restrict the RenderSurface size to the portion that's visible.
         FloatSize centerOffsetDueToClipping;
-        renderSurface->m_contentRect.intersect(layer->m_scissorRect);
-        FloatPoint clippedSurfaceCenter = renderSurface->contentRectCenter();
-        centerOffsetDueToClipping = clippedSurfaceCenter - surfaceCenter;
+        // Don't clip if the layer is reflected as the reflection shouldn't be
+        // clipped.
+        if (!layer->replicaLayer()) {
+            renderSurface->m_contentRect.intersect(layer->m_scissorRect);
+            FloatPoint clippedSurfaceCenter = renderSurface->contentRectCenter();
+            centerOffsetDueToClipping = clippedSurfaceCenter - surfaceCenter;
+        }
 
         // The RenderSurface backing texture cannot exceed the maximum supported
         // texture size.
@@ -596,6 +618,15 @@ void LayerRendererChromium::updateLayersRecursive(LayerChromium* layer, const Tr
         // Adjust the origin of the transform to be the center of the render surface.
         renderSurface->m_drawTransform = renderSurface->m_originTransform;
         renderSurface->m_drawTransform.translate3d(surfaceCenter.x() + centerOffsetDueToClipping.width(), surfaceCenter.y() + centerOffsetDueToClipping.height(), 0);
+
+        // Compute the transformation matrix used to draw the replica of the render
+        // surface.
+        if (layer->replicaLayer()) {
+            renderSurface->m_replicaDrawTransform = renderSurface->m_originTransform;
+            renderSurface->m_replicaDrawTransform.translate3d(layer->replicaLayer()->position().x(), layer->replicaLayer()->position().y(), 0);
+            renderSurface->m_replicaDrawTransform.multiply(layer->replicaLayer()->transform());
+            renderSurface->m_replicaDrawTransform.translate3d(surfaceCenter.x() - anchorPoint.x() * bounds.width(), surfaceCenter.y() - anchorPoint.y() * bounds.height(), 0);
+        }
     }
 
     // Compute the depth value of the center of the layer which will be used when
@@ -682,10 +713,10 @@ void LayerRendererChromium::drawLayer(LayerChromium* layer, RenderSurfaceChromiu
     if (!isLayerVisible)
         return;
 
-    // FIXME: Need to take into account the transform of the containing
-    // RenderSurface here, otherwise single-sided layers that draw on
-    // transformed surfaces won't always be culled properly.
-    if (!layer->doubleSided() && layer->m_drawTransform.m33() < 0)
+    // FIXME: Need to take into account the commulative render surface transforms all the way from
+    //        the default render surface in order to determine visibility.
+    TransformationMatrix combinedDrawMatrix = (layer->m_renderSurface ? layer->m_renderSurface->drawTransform().multiply(layer->m_drawTransform) : layer->m_drawTransform);
+    if (!layer->doubleSided() && combinedDrawMatrix.m33() < 0)
          return;
 
     if (layer->drawsContent()) {
@@ -711,7 +742,7 @@ void LayerRendererChromium::setScissorToRect(const IntRect& scissorRect)
     // But, if rendering to offscreen texture, we reverse our sense of 'upside down'.
     int scissorY;
     if (m_currentRenderSurface == m_defaultRenderSurface && !m_compositeOffscreen)
-        scissorY = m_currentRenderSurface->m_contentRect.height() - (scissorRect.bottom() - m_currentRenderSurface->m_contentRect.y());
+        scissorY = m_currentRenderSurface->m_contentRect.height() - (scissorRect.maxY() - m_currentRenderSurface->m_contentRect.y());
     else
         scissorY = scissorRect.y() - m_currentRenderSurface->m_contentRect.y();
     GLC(m_context.get(), m_context->scissor(scissorX, scissorY, scissorRect.width(), scissorRect.height()));
@@ -737,9 +768,9 @@ bool LayerRendererChromium::checkTextureSize(const IntSize& textureSize)
 void LayerRendererChromium::setDrawViewportRect(const IntRect& drawRect, bool flipY)
 {
     if (flipY)
-        m_projectionMatrix = orthoMatrix(drawRect.x(), drawRect.right(), drawRect.bottom(), drawRect.y());
+        m_projectionMatrix = orthoMatrix(drawRect.x(), drawRect.maxX(), drawRect.maxY(), drawRect.y());
     else
-        m_projectionMatrix = orthoMatrix(drawRect.x(), drawRect.right(), drawRect.y(), drawRect.bottom());
+        m_projectionMatrix = orthoMatrix(drawRect.x(), drawRect.maxX(), drawRect.y(), drawRect.maxY());
     GLC(m_context.get(), m_context->viewport(0, 0, drawRect.width(), drawRect.height()));
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/LayerTexture.cpp b/Source/WebCore/platform/graphics/chromium/LayerTexture.cpp
index 32bfa0b..23cb4b3 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerTexture.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerTexture.cpp
@@ -79,6 +79,7 @@ void LayerTexture::unreserve()
 
 void LayerTexture::bindTexture()
 {
+    ASSERT(m_textureManager->hasTexture(m_token));
     m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_textureId);
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp
index 6b65e66..e28c084 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp
@@ -145,8 +145,8 @@ void LayerTilerChromium::contentRectToTileIndices(const IntRect& contentRect, in
 
     left = layerRect.x() / m_tileSize.width();
     top = layerRect.y() / m_tileSize.height();
-    right = (layerRect.right() - 1) / m_tileSize.width();
-    bottom = (layerRect.bottom() - 1) / m_tileSize.height();
+    right = (layerRect.maxX() - 1) / m_tileSize.width();
+    bottom = (layerRect.maxY() - 1) / m_tileSize.height();
 }
 
 IntRect LayerTilerChromium::contentRectToLayerRect(const IntRect& contentRect) const
@@ -272,7 +272,11 @@ void LayerTilerChromium::update(TilePaintInterface& painter, const IntRect& cont
     // Get the contents of the updated rect.
     const SkBitmap& bitmap = canvas->getDevice()->accessBitmap(false);
     ASSERT(bitmap.width() == paintRect.width() && bitmap.height() == paintRect.height());
+    if (bitmap.width() != paintRect.width() || bitmap.height() != paintRect.height())
+        CRASH();
     uint8_t* paintPixels = static_cast<uint8_t*>(bitmap.getPixels());
+    if (!paintPixels)
+        CRASH();
 #elif PLATFORM(CG)
     Vector<uint8_t> canvasPixels;
     int rowBytes = 4 * paintRect.width();
@@ -299,9 +303,15 @@ void LayerTilerChromium::update(TilePaintInterface& painter, const IntRect& cont
 #error "Need to implement for your platform."
 #endif
 
+    // Painting could cause compositing to get turned off, which may cause the tiler to become invalidated mid-update.
+    if (!m_tiles.size())
+        return;
+
     for (int j = top; j <= bottom; ++j) {
         for (int i = left; i <= right; ++i) {
             Tile* tile = m_tiles[tileIndex(i, j)].get();
+            if (!tile)
+                CRASH();
             if (!tile->dirty())
                 continue;
 
@@ -320,13 +330,21 @@ void LayerTilerChromium::update(TilePaintInterface& painter, const IntRect& cont
 
             // Calculate tile-space rectangle to upload into.
             IntRect destRect(IntPoint(sourceRect.x() - anchor.x(), sourceRect.y() - anchor.y()), sourceRect.size());
-            ASSERT(destRect.x() >= 0);
-            ASSERT(destRect.y() >= 0);
+            if (destRect.x() < 0)
+                CRASH();
+            if (destRect.y() < 0)
+                CRASH();
 
             // Offset from paint rectangle to this tile's dirty rectangle.
             IntPoint paintOffset(sourceRect.x() - paintRect.x(), sourceRect.y() - paintRect.y());
-            ASSERT(paintOffset.x() >= 0);
-            ASSERT(paintOffset.y() >= 0);
+            if (paintOffset.x() < 0)
+                CRASH();
+            if (paintOffset.y() < 0)
+                CRASH();
+            if (paintOffset.x() + destRect.width() > paintRect.width())
+                CRASH();
+            if (paintOffset.y() + destRect.height() > paintRect.height())
+                CRASH();
 
             uint8_t* pixelSource;
             if (paintRect.width() == sourceRect.width() && !paintOffset.x())
@@ -357,7 +375,7 @@ void LayerTilerChromium::setLayerPosition(const IntPoint& layerPosition)
 
 void LayerTilerChromium::draw(const IntRect& contentRect)
 {
-    if (m_skipsDraw)
+    if (m_skipsDraw || !m_tiles.size())
         return;
 
     // We reuse the shader program used by ContentLayerChromium.
@@ -394,6 +412,9 @@ void LayerTilerChromium::resizeLayer(const IntSize& size)
     int width = (size.width() + m_tileSize.width() - 1) / m_tileSize.width();
     int height = (size.height() + m_tileSize.height() - 1) / m_tileSize.height();
 
+    if (height && (width > INT_MAX / height))
+        CRASH();
+
     Vector<OwnPtr<Tile> > newTiles;
     newTiles.resize(width * height);
     for (int j = 0; j < m_layerTileSize.height(); ++j)
@@ -409,7 +430,7 @@ void LayerTilerChromium::growLayerToContain(const IntRect& contentRect)
 {
     // Grow the tile array to contain this content rect.
     IntRect layerRect = contentRectToLayerRect(contentRect);
-    IntSize layerSize = IntSize(layerRect.right(), layerRect.bottom());
+    IntSize layerSize = IntSize(layerRect.maxX(), layerRect.maxY());
 
     IntSize newSize = layerSize.expandedTo(m_layerSize);
     resizeLayer(newSize);
diff --git a/Source/WebCore/platform/graphics/chromium/PlatformIcon.h b/Source/WebCore/platform/graphics/chromium/PlatformIcon.h
index 51613b8..b485917 100644
--- a/Source/WebCore/platform/graphics/chromium/PlatformIcon.h
+++ b/Source/WebCore/platform/graphics/chromium/PlatformIcon.h
@@ -31,11 +31,11 @@
 #ifndef PlatformIcon_h
 #define PlatformIcon_h
 
-typedef struct HICON__* HICON;
-
 namespace WebCore {
 
-typedef HICON PlatformIcon;
+class Image;
+
+typedef Image PlatformIcon;
 
 }  // namespace WebCore
 
diff --git a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
index 696828f..b3ce9d7 100644
--- a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
@@ -38,15 +38,17 @@ namespace WebCore {
 RenderSurfaceChromium::SharedValues::SharedValues(GraphicsContext3D* context)
     : m_context(context)
     , m_shaderProgram(0)
+    , m_maskShaderProgram(0)
     , m_shaderSamplerLocation(-1)
     , m_shaderMatrixLocation(-1)
     , m_shaderAlphaLocation(-1)
+    , m_maskShaderSamplerLocation(-1)
+    , m_maskShaderMaskSamplerLocation(-1)
+    , m_maskShaderMatrixLocation(-1)
+    , m_maskShaderAlphaLocation(-1)
     , m_initialized(false)
 {
-    // The following program composites layers whose contents are the results of a previous
-    // render operation and therefore doesn't perform any color swizzling. It is used
-    // in scrolling and for compositing offscreen textures.
-    char renderSurfaceVertexShaderString[] =
+    char vertexShaderString[] =
         "attribute vec4 a_position;   \n"
         "attribute vec2 a_texCoord;   \n"
         "uniform mat4 matrix;         \n"
@@ -56,7 +58,7 @@ RenderSurfaceChromium::SharedValues::SharedValues(GraphicsContext3D* context)
         "  gl_Position = matrix * a_position; \n"
         "  v_texCoord = a_texCoord;   \n"
         "}                            \n";
-    char renderSurfaceFragmentShaderString[] =
+    char fragmentShaderString[] =
         "precision mediump float;                            \n"
         "varying vec2 v_texCoord;                            \n"
         "uniform sampler2D s_texture;                        \n"
@@ -66,9 +68,22 @@ RenderSurfaceChromium::SharedValues::SharedValues(GraphicsContext3D* context)
         "  vec4 texColor = texture2D(s_texture, v_texCoord); \n"
         "  gl_FragColor = vec4(texColor.x, texColor.y, texColor.z, texColor.w) * alpha; \n"
         "}                                                   \n";
+    char fragmentShaderWithMaskString[] =
+        "precision mediump float;                            \n"
+        "varying vec2 v_texCoord;                            \n"
+        "uniform sampler2D s_texture;                        \n"
+        "uniform sampler2D s_mask;                           \n"
+        "uniform float alpha;                                \n"
+        "void main()                                         \n"
+        "{                                                   \n"
+        "  vec4 texColor = texture2D(s_texture, v_texCoord); \n"
+        "  vec4 maskColor = texture2D(s_mask, v_texCoord);   \n"
+        "  gl_FragColor = vec4(texColor.x, texColor.y, texColor.z, texColor.w) * alpha * maskColor.w; \n"
+        "}                                                   \n";
 
-    m_shaderProgram = LayerChromium::createShaderProgram(m_context, renderSurfaceVertexShaderString, renderSurfaceFragmentShaderString);
-    if (!m_shaderProgram) {
+    m_shaderProgram = LayerChromium::createShaderProgram(m_context, vertexShaderString, fragmentShaderString);
+    m_maskShaderProgram = LayerChromium::createShaderProgram(m_context, vertexShaderString, fragmentShaderWithMaskString);
+    if (!m_shaderProgram || !m_maskShaderProgram) {
         LOG_ERROR("RenderSurfaceChromium: Failed to create shader program");
         return;
     }
@@ -76,10 +91,24 @@ RenderSurfaceChromium::SharedValues::SharedValues(GraphicsContext3D* context)
     GLC(m_context, m_shaderSamplerLocation = m_context->getUniformLocation(m_shaderProgram, "s_texture"));
     GLC(m_context, m_shaderMatrixLocation = m_context->getUniformLocation(m_shaderProgram, "matrix"));
     GLC(m_context, m_shaderAlphaLocation = m_context->getUniformLocation(m_shaderProgram, "alpha"));
-    if (m_shaderSamplerLocation == -1 || m_shaderMatrixLocation == -1 || m_shaderAlphaLocation == -1) {
-        LOG_ERROR("Failed to initialize texture layer shader.");
+
+    GLC(m_context, m_maskShaderSamplerLocation = m_context->getUniformLocation(m_maskShaderProgram, "s_texture"));
+    GLC(m_context, m_maskShaderMaskSamplerLocation = m_context->getUniformLocation(m_maskShaderProgram, "s_mask"));
+    GLC(m_context, m_maskShaderMatrixLocation = m_context->getUniformLocation(m_maskShaderProgram, "matrix"));
+    GLC(m_context, m_maskShaderAlphaLocation = m_context->getUniformLocation(m_maskShaderProgram, "alpha"));
+
+    if (m_shaderSamplerLocation == -1 || m_shaderMatrixLocation == -1 || m_shaderAlphaLocation == -1
+        || m_maskShaderSamplerLocation == -1 || m_maskShaderMaskSamplerLocation == -1 || m_maskShaderMatrixLocation == -1 || m_maskShaderAlphaLocation == -1) {
+        LOG_ERROR("Failed to initialize render surface shaders.");
         return;
     }
+
+    GLC(m_context, m_context->useProgram(m_shaderProgram));
+    GLC(m_context, m_context->uniform1i(m_shaderSamplerLocation, 0));
+    GLC(m_context, m_context->useProgram(m_maskShaderProgram));
+    GLC(m_context, m_context->uniform1i(m_maskShaderSamplerLocation, 0));
+    GLC(m_context, m_context->uniform1i(m_maskShaderMaskSamplerLocation, 1));
+    GLC(m_context, m_context->useProgram(0));
     m_initialized = true;
 }
 
@@ -87,10 +116,13 @@ RenderSurfaceChromium::SharedValues::~SharedValues()
 {
     if (m_shaderProgram)
         GLC(m_context, m_context->deleteProgram(m_shaderProgram));
+    if (m_maskShaderProgram)
+        GLC(m_context, m_context->deleteProgram(m_maskShaderProgram));
 }
 
 RenderSurfaceChromium::RenderSurfaceChromium(LayerChromium* owningLayer)
     : m_owningLayer(owningLayer)
+    , m_maskLayer(0)
     , m_skipsDraw(false)
 {
 }
@@ -116,6 +148,17 @@ LayerRendererChromium* RenderSurfaceChromium::layerRenderer()
     return m_owningLayer->layerRenderer();
 }
 
+FloatRect RenderSurfaceChromium::drawableContentRect() const
+{
+    FloatRect localContentRect(-0.5 * m_contentRect.width(), -0.5 * m_contentRect.height(),
+                               m_contentRect.width(), m_contentRect.height());
+    FloatRect drawableContentRect = m_drawTransform.mapRect(localContentRect);
+    if (m_owningLayer->replicaLayer())
+        drawableContentRect.unite(m_replicaDrawTransform.mapRect(localContentRect));
+
+    return drawableContentRect;
+}
+
 bool RenderSurfaceChromium::prepareContentsTexture()
 {
     IntSize requiredSize(m_contentRect.size());
@@ -136,24 +179,69 @@ bool RenderSurfaceChromium::prepareContentsTexture()
     return true;
 }
 
-void RenderSurfaceChromium::draw()
+void RenderSurfaceChromium::drawSurface(LayerChromium* maskLayer, const TransformationMatrix& drawTransform)
 {
-    if (m_skipsDraw || !m_contentsTexture)
-        return;
-
-    m_contentsTexture->bindTexture();
+    GraphicsContext3D* context3D = layerRenderer()->context();
 
+    int shaderMatrixLocation = -1;
+    int shaderAlphaLocation = -1;
     const RenderSurfaceChromium::SharedValues* sv = layerRenderer()->renderSurfaceSharedValues();
     ASSERT(sv && sv->initialized());
+    bool useMask = false;
+    if (maskLayer && maskLayer->drawsContent()) {
+        maskLayer->updateContentsIfDirty();
+        if (!maskLayer->bounds().isEmpty()) {
+            context3D->makeContextCurrent();
+            layerRenderer()->useShader(sv->maskShaderProgram());
+            GLC(context3D, context3D->activeTexture(GraphicsContext3D::TEXTURE0));
+            m_contentsTexture->bindTexture();
+            GLC(context3D, context3D->activeTexture(GraphicsContext3D::TEXTURE1));
+            maskLayer->bindContentsTexture();
+            GLC(context3D, context3D->activeTexture(GraphicsContext3D::TEXTURE0));
+            shaderMatrixLocation = sv->maskShaderMatrixLocation();
+            shaderAlphaLocation = sv->maskShaderAlphaLocation();
+            useMask = true;
+        }
+    }
+
+    if (!useMask) {
+        layerRenderer()->useShader(sv->shaderProgram());
+        m_contentsTexture->bindTexture();
+        shaderMatrixLocation = sv->shaderMatrixLocation();
+        shaderAlphaLocation = sv->shaderAlphaLocation();
+    }
+    
+    LayerChromium::drawTexturedQuad(layerRenderer()->context(), layerRenderer()->projectionMatrix(), drawTransform,
+                                        m_contentRect.width(), m_contentRect.height(), m_drawOpacity,
+                                        shaderMatrixLocation, shaderAlphaLocation);
+
+    m_contentsTexture->unreserve();
+
+    if (maskLayer)
+        maskLayer->unreserveContentsTexture();
+}
+
+void RenderSurfaceChromium::draw()
+{
+    if (m_skipsDraw || !m_contentsTexture)
+        return;
+    // FIXME: By using the same RenderSurface for both the content and its reflection,
+    // it's currently not possible to apply a separate mask to the reflection layer
+    // or correctly handle opacity in reflections (opacity must be applied after drawing
+    // both the layer and its reflection). The solution is to introduce yet another RenderSurface
+    // to draw the layer and its reflection in. For now we only apply a separate reflection
+    // mask if the contents don't have a mask of their own.
+    LayerChromium* replicaMaskLayer = m_maskLayer;
+    if (!m_maskLayer && m_owningLayer->replicaLayer())
+        replicaMaskLayer = m_owningLayer->replicaLayer()->maskLayer();
 
-    layerRenderer()->useShader(sv->shaderProgram());
     layerRenderer()->setScissorToRect(m_scissorRect);
 
-    LayerChromium::drawTexturedQuad(layerRenderer()->context(), layerRenderer()->projectionMatrix(), m_drawTransform,
-                                    m_contentRect.width(), m_contentRect.height(), m_drawOpacity,
-                                    sv->shaderMatrixLocation(), sv->shaderAlphaLocation());
+    // Reflection draws before the layer.
+    if (m_owningLayer->replicaLayer()) 
+        drawSurface(replicaMaskLayer, m_replicaDrawTransform);
 
-    m_contentsTexture->unreserve();
+    drawSurface(m_maskLayer, m_drawTransform);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
index 689a6eb..b1f6a5c 100644
--- a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
@@ -55,6 +55,11 @@ public:
     FloatPoint contentRectCenter() const { return FloatRect(m_contentRect).center(); }
     IntRect contentRect() const { return m_contentRect; }
 
+    // Returns the rect that encloses the RenderSurface including any reflection.
+    FloatRect drawableContentRect() const;
+
+    TransformationMatrix drawTransform() const { return m_drawTransform; }
+
     // Stores values that are shared between instances of this class that are
     // associated with the same LayerRendererChromium (and hence the same GL
     // context).
@@ -64,30 +69,44 @@ public:
         ~SharedValues();
 
         unsigned shaderProgram() const { return m_shaderProgram; }
+        unsigned maskShaderProgram() const { return m_maskShaderProgram; }
         int shaderSamplerLocation() const { return m_shaderSamplerLocation; }
         int shaderMatrixLocation() const { return m_shaderMatrixLocation; }
         int shaderAlphaLocation() const { return m_shaderAlphaLocation; }
+        int maskShaderSamplerLocation() const { return m_maskShaderSamplerLocation; }
+        int maskShaderMaskSamplerLocation() const { return m_maskShaderMaskSamplerLocation; }
+        int maskShaderMatrixLocation() const { return m_maskShaderMatrixLocation; }
+        int maskShaderAlphaLocation() const { return m_maskShaderAlphaLocation; }
         bool initialized() const { return m_initialized; }
 
     private:
         GraphicsContext3D* m_context;
 
         unsigned m_shaderProgram;
+        unsigned m_maskShaderProgram;
         int m_shaderSamplerLocation;
         int m_shaderMatrixLocation;
         int m_shaderAlphaLocation;
+        int m_maskShaderSamplerLocation;
+        int m_maskShaderMaskSamplerLocation;
+        int m_maskShaderMatrixLocation;
+        int m_maskShaderAlphaLocation;
         bool m_initialized;
     };
 
 private:
     LayerRendererChromium* layerRenderer();
+    void drawSurface(LayerChromium* maskLayer, const TransformationMatrix& drawTransform);
 
     LayerChromium* m_owningLayer;
+    LayerChromium* m_maskLayer;
+
     IntRect m_contentRect;
     bool m_skipsDraw;
     OwnPtr<LayerTexture> m_contentsTexture;
     float m_drawOpacity;
     TransformationMatrix m_drawTransform;
+    TransformationMatrix m_replicaDrawTransform;
     TransformationMatrix m_originTransform;
     IntRect m_scissorRect;
     Vector<LayerChromium*> m_layerList;
diff --git a/Source/WebCore/platform/graphics/chromium/SimpleFontDataChromiumWin.cpp b/Source/WebCore/platform/graphics/chromium/SimpleFontDataChromiumWin.cpp
index c23c586..1450c5a 100644
--- a/Source/WebCore/platform/graphics/chromium/SimpleFontDataChromiumWin.cpp
+++ b/Source/WebCore/platform/graphics/chromium/SimpleFontDataChromiumWin.cpp
@@ -54,14 +54,9 @@ static inline float scaleEmToUnits(float x, int unitsPerEm)
 void SimpleFontData::platformInit()
 {
     if (!m_platformData.size()) {
-        m_ascent = 0;
-        m_descent = 0;
-        m_lineGap = 0;
-        m_lineSpacing = 0;
+        m_fontMetrics.reset();
         m_avgCharWidth = 0;
         m_maxCharWidth = 0;
-        m_xHeight = 0;
-        m_unitsPerEm = 0;
         return;
     }
 
@@ -82,10 +77,11 @@ void SimpleFontData::platformInit()
     m_avgCharWidth = textMetric.tmAveCharWidth;
     m_maxCharWidth = textMetric.tmMaxCharWidth;
 
-    m_ascent = textMetric.tmAscent;
-    m_descent = textMetric.tmDescent;
-    m_lineGap = textMetric.tmExternalLeading;
-    m_xHeight = m_ascent * 0.56f;  // Best guess for xHeight for non-Truetype fonts.
+    // FIXME: Access ascent/descent/lineGap with floating point precision.
+    float ascent = textMetric.tmAscent;
+    float descent = textMetric.tmDescent;
+    float lineGap = textMetric.tmExternalLeading;
+    float xHeight = ascent * 0.56f; // Best guess for xHeight for non-Truetype fonts.
 
     OUTLINETEXTMETRIC outlineTextMetric;
     if (GetOutlineTextMetrics(dc, sizeof(outlineTextMetric), &outlineTextMetric) > 0) {
@@ -94,10 +90,14 @@ void SimpleFontData::platformInit()
         MAT2 identityMatrix = {{0, 1}, {0, 0}, {0, 0}, {0, 1}};
         DWORD len = GetGlyphOutlineW(dc, 'x', GGO_METRICS, &glyphMetrics, 0, 0, &identityMatrix);
         if (len != GDI_ERROR && glyphMetrics.gmBlackBoxY > 0)
-            m_xHeight = static_cast<float>(glyphMetrics.gmBlackBoxY);
+            xHeight = static_cast<float>(glyphMetrics.gmBlackBoxY);
     }
 
-    m_lineSpacing = m_ascent + m_descent + m_lineGap;
+    m_fontMetrics.setAscent(ascent);
+    m_fontMetrics.setDescent(descent);
+    m_fontMetrics.setLineGap(lineGap);
+    m_fontMetrics.setXHeight(xHeight);
+    m_fontMetrics.setLineSpacing(ascent + descent + lineGap);
 
     SelectObject(dc, oldFont);
     ReleaseDC(0, dc);
diff --git a/Source/WebCore/platform/graphics/chromium/SimpleFontDataLinux.cpp b/Source/WebCore/platform/graphics/chromium/SimpleFontDataLinux.cpp
index 355d837..9423d1e 100644
--- a/Source/WebCore/platform/graphics/chromium/SimpleFontDataLinux.cpp
+++ b/Source/WebCore/platform/graphics/chromium/SimpleFontDataLinux.cpp
@@ -55,14 +55,9 @@ static const size_t maxVDMXTableSize = 1024 * 1024;  // 1 MB
 void SimpleFontData::platformInit()
 {
     if (!m_platformData.size()) {
-        m_ascent = 0;
-        m_descent = 0;
-        m_lineGap = 0;
-        m_lineSpacing = 0;
+        m_fontMetrics.reset();
         m_avgCharWidth = 0;
         m_maxCharWidth = 0;
-        m_xHeight = 0;
-        m_unitsPerEm = 0;
         return;
     }
 
@@ -88,26 +83,35 @@ void SimpleFontData::platformInit()
         fastFree(vdmxTable);
     }
 
+    float ascent;
+    float descent;
+
     // Beware those who step here: This code is designed to match Win32 font
     // metrics *exactly*.
     if (isVDMXValid) {
-        m_ascent = vdmxAscent;
-        m_descent = -vdmxDescent;
+        ascent = vdmxAscent;
+        descent = -vdmxDescent;
     } else {
         SkScalar height = -metrics.fAscent + metrics.fDescent + metrics.fLeading;
-        m_ascent = SkScalarRound(-metrics.fAscent);
-        m_descent = SkScalarRound(height) - m_ascent;
+        ascent = SkScalarRound(-metrics.fAscent);
+        descent = SkScalarRound(height) - ascent;
     }
 
+    m_fontMetrics.setAscent(ascent);
+    m_fontMetrics.setDescent(descent);
+
+    float xHeight;
     if (metrics.fXHeight)
-        m_xHeight = metrics.fXHeight;
+        xHeight = metrics.fXHeight;
     else {
         // hack taken from the Windows port
-        m_xHeight = static_cast<float>(m_ascent) * 0.56;
+        xHeight = ascent * 0.56f;
     }
 
-    m_lineGap = SkScalarRound(metrics.fLeading);
-    m_lineSpacing = m_ascent + m_descent + m_lineGap;
+    float lineGap = SkScalarToFloat(metrics.fLeading);
+    m_fontMetrics.setLineGap(lineGap);
+    m_fontMetrics.setXHeight(xHeight);
+    m_fontMetrics.setLineSpacing(lroundf(ascent) + lroundf(descent) + lroundf(lineGap));
 
     if (m_orientation == Vertical) {
         static const uint32_t vheaTag = SkSetFourByteTag('v', 'h', 'e', 'a');
@@ -128,7 +132,7 @@ void SimpleFontData::platformInit()
     if (metrics.fAvgCharWidth)
         m_avgCharWidth = SkScalarRound(metrics.fAvgCharWidth);
     else {
-        m_avgCharWidth = m_xHeight;
+        m_avgCharWidth = xHeight;
 
         GlyphPage* glyphPageZero = GlyphPageTreeNode::getRootChild(this, 0)->page();
 
diff --git a/Source/WebCore/platform/graphics/chromium/TransparencyWin.cpp b/Source/WebCore/platform/graphics/chromium/TransparencyWin.cpp
index ba66eae..193271d 100644
--- a/Source/WebCore/platform/graphics/chromium/TransparencyWin.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TransparencyWin.cpp
@@ -446,9 +446,9 @@ void TransparencyWin::compositeOpaqueComposite()
         identity.reset();
         destCanvas->setMatrix(identity);
 
-        destRect.set(m_transformedSourceRect.x(), m_transformedSourceRect.y(), m_transformedSourceRect.right(), m_transformedSourceRect.bottom());
+        destRect.set(m_transformedSourceRect.x(), m_transformedSourceRect.y(), m_transformedSourceRect.maxX(), m_transformedSourceRect.maxY());
     } else
-        destRect.set(m_sourceRect.x(), m_sourceRect.y(), m_sourceRect.right(), m_sourceRect.bottom());
+        destRect.set(m_sourceRect.x(), m_sourceRect.y(), m_sourceRect.maxX(), m_sourceRect.maxY());
 
     SkPaint paint;
     paint.setFilterBitmap(true);
@@ -487,7 +487,7 @@ void TransparencyWin::compositeTextComposite()
     SkMatrix identity;
     identity.reset();
     destCanvas->setMatrix(identity);
-    SkRect destRect = { m_transformedSourceRect.x(), m_transformedSourceRect.y(), m_transformedSourceRect.right(), m_transformedSourceRect.bottom() };
+    SkRect destRect = { m_transformedSourceRect.x(), m_transformedSourceRect.y(), m_transformedSourceRect.maxX(), m_transformedSourceRect.maxY() };
 
     // Note that we need to specify the source layer subset, since the bitmap
     // may have been cached and it could be larger than what we're using.
diff --git a/Source/WebCore/platform/graphics/chromium/UniscribeHelperTextRun.cpp b/Source/WebCore/platform/graphics/chromium/UniscribeHelperTextRun.cpp
index aa18b4a..c060b43 100644
--- a/Source/WebCore/platform/graphics/chromium/UniscribeHelperTextRun.cpp
+++ b/Source/WebCore/platform/graphics/chromium/UniscribeHelperTextRun.cpp
@@ -51,14 +51,14 @@ UniscribeHelperTextRun::UniscribeHelperTextRun(const TextRun& run,
     setLetterSpacing(font.letterSpacing());
     setSpaceWidth(font.spaceWidth());
     setWordSpacing(font.wordSpacing());
-    setAscent(font.primaryFont()->ascent());
+    setAscent(font.fontMetrics().ascent());
 
     init();
 
-    // Padding is the amount to add to make justification happen. This
+    // Expansion is the amount to add to make justification happen. This
     // should be done after Init() so all the runs are already measured.
-    if (run.padding() > 0)
-        justify(run.padding());
+    if (run.expansion() > 0)
+        justify(run.expansion());
 }
 
 UniscribeHelperTextRun::UniscribeHelperTextRun(
@@ -121,7 +121,7 @@ bool UniscribeHelperTextRun::nextWinFontData(
         m_hfonts.append(simpleFontData->platformData().hfont());
         m_scriptCaches.append(simpleFontData->platformData().scriptCache());
         m_fontProperties.append(simpleFontData->platformData().scriptFontProperties());
-        m_ascents.append(simpleFontData->ascent());
+        m_ascents.append(simpleFontData->fontMetrics().ascent());
     }
 
     *hfont = m_hfonts[m_fontIndex - 1];
diff --git a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
index 776b83f..41cd180 100644
--- a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
@@ -60,6 +60,7 @@ VideoLayerChromium::SharedValues::SharedValues(GraphicsContext3D* context)
     , m_rgbaShaderMatrixLocation(0)
     , m_rgbaWidthScaleFactorLocation(0)
     , m_ccMatrixLocation(0)
+    , m_signAdjLocation(0)
     , m_yTextureLocation(0)
     , m_uTextureLocation(0)
     , m_vTextureLocation(0)
@@ -96,14 +97,15 @@ VideoLayerChromium::SharedValues::SharedValues(GraphicsContext3D* context)
         "uniform sampler2D u_texture;                         \n"
         "uniform sampler2D v_texture;                         \n"
         "uniform float alpha;                                 \n"
+        "uniform float adj;                                   \n"
         "uniform mat3 cc_matrix;                              \n"
         "void main()                                          \n"
         "{                                                    \n"
         "  float y = texture2D(y_texture, v_texCoord).x;      \n"
-        "  float u = texture2D(u_texture, v_texCoord).r - .5; \n"
-        "  float v = texture2D(v_texture, v_texCoord).r - .5; \n"
+        "  float u = texture2D(u_texture, v_texCoord).x - adj; \n"
+        "  float v = texture2D(v_texture, v_texCoord).x - adj; \n"
         "  vec3 rgb = cc_matrix * vec3(y, u, v);              \n"
-        "  gl_FragColor = vec4(rgb.x, rgb.y, rgb.z, 1.0) * alpha; \n"
+        "  gl_FragColor = vec4(rgb, float(1)) * alpha;        \n"
         "}                                                    \n";
 
     char rgbaFragmentShaderString[] =
@@ -113,7 +115,7 @@ VideoLayerChromium::SharedValues::SharedValues(GraphicsContext3D* context)
         "uniform float alpha;                                 \n"
         "void main()                                          \n"
         "{                                                    \n"
-        "  vec4 texColor = texture2D(rgba_texture, vec2(v_texCoord.x, 1.0 - v_texCoord.y)); \n"
+        "  vec4 texColor = texture2D(rgba_texture, vec2(v_texCoord.x, float(1) - v_texCoord.y)); \n"
         "  gl_FragColor = vec4(texColor.x, texColor.y, texColor.z, texColor.w) * alpha; \n"
         "}                                                    \n";
 
@@ -135,6 +137,7 @@ VideoLayerChromium::SharedValues::SharedValues(GraphicsContext3D* context)
     m_uTextureLocation = m_context->getUniformLocation(m_yuvShaderProgram, "u_texture");
     m_vTextureLocation = m_context->getUniformLocation(m_yuvShaderProgram, "v_texture");
     m_ccMatrixLocation = m_context->getUniformLocation(m_yuvShaderProgram, "cc_matrix");
+    m_signAdjLocation = m_context->getUniformLocation(m_yuvShaderProgram, "adj");
     m_yuvAlphaLocation = m_context->getUniformLocation(m_yuvShaderProgram, "alpha");
 
     ASSERT(m_yuvShaderMatrixLocation != -1);
@@ -143,6 +146,7 @@ VideoLayerChromium::SharedValues::SharedValues(GraphicsContext3D* context)
     ASSERT(m_uTextureLocation != -1);
     ASSERT(m_vTextureLocation != -1);
     ASSERT(m_ccMatrixLocation != -1);
+    ASSERT(m_signAdjLocation != -1);
     ASSERT(m_yuvAlphaLocation != -1);
 
     m_rgbaShaderMatrixLocation = m_context->getUniformLocation(m_rgbaShaderProgram, "matrix");
@@ -375,6 +379,12 @@ void VideoLayerChromium::drawYUV(const SharedValues* sv)
     GLC(context, context->uniform1i(sv->uTextureLocation(), 2));
     GLC(context, context->uniform1i(sv->vTextureLocation(), 3));
 
+    // This value of 0.5 maps to 128. It is used in the YUV to RGB conversion
+    // formula to turn unsigned u and v values to signed u and v values.
+    // This is loaded as a uniform because certain drivers have problems
+    // reading literal float values.
+    GLC(context, context->uniform1f(sv->signAdjLocation(), 0.5));
+
     GLC(context, context->uniformMatrix3fv(sv->ccMatrixLocation(), 0, const_cast<float*>(yuv2RGB), 1));
 
     drawTexturedQuad(context, layerRenderer()->projectionMatrix(), drawTransform(),
diff --git a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h
index 0992ab7..ac3bca9 100644
--- a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h
@@ -70,6 +70,7 @@ public:
         int rgbaAlphaLocation() const { return m_rgbaAlphaLocation; }
         int rgbaTextureLocation() const { return m_rgbaTextureLocation; }
         int ccMatrixLocation() const { return m_ccMatrixLocation; }
+        int signAdjLocation() const { return m_signAdjLocation; }
         bool initialized() const { return m_initialized; }
     private:
         GraphicsContext3D* m_context;
@@ -80,6 +81,7 @@ public:
         int m_rgbaShaderMatrixLocation;
         int m_rgbaWidthScaleFactorLocation;
         int m_ccMatrixLocation;
+        int m_signAdjLocation;
         int m_yTextureLocation;
         int m_uTextureLocation;
         int m_vTextureLocation;
diff --git a/Source/WebCore/platform/graphics/cocoa/FontPlatformData.h b/Source/WebCore/platform/graphics/cocoa/FontPlatformData.h
index 8cf08fb..ca38029 100644
--- a/Source/WebCore/platform/graphics/cocoa/FontPlatformData.h
+++ b/Source/WebCore/platform/graphics/cocoa/FontPlatformData.h
@@ -25,6 +25,7 @@
 #define FontPlatformData_h
 
 #include "FontOrientation.h"
+#include "FontWidthVariant.h"
 #include <wtf/text/StringImpl.h>
 
 #ifdef __OBJC__
@@ -59,11 +60,12 @@ inline CTFontRef toCTFontRef(NSFont *nsFont) { return reinterpret_cast<CTFontRef
 
 class FontPlatformData {
   public:
-    FontPlatformData(float size, bool syntheticBold, bool syntheticOblique, FontOrientation orientation = Horizontal)
+    FontPlatformData(float size, bool syntheticBold, bool syntheticOblique, FontOrientation orientation = Horizontal, FontWidthVariant widthVariant = RegularWidth)
         : m_syntheticBold(syntheticBold)
         , m_syntheticOblique(syntheticOblique)
         , m_orientation(orientation)
         , m_size(size)
+        , m_widthVariant(widthVariant)
         , m_font(0)
 #ifdef BUILDING_ON_TIGER
         , m_cgFont(0)
@@ -72,13 +74,14 @@ class FontPlatformData {
     {
     }
 
-    FontPlatformData(NSFont *nsFont, float size, bool syntheticBold = false, bool syntheticOblique = false, FontOrientation = Horizontal);
+    FontPlatformData(NSFont*, float size, bool syntheticBold = false, bool syntheticOblique = false, FontOrientation = Horizontal, FontWidthVariant = RegularWidth);
     
-    FontPlatformData(CGFontRef cgFont, float size, bool syntheticBold, bool syntheticOblique, FontOrientation orientation)
+    FontPlatformData(CGFontRef cgFont, float size, bool syntheticBold, bool syntheticOblique, FontOrientation orientation, FontWidthVariant widthVariant)
         : m_syntheticBold(syntheticBold)
         , m_syntheticOblique(syntheticOblique)
         , m_orientation(orientation)
         , m_size(size)
+        , m_widthVariant(widthVariant)
         , m_font(0)
         , m_cgFont(cgFont)
         , m_isColorBitmapFont(false)
@@ -96,17 +99,20 @@ class FontPlatformData {
     bool syntheticBold() const { return m_syntheticBold; }
     bool syntheticOblique() const { return m_syntheticOblique; }
     FontOrientation orientation() const { return m_orientation; }
+    FontWidthVariant widthVariant() const { return m_widthVariant; }
 
     bool m_syntheticBold;
     bool m_syntheticOblique;
     FontOrientation m_orientation;
 
     float m_size;
+    
+    FontWidthVariant m_widthVariant;
 
     unsigned hash() const
     {
         ASSERT(m_font != 0 || m_cgFont == 0);
-        uintptr_t hashCodes[2] = { (uintptr_t)m_font, m_orientation << 2 | m_syntheticBold << 1 | m_syntheticOblique };
+        uintptr_t hashCodes[3] = { (uintptr_t)m_font, m_widthVariant, m_orientation << 2 | m_syntheticBold << 1 | m_syntheticOblique };
         return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
     }
 
@@ -115,7 +121,7 @@ class FontPlatformData {
     bool operator==(const FontPlatformData& other) const
     { 
         return m_font == other.m_font && m_syntheticBold == other.m_syntheticBold && m_syntheticOblique == other.m_syntheticOblique && 
-               m_cgFont == other.m_cgFont && m_size == other.m_size && m_orientation == other.m_orientation;
+               m_cgFont == other.m_cgFont && m_size == other.m_size && m_orientation == other.m_orientation && m_widthVariant == other.m_widthVariant;
     }
 
     NSFont *font() const { return m_font; }
diff --git a/Source/WebCore/platform/graphics/cocoa/FontPlatformDataCocoa.mm b/Source/WebCore/platform/graphics/cocoa/FontPlatformDataCocoa.mm
index 8dacbe3..b40f698 100644
--- a/Source/WebCore/platform/graphics/cocoa/FontPlatformDataCocoa.mm
+++ b/Source/WebCore/platform/graphics/cocoa/FontPlatformDataCocoa.mm
@@ -30,6 +30,9 @@
 
 namespace WebCore {
 
+// These CoreText Text Spacing feature selectors are not defined in CoreText.
+enum TextSpacingCTFeatureSelector { TextSpacingProportional, TextSpacingFullWidth, TextSpacingHalfWidth, TextSpacingThirdWidth, TextSpacingQuarterWidth };
+
 #if PLATFORM(MAC)
 void FontPlatformData::loadFont(NSFont* nsFont, float, NSFont*& outNSFont, CGFontRef& cgFont)
 {
@@ -42,10 +45,11 @@ void FontPlatformData::loadFont(NSFont* nsFont, float, NSFont*& outNSFont, CGFon
 }
 #endif  // PLATFORM(MAC)
 
-FontPlatformData::FontPlatformData(NSFont *nsFont, float size, bool syntheticBold, bool syntheticOblique, FontOrientation orientation)
+FontPlatformData::FontPlatformData(NSFont *nsFont, float size, bool syntheticBold, bool syntheticOblique, FontOrientation orientation, FontWidthVariant widthVariant)
     : m_syntheticBold(syntheticBold)
     , m_syntheticOblique(syntheticOblique)
     , m_size(size)
+    , m_widthVariant(widthVariant)
     , m_font(nsFont)
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
     // FIXME: Chromium: The following code isn't correct for the Chromium port since the sandbox might
@@ -79,6 +83,7 @@ FontPlatformData::FontPlatformData(const FontPlatformData& f)
     m_syntheticBold = f.m_syntheticBold;
     m_syntheticOblique = f.m_syntheticOblique;
     m_size = f.m_size;
+    m_widthVariant = f.m_widthVariant;
     m_cgFont = f.m_cgFont;
     m_isColorBitmapFont = f.m_isColorBitmapFont;
     m_orientation = f.m_orientation;
@@ -99,6 +104,7 @@ const FontPlatformData& FontPlatformData::operator=(const FontPlatformData& f)
     m_syntheticBold = f.m_syntheticBold;
     m_syntheticOblique = f.m_syntheticOblique;
     m_size = f.m_size;
+    m_widthVariant = f.m_widthVariant;
     m_cgFont = f.m_cgFont;
     if (m_font == f.m_font)
         return *this;
@@ -165,12 +171,48 @@ bool FontPlatformData::allowsLigatures() const
     return ![[m_font coveredCharacterSet] characterIsMember:'a'];
 }
 
+inline int mapFontWidthVariantToCTFeatureSelector(FontWidthVariant variant)
+{
+    switch(variant) {
+    case RegularWidth:
+        return TextSpacingProportional;
+
+    case HalfWidth:
+        return TextSpacingHalfWidth;
+
+    case ThirdWidth:
+        return TextSpacingThirdWidth;
+
+    case QuarterWidth:
+        return TextSpacingQuarterWidth;
+    }
+
+    ASSERT_NOT_REACHED();
+    return TextSpacingProportional;
+}
+
 CTFontRef FontPlatformData::ctFont() const
 {
-    if (m_font)
-        return toCTFontRef(m_font);
-    if (!m_CTFont)
-        m_CTFont.adoptCF(CTFontCreateWithGraphicsFont(m_cgFont.get(), m_size, 0, 0));
+    if (m_widthVariant == RegularWidth) {
+        if (m_font)
+            return toCTFontRef(m_font);
+        if (!m_CTFont)
+            m_CTFont.adoptCF(CTFontCreateWithGraphicsFont(m_cgFont.get(), m_size, 0, 0));
+        return m_CTFont.get();
+    }
+    
+    if (!m_CTFont) {
+        int featureTypeValue = kTextSpacingType;
+        int featureSelectorValue = mapFontWidthVariantToCTFeatureSelector(m_widthVariant);
+        RetainPtr<CTFontRef> sourceFont(AdoptCF, CTFontCreateWithGraphicsFont(m_cgFont.get(), m_size, 0, 0));
+        RetainPtr<CTFontDescriptorRef> sourceDescriptor(AdoptCF, CTFontCopyFontDescriptor(sourceFont.get()));
+        RetainPtr<CFNumberRef> featureType(AdoptCF, CFNumberCreate(kCFAllocatorDefault, kCFNumberIntType, &featureTypeValue));
+        RetainPtr<CFNumberRef> featureSelector(AdoptCF, CFNumberCreate(kCFAllocatorDefault, kCFNumberIntType, &featureSelectorValue));
+        RetainPtr<CTFontDescriptorRef> newDescriptor(AdoptCF, CTFontDescriptorCreateCopyWithFeature(sourceDescriptor.get(), featureType.get(), featureSelector.get()));
+        RetainPtr<CTFontRef> newFont(AdoptCF, CTFontCreateWithFontDescriptor(newDescriptor.get(), m_size, 0));
+
+        m_CTFont = newFont.get() ? newFont : sourceFont;
+    }
     return m_CTFont.get();
 }
 
diff --git a/Source/WebCore/platform/graphics/efl/FontEfl.cpp b/Source/WebCore/platform/graphics/efl/FontEfl.cpp
index d3ca183..83cc7ff 100644
--- a/Source/WebCore/platform/graphics/efl/FontEfl.cpp
+++ b/Source/WebCore/platform/graphics/efl/FontEfl.cpp
@@ -50,6 +50,11 @@ bool Font::canReturnFallbackFontsForComplexText()
     return false;
 }
 
+bool Font::canExpandAroundIdeographsInComplexText()
+{
+    return false;
+}
+
 float Font::floatWidthForComplexText(const TextRun&, HashSet<const SimpleFontData*>*, GlyphOverflow*) const
 {
     notImplemented();
diff --git a/Source/WebCore/platform/graphics/filters/DistantLightSource.cpp b/Source/WebCore/platform/graphics/filters/DistantLightSource.cpp
new file mode 100644
index 0000000..4c3b49b
--- /dev/null
+++ b/Source/WebCore/platform/graphics/filters/DistantLightSource.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2004, 2005 Rob Buis <buis@kde.org>
+ * Copyright (C) 2005 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2010 Zoltan Herczeg <zherczeg@webkit.org>
+ * Copyright (C) 2011 University of Szeged
+ * Copyright (C) 2011 Renata Hodovan <reni@webkit.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY UNIVERSITY OF SZEGED ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(FILTERS)
+#include "DistantLightSource.h"
+
+#include "RenderTreeAsText.h"
+
+namespace WebCore {
+
+void DistantLightSource::initPaintingData(PaintingData& paintingData)
+{
+    float azimuth = deg2rad(m_azimuth);
+    float elevation = deg2rad(m_elevation);
+    paintingData.lightVector.setX(cosf(azimuth) * cosf(elevation));
+    paintingData.lightVector.setY(sinf(azimuth) * cosf(elevation));
+    paintingData.lightVector.setZ(sinf(elevation));
+    paintingData.lightVectorLength = 1;
+}
+
+void DistantLightSource::updatePaintingData(PaintingData&, int, int, float)
+{
+}
+
+bool DistantLightSource::setAzimuth(float azimuth)
+{
+    if (m_azimuth == azimuth)
+        return false;
+    m_azimuth = azimuth;
+    return true;
+}
+
+bool DistantLightSource::setElevation(float elevation)
+{
+    if (m_elevation == elevation)
+        return false;
+    m_elevation = elevation;
+    return true;
+}
+
+TextStream& DistantLightSource::externalRepresentation(TextStream& ts) const
+{
+    ts << "[type=DISTANT-LIGHT] ";
+    ts << "[azimuth=\"" << azimuth() << "\"]";
+    ts << "[elevation=\"" << elevation() << "\"]";
+    return ts;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(FILTERS)
diff --git a/Source/WebCore/platform/graphics/filters/DistantLightSource.h b/Source/WebCore/platform/graphics/filters/DistantLightSource.h
index d5d474f..1e19c62 100644
--- a/Source/WebCore/platform/graphics/filters/DistantLightSource.h
+++ b/Source/WebCore/platform/graphics/filters/DistantLightSource.h
@@ -36,7 +36,9 @@ public:
     }
 
     float azimuth() const { return m_azimuth; }
+    bool setAzimuth(float);
     float elevation() const { return m_elevation; }
+    bool setElevation(float);
 
     virtual void initPaintingData(PaintingData&);
     virtual void updatePaintingData(PaintingData&, int x, int y, float z);
diff --git a/Source/WebCore/platform/graphics/filters/FEDiffuseLighting.cpp b/Source/WebCore/platform/graphics/filters/FEDiffuseLighting.cpp
index a8a825a..5f9d049 100644
--- a/Source/WebCore/platform/graphics/filters/FEDiffuseLighting.cpp
+++ b/Source/WebCore/platform/graphics/filters/FEDiffuseLighting.cpp
@@ -52,9 +52,12 @@ Color FEDiffuseLighting::lightingColor() const
     return m_lightingColor;
 }
 
-void FEDiffuseLighting::setLightingColor(const Color& lightingColor)
+bool FEDiffuseLighting::setLightingColor(const Color& lightingColor)
 {
+    if (m_lightingColor == lightingColor)
+        return false;
     m_lightingColor = lightingColor;
+    return true;
 }
 
 float FEDiffuseLighting::surfaceScale() const 
@@ -62,9 +65,12 @@ float FEDiffuseLighting::surfaceScale() const
     return m_surfaceScale;
 }
 
-void FEDiffuseLighting::setSurfaceScale(float surfaceScale)
+bool FEDiffuseLighting::setSurfaceScale(float surfaceScale)
 {
+    if (m_surfaceScale == surfaceScale)
+        return false;
     m_surfaceScale = surfaceScale;
+    return true;
 }
 
 float FEDiffuseLighting::diffuseConstant() const
@@ -72,9 +78,12 @@ float FEDiffuseLighting::diffuseConstant() const
     return m_diffuseConstant;
 }
 
-void FEDiffuseLighting::setDiffuseConstant(float diffuseConstant)
+bool FEDiffuseLighting::setDiffuseConstant(float diffuseConstant)
 {
+    if (m_diffuseConstant == diffuseConstant)
+        return false;
     m_diffuseConstant = diffuseConstant;
+    return true;
 }
 
 float FEDiffuseLighting::kernelUnitLengthX() const
@@ -82,9 +91,12 @@ float FEDiffuseLighting::kernelUnitLengthX() const
     return m_kernelUnitLengthX;
 }
 
-void FEDiffuseLighting::setKernelUnitLengthX(float kernelUnitLengthX)
+bool FEDiffuseLighting::setKernelUnitLengthX(float kernelUnitLengthX)
 {
+    if (m_kernelUnitLengthX == kernelUnitLengthX)
+        return false;
     m_kernelUnitLengthX = kernelUnitLengthX;
+    return true;
 }
 
 float FEDiffuseLighting::kernelUnitLengthY() const
@@ -92,9 +104,12 @@ float FEDiffuseLighting::kernelUnitLengthY() const
     return m_kernelUnitLengthY;
 }
 
-void FEDiffuseLighting::setKernelUnitLengthY(float kernelUnitLengthY)
+bool FEDiffuseLighting::setKernelUnitLengthY(float kernelUnitLengthY)
 {
+    if (m_kernelUnitLengthY == kernelUnitLengthY)
+        return false;
     m_kernelUnitLengthY = kernelUnitLengthY;
+    return true;
 }
 
 const LightSource* FEDiffuseLighting::lightSource() const
diff --git a/Source/WebCore/platform/graphics/filters/FEDiffuseLighting.h b/Source/WebCore/platform/graphics/filters/FEDiffuseLighting.h
index b58b47a..5f20651 100644
--- a/Source/WebCore/platform/graphics/filters/FEDiffuseLighting.h
+++ b/Source/WebCore/platform/graphics/filters/FEDiffuseLighting.h
@@ -36,19 +36,19 @@ public:
     virtual ~FEDiffuseLighting();
 
     Color lightingColor() const;
-    void setLightingColor(const Color&);
+    bool setLightingColor(const Color&);
 
     float surfaceScale() const;
-    void setSurfaceScale(float);
+    bool setSurfaceScale(float);
 
     float diffuseConstant() const;
-    void setDiffuseConstant(float);
+    bool setDiffuseConstant(float);
 
     float kernelUnitLengthX() const;
-    void setKernelUnitLengthX(float);
+    bool setKernelUnitLengthX(float);
 
     float kernelUnitLengthY() const;
-    void setKernelUnitLengthY(float);
+    bool setKernelUnitLengthY(float);
 
     const LightSource* lightSource() const;
     void setLightSource(PassRefPtr<LightSource>);
diff --git a/Source/WebCore/platform/graphics/filters/FilterEffect.cpp b/Source/WebCore/platform/graphics/filters/FilterEffect.cpp
index 85154b5..f07d00c 100644
--- a/Source/WebCore/platform/graphics/filters/FilterEffect.cpp
+++ b/Source/WebCore/platform/graphics/filters/FilterEffect.cpp
@@ -77,6 +77,16 @@ FilterEffect* FilterEffect::inputEffect(unsigned number) const
     return m_inputEffects.at(number).get();
 }
 
+void FilterEffect::clearResult()
+{
+    if (m_imageBufferResult)
+        m_imageBufferResult.clear();
+    if (m_unmultipliedImageResult)
+        m_unmultipliedImageResult.clear();
+    if (m_premultipliedImageResult)
+        m_premultipliedImageResult.clear();
+}
+
 ImageBuffer* FilterEffect::asImageBuffer()
 {
     if (!hasResult())
@@ -109,7 +119,7 @@ PassRefPtr<ByteArray> FilterEffect::asPremultipliedImage(const IntRect& rect)
 inline void FilterEffect::copyImageBytes(ByteArray* source, ByteArray* destination, const IntRect& rect)
 {
     // Copy the necessary lines.
-    if (rect.x() < 0 || rect.y() < 0 || rect.bottom() > m_absolutePaintRect.width() || rect.bottom() > m_absolutePaintRect.height())
+    if (rect.x() < 0 || rect.y() < 0 || rect.maxY() > m_absolutePaintRect.width() || rect.maxY() > m_absolutePaintRect.height())
         memset(destination->data(), 0, destination->length());
 
     int xOrigin = rect.x();
@@ -118,7 +128,7 @@ inline void FilterEffect::copyImageBytes(ByteArray* source, ByteArray* destinati
         xDest = -xOrigin;
         xOrigin = 0;
     }
-    int xEnd = rect.right();
+    int xEnd = rect.maxX();
     if (xEnd > m_absolutePaintRect.width())
         xEnd = m_absolutePaintRect.width();
 
@@ -128,7 +138,7 @@ inline void FilterEffect::copyImageBytes(ByteArray* source, ByteArray* destinati
         yDest = -yOrigin;
         yOrigin = 0;
     }
-    int yEnd = rect.bottom();
+    int yEnd = rect.maxY();
     if (yEnd > m_absolutePaintRect.height())
         yEnd = m_absolutePaintRect.height();
 
diff --git a/Source/WebCore/platform/graphics/filters/FilterEffect.h b/Source/WebCore/platform/graphics/filters/FilterEffect.h
index 062dd1b..2de8ac5 100644
--- a/Source/WebCore/platform/graphics/filters/FilterEffect.h
+++ b/Source/WebCore/platform/graphics/filters/FilterEffect.h
@@ -53,6 +53,7 @@ public:
     virtual ~FilterEffect();
 
     bool hasResult() const { return m_imageBufferResult || m_unmultipliedImageResult || m_premultipliedImageResult; }
+    void clearResult();
     ImageBuffer* asImageBuffer();
     PassRefPtr<ByteArray> asUnmultipliedImage(const IntRect&);
     PassRefPtr<ByteArray> asPremultipliedImage(const IntRect&);
diff --git a/Source/WebCore/platform/graphics/filters/LightSource.cpp b/Source/WebCore/platform/graphics/filters/LightSource.cpp
index de0691e..cf262e8 100644
--- a/Source/WebCore/platform/graphics/filters/LightSource.cpp
+++ b/Source/WebCore/platform/graphics/filters/LightSource.cpp
@@ -3,6 +3,7 @@
  * Copyright (C) 2004, 2005 Rob Buis <buis@kde.org>
  * Copyright (C) 2005 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2010 Zoltan Herczeg <zherczeg@webkit.org>
+ * Copyright (C) 2011 Renata Hodovan <reni@webkit.org>, University of Szeged.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -33,136 +34,80 @@
 
 namespace WebCore {
 
-void PointLightSource::initPaintingData(PaintingData&)
+bool LightSource::setAzimuth(float azimuth)
 {
+    if (m_type == LS_DISTANT)
+        return static_cast<DistantLightSource*>(this)->setAzimuth(azimuth);
+    return false;
 }
 
-void PointLightSource::updatePaintingData(PaintingData& paintingData, int x, int y, float z)
+bool LightSource::setElevation(float elevation)
 {
-    paintingData.lightVector.setX(m_position.x() - x);
-    paintingData.lightVector.setY(m_position.y() - y);
-    paintingData.lightVector.setZ(m_position.z() - z);
-    paintingData.lightVectorLength = paintingData.lightVector.length();
+    if (m_type == LS_DISTANT)
+        return static_cast<DistantLightSource*>(this)->setElevation(elevation);
+    return false;
 }
 
-// spot-light edge darkening depends on an absolute treshold
-// according to the SVG 1.1 SE light regression tests
-static const float antiAliasTreshold = 0.016f;
-
-void SpotLightSource::initPaintingData(PaintingData& paintingData)
+bool LightSource::setX(float x)
 {
-    paintingData.privateColorVector = paintingData.colorVector;
-    paintingData.directionVector.setX(m_direction.x() - m_position.x());
-    paintingData.directionVector.setY(m_direction.y() - m_position.y());
-    paintingData.directionVector.setZ(m_direction.z() - m_position.z());
-    paintingData.directionVector.normalize();
-
-    if (!m_limitingConeAngle) {
-        paintingData.coneCutOffLimit = 0.0f;
-        paintingData.coneFullLight = -antiAliasTreshold;
-    } else {
-        float limitingConeAngle = m_limitingConeAngle;
-        if (limitingConeAngle < 0.0f)
-            limitingConeAngle = -limitingConeAngle;
-        if (limitingConeAngle > 90.0f)
-            limitingConeAngle = 90.0f;
-        paintingData.coneCutOffLimit = cosf(deg2rad(180.0f - limitingConeAngle));
-        paintingData.coneFullLight = paintingData.coneCutOffLimit - antiAliasTreshold;
-    }
-
-    // Optimization for common specularExponent values
-    if (!m_specularExponent)
-        paintingData.specularExponent = 0;
-    else if (m_specularExponent == 1.0f)
-        paintingData.specularExponent = 1;
-    else // It is neither 0.0f nor 1.0f
-        paintingData.specularExponent = 2;
+    if (m_type == LS_SPOT)
+        return static_cast<SpotLightSource*>(this)->setX(x);
+    if (m_type == LS_POINT)
+        return static_cast<PointLightSource*>(this)->setX(x);
+    return false;
 }
 
-void SpotLightSource::updatePaintingData(PaintingData& paintingData, int x, int y, float z)
+bool LightSource::setY(float y)
 {
-    paintingData.lightVector.setX(m_position.x() - x);
-    paintingData.lightVector.setY(m_position.y() - y);
-    paintingData.lightVector.setZ(m_position.z() - z);
-    paintingData.lightVectorLength = paintingData.lightVector.length();
-
-    float cosineOfAngle = (paintingData.lightVector * paintingData.directionVector) / paintingData.lightVectorLength;
-    if (cosineOfAngle > paintingData.coneCutOffLimit) {
-        // No light is produced, scanlines are not updated
-        paintingData.colorVector.setX(0.0f);
-        paintingData.colorVector.setY(0.0f);
-        paintingData.colorVector.setZ(0.0f);
-        return;
-    }
-
-    // Set the color of the pixel
-    float lightStrength;
-    switch (paintingData.specularExponent) {
-    case 0:
-        lightStrength = 1.0f; // -cosineOfAngle ^ 0 == 1
-        break;
-    case 1:
-        lightStrength = -cosineOfAngle; // -cosineOfAngle ^ 1 == -cosineOfAngle
-        break;
-    default:
-        lightStrength = powf(-cosineOfAngle, m_specularExponent);
-        break;
-    }
-
-    if (cosineOfAngle > paintingData.coneFullLight)
-        lightStrength *= (paintingData.coneCutOffLimit - cosineOfAngle) / (paintingData.coneCutOffLimit - paintingData.coneFullLight);
-
-    if (lightStrength > 1.0f)
-        lightStrength = 1.0f;
-
-    paintingData.colorVector.setX(paintingData.privateColorVector.x() * lightStrength);
-    paintingData.colorVector.setY(paintingData.privateColorVector.y() * lightStrength);
-    paintingData.colorVector.setZ(paintingData.privateColorVector.z() * lightStrength);
+    if (m_type == LS_SPOT)
+        return static_cast<SpotLightSource*>(this)->setY(y);
+    if (m_type == LS_POINT)
+        return static_cast<PointLightSource*>(this)->setY(y);
+    return false;
 }
 
-void DistantLightSource::initPaintingData(PaintingData& paintingData)
+bool LightSource::setZ(float z)
 {
-    float azimuth = deg2rad(m_azimuth);
-    float elevation = deg2rad(m_elevation);
-    paintingData.lightVector.setX(cosf(azimuth) * cosf(elevation));
-    paintingData.lightVector.setY(sinf(azimuth) * cosf(elevation));
-    paintingData.lightVector.setZ(sinf(elevation));
-    paintingData.lightVectorLength = 1;
+    if (m_type == LS_SPOT)
+        return static_cast<SpotLightSource*>(this)->setZ(z);
+    if (m_type == LS_POINT)
+        return static_cast<PointLightSource*>(this)->setZ(z);
+    return false;
 }
 
-void DistantLightSource::updatePaintingData(PaintingData&, int, int, float)
+bool LightSource::setPointsAtX(float pointsAtX)
 {
+    if (m_type == LS_SPOT)
+        return static_cast<SpotLightSource*>(this)->setPointsAtX(pointsAtX);
+    return false;
 }
 
-static TextStream& operator<<(TextStream& ts, const FloatPoint3D& p)
+bool LightSource::setPointsAtY(float pointsAtY)
 {
-    ts << "x=" << p.x() << " y=" << p.y() << " z=" << p.z();
-    return ts;
+    if (m_type == LS_SPOT)
+        return static_cast<SpotLightSource*>(this)->setPointsAtY(pointsAtY);
+    return false;
 }
 
-TextStream& PointLightSource::externalRepresentation(TextStream& ts) const
+bool LightSource::setPointsAtZ(float pointsAtZ)
 {
-    ts << "[type=POINT-LIGHT] ";
-    ts << "[position=\"" << position() << "\"]";
-    return ts;
+    if (m_type == LS_SPOT)
+        return static_cast<SpotLightSource*>(this)->setPointsAtZ(pointsAtZ);
+    return false;
 }
 
-TextStream& SpotLightSource::externalRepresentation(TextStream& ts) const
+bool LightSource::setSpecularExponent(float specularExponent)
 {
-    ts << "[type=SPOT-LIGHT] ";
-    ts << "[position=\"" << position() << "\"]";
-    ts << "[direction=\"" << direction() << "\"]";
-    ts << "[specularExponent=\"" << specularExponent() << "\"]";
-    ts << "[limitingConeAngle=\"" << limitingConeAngle() << "\"]";
-    return ts;
+    if (m_type == LS_SPOT)
+        return static_cast<SpotLightSource*>(this)->setSpecularExponent(specularExponent);
+    return false;
 }
 
-TextStream& DistantLightSource::externalRepresentation(TextStream& ts) const
+bool LightSource::setLimitingConeAngle(float limitingConeAngle)
 {
-    ts << "[type=DISTANT-LIGHT] ";
-    ts << "[azimuth=\"" << azimuth() << "\"]";
-    ts << "[elevation=\"" << elevation() << "\"]";
-    return ts;
+    if (m_type == LS_SPOT)
+        return static_cast<SpotLightSource*>(this)->setLimitingConeAngle(limitingConeAngle);
+    return false;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/filters/LightSource.h b/Source/WebCore/platform/graphics/filters/LightSource.h
index 013e910..24c319a 100644
--- a/Source/WebCore/platform/graphics/filters/LightSource.h
+++ b/Source/WebCore/platform/graphics/filters/LightSource.h
@@ -74,6 +74,17 @@ public:
     // specified "surfaceScale" constant, which type is <number> in the SVG standard
     virtual void updatePaintingData(PaintingData&, int x, int y, float z) = 0;
 
+    bool setAzimuth(float);
+    bool setElevation(float);
+    bool setX(float);
+    bool setY(float);
+    bool setZ(float);
+    bool setPointsAtX(float);
+    bool setPointsAtY(float);
+    bool setPointsAtZ(float);
+    bool setSpecularExponent(float);
+    bool setLimitingConeAngle(float);
+
 private:
     LightType m_type;
 };
diff --git a/Source/WebCore/platform/graphics/filters/PointLightSource.cpp b/Source/WebCore/platform/graphics/filters/PointLightSource.cpp
new file mode 100644
index 0000000..207ed8e
--- /dev/null
+++ b/Source/WebCore/platform/graphics/filters/PointLightSource.cpp
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2004, 2005 Rob Buis <buis@kde.org>
+ * Copyright (C) 2005 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2010 Zoltan Herczeg <zherczeg@webkit.org>
+ * Copyright (C) 2011 University of Szeged
+ * Copyright (C) 2011 Renata Hodovan <reni@webkit.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY UNIVERSITY OF SZEGED ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(FILTERS)
+#include "PointLightSource.h"
+
+#include "TextStream.h"
+
+namespace WebCore {
+
+void PointLightSource::initPaintingData(PaintingData&)
+{
+}
+
+void PointLightSource::updatePaintingData(PaintingData& paintingData, int x, int y, float z)
+{
+    paintingData.lightVector.setX(m_position.x() - x);
+    paintingData.lightVector.setY(m_position.y() - y);
+    paintingData.lightVector.setZ(m_position.z() - z);
+    paintingData.lightVectorLength = paintingData.lightVector.length();
+}
+
+bool PointLightSource::setX(float x)
+{
+    if (m_position.x() == x)
+        return false;
+    m_position.setX(x);
+    return true;
+}
+
+bool PointLightSource::setY(float y)
+{
+    if (m_position.y() == y)
+        return false;
+    m_position.setY(y);
+    return true;
+}
+
+bool PointLightSource::setZ(float z)
+{
+    if (m_position.z() == z)
+        return false;
+    m_position.setZ(z);
+    return true;
+}
+
+static TextStream& operator<<(TextStream& ts, const FloatPoint3D& p)
+{
+    ts << "x=" << p.x() << " y=" << p.y() << " z=" << p.z();
+    return ts;
+}
+
+TextStream& PointLightSource::externalRepresentation(TextStream& ts) const
+{
+    ts << "[type=POINT-LIGHT] ";
+    ts << "[position=\"" << position() << "\"]";
+    return ts;
+}
+
+}; // namespace WebCore
+
+#endif // ENABLE(FILTERS)
diff --git a/Source/WebCore/platform/graphics/filters/PointLightSource.h b/Source/WebCore/platform/graphics/filters/PointLightSource.h
index 163c829..a93bf2c 100644
--- a/Source/WebCore/platform/graphics/filters/PointLightSource.h
+++ b/Source/WebCore/platform/graphics/filters/PointLightSource.h
@@ -36,6 +36,9 @@ public:
     }
 
     const FloatPoint3D& position() const { return m_position; }
+    bool setX(float);
+    bool setY(float);
+    bool setZ(float);
 
     virtual void initPaintingData(PaintingData&);
     virtual void updatePaintingData(PaintingData&, int x, int y, float z);
diff --git a/Source/WebCore/platform/graphics/filters/SpotLightSource.cpp b/Source/WebCore/platform/graphics/filters/SpotLightSource.cpp
new file mode 100644
index 0000000..648fcae
--- /dev/null
+++ b/Source/WebCore/platform/graphics/filters/SpotLightSource.cpp
@@ -0,0 +1,198 @@
+/*
+ * Copyright (C) 2008 Alex Mathews <possessedpenguinbob@gmail.com>
+ * Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2004, 2005 Rob Buis <buis@kde.org>
+ * Copyright (C) 2005 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2010 Zoltan Herczeg <zherczeg@webkit.org>
+ * Copyright (C) 2011 University of Szeged
+ * Copyright (C) 2011 Renata Hodovan <reni@webkit.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY UNIVERSITY OF SZEGED ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(FILTERS)
+#include "SpotLightSource.h"
+
+#include "TextStream.h"
+
+namespace WebCore {
+
+// spot-light edge darkening depends on an absolute treshold
+// according to the SVG 1.1 SE light regression tests
+static const float antiAliasTreshold = 0.016f;
+
+void SpotLightSource::initPaintingData(PaintingData& paintingData)
+{
+    paintingData.privateColorVector = paintingData.colorVector;
+    paintingData.directionVector.setX(m_direction.x() - m_position.x());
+    paintingData.directionVector.setY(m_direction.y() - m_position.y());
+    paintingData.directionVector.setZ(m_direction.z() - m_position.z());
+    paintingData.directionVector.normalize();
+
+    if (!m_limitingConeAngle) {
+        paintingData.coneCutOffLimit = 0.0f;
+        paintingData.coneFullLight = -antiAliasTreshold;
+    } else {
+        float limitingConeAngle = m_limitingConeAngle;
+        if (limitingConeAngle < 0.0f)
+            limitingConeAngle = -limitingConeAngle;
+        if (limitingConeAngle > 90.0f)
+            limitingConeAngle = 90.0f;
+        paintingData.coneCutOffLimit = cosf(deg2rad(180.0f - limitingConeAngle));
+        paintingData.coneFullLight = paintingData.coneCutOffLimit - antiAliasTreshold;
+    }
+
+    // Optimization for common specularExponent values
+    if (!m_specularExponent)
+        paintingData.specularExponent = 0;
+    else if (m_specularExponent == 1.0f)
+        paintingData.specularExponent = 1;
+    else // It is neither 0.0f nor 1.0f
+        paintingData.specularExponent = 2;
+}
+
+void SpotLightSource::updatePaintingData(PaintingData& paintingData, int x, int y, float z)
+{
+    paintingData.lightVector.setX(m_position.x() - x);
+    paintingData.lightVector.setY(m_position.y() - y);
+    paintingData.lightVector.setZ(m_position.z() - z);
+    paintingData.lightVectorLength = paintingData.lightVector.length();
+
+    float cosineOfAngle = (paintingData.lightVector * paintingData.directionVector) / paintingData.lightVectorLength;
+    if (cosineOfAngle > paintingData.coneCutOffLimit) {
+        // No light is produced, scanlines are not updated
+        paintingData.colorVector.setX(0.0f);
+        paintingData.colorVector.setY(0.0f);
+        paintingData.colorVector.setZ(0.0f);
+        return;
+    }
+
+    // Set the color of the pixel
+    float lightStrength;
+    switch (paintingData.specularExponent) {
+    case 0:
+        lightStrength = 1.0f; // -cosineOfAngle ^ 0 == 1
+        break;
+    case 1:
+        lightStrength = -cosineOfAngle; // -cosineOfAngle ^ 1 == -cosineOfAngle
+        break;
+    default:
+        lightStrength = powf(-cosineOfAngle, m_specularExponent);
+        break;
+    }
+
+    if (cosineOfAngle > paintingData.coneFullLight)
+        lightStrength *= (paintingData.coneCutOffLimit - cosineOfAngle) / (paintingData.coneCutOffLimit - paintingData.coneFullLight);
+
+    if (lightStrength > 1.0f)
+        lightStrength = 1.0f;
+
+    paintingData.colorVector.setX(paintingData.privateColorVector.x() * lightStrength);
+    paintingData.colorVector.setY(paintingData.privateColorVector.y() * lightStrength);
+    paintingData.colorVector.setZ(paintingData.privateColorVector.z() * lightStrength);
+}
+
+bool SpotLightSource::setX(float x)
+{
+    if (m_position.x() == x)
+        return false;
+    m_position.setX(x);
+    return true;
+}
+
+bool SpotLightSource::setY(float y)
+{
+    if (m_position.y() == y)
+        return false;
+    m_position.setY(y);
+    return true;
+}
+
+bool SpotLightSource::setZ(float z)
+{
+    if (m_position.z() == z)
+        return false;
+    m_position.setZ(z);
+    return true;
+}
+
+bool SpotLightSource::setPointsAtX(float pointsAtX)
+{
+    if (m_direction.x() == pointsAtX)
+        return false;
+    m_direction.setX(pointsAtX);
+    return true;
+}
+
+bool SpotLightSource::setPointsAtY(float pointsAtY)
+{
+    if (m_direction.y() == pointsAtY)
+        return false;
+    m_direction.setY(pointsAtY);
+    return true;
+}
+
+bool SpotLightSource::setPointsAtZ(float pointsAtZ)
+{
+    if (m_direction.z() == pointsAtZ)
+        return false;
+    m_direction.setZ(pointsAtZ);
+    return true;
+}
+
+bool SpotLightSource::setSpecularExponent(float specularExponent)
+{
+    if (m_specularExponent == specularExponent)
+        return false;
+    m_specularExponent = specularExponent;
+    return true;
+}
+
+bool SpotLightSource::setLimitingConeAngle(float limitingConeAngle)
+{
+    if (m_limitingConeAngle == limitingConeAngle)
+        return false;
+    m_limitingConeAngle = limitingConeAngle;
+    return true;
+}
+
+static TextStream& operator<<(TextStream& ts, const FloatPoint3D& p)
+{
+    ts << "x=" << p.x() << " y=" << p.y() << " z=" << p.z();
+    return ts;
+}
+
+TextStream& SpotLightSource::externalRepresentation(TextStream& ts) const
+{
+    ts << "[type=SPOT-LIGHT] ";
+    ts << "[position=\"" << position() << "\"]";
+    ts << "[direction=\"" << direction() << "\"]";
+    ts << "[specularExponent=\"" << specularExponent() << "\"]";
+    ts << "[limitingConeAngle=\"" << limitingConeAngle() << "\"]";
+    return ts;
+}
+
+}; // namespace WebCore
+
+#endif // ENABLE(FILTERS)
diff --git a/Source/WebCore/platform/graphics/filters/SpotLightSource.h b/Source/WebCore/platform/graphics/filters/SpotLightSource.h
index cd6a614..b4f1b61 100644
--- a/Source/WebCore/platform/graphics/filters/SpotLightSource.h
+++ b/Source/WebCore/platform/graphics/filters/SpotLightSource.h
@@ -37,10 +37,18 @@ public:
     }
 
     const FloatPoint3D& position() const { return m_position; }
+    bool setX(float);
+    bool setY(float);
+    bool setZ(float);
     const FloatPoint3D& direction() const { return m_direction; }
+    bool setPointsAtX(float);
+    bool setPointsAtY(float);
+    bool setPointsAtZ(float);
 
     float specularExponent() const { return m_specularExponent; }
+    bool setSpecularExponent(float);
     float limitingConeAngle() const { return m_limitingConeAngle; }
+    bool setLimitingConeAngle(float);
 
     virtual void initPaintingData(PaintingData&);
     virtual void updatePaintingData(PaintingData&, int x, int y, float z);
diff --git a/Source/WebCore/platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp b/Source/WebCore/platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp
index c547224..841c8a3 100644
--- a/Source/WebCore/platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp
+++ b/Source/WebCore/platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp
@@ -59,7 +59,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
     cairo_font_face_destroy(m_fontFace);
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontRenderingMode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontWidthVariant, FontRenderingMode)
 {
     return FontPlatformData(m_fontFace, size, bold, italic);
 }
diff --git a/Source/WebCore/platform/graphics/freetype/SimpleFontDataFreeType.cpp b/Source/WebCore/platform/graphics/freetype/SimpleFontDataFreeType.cpp
index 97fd81a..6290eeb 100644
--- a/Source/WebCore/platform/graphics/freetype/SimpleFontDataFreeType.cpp
+++ b/Source/WebCore/platform/graphics/freetype/SimpleFontDataFreeType.cpp
@@ -50,21 +50,28 @@ void SimpleFontData::platformInit()
     cairo_font_extents_t font_extents;
     cairo_text_extents_t text_extents;
     cairo_scaled_font_extents(m_platformData.scaledFont(), &font_extents);
-    m_ascent = static_cast<int>(lroundf(font_extents.ascent));
-    m_descent = static_cast<int>(lroundf(font_extents.descent));
-    m_lineSpacing = static_cast<int>(lroundf(font_extents.height));
+
+    m_fontMetrics.setAscent(font_extents.ascent);
+    m_fontMetrics.setDescent(font_extents.descent);
+
     // There seems to be some rounding error in cairo (or in how we
     // use cairo) with some fonts, like DejaVu Sans Mono, which makes
     // cairo report a height smaller than ascent + descent, which is
     // wrong and confuses WebCore's layout system. Workaround this
     // while we figure out what's going on.
-    if (m_lineSpacing < m_ascent + m_descent)
-        m_lineSpacing = m_ascent + m_descent;
+    float lineSpacing = font_extents.height;
+    if (lineSpacing < font_extents.ascent + font_extents.descent)
+        lineSpacing = font_extents.ascent + font_extents.descent;
+
+    m_fontMetrics.setLineSpacing(lroundf(lineSpacing));
+    m_fontMetrics.setLineGap(lineSpacing - font_extents.ascent - font_extents.descent);
+
     cairo_scaled_font_text_extents(m_platformData.scaledFont(), "x", &text_extents);
-    m_xHeight = text_extents.height;
+    m_fontMetrics.setXHeight(text_extents.height);
+
     cairo_scaled_font_text_extents(m_platformData.scaledFont(), " ", &text_extents);
     m_spaceWidth = static_cast<float>(text_extents.x_advance);
-    m_lineGap = m_lineSpacing - m_ascent - m_descent;
+    
     m_syntheticBoldOffset = m_platformData.syntheticBold() ? 1.0f : 0.f;
 }
 
diff --git a/Source/WebCore/platform/graphics/gpu/DrawingBuffer.cpp b/Source/WebCore/platform/graphics/gpu/DrawingBuffer.cpp
index dae83a2..2a83fcf 100644
--- a/Source/WebCore/platform/graphics/gpu/DrawingBuffer.cpp
+++ b/Source/WebCore/platform/graphics/gpu/DrawingBuffer.cpp
@@ -30,7 +30,7 @@
 
 #include "config.h"
 
-#if ENABLE(ACCELERATED_2D_CANVAS) || ENABLE(3D_CANVAS)
+#if ENABLE(ACCELERATED_2D_CANVAS) || ENABLE(WEBGL)
 
 #include "DrawingBuffer.h"
 
@@ -41,10 +41,11 @@ namespace WebCore {
 PassRefPtr<DrawingBuffer> DrawingBuffer::create(GraphicsContext3D* context, const IntSize& size)
 {
     Extensions3D* extensions = context->getExtensions();
-    bool multisampleSupported = extensions->supports("GL_ANGLE_framebuffer_blit") && extensions->supports("GL_ANGLE_framebuffer_multisample");
+    bool multisampleSupported = extensions->supports("GL_ANGLE_framebuffer_blit") && extensions->supports("GL_ANGLE_framebuffer_multisample") && extensions->supports("GL_OES_rgb8_rgba8");
     if (multisampleSupported) {
         extensions->ensureEnabled("GL_ANGLE_framebuffer_blit");
         extensions->ensureEnabled("GL_ANGLE_framebuffer_multisample");
+        extensions->ensureEnabled("GL_OES_rgb8_rgba8");
     }
     bool packedDepthStencilSupported = extensions->supports("GL_OES_packed_depth_stencil");
     if (packedDepthStencilSupported)
@@ -145,8 +146,6 @@ void DrawingBuffer::resizeDepthStencil(int sampleCount)
 
 void DrawingBuffer::reset(const IntSize& newSize)
 {
-    if (m_size == newSize)
-        return;
     m_size = newSize;
 
     if (!m_context)
@@ -155,13 +154,15 @@ void DrawingBuffer::reset(const IntSize& newSize)
     m_context->makeContextCurrent();
     
     const GraphicsContext3D::Attributes& attributes = m_context->getContextAttributes();
-    unsigned long internalColorFormat, colorFormat;
+    unsigned long internalColorFormat, colorFormat, internalRenderbufferFormat;
     if (attributes.alpha) {
         internalColorFormat = GraphicsContext3D::RGBA;
         colorFormat = GraphicsContext3D::RGBA;
+        internalRenderbufferFormat = Extensions3D::RGBA8_OES;
     } else {
         internalColorFormat = GraphicsContext3D::RGB;
         colorFormat = GraphicsContext3D::RGB;
+        internalRenderbufferFormat = Extensions3D::RGB8_OES;
     }
 
 
@@ -175,7 +176,7 @@ void DrawingBuffer::reset(const IntSize& newSize)
         m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_multisampleFBO);
 
         m_context->bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, m_multisampleColorBuffer);
-        m_context->getExtensions()->renderbufferStorageMultisample(GraphicsContext3D::RENDERBUFFER, sampleCount, internalColorFormat, m_size.width(), m_size.height());
+        m_context->getExtensions()->renderbufferStorageMultisample(GraphicsContext3D::RENDERBUFFER, sampleCount, internalRenderbufferFormat, m_size.width(), m_size.height());
         m_context->framebufferRenderbuffer(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::RENDERBUFFER, m_multisampleColorBuffer);
         resizeDepthStencil(sampleCount);
         if (m_context->checkFramebufferStatus(GraphicsContext3D::FRAMEBUFFER) != GraphicsContext3D::FRAMEBUFFER_COMPLETE) {
@@ -192,7 +193,8 @@ void DrawingBuffer::reset(const IntSize& newSize)
     m_context->texImage2DResourceSafe(GraphicsContext3D::TEXTURE_2D, 0, internalColorFormat, m_size.width(), m_size.height(), 0, colorFormat, GraphicsContext3D::UNSIGNED_BYTE);
     m_context->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, m_colorBuffer, 0);
     m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, 0);
-    resizeDepthStencil(0);
+    if (!multisample())
+        resizeDepthStencil(0);
     if (m_context->checkFramebufferStatus(GraphicsContext3D::FRAMEBUFFER) != GraphicsContext3D::FRAMEBUFFER_COMPLETE) {
         // Cleanup
         clear();
diff --git a/Source/WebCore/platform/graphics/gpu/LoopBlinnPathCache.cpp b/Source/WebCore/platform/graphics/gpu/LoopBlinnPathCache.cpp
new file mode 100644
index 0000000..35f15e5
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gpu/LoopBlinnPathCache.cpp
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "LoopBlinnPathCache.h"
+
+namespace WebCore {
+
+LoopBlinnPathCache::LoopBlinnPathCache()
+{
+}
+
+LoopBlinnPathCache::~LoopBlinnPathCache()
+{
+}
+
+void LoopBlinnPathCache::addVertex(float x, float y,
+                                   float k, float l, float m)
+{
+    m_vertices.append(x);
+    m_vertices.append(y);
+    m_texcoords.append(k);
+    m_texcoords.append(l);
+    m_texcoords.append(m);
+}
+
+void LoopBlinnPathCache::clear()
+{
+    m_vertices.clear();
+    m_texcoords.clear();
+    m_interiorVertices.clear();
+#ifdef LOOP_BLINN_PATH_CACHE_DEBUG_INTERIOR_EDGES
+    m_interiorEdgeVertices.clear();
+#endif // LOOP_BLINN_PATH_CACHE_DEBUG_INTERIOR_EDGES
+}
+
+void LoopBlinnPathCache::addInteriorVertex(float x, float y)
+{
+    m_interiorVertices.append(x);
+    m_interiorVertices.append(y);
+}
+
+#ifdef LOOP_BLINN_PATH_CACHE_DEBUG_INTERIOR_EDGES
+unsigned LoopBlinnPathCache::numberOfInteriorEdgeVertices() const
+{
+    return m_interiorEdgeVertices.size() / 2;
+}
+
+const float* LoopBlinnPathCache::interiorEdgeVertices() const
+{
+    if (!numberOfInteriorEdgeVertices())
+        return 0;
+    return m_interiorEdgeVertices.data();
+}
+
+void LoopBlinnPathCache::addInteriorEdgeVertex(float x, float y)
+{
+    m_interiorEdgeVertices.append(x);
+    m_interiorEdgeVertices.append(y);
+}
+#endif // LOOP_BLINN_PATH_CACHE_DEBUG_INTERIOR_EDGES
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/gpu/LoopBlinnPathCache.h b/Source/WebCore/platform/graphics/gpu/LoopBlinnPathCache.h
new file mode 100644
index 0000000..d21d246
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gpu/LoopBlinnPathCache.h
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LoopBlinnPathCache_h
+#define LoopBlinnPathCache_h
+
+#include <wtf/Noncopyable.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+// A cache of the processed triangle mesh for a given path. Because these
+// might be expensive to allocate (using malloc/free internally), it is
+// recommended to try to reuse them when possible.
+
+// Uncomment the following to obtain debugging information for the edges
+// facing the interior region of the mesh.
+// #define LOOP_BLINN_PATH_CACHE_DEBUG_INTERIOR_EDGES
+
+class LoopBlinnPathCache {
+    WTF_MAKE_NONCOPYABLE(LoopBlinnPathCache);
+public:
+    LoopBlinnPathCache();
+    ~LoopBlinnPathCache();
+
+    unsigned numberOfVertices() const { return m_vertices.size() / 2; }
+
+    // Get the base pointer to the vertex information. There are two
+    // coordinates per vertex. This pointer is valid until the cache is
+    // cleared or another vertex is added. Returns 0 if there are no
+    // vertices in the mesh.
+    const float* vertices() const
+    {
+        if (!numberOfVertices())
+            return 0;
+        return m_vertices.data();
+    }
+
+    // Get the base pointer to the texture coordinate information. There
+    // are three coordinates per vertex. This pointer is valid until the
+    // cache is cleared or another vertex is added. Returns 0 if
+    // there are no vertices in the mesh.
+    const float* texcoords() const
+    {
+        if (!numberOfVertices())
+            return 0;
+        return m_texcoords.data();
+    }
+
+    // Adds a vertex's information to the cache. The first two arguments
+    // are the x and y coordinates of the vertex on the plane; the last
+    // three arguments are the cubic texture coordinates associated with
+    // this vertex.
+    void addVertex(float x, float y,
+                   float /*k*/, float /*l*/, float /*m*/);
+
+    unsigned numberOfInteriorVertices() const { return m_interiorVertices.size() / 2; }
+
+    // Base pointer to the interior vertices; two coordinates per
+    // vertex, which can be drawn as GL_TRIANGLES. Returns 0 if there
+    // are no interior vertices in the mesh.
+    const float* interiorVertices() const
+    {
+        if (!numberOfInteriorVertices())
+            return 0;
+        return m_interiorVertices.data();
+    }
+
+    void addInteriorVertex(float x, float y);
+
+    // Clears all of the stored vertex information in this cache.
+    void clear();
+
+#ifdef LOOP_BLINN_PATH_CACHE_DEBUG_INTERIOR_EDGES
+    // The number of interior edge vertices
+    unsigned numberOfInteriorEdgeVertices() const;
+    // Base pointer to the interior vertices; two coordinates per
+    // vertex, which can be drawn as GL_LINES. Returns 0 if there are
+    // no interior edge vertices in the mesh.
+    const float* interiorEdgeVertices() const;
+    void addInteriorEdgeVertex(float x, float y);
+#endif // LOOP_BLINN_PATH_CACHE_DEBUG_INTERIOR_EDGES
+
+private:
+    // The two-dimensional vertices of the triangle mesh.
+    Vector<float> m_vertices;
+
+    // The three-dimensional cubic texture coordinates.
+    Vector<float> m_texcoords;
+
+    Vector<float> m_interiorVertices;
+
+#ifdef LOOP_BLINN_PATH_CACHE_DEBUG_INTERIOR_EDGES
+    // The following is only for debugging
+    Vector<float> m_interiorEdgeVertices;
+#endif // LOOP_BLINN_PATH_CACHE_DEBUG_INTERIOR_EDGES
+};
+
+} // namespace WebCore
+
+#endif // LoopBlinnPathCache_h
diff --git a/Source/WebCore/platform/graphics/gpu/LoopBlinnPathProcessor.cpp b/Source/WebCore/platform/graphics/gpu/LoopBlinnPathProcessor.cpp
new file mode 100644
index 0000000..e84ddbf
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gpu/LoopBlinnPathProcessor.cpp
@@ -0,0 +1,1228 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "LoopBlinnPathProcessor.h"
+
+#include "FloatPoint.h"
+#include "FloatRect.h"
+#include "LoopBlinnClassifier.h"
+#include "LoopBlinnConstants.h"
+#include "LoopBlinnLocalTriangulator.h"
+#include "LoopBlinnMathUtils.h"
+#include "LoopBlinnPathCache.h"
+#include "LoopBlinnTextureCoords.h"
+#include "PODArena.h"
+#include "PODIntervalTree.h"
+#include "Path.h"
+#include "internal_glu.h"
+#include <algorithm>
+#include <wtf/Assertions.h>
+#include <wtf/FastMalloc.h>
+
+#if PLATFORM(SKIA)
+#include "SkGeometry.h"
+#include "SkPath.h"
+#include "SkScalar.h"
+#else
+// Must port to your platform.
+#endif
+
+namespace WebCore {
+
+using LoopBlinnMathUtils::XRay;
+using LoopBlinnMathUtils::chopCubicAt;
+using LoopBlinnMathUtils::numXRayCrossingsForCubic;
+using LoopBlinnMathUtils::trianglesOverlap;
+using LoopBlinnMathUtils::xRayCrossesLine;
+using LoopBlinnPathProcessorImplementation::Contour;
+using LoopBlinnPathProcessorImplementation::Segment;
+
+namespace {
+
+#ifndef NDEBUG
+String valueToString(const FloatRect& arg)
+{
+    StringBuilder builder;
+    builder.append("[FloatRect x=");
+    builder.append(String::number(arg.x()));
+    builder.append(" y=");
+    builder.append(String::number(arg.y()));
+    builder.append(" maxX=");
+    builder.append(String::number(arg.maxX()));
+    builder.append(" maxY=");
+    builder.append(String::number(arg.maxY()));
+    builder.append("]");
+    return builder.toString();
+}
+#endif
+
+struct SweepData;
+
+} // anonymous namespace
+
+namespace LoopBlinnPathProcessorImplementation {
+class Segment;
+}
+
+#ifndef NDEBUG
+// Routines needed to print the types of IntervalNodes we instantiate
+// in this file.
+template <>
+struct ValueToString<float> {
+    static String string(const float& value)
+    {
+        return String::number(value);
+    }
+};
+
+template <>
+struct ValueToString<SweepData*> {
+    static String string(SweepData* const& value)
+    {
+        return String::format("0x%p", value);
+    }
+};
+
+template <>
+struct ValueToString<LoopBlinnPathProcessorImplementation::Segment*> {
+    static String string(LoopBlinnPathProcessorImplementation::Segment* const& value)
+    {
+        return String::format("0x%p", value);
+    }
+};
+#endif
+
+namespace LoopBlinnPathProcessorImplementation {
+
+//----------------------------------------------------------------------
+// Segment
+//
+
+// Describes a segment of the path: either a cubic or a line segment.
+// These are stored in a doubly linked list to speed up curve
+// subdivision, which occurs due to either rendering artifacts in the
+// loop case or due to overlapping triangles.
+class Segment {
+    WTF_MAKE_NONCOPYABLE(Segment);
+public:
+    enum Kind {
+        Cubic,
+        Line
+    };
+
+    // No-argument constructor allows construction by the PODArena class.
+    Segment()
+         : m_arena(0)
+         , m_kind(Cubic)
+         , m_prev(0)
+         , m_next(0)
+         , m_contour(0)
+         , m_triangulator(0)
+         , m_markedForSubdivision(false)
+    {
+    }
+
+    // Initializer for cubic curve segments.
+    void setup(PODArena* arena,
+               Contour* contour,
+               FloatPoint cp0,
+               FloatPoint cp1,
+               FloatPoint cp2,
+               FloatPoint cp3)
+    {
+        m_arena = arena;
+        m_contour = contour;
+        m_kind = Cubic;
+        m_points[0] = cp0;
+        m_points[1] = cp1;
+        m_points[2] = cp2;
+        m_points[3] = cp3;
+        computeBoundingBox();
+    }
+
+    // Initializer for line segments.
+    void setup(PODArena* arena,
+               Contour* contour,
+               FloatPoint p0,
+               FloatPoint p1)
+    {
+        m_arena = arena;
+        m_contour = contour;
+        m_kind = Line;
+        m_points[0] = p0;
+        m_points[1] = p1;
+        computeBoundingBox();
+    }
+
+    Kind kind() const { return m_kind; }
+
+    // Returns the i'th control point, 0 <= i < 4.
+    const FloatPoint& getPoint(int i)
+    {
+        ASSERT(i >= 0 && i < 4);
+        return m_points[i];
+    }
+
+    Segment* next() const { return m_next; }
+    Segment* prev() const { return m_prev; }
+
+    void setNext(Segment* next) { m_next = next; }
+    void setPrev(Segment* prev) { m_prev = prev; }
+
+    // The contour this segment belongs to.
+    Contour* contour() const { return m_contour; }
+
+    // Subdivides the current segment at the given parameter value (0 <=
+    // t <= 1) and replaces it with the two newly created Segments in
+    // the linked list, if possible. Returns a pointer to the leftmost
+    // Segment.
+    Segment* subdivide(float param)
+    {
+        FloatPoint dst[7];
+        chopCubicAt(m_points, dst, param);
+        Segment* left = m_arena->allocateObject<Segment>();
+        Segment* right = m_arena->allocateObject<Segment>();
+        left->setup(m_arena, m_contour, dst[0], dst[1], dst[2], dst[3]);
+        right->setup(m_arena, m_contour, dst[3], dst[4], dst[5], dst[6]);
+        left->setNext(right);
+        right->setPrev(left);
+        // Try to set up a link between "this->prev()" and "left".
+        if (prev()) {
+            left->setPrev(prev());
+            prev()->setNext(left);
+        }
+        // Try to set up a link between "this->next()" and "right".
+        Segment* n = next();
+        if (n) {
+            right->setNext(n);
+            n->setPrev(right);
+        }
+        // Set up a link between "this" and "left"; this is only to
+        // provide a certain amount of continuity during forward iteration.
+        setNext(left);
+        return left;
+    }
+
+    // Subdivides the current segment at the halfway point and replaces
+    // it with the two newly created Segments in the linked list, if
+    // possible. Returns a pointer to the leftmost Segment.
+    Segment* subdivide() { return subdivide(0.5f); }
+
+    const FloatRect& boundingBox() const { return m_boundingBox; }
+
+    // Computes the number of times a query line starting at the given
+    // point and extending to x=+infinity crosses this segment. Outgoing
+    // "ambiguous" argument indicates whether the query intersected an
+    // endpoint or tangent point of the segment, indicating that another
+    // query point is preferred.
+    int numCrossingsForXRay(const XRay& xRay, bool& ambiguous) const
+    {
+        if (m_kind == Cubic)
+            // Should consider caching the monotonic cubics.
+            return numXRayCrossingsForCubic(xRay, m_points, ambiguous);
+
+        return xRayCrossesLine(xRay, m_points, ambiguous) ? 1 : 0;
+    }
+
+    // Performs a local triangulation of the control points in this
+    // segment. This operation only makes sense for cubic type segments.
+    // texCoords may be null when the klm coordinates have not been
+    // computed yet.
+    void triangulate(LoopBlinnLocalTriangulator::InsideEdgeComputation computeInsideEdges,
+                     const LoopBlinnTextureCoords::Result* texCoords);
+
+    // Returns the number of control point triangles associated with
+    // this segment.
+    int numberOfTriangles() const
+    {
+        if (!m_triangulator)
+            return 0;
+        return m_triangulator->numberOfTriangles();
+    }
+
+    // Fetches the given control point triangle for this segment.
+    LoopBlinnLocalTriangulator::Triangle* getTriangle(int index)
+    {
+        ASSERT(m_triangulator);
+        return m_triangulator->getTriangle(index);
+    }
+
+    // Number of vertices along the inside edge of this segment. This
+    // can be called either for line or cubic type segments.
+    int numberOfInteriorVertices() const
+    {
+        if (m_kind == Cubic) {
+            if (m_triangulator)
+                return m_triangulator->numberOfInteriorVertices();
+
+            return 0;
+        }
+
+        return 2;
+    }
+
+    // Returns the given interior vertex, 0 <= index < numberOfInteriorVertices().
+    FloatPoint getInteriorVertex(int index) const
+    {
+        ASSERT(index >= 0 && index < numberOfInteriorVertices());
+        if (m_kind == Cubic) {
+            FloatPoint res;
+            if (m_triangulator) {
+                LoopBlinnLocalTriangulator::Vertex* vertex = m_triangulator->getInteriorVertex(index);
+                if (vertex)
+                    res.set(vertex->xyCoordinates().x(), vertex->xyCoordinates().y());
+            }
+            return res;
+        }
+
+        return m_points[index];
+    }
+
+    // State to assist with curve subdivision.
+    bool markedForSubdivision() const { return m_markedForSubdivision; }
+    void setMarkedForSubdivision(bool markedForSubdivision) { m_markedForSubdivision = markedForSubdivision; }
+
+#ifndef NDEBUG
+    // Suppport for printing Segments.
+    String toString() const
+    {
+        StringBuilder builder;
+        builder.append("[Segment kind=");
+        builder.append(kind() == Line ? "line" : "cubic");
+        builder.append(" boundingBox=");
+        builder.append(valueToString(boundingBox()));
+        builder.append(" contour=0x");
+        builder.append(String::format("%p", contour()));
+        builder.append(" markedForSubdivision=");
+        builder.append(markedForSubdivision() ? "true" : "false");
+        builder.append("]");
+        return builder.toString();
+    }
+#endif
+
+ private:
+    // Computes the bounding box of this Segment.
+    void computeBoundingBox()
+    {
+        switch (m_kind) {
+        case Cubic:
+            m_boundingBox.fitToPoints(m_points[0], m_points[1], m_points[2], m_points[3]);
+            break;
+
+        case Line:
+            m_boundingBox.fitToPoints(m_points[0], m_points[1]);
+            break;
+        }
+    }
+
+    PODArena* m_arena;
+    Kind m_kind;
+    FloatPoint m_points[4];
+    Segment* m_prev;
+    Segment* m_next;
+    Contour* m_contour;
+    FloatRect m_boundingBox;
+    LoopBlinnLocalTriangulator* m_triangulator;
+    bool m_markedForSubdivision;
+};
+
+//----------------------------------------------------------------------
+// Contour
+//
+
+// Describes a closed contour of the path.
+class Contour {
+    WTF_MAKE_NONCOPYABLE(Contour);
+public:
+    Contour()
+    {
+        m_first = &m_sentinel;
+        m_first->setNext(m_first);
+        m_first->setPrev(m_first);
+        m_isOrientedCounterClockwise = true;
+        m_boundingBoxDirty = false;
+        m_fillSide = LoopBlinnConstants::RightSide;
+    }
+
+    void add(Segment* segment)
+    {
+        if (m_first == &m_sentinel) {
+            // First element is the sentinel. Replace it with the incoming
+            // segment.
+            segment->setNext(m_first);
+            segment->setPrev(m_first);
+            m_first->setNext(segment);
+            m_first->setPrev(segment);
+            m_first = segment;
+        } else {
+            // m_first->prev() is the sentinel.
+            ASSERT(m_first->prev() == &m_sentinel);
+            Segment* last = m_sentinel.prev();
+            last->setNext(segment);
+            segment->setPrev(last);
+            segment->setNext(&m_sentinel);
+            m_sentinel.setPrev(segment);
+        }
+        m_boundingBoxDirty = true;
+    }
+
+    // Subdivides the given segment at the given parametric value.
+    // Returns a pointer to the first of the two portions of the
+    // subdivided segment.
+    Segment* subdivide(Segment* segment, float param)
+    {
+        Segment* left = segment->subdivide(param);
+        if (m_first == segment)
+            m_first = left;
+        return left;
+    }
+
+    // Subdivides the given segment at the halfway point. Returns a
+    // pointer to the first of the two portions of the subdivided
+    // segment.
+    Segment* subdivide(Segment* segment)
+    {
+        Segment* left = segment->subdivide();
+        if (m_first == segment)
+            m_first = left;
+        return left;
+    }
+
+    // Returns the first segment in the contour for iteration.
+    Segment* begin() const { return m_first; }
+
+    // Returns the last segment in the contour for iteration. Callers
+    // should not iterate over this segment. In other words:
+    //  for (Segment* cur = contour->begin();
+    //       cur != contour->end();
+    //       cur = cur->next()) {
+    //    // .. process cur ...
+    //  }
+    Segment* end()
+    {
+        ASSERT(m_first->prev() == &m_sentinel);
+        return &m_sentinel;
+    }
+
+    bool isOrientedCounterClockwise() const { return m_isOrientedCounterClockwise; }
+    void setIsOrientedCounterClockwise(bool isOrientedCounterClockwise) { m_isOrientedCounterClockwise = isOrientedCounterClockwise; }
+
+    const FloatRect& boundingBox()
+    {
+        if (m_boundingBoxDirty) {
+            bool first = true;
+            for (Segment* cur = begin(); cur != end(); cur = cur->next()) {
+                if (first)
+                    m_boundingBox = cur->boundingBox();
+                else
+                    m_boundingBox.unite(cur->boundingBox());
+                first = false;
+            }
+
+            m_boundingBoxDirty = false;
+        }
+        return m_boundingBox;
+    }
+
+    // Returns which side of this contour is filled.
+    LoopBlinnConstants::FillSide fillSide() const
+    {
+        return m_fillSide;
+    }
+
+    void setFillSide(LoopBlinnConstants::FillSide fillSide)
+    {
+        m_fillSide = fillSide;
+    }
+
+private:
+    // The start of the segment chain. The segments are kept in a
+    // circular doubly linked list for rapid access to the beginning and
+    // end.
+    Segment* m_first;
+
+    // The sentinel element at the end of the chain, needed for
+    // reasonable iteration semantics.
+    Segment m_sentinel;
+
+    bool m_isOrientedCounterClockwise;
+
+    FloatRect m_boundingBox;
+    bool m_boundingBoxDirty;
+
+    // Which side of this contour should be filled.
+    LoopBlinnConstants::FillSide m_fillSide;
+};
+
+//----------------------------------------------------------------------
+// Segment
+//
+
+// Definition of Segment::triangulate(), which must come after
+// declaration of Contour.
+void Segment::triangulate(LoopBlinnLocalTriangulator::InsideEdgeComputation computeInsideEdges,
+                          const LoopBlinnTextureCoords::Result* texCoords)
+{
+    ASSERT(m_kind == Cubic);
+    if (!m_triangulator)
+        m_triangulator = m_arena->allocateObject<LoopBlinnLocalTriangulator>();
+    m_triangulator->reset();
+    for (int i = 0; i < 4; i++) {
+        LoopBlinnLocalTriangulator::Vertex* vertex = m_triangulator->getVertex(i);
+        if (texCoords) {
+            vertex->set(getPoint(i).x(),
+                        getPoint(i).y(),
+                        texCoords->klmCoordinates[i].x(),
+                        texCoords->klmCoordinates[i].y(),
+                        texCoords->klmCoordinates[i].z());
+        } else {
+            vertex->set(getPoint(i).x(),
+                        getPoint(i).y(),
+                        // No texture coordinates yet
+                        0, 0, 0);
+        }
+    }
+    m_triangulator->triangulate(computeInsideEdges, contour()->fillSide());
+}
+
+} // namespace LoopBlinnPathProcessorImplementation
+
+//----------------------------------------------------------------------
+// LoopBlinnPathProcessor
+//
+
+LoopBlinnPathProcessor::LoopBlinnPathProcessor()
+    : m_arena(PODArena::create())
+#ifndef NDEBUG
+    , m_verboseLogging(false)
+#endif
+{
+}
+
+LoopBlinnPathProcessor::LoopBlinnPathProcessor(PassRefPtr<PODArena> arena)
+    : m_arena(arena)
+#ifndef NDEBUG
+    , m_verboseLogging(false)
+#endif
+{
+}
+
+LoopBlinnPathProcessor::~LoopBlinnPathProcessor()
+{
+}
+
+void LoopBlinnPathProcessor::process(const Path& path, LoopBlinnPathCache& cache)
+{
+    buildContours(path);
+
+    // Run plane-sweep algorithm to determine overlaps of control point
+    // curves and subdivide curves appropriately.
+    subdivideCurves();
+
+    // Determine orientations of countours. Based on orientation and the
+    // number of curve crossings at a random point on the contour,
+    // determine whether to fill the left or right side of the contour.
+    determineSidesToFill();
+
+    // Classify curves, compute texture coordinates and subdivide as
+    // necessary to eliminate rendering artifacts. Do the final
+    // triangulation of the curve segments, determining the path along
+    // the interior of the shape.
+    for (Vector<Contour*>::iterator iter = m_contours.begin(); iter != m_contours.end(); ++iter) {
+        Contour* cur = *iter;
+        for (Segment* seg = cur->begin(); seg != cur->end(); seg = seg->next()) {
+            if (seg->kind() == Segment::Cubic) {
+                LoopBlinnClassifier::Result classification = LoopBlinnClassifier::classify(seg->getPoint(0),
+                                                                                           seg->getPoint(1),
+                                                                                           seg->getPoint(2),
+                                                                                           seg->getPoint(3));
+#ifndef NDEBUG
+                if (m_verboseLogging)
+                    LOG_ERROR("Classification: %d", (int) classification.curveType);
+#endif
+                LoopBlinnTextureCoords::Result texCoords =
+                    LoopBlinnTextureCoords::compute(classification, cur->fillSide());
+                if (texCoords.hasRenderingArtifact) {
+                    // FIXME: there is a problem where the algorithm
+                    // sometimes fails to converge when splitting at the
+                    // subdivision parameter value. For the time being,
+                    // split halfway.
+                    cur->subdivide(seg);
+                    // Next iteration will handle the newly subdivided curves
+                } else {
+                    if (!texCoords.isLineOrPoint) {
+                        seg->triangulate(LoopBlinnLocalTriangulator::ComputeInsideEdges, &texCoords);
+                        for (int i = 0; i < seg->numberOfTriangles(); i++) {
+                            LoopBlinnLocalTriangulator::Triangle* triangle = seg->getTriangle(i);
+                            for (int j = 0; j < 3; j++) {
+                                LoopBlinnLocalTriangulator::Vertex* vert = triangle->getVertex(j);
+                                cache.addVertex(vert->xyCoordinates().x(),
+                                                vert->xyCoordinates().y(),
+                                                vert->klmCoordinates().x(),
+                                                vert->klmCoordinates().y(),
+                                                vert->klmCoordinates().z());
+                            }
+                        }
+#ifdef LOOP_BLINN_PATH_CACHE_DEBUG_INTERIOR_EDGES
+                        // Show the end user the interior edges as well
+                        for (int i = 1; i < seg->numberOfInteriorVertices(); i++) {
+                            FloatPoint vert = seg->getInteriorVertex(i);
+                            // Duplicate previous vertex to be able to draw GL_LINES
+                            FloatPoint prev = seg->getInteriorVertex(i - 1);
+                            cache.addInteriorEdgeVertex(prev.x(), prev.y());
+                            cache.addInteriorEdgeVertex(vert.x(), vert.y());
+                        }
+#endif // LOOP_BLINN_PATH_CACHE_DEBUG_INTERIOR_EDGES
+                    }
+                }
+            }
+        }
+    }
+
+    // Run the interior paths through a tessellation algorithm
+    // supporting multiple contours.
+    tessellateInterior(cache);
+}
+
+void LoopBlinnPathProcessor::buildContours(const Path& path)
+{
+    // Clear out the contours
+    m_contours.clear();
+#if PLATFORM(SKIA)
+    SkPath::Iter iter(*path.platformPath(), false);
+    SkPoint points[4];
+    SkPath::Verb verb;
+    Contour* contour = 0;
+    SkPoint curPoint = { 0 };
+    SkPoint moveToPoint = { 0 };
+    do {
+        verb = iter.next(points);
+        if (verb != SkPath::kMove_Verb) {
+            if (!contour) {
+                contour = m_arena->allocateObject<Contour>();
+                m_contours.append(contour);
+            }
+        }
+        switch (verb) {
+        case SkPath::kMove_Verb: {
+            contour = m_arena->allocateObject<Contour>();
+            m_contours.append(contour);
+            curPoint = points[0];
+            moveToPoint = points[0];
+#ifndef NDEBUG
+            if (m_verboseLogging)
+                LOG_ERROR("MoveTo (%f, %f)", points[0].fX, points[0].fY);
+#endif
+            break;
+        }
+        case SkPath::kLine_Verb: {
+            Segment* segment = m_arena->allocateObject<Segment>();
+            if (iter.isCloseLine()) {
+                segment->setup(m_arena.get(), contour, curPoint, points[1]);
+#ifndef NDEBUG
+                if (m_verboseLogging)
+                    LOG_ERROR("CloseLineTo (%f, %f), (%f, %f)", curPoint.fX, curPoint.fY, points[1].fX, points[1].fY);
+#endif
+                contour->add(segment);
+                contour = 0;
+            } else {
+                segment->setup(m_arena.get(), contour, points[0], points[1]);
+#ifndef NDEBUG
+                if (m_verboseLogging)
+                    LOG_ERROR("LineTo (%f, %f), (%f, %f)", points[0].fX, points[0].fY, points[1].fX, points[1].fY);
+#endif
+                contour->add(segment);
+                curPoint = points[1];
+            }
+            break;
+        }
+        case SkPath::kQuad_Verb: {
+            // Need to degree elevate the quadratic into a cubic
+            SkPoint cubic[4];
+            SkConvertQuadToCubic(points, cubic);
+            Segment* segment = m_arena->allocateObject<Segment>();
+            segment->setup(m_arena.get(), contour,
+                           cubic[0], cubic[1], cubic[2], cubic[3]);
+#ifndef NDEBUG
+            if (m_verboseLogging)
+                LOG_ERROR("Quad->CubicTo (%f, %f), (%f, %f), (%f, %f), (%f, %f)", cubic[0].fX, cubic[0].fY, cubic[1].fX, cubic[1].fY, cubic[2].fX, cubic[2].fY, cubic[3].fX, cubic[3].fY);
+#endif
+            contour->add(segment);
+            curPoint = cubic[3];
+            break;
+        }
+        case SkPath::kCubic_Verb: {
+            Segment* segment = m_arena->allocateObject<Segment>();
+            segment->setup(m_arena.get(), contour, points[0], points[1], points[2], points[3]);
+#ifndef NDEBUG
+            if (m_verboseLogging)
+                LOG_ERROR("CubicTo (%f, %f), (%f, %f), (%f, %f), (%f, %f)", points[0].fX, points[0].fY, points[1].fX, points[1].fY, points[2].fX, points[2].fY, points[3].fX, points[3].fY);
+#endif
+            contour->add(segment);
+            curPoint = points[3];
+            break;
+        }
+        case SkPath::kClose_Verb: {
+            Segment* segment = m_arena->allocateObject<Segment>();
+            segment->setup(m_arena.get(), contour, curPoint, moveToPoint);
+#ifndef NDEBUG
+            if (m_verboseLogging)
+                LOG_ERROR("Close (%f, %f) -> (%f, %f)", curPoint.fX, curPoint.fY, moveToPoint.fX, moveToPoint.fY);
+#endif
+            contour->add(segment);
+            contour = 0;
+        }
+        case SkPath::kDone_Verb:
+            break;
+        }
+    } while (verb != SkPath::kDone_Verb);
+#else // !PLATFORM(SKIA)
+    // Must port to your platform.
+    ASSERT_NOT_REACHED();
+#endif
+}
+
+#ifndef NDEBUG
+Vector<Segment*> LoopBlinnPathProcessor::allSegmentsOverlappingY(Contour* queryContour, float x, float y)
+{
+    Vector<Segment*> res;
+    for (Vector<Contour*>::iterator iter = m_contours.begin(); iter != m_contours.end(); ++iter) {
+        Contour* cur = *iter;
+        for (Segment* seg = cur->begin(); seg != cur->end(); seg = seg->next()) {
+            const FloatRect& boundingBox = seg->boundingBox();
+            if (boundingBox.y() <= y && y <= boundingBox.maxY())
+                res.append(seg);
+        }
+    }
+    return res;
+}
+#endif
+
+// Uncomment this to debug the orientation computation.
+// #define GPU_PATH_PROCESSOR_DEBUG_ORIENTATION
+
+void LoopBlinnPathProcessor::determineSidesToFill()
+{
+    // Loop and Blinn's algorithm can only easily emulate the even/odd
+    // fill rule, and only for non-intersecting curves. We can determine
+    // which side of each curve segment to fill based on its
+    // clockwise/counterclockwise orientation and how many other
+    // contours surround it.
+
+    // To optimize the query of all curve segments intersecting a
+    // horizontal line going to x=+infinity, we build up an interval
+    // tree whose keys are the y extents of the segments.
+    PODIntervalTree<float, Segment*> tree(m_arena);
+    typedef PODIntervalTree<float, Segment*>::IntervalType IntervalType;
+
+    for (Vector<Contour*>::iterator iter = m_contours.begin(); iter != m_contours.end(); ++iter) {
+        Contour* cur = *iter;
+        determineOrientation(cur);
+        for (Segment* seg = cur->begin(); seg != cur->end(); seg = seg->next()) {
+            const FloatRect& boundingBox = seg->boundingBox();
+            tree.add(tree.createInterval(boundingBox.y(), boundingBox.maxY(), seg));
+        }
+    }
+
+    // Now iterate through the contours and pick a random segment (in
+    // this case we use the first) and a random point on that segment.
+    // Find all segments from other contours which intersect this one
+    // and count the number of crossings a horizontal line to
+    // x=+infinity makes with those contours. This combined with the
+    // orientation of the curve tells us which side to fill -- again,
+    // assuming an even/odd fill rule, which is all we can easily
+    // handle.
+    for (Vector<Contour*>::iterator iter = m_contours.begin(); iter != m_contours.end(); ++iter) {
+        Contour* cur = *iter;
+
+        bool ambiguous = true;
+        int numCrossings = 0;
+
+        // For each contour, attempt to find a point on the contour which,
+        // when we cast an XRay, does not intersect the other contours at
+        // an ambiguous point (the junction between two curves or at a
+        // tangent point). Ambiguous points make the determination of
+        // whether this contour is contained within another fragile. Note
+        // that this loop is only an approximation to the selection of a
+        // good casting point. We could as well evaluate a segment to
+        // determine a point upon it.
+        for (Segment* seg = cur->begin();
+             ambiguous && seg != cur->end();
+             seg = seg->next()) {
+            numCrossings = 0;
+            // We use a zero-sized vertical interval for the query.
+            Vector<IntervalType> overlaps = tree.allOverlaps(tree.createInterval(seg->getPoint(0).y(),
+                                                                                 seg->getPoint(0).y(),
+                                                                                 0));
+#if defined(GPU_PATH_PROCESSOR_DEBUG_ORIENTATION) && !defined(NDEBUG)
+            Vector<Segment*> slowOverlaps = allSegmentsOverlappingY(cur, seg->getPoint(0).x(), seg->getPoint(0).y());
+            if (overlaps.size() != slowOverlaps.size()) {
+                LOG_ERROR("For query point (%f, %f) on contour 0x%p:", seg->getPoint(0).x(), seg->getPoint(0).y(), cur);
+                LOG_ERROR(" overlaps:");
+                for (size_t i = 0; i < overlaps.size(); i++)
+                    LOG_ERROR("  %d: %s", i+1, overlaps[i].data()->toString().ascii().data());
+                LOG_ERROR(" slowOverlaps:");
+                for (size_t i = 0; i < slowOverlaps.size(); i++)
+                    LOG_ERROR("  %d: %s", (i+1) slowOverlaps[i]->toString());
+                LOG_ERROR("Interval tree:");
+                tree.dump();
+            }
+            ASSERT(overlaps.size() == slowOverlaps.size());
+#endif // defined(GPU_PATH_PROCESSOR_DEBUG_ORIENTATION) && !defined(NDEBUG)
+            for (Vector<IntervalType>::iterator iter = overlaps.begin(); iter != overlaps.end(); ++iter) {
+                const IntervalType& interval = *iter;
+                Segment* querySegment = interval.data();
+                // Ignore segments coming from the same contour.
+                if (querySegment->contour() != cur) {
+                    // Only perform queries that can affect the computation.
+                    const FloatRect& boundingBox = querySegment->contour()->boundingBox();
+                    if (seg->getPoint(0).x() >= boundingBox.x()
+                        && seg->getPoint(0).x() <= boundingBox.maxX()) {
+                        numCrossings += querySegment->numCrossingsForXRay(seg->getPoint(0),
+                                                                          ambiguous);
+                        if (ambiguous) {
+#ifndef NDEBUG
+                            if (m_verboseLogging) {
+                                LOG_ERROR("Ambiguous intersection query at point (%f, %f)", seg->getPoint(0).x(), seg->getPoint(0).y());
+                                LOG_ERROR("Query segment: %s", querySegment->toString().ascii().data());
+                            }
+#endif
+                            break; // Abort iteration over overlaps.
+                        }
+                    }
+                }
+            }
+        } // for (Segment* seg = cur->begin(); ...
+
+        cur->setFillSide((cur->isOrientedCounterClockwise() ^ (numCrossings & 1)) ? LoopBlinnConstants::LeftSide : LoopBlinnConstants::RightSide);
+    }
+}
+
+void LoopBlinnPathProcessor::determineOrientation(Contour* contour)
+{
+    // Determine signed area of the polygon represented by the points
+    // along the segments. Consider this an approximation to the true
+    // orientation of the polygon; it probably won't handle
+    // self-intersecting curves correctly.
+    //
+    // There is also a pretty basic assumption here that the contour is
+    // closed.
+    float signedArea = 0;
+    for (Segment* seg = contour->begin();
+         seg != contour->end();
+         seg = seg->next()) {
+        int limit = (seg->kind() == Segment::Cubic) ? 4 : 2;
+        for (int i = 1; i < limit; i++) {
+            const FloatPoint& prevPoint = seg->getPoint(i - 1);
+            const FloatPoint& point = seg->getPoint(i);
+            float curArea = prevPoint.x() * point.y() - prevPoint.y() * point.x();
+#ifndef NDEBUG
+            if (m_verboseLogging)
+                LOG_ERROR("Adding to signed area (%f, %f) -> (%f, %f) = %f", prevPoint.x(), prevPoint.y(), point.x(), point.y(), curArea);
+#endif
+            signedArea += curArea;
+        }
+    }
+
+    if (signedArea > 0)
+        contour->setIsOrientedCounterClockwise(true);
+    else
+        contour->setIsOrientedCounterClockwise(false);
+}
+
+namespace {
+
+//----------------------------------------------------------------------
+// Classes and typedefs needed for curve subdivision. These can't be scoped
+// within the subdivideCurves() method itself, because templates then fail
+// to instantiate.
+
+// The user data which is placed in the PODIntervalTree.
+struct SweepData {
+    SweepData()
+        : triangle(0)
+        , segment(0)
+    {
+    }
+
+    // The triangle this interval is associated with
+    LoopBlinnLocalTriangulator::Triangle* triangle;
+    // The segment the triangle is associated with
+    Segment* segment;
+};
+
+typedef PODIntervalTree<float, SweepData*> SweepTree;
+typedef SweepTree::IntervalType SweepInterval;
+
+// The entry / exit events which occur at the minimum and maximum x
+// coordinates of the control point triangles' bounding boxes.
+//
+// Note that this class requires its copy constructor and assignment
+// operator since it needs to be stored in a Vector.
+class SweepEvent {
+public:
+    SweepEvent()
+        : m_x(0)
+        , m_entry(false)
+        , m_interval(0, 0, 0)
+    {
+    }
+
+    // Initializes the SweepEvent.
+    void setup(float x, bool entry, SweepInterval interval)
+    {
+        m_x = x;
+        m_entry = entry;
+        m_interval = interval;
+    }
+
+    float x() const { return m_x; }
+    bool entry() const { return m_entry; }
+    const SweepInterval& interval() const { return m_interval; }
+
+    bool operator<(const SweepEvent& other) const
+    {
+        return m_x < other.m_x;
+    }
+
+private:
+    float m_x;
+    bool m_entry;
+    SweepInterval m_interval;
+};
+
+bool trianglesOverlap(LoopBlinnLocalTriangulator::Triangle* t0,
+                      LoopBlinnLocalTriangulator::Triangle* t1)
+{
+    return trianglesOverlap(t0->getVertex(0)->xyCoordinates(),
+                            t0->getVertex(1)->xyCoordinates(),
+                            t0->getVertex(2)->xyCoordinates(),
+                            t1->getVertex(0)->xyCoordinates(),
+                            t1->getVertex(1)->xyCoordinates(),
+                            t1->getVertex(2)->xyCoordinates());
+}
+
+} // anonymous namespace
+
+void LoopBlinnPathProcessor::subdivideCurves()
+{
+    // We need to determine all overlaps of all control point triangles
+    // (from different segments, not the same segment) and, if any
+    // exist, subdivide the associated curves.
+    //
+    // The plane-sweep algorithm determines all overlaps of a set of
+    // rectangles in the 2D plane. Our problem maps very well to this
+    // algorithm and significantly reduces the complexity compared to a
+    // naive implementation.
+    //
+    // Each bounding box of a control point triangle is converted into
+    // an "entry" event at its smallest X coordinate and an "exit" event
+    // at its largest X coordinate. Each event has an associated
+    // one-dimensional interval representing the Y span of the bounding
+    // box. We sort these events by increasing X coordinate. We then
+    // iterate through them. For each entry event we add the interval to
+    // a side interval tree, and query this tree for overlapping
+    // intervals. Any overlapping interval corresponds to an overlapping
+    // bounding box. For each exit event we remove the associated
+    // interval from the interval tree.
+
+    Vector<Segment*> curSegments;
+    Vector<Segment*> nextSegments;
+
+    // Start things off by considering all of the segments
+    for (Vector<Contour*>::iterator iter = m_contours.begin(); iter != m_contours.end(); ++iter) {
+        Contour* cur = *iter;
+        for (Segment* seg = cur->begin(); seg != cur->end(); seg = seg->next()) {
+            if (seg->kind() == Segment::Cubic) {
+                seg->triangulate(LoopBlinnLocalTriangulator::DontComputeInsideEdges, 0);
+                curSegments.append(seg);
+            }
+        }
+    }
+
+    // Subdivide curves at most this many times
+    const int MaxIterations = 5;
+    Vector<SweepInterval> overlaps;
+
+    for (int currentIteration = 0; currentIteration < MaxIterations; ++currentIteration) {
+        if (!curSegments.size())
+            // Done
+            break;
+
+        Vector<SweepEvent> events;
+        SweepTree tree(m_arena);
+        for (Vector<Segment*>::iterator iter = curSegments.begin(); iter != curSegments.end(); ++iter) {
+            Segment* seg = *iter;
+            ASSERT(seg->kind() == Segment::Cubic);
+            for (int i = 0; i < seg->numberOfTriangles(); i++) {
+                LoopBlinnLocalTriangulator::Triangle* triangle = seg->getTriangle(i);
+                FloatRect boundingBox;
+                boundingBox.fitToPoints(triangle->getVertex(0)->xyCoordinates(),
+                                        triangle->getVertex(1)->xyCoordinates(),
+                                        triangle->getVertex(2)->xyCoordinates());
+                // Ignore zero-width triangles to avoid issues with
+                // coincident entry and exit events for the same triangle
+                if (boundingBox.maxX() > boundingBox.x()) {
+                    SweepData* data = m_arena->allocateObject<SweepData>();
+                    data->triangle = triangle;
+                    data->segment = seg;
+                    SweepInterval interval = tree.createInterval(boundingBox.y(), boundingBox.maxY(), data);
+                    // Add entry and exit events
+                    SweepEvent event;
+                    event.setup(boundingBox.x(), true, interval);
+                    events.append(event);
+                    event.setup(boundingBox.maxX(), false, interval);
+                    events.append(event);
+                }
+            }
+        }
+
+        // Sort events by increasing X coordinate
+        std::sort(events.begin(), events.end());
+#ifndef NDEBUG
+        for (size_t ii = 1; ii < events.size(); ++ii)
+            ASSERT(events[ii - 1].x() <= events[ii].x());
+#endif
+
+        // Now iterate through the events
+        for (Vector<SweepEvent>::iterator iter = events.begin(); iter != events.end(); ++iter) {
+            SweepEvent event = *iter;
+            if (event.entry()) {
+                // See whether the associated segment has been subdivided yet
+                if (!event.interval().data()->segment->markedForSubdivision()) {
+                    // Query the tree
+                    overlaps.clear();
+                    tree.allOverlaps(event.interval(), overlaps);
+                    // Now see exactly which triangles overlap this one
+                    for (Vector<SweepInterval>::iterator iter = overlaps.begin(); iter != overlaps.end(); ++iter) {
+                        SweepInterval overlap = *iter;
+                        // Only pay attention to overlaps from a different Segment
+                        if (event.interval().data()->segment != overlap.data()->segment) {
+                            // See whether the triangles actually overlap
+                            if (trianglesOverlap(event.interval().data()->triangle,
+                                                 overlap.data()->triangle)) {
+                                // Actually subdivide the segments.
+                                // Each one might already have been subdivided.
+                                Segment* seg = event.interval().data()->segment;
+                                conditionallySubdivide(seg, nextSegments);
+                                seg = overlap.data()->segment;
+                                conditionallySubdivide(seg, nextSegments);
+                            }
+                        }
+                    }
+                }
+                // Add this interval into the tree
+                tree.add(event.interval());
+            } else {
+                // Remove this interval from the tree
+                tree.remove(event.interval());
+            }
+        }
+
+        curSegments.swap(nextSegments);
+        nextSegments.clear();
+    }
+}
+
+void LoopBlinnPathProcessor::conditionallySubdivide(Segment* seg, Vector<Segment*>& nextSegments)
+{
+    if (!seg->markedForSubdivision()) {
+        seg->setMarkedForSubdivision(true);
+        Segment* next = seg->contour()->subdivide(seg);
+        // Triangulate the newly subdivided segments.
+        next->triangulate(LoopBlinnLocalTriangulator::DontComputeInsideEdges, 0);
+        next->next()->triangulate(LoopBlinnLocalTriangulator::DontComputeInsideEdges, 0);
+        // Add them for the next iteration.
+        nextSegments.append(next);
+        nextSegments.append(next->next());
+    }
+}
+
+#ifndef NDEBUG
+void LoopBlinnPathProcessor::subdivideCurvesSlow()
+{
+    // Alternate, significantly slower algorithm for curve subdivision
+    // for use in debugging.
+    Vector<Segment*> curSegments;
+    Vector<Segment*> nextSegments;
+
+    // Start things off by considering all of the segments
+    for (Vector<Contour*>::iterator iter = m_contours.begin(); iter != m_contours.end(); ++iter) {
+        Contour* cur = *iter;
+        for (Segment* seg = cur->begin(); seg != cur->end(); seg = seg->next()) {
+            if (seg->kind() == Segment::Cubic) {
+                seg->triangulate(LoopBlinnLocalTriangulator::DontComputeInsideEdges, 0);
+                curSegments.append(seg);
+            }
+        }
+    }
+
+    // Subdivide curves at most this many times
+    const int MaxIterations = 5;
+
+    for (int currentIteration = 0; currentIteration < MaxIterations; ++currentIteration) {
+        if (!curSegments.size())
+            // Done
+            break;
+
+        for (Vector<Segment*>::iterator iter = curSegments.begin(); iter != curSegments.end(); ++iter) {
+            Segment* seg = *iter;
+            ASSERT(seg->kind() == Segment::Cubic);
+            for (Vector<Segment*>::iterator iter2 = curSegments.begin();
+                 iter2 != curSegments.end();
+                 iter2++) {
+                Segment* seg2 = *iter2;
+                ASSERT(seg2->kind() == Segment::Cubic);
+                if (seg != seg2) {
+                    for (int i = 0; i < seg->numberOfTriangles(); i++) {
+                        LoopBlinnLocalTriangulator::Triangle* triangle = seg->getTriangle(i);
+                        for (int j = 0; j < seg2->numberOfTriangles(); j++) {
+                            LoopBlinnLocalTriangulator::Triangle* triangle2 = seg2->getTriangle(j);
+                            if (trianglesOverlap(triangle, triangle2)) {
+                                conditionallySubdivide(seg, nextSegments);
+                                conditionallySubdivide(seg2, nextSegments);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        curSegments.swap(nextSegments);
+        nextSegments.clear();
+    }
+}
+#endif
+
+namespace {
+
+//----------------------------------------------------------------------
+// Structures and callbacks for tessellation of the interior region of
+// the contours.
+
+// The user data for the GLU tessellator.
+struct TessellationState {
+    TessellationState(LoopBlinnPathCache& inputCache)
+        : cache(inputCache) { }
+
+    LoopBlinnPathCache& cache;
+    Vector<void*> allocatedPointers;
+};
+
+static void vertexCallback(void* vertexData, void* data)
+{
+    TessellationState* state = static_cast<TessellationState*>(data);
+    GLdouble* location = static_cast<GLdouble*>(vertexData);
+    state->cache.addInteriorVertex(static_cast<float>(location[0]),
+                                   static_cast<float>(location[1]));
+}
+
+static void combineCallback(GLdouble coords[3], void* vertexData[4],
+                            GLfloat weight[4], void** outData,
+                            void* polygonData)
+{
+    TessellationState* state = static_cast<TessellationState*>(polygonData);
+    GLdouble* outVertex = static_cast<GLdouble*>(fastMalloc(3 * sizeof(GLdouble)));
+    state->allocatedPointers.append(outVertex);
+    outVertex[0] = coords[0];
+    outVertex[1] = coords[1];
+    outVertex[2] = coords[2];
+    *outData = outVertex;
+}
+
+static void edgeFlagCallback(GLboolean)
+{
+    // No-op just to prevent triangle strips and fans from being passed to us.
+    // See the OpenGL Programming Guide, Chapter 11, "Tessellators and Quadrics".
+}
+
+} // anonymous namespace
+
+void LoopBlinnPathProcessor::tessellateInterior(LoopBlinnPathCache& cache)
+{
+    // Because the GLU tessellator requires its input in
+    // double-precision format, we need to make a separate copy of the
+    // data.
+    Vector<GLdouble> vertexData;
+    Vector<size_t> contourEndings;
+    // For avoiding adding coincident vertices.
+    float curX = 0, curY = 0;
+    for (Vector<Contour*>::iterator iter = m_contours.begin(); iter != m_contours.end(); ++iter) {
+        Contour* cur = *iter;
+        bool first = true;
+        for (Segment* seg = cur->begin(); seg != cur->end(); seg = seg->next()) {
+            int numberOfInteriorVertices = seg->numberOfInteriorVertices();
+            for (int i = 0; i < numberOfInteriorVertices - 1; i++) {
+                FloatPoint point = seg->getInteriorVertex(i);
+                if (first) {
+                    first = false;
+                    vertexData.append(point.x());
+                    vertexData.append(point.y());
+                    vertexData.append(0);
+                    curX = point.x();
+                    curY = point.y();
+                } else if (point.x() != curX || point.y() != curY)  {
+                    vertexData.append(point.x());
+                    vertexData.append(point.y());
+                    vertexData.append(0);
+                    curX = point.x();
+                    curY = point.y();
+                }
+            }
+        }
+        contourEndings.append(vertexData.size());
+    }
+    // Now that we have all of the vertex data in a stable location in
+    // memory, call the tessellator.
+    GLUtesselator* tess = internal_gluNewTess();
+    TessellationState state(cache);
+    internal_gluTessCallback(tess, GLU_TESS_VERTEX_DATA,
+                             reinterpret_cast<GLvoid (*)()>(vertexCallback));
+    internal_gluTessCallback(tess, GLU_TESS_COMBINE_DATA,
+                             reinterpret_cast<GLvoid (*)()>(combineCallback));
+    internal_gluTessCallback(tess, GLU_TESS_EDGE_FLAG,
+                             reinterpret_cast<GLvoid (*)()>(edgeFlagCallback));
+    internal_gluTessBeginPolygon(tess, &state);
+    internal_gluTessBeginContour(tess);
+    GLdouble* base = vertexData.data();
+    int contourIndex = 0;
+    for (size_t i = 0; i < vertexData.size(); i += 3) {
+        if (i == contourEndings[contourIndex]) {
+            internal_gluTessEndContour(tess);
+            internal_gluTessBeginContour(tess);
+            ++contourIndex;
+        }
+        internal_gluTessVertex(tess, &base[i], &base[i]);
+    }
+    internal_gluTessEndContour(tess);
+    internal_gluTessEndPolygon(tess);
+    for (size_t i = 0; i < state.allocatedPointers.size(); i++)
+        fastFree(state.allocatedPointers[i]);
+    internal_gluDeleteTess(tess);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/gpu/LoopBlinnPathProcessor.h b/Source/WebCore/platform/graphics/gpu/LoopBlinnPathProcessor.h
new file mode 100644
index 0000000..ad89bc1
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gpu/LoopBlinnPathProcessor.h
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// The main entry point for Loop and Blinn's GPU accelerated curve
+// rendering algorithm.
+
+#ifndef LoopBlinnPathProcessor_h
+#define LoopBlinnPathProcessor_h
+
+#include <wtf/Noncopyable.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+// We use a namespace for classes which are simply implementation
+// details of the algorithm but which we need to reference from the
+// class definition.
+namespace LoopBlinnPathProcessorImplementation {
+
+class Contour;
+class Segment;
+
+} // namespace LoopBlinnPathProcessorImplementation
+
+class Path;
+class LoopBlinnPathCache;
+class PODArena;
+
+// The LoopBlinnPathProcessor turns a Path (assumed to contain one or
+// more closed regions) into a set of exterior and interior triangles,
+// stored in the LoopBlinnPathCache. The exterior triangles have
+// associated 3D texture coordinates which are used to evaluate the
+// curve's inside/outside function on a per-pixel basis. The interior
+// triangles are filled with 100% opacity.
+//
+// Note that the fill style and management of multiple layers are
+// separate concerns, handled at a higher level with shaders and
+// polygon offsets.
+class LoopBlinnPathProcessor {
+public:
+    LoopBlinnPathProcessor();
+    explicit LoopBlinnPathProcessor(PassRefPtr<PODArena>);
+    ~LoopBlinnPathProcessor();
+
+    // Transforms the given path into a triangle mesh for rendering
+    // using Loop and Blinn's shader, placing the result into the given
+    // LoopBlinnPathCache.
+    void process(const Path&, LoopBlinnPathCache&);
+
+#ifndef NDEBUG
+    // Enables or disables verbose logging in debug mode.
+    void setVerboseLogging(bool onOrOff);
+#endif
+
+private:
+    // Builds a list of contours for the given path.
+    void buildContours(const Path&);
+
+    // Determines whether the left or right side of each contour should
+    // be filled.
+    void determineSidesToFill();
+
+    // Determines whether the given (closed) contour is oriented
+    // clockwise or counterclockwise.
+    void determineOrientation(LoopBlinnPathProcessorImplementation::Contour*);
+
+    // Subdivides the curves so that there are no overlaps of the
+    // triangles associated with the curves' control points.
+    void subdivideCurves();
+
+    // Helper function used during curve subdivision.
+    void conditionallySubdivide(LoopBlinnPathProcessorImplementation::Segment*,
+                                Vector<LoopBlinnPathProcessorImplementation::Segment*>& nextSegments);
+
+    // Tessellates the interior regions of the contours.
+    void tessellateInterior(LoopBlinnPathCache&);
+
+#ifndef NDEBUG
+    // For debugging the orientation computation. Returns all of the
+    // segments overlapping the given Y coordinate.
+    Vector<LoopBlinnPathProcessorImplementation::Segment*> allSegmentsOverlappingY(LoopBlinnPathProcessorImplementation::Contour*, float x, float y);
+
+    // For debugging the curve subdivision algorithm. Subdivides the
+    // curves using an alternate, slow (O(n^3)) algorithm.
+    void subdivideCurvesSlow();
+#endif
+
+    // PODArena from which to allocate temporary objects.
+    RefPtr<PODArena> m_arena;
+
+    // The contours described by the path.
+    Vector<LoopBlinnPathProcessorImplementation::Contour*> m_contours;
+
+#ifndef NDEBUG
+    // Whether or not to perform verbose logging in debug mode.
+    bool m_verboseLogging;
+#endif
+};
+
+} // namespace WebCore
+
+#endif // LoopBlinnPathProcessor_h
diff --git a/Source/WebCore/platform/graphics/gpu/LoopBlinnShader.cpp b/Source/WebCore/platform/graphics/gpu/LoopBlinnShader.cpp
new file mode 100644
index 0000000..364e6c8
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gpu/LoopBlinnShader.cpp
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "LoopBlinnShader.h"
+
+#include "GraphicsContext3D.h"
+
+namespace WebCore {
+
+LoopBlinnShader::LoopBlinnShader(GraphicsContext3D* context, unsigned program)
+    : Shader(context, program)
+{
+    m_worldViewProjectionLocation = context->getUniformLocation(program, "worldViewProjection");
+    m_positionLocation = context->getAttribLocation(program, "position");
+    m_klmLocation = context->getAttribLocation(program, "klm");
+}
+
+void LoopBlinnShader::use(unsigned vertexOffset, unsigned klmOffset, const AffineTransform& transform)
+{
+    m_context->useProgram(m_program);
+
+    float matrix[16];
+    affineTo4x4(transform, matrix);
+    m_context->uniformMatrix4fv(m_worldViewProjectionLocation, false /*transpose*/, matrix, 1 /*count*/);
+
+    m_context->vertexAttribPointer(m_positionLocation, 2, GraphicsContext3D::FLOAT, false, 0, vertexOffset);
+    m_context->enableVertexAttribArray(m_positionLocation);
+
+    if (m_klmLocation != -1) {
+        m_context->vertexAttribPointer(m_klmLocation, 3, GraphicsContext3D::FLOAT, false, 0, klmOffset);
+        m_context->enableVertexAttribArray(m_klmLocation);
+    }
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/storage/IDBTimeoutEvent.h b/Source/WebCore/platform/graphics/gpu/LoopBlinnShader.h
index afc9ba4..2d24dc3 100644
--- a/Source/WebCore/storage/IDBTimeoutEvent.h
+++ b/Source/WebCore/platform/graphics/gpu/LoopBlinnShader.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,9 +10,6 @@
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -26,32 +23,36 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef IDBTimeoutEvent_h
-#define IDBTimeoutEvent_h
+#ifndef LoopBlinnShader_h
+#define LoopBlinnShader_h
 
-#if ENABLE(INDEXED_DATABASE)
-
-#include "IDBEvent.h"
-#include "PlatformString.h"
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefPtr.h>
+#include "Shader.h"
 
 namespace WebCore {
 
-class IDBTimeoutEvent : public IDBEvent {
+class GraphicsContext3D;
+
+class LoopBlinnShader : public Shader {
 public:
-    static PassRefPtr<IDBTimeoutEvent> create();
-    // FIXME: Need to allow creation of these events from JS.
-    virtual ~IDBTimeoutEvent();
+    enum Region {
+        Interior,
+        Exterior
+    };
 
-    virtual bool isIDBTimeoutEvent() const { return true; }
+protected:
+    LoopBlinnShader(GraphicsContext3D*, unsigned program);
+
+    // This assumes the vertices and klm coordinates are stored in the
+    // same, currently bound, buffer object, contiguously and at the
+    // specified offsets.
+    void use(unsigned vertexOffset, unsigned klmOffset, const AffineTransform&);
 
 private:
-    IDBTimeoutEvent();
+    int m_worldViewProjectionLocation;
+    int m_positionLocation;
+    int m_klmLocation;
 };
 
 } // namespace WebCore
 
-#endif // ENABLE(INDEXED_DATABASE)
-
-#endif // IDBTimeoutEvent_h
+#endif // LoopBlinnShader_h
diff --git a/Source/WebCore/platform/graphics/gpu/LoopBlinnSolidFillShader.cpp b/Source/WebCore/platform/graphics/gpu/LoopBlinnSolidFillShader.cpp
new file mode 100644
index 0000000..43a97ef
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gpu/LoopBlinnSolidFillShader.cpp
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "LoopBlinnSolidFillShader.h"
+
+#include "GraphicsContext3D.h"
+
+namespace WebCore {
+
+PassOwnPtr<LoopBlinnSolidFillShader> LoopBlinnSolidFillShader::create(GraphicsContext3D* context,
+                                                                      LoopBlinnShader::Region region,
+                                                                      Shader::AntialiasType antialiasType)
+{
+    VertexType type = (region == Interior) ? LoopBlinnInterior : LoopBlinnExterior;
+    unsigned program = loadProgram(context,
+                                   generateVertex(type, SolidFill),
+                                   generateFragment(type, SolidFill, antialiasType));
+    if (!program)
+        return 0;
+    return new LoopBlinnSolidFillShader(context, program);
+}
+
+LoopBlinnSolidFillShader::LoopBlinnSolidFillShader(GraphicsContext3D* context, unsigned program)
+    : LoopBlinnShader(context, program)
+{
+    m_colorLocation = context->getUniformLocation(program, "color");
+}
+
+void LoopBlinnSolidFillShader::use(unsigned vertexOffset, unsigned klmOffset, const AffineTransform& transform, const Color& color)
+{
+    LoopBlinnShader::use(vertexOffset, klmOffset, transform);
+
+    float rgba[4];
+    color.getRGBA(rgba[0], rgba[1], rgba[2], rgba[3]);
+    m_context->uniform4f(m_colorLocation, rgba[0] * rgba[3], rgba[1] * rgba[3], rgba[2] * rgba[3], rgba[3]);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/gpu/LoopBlinnSolidFillShader.h b/Source/WebCore/platform/graphics/gpu/LoopBlinnSolidFillShader.h
new file mode 100644
index 0000000..36312a2
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gpu/LoopBlinnSolidFillShader.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LoopBlinnSolidFillShader_h
+#define LoopBlinnSolidFillShader_h
+
+#include "LoopBlinnShader.h"
+
+namespace WebCore {
+
+class GraphicsContext3D;
+
+class LoopBlinnSolidFillShader : public LoopBlinnShader {
+public:
+    static PassOwnPtr<LoopBlinnSolidFillShader> create(GraphicsContext3D*, Region, AntialiasType);
+
+    // This assumes the vertices and klm coordinates are stored in the
+    // same, currently bound, buffer object, contiguously and at the
+    // specified offsets.
+    void use(unsigned vertexOffset, unsigned klmOffset, const AffineTransform&, const Color&);
+
+private:
+    LoopBlinnSolidFillShader(GraphicsContext3D*, unsigned program);
+
+    int m_colorLocation;
+};
+
+} // namespace WebCore
+
+#endif // LoopBlinnSolidFillShader_h
diff --git a/Source/WebCore/platform/graphics/gpu/Shader.cpp b/Source/WebCore/platform/graphics/gpu/Shader.cpp
index 6978322..1b9bfd5 100644
--- a/Source/WebCore/platform/graphics/gpu/Shader.cpp
+++ b/Source/WebCore/platform/graphics/gpu/Shader.cpp
@@ -38,6 +38,7 @@
 #include "GraphicsContext3D.h"
 
 #include <wtf/text/CString.h>
+#include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
@@ -56,14 +57,34 @@ void Shader::affineTo3x3(const AffineTransform& transform, float mat[9])
 }
 
 // static
-unsigned Shader::loadShader(GraphicsContext3D* context, unsigned type, const char* shaderSource)
+void Shader::affineTo4x4(const AffineTransform& transform, float mat[16])
+{
+    mat[0] = transform.a();
+    mat[1] = transform.b();
+    mat[2] = 0.0f;
+    mat[3] = 0.0f;
+    mat[4] = transform.c();
+    mat[5] = transform.d();
+    mat[6] = 0.0f;
+    mat[7] = 0.0f;
+    mat[8] = 0.0f;
+    mat[9] = 0.0f;
+    mat[10] = 1.0f;
+    mat[11] = 0.0f;
+    mat[12] = transform.e();
+    mat[13] = transform.f();
+    mat[14] = 0.0f;
+    mat[15] = 1.0f;
+}
+
+// static
+unsigned Shader::loadShader(GraphicsContext3D* context, unsigned type, const String& shaderSource)
 {
     unsigned shader = context->createShader(type);
     if (!shader)
         return 0;
 
-    String shaderSourceStr(shaderSource);
-    context->shaderSource(shader, shaderSourceStr);
+    context->shaderSource(shader, shaderSource);
     context->compileShader(shader);
     int compileStatus = 0;
     context->getShaderiv(shader, GraphicsContext3D::COMPILE_STATUS, &compileStatus);
@@ -77,7 +98,7 @@ unsigned Shader::loadShader(GraphicsContext3D* context, unsigned type, const cha
 }
 
 // static
-unsigned Shader::loadProgram(GraphicsContext3D* context, const char* vertexShaderSource, const char* fragmentShaderSource)
+unsigned Shader::loadProgram(GraphicsContext3D* context, const String& vertexShaderSource, const String& fragmentShaderSource)
 {
     unsigned vertexShader = loadShader(context, GraphicsContext3D::VERTEX_SHADER, vertexShaderSource);
     if (!vertexShader)
@@ -111,6 +132,146 @@ Shader::~Shader()
     m_context->deleteProgram(m_program);
 }
 
+// static
+String Shader::generateVertex(Shader::VertexType vertexType, Shader::FillType fillType)
+{
+    StringBuilder builder;
+    switch (vertexType) {
+    case TwoDimensional:
+        builder.append(
+            "uniform mat3 matrix;\n"
+            "attribute vec3 position;\n");
+        break;
+    case LoopBlinnInterior:
+        builder.append(
+            "uniform mat4 worldViewProjection;\n"
+            "attribute vec2 position;\n");
+        break;
+    case LoopBlinnExterior:
+        builder.append(
+            "uniform mat4 worldViewProjection;\n"
+            "attribute vec2 position;\n"
+            "attribute vec3 klm;\n"
+            "varying vec3 v_klm;\n");
+        break;
+    }
+
+    if (fillType == TextureFill) {
+        builder.append(
+            "uniform mat3 texMatrix;\n"
+            "varying vec3 texCoord;\n");
+    }
+
+    builder.append(
+        "void main() {\n");
+
+    if (vertexType == TwoDimensional) {
+        builder.append(
+            "gl_Position = vec4(matrix * position, 1.0);\n");
+    } else {
+        builder.append(
+            "gl_Position = worldViewProjection * vec4(position, 0.0, 1.0);\n");
+        if (vertexType == LoopBlinnExterior) {
+            builder.append(
+                "v_klm = klm;\n");
+        }
+    }
+
+    if (fillType == TextureFill) {
+        builder.append(
+            "texCoord = texMatrix * position;\n");
+    }
+
+    builder.append(
+        "}\n");
+
+    return builder.toString();
 }
 
+// static
+String Shader::generateFragment(Shader::VertexType vertexType, Shader::FillType fillType, Shader::AntialiasType antialiasType)
+{
+    StringBuilder builder;
+    builder.append(
+        "#ifdef GL_ES\n"
+        "precision mediump float;\n"
+        "#endif\n");
+
+    if (vertexType == LoopBlinnExterior) {
+        if (antialiasType == Antialiased) {
+            builder.append(
+                "#extension GL_OES_standard_derivatives : enable\n");
+        }
+        builder.append(
+            "varying vec3 v_klm;\n");
+    }
+
+    switch (fillType) {
+    case SolidFill:
+        builder.append(
+            "uniform vec4 color;\n");
+        break;
+    case TextureFill:
+        builder.append(
+            "uniform sampler2D sampler;\n"
+            "uniform float globalAlpha;\n"
+            "varying vec3 texCoord;\n");
+        break;
+    }
+
+    builder.append(
+        "void main() {\n");
+
+    if (vertexType != LoopBlinnExterior) {
+        builder.append(
+            "float alpha = 1.0;\n");
+    } else {
+        if (antialiasType == Antialiased) {
+            builder.append(
+                "  // Gradients\n"
+                "  vec3 px = dFdx(v_klm);\n"
+                "  vec3 py = dFdy(v_klm);\n"
+                "\n"
+                "  // Chain rule\n"
+                "  float k2 = v_klm.x * v_klm.x;\n"
+                "  float c = k2 * v_klm.x - v_klm.y * v_klm.z;\n"
+                "  float k23 = 3.0 * k2;\n"
+                "  float cx = k23 * px.x - v_klm.z * px.y - v_klm.y * px.z;\n"
+                "  float cy = k23 * py.x - v_klm.z * py.y - v_klm.y * py.z;\n"
+                "\n"
+                "  // Signed distance\n"
+                "  float sd = c / sqrt(cx * cx + cy * cy);\n"
+                "\n"
+                "  // Linear alpha\n"
+                "  // FIXME: figure out why this needs to be\n"
+                "  // negated compared to the HLSL version, and also why\n"
+                "  // we need an adjustment by +1.0 for it to look good.\n"
+                "  // float alpha = clamp(0.5 - sd, 0.0, 1.0);\n"
+                "  float alpha = clamp(sd + 0.5, 0.0, 1.0);\n");
+        } else {
+            builder.append(
+                "  float t = v_klm.x * v_klm.x * v_klm.x - v_klm.y * v_klm.z;\n"
+                "  float alpha = clamp(sign(t), 0.0, 1.0);\n");
+        }
+    }
+
+    switch (fillType) {
+    case SolidFill:
+        builder.append(
+            "gl_FragColor = color * alpha;\n");
+        break;
+    case TextureFill:
+        builder.append(
+            "gl_FragColor = texture2D(sampler, texCoord.xy) * alpha * globalAlpha;\n");
+        break;
+    }
+
+    builder.append(
+        "}\n");
+
+    return builder.toString();
+}
+
+} // namespace WebCore
+
 #endif
diff --git a/Source/WebCore/platform/graphics/gpu/Shader.h b/Source/WebCore/platform/graphics/gpu/Shader.h
index 4f62ca9..35d1a3b 100644
--- a/Source/WebCore/platform/graphics/gpu/Shader.h
+++ b/Source/WebCore/platform/graphics/gpu/Shader.h
@@ -33,6 +33,7 @@
 
 #include <wtf/Noncopyable.h>
 #include <wtf/PassOwnPtr.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
@@ -42,13 +43,35 @@ class Color;
 
 class Shader {
     WTF_MAKE_NONCOPYABLE(Shader);
+public:
+    enum VertexType {
+        TwoDimensional,
+        LoopBlinnInterior,
+        LoopBlinnExterior
+    };
+
+    enum FillType {
+        SolidFill,
+        TextureFill
+    };
+
+    // Currently only applies to the Loop-Blinn vertex type.
+    enum AntialiasType {
+        NotAntialiased,
+        Antialiased
+    };
+
 protected:
     Shader(GraphicsContext3D*, unsigned program);
     ~Shader();
 
+    static String generateVertex(VertexType, FillType);
+    static String generateFragment(VertexType, FillType, AntialiasType);
+
     static void affineTo3x3(const AffineTransform&, float mat[9]);
-    static unsigned loadShader(GraphicsContext3D*, unsigned type, const char* shaderSource);
-    static unsigned loadProgram(GraphicsContext3D*, const char* vertexShaderSource, const char* fragmentShaderSource);
+    static void affineTo4x4(const AffineTransform&, float mat[16]);
+    static unsigned loadShader(GraphicsContext3D*, unsigned type, const String& shaderSource);
+    static unsigned loadProgram(GraphicsContext3D*, const String& vertexShaderSource, const String& fragmentShaderSource);
 
     GraphicsContext3D* m_context;
     unsigned m_program;
diff --git a/Source/WebCore/platform/graphics/gpu/SolidFillShader.cpp b/Source/WebCore/platform/graphics/gpu/SolidFillShader.cpp
index 86079be..78381f0 100644
--- a/Source/WebCore/platform/graphics/gpu/SolidFillShader.cpp
+++ b/Source/WebCore/platform/graphics/gpu/SolidFillShader.cpp
@@ -49,23 +49,9 @@ SolidFillShader::SolidFillShader(GraphicsContext3D* context, unsigned program)
 
 PassOwnPtr<SolidFillShader> SolidFillShader::create(GraphicsContext3D* context)
 {
-    static const char* vertexShaderSource =
-            "uniform mat3 matrix;\n"
-            "uniform vec4 color;\n"
-            "attribute vec3 position;\n"
-            "void main() {\n"
-            "    gl_Position = vec4(matrix * position, 1.0);\n"
-            "}\n";
-    static const char* fragmentShaderSource =
-            "#ifdef GL_ES\n"
-            "precision mediump float;\n"
-            "#endif\n"
-            "uniform mat3 matrix;\n"
-            "uniform vec4 color;\n"
-            "void main() {\n"
-            "    gl_FragColor = color;\n"
-            "}\n";
-    unsigned program = loadProgram(context, vertexShaderSource, fragmentShaderSource);
+    unsigned program = loadProgram(context,
+                                   generateVertex(Shader::TwoDimensional, Shader::SolidFill),
+                                   generateFragment(Shader::TwoDimensional, Shader::SolidFill, Shader::NotAntialiased));
     if (!program)
         return 0;
     return new SolidFillShader(context, program);
diff --git a/Source/WebCore/platform/graphics/gpu/TexShader.cpp b/Source/WebCore/platform/graphics/gpu/TexShader.cpp
index d7ffa17..9eb5c16 100644
--- a/Source/WebCore/platform/graphics/gpu/TexShader.cpp
+++ b/Source/WebCore/platform/graphics/gpu/TexShader.cpp
@@ -43,33 +43,16 @@ TexShader::TexShader(GraphicsContext3D* context, unsigned program)
 {
     m_matrixLocation = context->getUniformLocation(program, "matrix");
     m_texMatrixLocation = context->getUniformLocation(program, "texMatrix");
-    m_alphaLocation = context->getUniformLocation(program, "alpha");
+    m_alphaLocation = context->getUniformLocation(program, "globalAlpha");
     m_positionLocation = context->getAttribLocation(program, "position");
     m_samplerLocation = context->getUniformLocation(program, "sampler");
 }
 
 PassOwnPtr<TexShader> TexShader::create(GraphicsContext3D* context)
 {
-    static const char* vertexShaderSource =
-        "uniform mat3 matrix;\n"
-        "uniform mat3 texMatrix;\n"
-        "attribute vec3 position;\n"
-        "varying vec3 texCoord;\n"
-        "void main() {\n"
-        "    texCoord = texMatrix * position;\n"
-        "    gl_Position = vec4(matrix * position, 1.0);\n"
-        "}\n";
-    static const char* fragmentShaderSource =
-        "#ifdef GL_ES\n"
-        "precision mediump float;\n"
-        "#endif\n"
-        "uniform sampler2D sampler;\n"
-        "uniform float alpha;\n"
-        "varying vec3 texCoord;\n"
-        "void main() {\n"
-        "    gl_FragColor = texture2D(sampler, texCoord.xy)* vec4(alpha);\n"
-        "}\n";
-    unsigned program = loadProgram(context, vertexShaderSource, fragmentShaderSource);
+    unsigned program = loadProgram(context,
+                                   generateVertex(Shader::TwoDimensional, Shader::TextureFill),
+                                   generateFragment(Shader::TwoDimensional, Shader::TextureFill, Shader::NotAntialiased));
     if (!program)
         return 0;
     return new TexShader(context, program);
diff --git a/Source/WebCore/platform/graphics/gpu/Texture.cpp b/Source/WebCore/platform/graphics/gpu/Texture.cpp
index e1f8114..b1ba827 100644
--- a/Source/WebCore/platform/graphics/gpu/Texture.cpp
+++ b/Source/WebCore/platform/graphics/gpu/Texture.cpp
@@ -166,7 +166,7 @@ void Texture::updateSubRect(void* pixels, const IntRect& updateRect)
     int tempBuffSize = // Temporary buffer size is the smaller of the max texture size or the updateRectSanitized
         min(m_tiles.maxTextureSize(), m_tiles.borderTexels() + updateRectSanitized.width()) *
         min(m_tiles.maxTextureSize(), m_tiles.borderTexels() + updateRectSanitized.height());
-    OwnArrayPtr<uint32_t> tempBuff(new uint32_t[tempBuffSize]);
+    OwnArrayPtr<uint32_t> tempBuff = adoptArrayPtr(new uint32_t[tempBuffSize]);
 
     for (int tile = 0; tile < m_tiles.numTiles(); tile++) {
         // Intersect with tile
diff --git a/Source/WebCore/platform/graphics/gpu/TilingData.cpp b/Source/WebCore/platform/graphics/gpu/TilingData.cpp
index a98add7..e7c4e4c 100644
--- a/Source/WebCore/platform/graphics/gpu/TilingData.cpp
+++ b/Source/WebCore/platform/graphics/gpu/TilingData.cpp
@@ -89,9 +89,9 @@ IntRect TilingData::tileBoundsWithBorder(int tile) const
 
     if (m_borderTexels) {
         int x1 = bounds.x();
-        int x2 = bounds.right();
+        int x2 = bounds.maxX();
         int y1 = bounds.y();
-        int y2 = bounds.bottom();
+        int y2 = bounds.maxY();
 
         if (tileXIndex(tile) > 0)
             x1--;
@@ -182,8 +182,8 @@ IntRect TilingData::overlappedTileIndices(const WebCore::IntRect &srcRect) const
 {
     int x = tileXIndexFromSrcCoord(srcRect.x());
     int y = tileYIndexFromSrcCoord(srcRect.y());
-    int r = tileXIndexFromSrcCoord(srcRect.right());
-    int b = tileYIndexFromSrcCoord(srcRect.bottom());
+    int r = tileXIndexFromSrcCoord(srcRect.maxX());
+    int b = tileYIndexFromSrcCoord(srcRect.maxY());
     return IntRect(x, y, r - x, b - y);
 }
 
diff --git a/Source/WebCore/platform/graphics/gpu/mac/DrawingBufferMac.mm b/Source/WebCore/platform/graphics/gpu/mac/DrawingBufferMac.mm
index e6dfdb8..13c0968 100644
--- a/Source/WebCore/platform/graphics/gpu/mac/DrawingBufferMac.mm
+++ b/Source/WebCore/platform/graphics/gpu/mac/DrawingBufferMac.mm
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(ACCELERATED_2D_CANVAS) || ENABLE(3D_CANVAS)
+#if ENABLE(ACCELERATED_2D_CANVAS) || ENABLE(WEBGL)
 
 #include "DrawingBuffer.h"
 
diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
index c113c69..69bdeab 100644
--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
@@ -1384,11 +1384,15 @@ static HashSet<String> mimeTypeCache()
 
                 // These formats are supported by GStreamer, but not
                 // correctly advertised.
-                if (g_str_equal(name, "video/x-h264")
-                    || g_str_equal(name, "audio/x-m4a")) {
+                if (g_str_equal(name, "video/x-h264")) {
                     cache.add(String("video/mp4"));
+                    cached = true;
+                }
+
+                if (g_str_equal(name, "audio/x-m4a")) {
                     cache.add(String("audio/aac"));
                     cache.add(String("audio/mp4"));
+                    cache.add(String("audio/x-m4a"));
                     cached = true;
                 }
 
@@ -1466,6 +1470,15 @@ static HashSet<String> mimeTypeCache()
                     for (int index = 0; extensions[index]; index++) {
                         if (g_str_equal(extensions[index], "m4v"))
                             cache.add(String("video/x-m4v"));
+
+                        // Workaround for
+                        // https://bugzilla.gnome.org/show_bug.cgi?id=640709.
+                        // typefindfunctions <= 0.10.32 doesn't
+                        // register the H264 typefinder correctly so
+                        // as a workaround we check the registered
+                        // file extensions for it.
+                        if (g_str_equal(extensions[index], "h264"))
+                            cache.add(String("video/mp4"));
                     }
                 }
             }
diff --git a/Source/WebCore/platform/graphics/gtk/FontGtk.cpp b/Source/WebCore/platform/graphics/gtk/FontGtk.cpp
index 4d6f509..216fb56 100644
--- a/Source/WebCore/platform/graphics/gtk/FontGtk.cpp
+++ b/Source/WebCore/platform/graphics/gtk/FontGtk.cpp
@@ -215,6 +215,11 @@ bool Font::canReturnFallbackFontsForComplexText()
     return false;
 }
 
+bool Font::canExpandAroundIdeographsInComplexText()
+{
+    return false;
+}
+
 static void drawGlyphsShadow(GraphicsContext* graphicsContext, cairo_t* context, const FloatPoint& point, PangoLayoutLine* layoutLine, PangoRegionType renderRegion)
 {
     ContextShadow* shadow = graphicsContext->contextShadow();
diff --git a/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.cpp b/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.cpp
index ce7ec46..017b1e4 100644
--- a/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.cpp
+++ b/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.cpp
@@ -31,7 +31,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
 {
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontRenderingMode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontWidthVariant, FontRenderingMode)
 {
     return FontPlatformData(size, bold, italic);
 }
diff --git a/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.h b/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.h
index 86f99b2..7ffe89a 100644
--- a/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.h
+++ b/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.h
@@ -23,6 +23,7 @@
 
 #include "FontOrientation.h"
 #include "FontRenderingMode.h"
+#include "FontWidthVariant.h"
 #include <wtf/Forward.h>
 
 namespace WebCore {
@@ -38,7 +39,7 @@ namespace WebCore {
 
         static bool supportsFormat(const String&);
 
-        FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontRenderingMode = NormalRenderingMode);
+        FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
     };
 
     FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer*);
diff --git a/Source/WebCore/platform/graphics/haiku/FontHaiku.cpp b/Source/WebCore/platform/graphics/haiku/FontHaiku.cpp
index 819fecb..5a1a1d0 100644
--- a/Source/WebCore/platform/graphics/haiku/FontHaiku.cpp
+++ b/Source/WebCore/platform/graphics/haiku/FontHaiku.cpp
@@ -65,6 +65,11 @@ bool Font::canReturnFallbackFontsForComplexText()
     return false;
 }
 
+bool Font::canExpandAroundIdeographsInComplexText()
+{
+    return false;
+}
+
 void Font::drawGlyphs(GraphicsContext* graphicsContext, const SimpleFontData* font,
                       const GlyphBuffer& glyphBuffer, int from, int numGlyphs, const FloatPoint& point) const
 {
diff --git a/Source/WebCore/platform/graphics/haiku/SimpleFontDataHaiku.cpp b/Source/WebCore/platform/graphics/haiku/SimpleFontDataHaiku.cpp
index b1e7082..4ded761 100644
--- a/Source/WebCore/platform/graphics/haiku/SimpleFontDataHaiku.cpp
+++ b/Source/WebCore/platform/graphics/haiku/SimpleFontDataHaiku.cpp
@@ -48,11 +48,11 @@ void SimpleFontData::platformInit()
 
     font_height height;
     font->GetHeight(&height);
-    m_ascent = static_cast<int>(height.ascent);
-    m_descent = static_cast<int>(height.descent);
-    m_lineSpacing = m_ascent + m_descent;
-    m_xHeight = height.ascent * 0.56f; // Hack taken from the win port.
-    m_lineGap = height.leading;
+    m_fontMetrics.setAscent(height.ascent);
+    m_fontMetrics.setDescent(height.descent);
+    m_fontMetrics.setXHeight(height.ascent * 0.56f); // Hack taken from the win port.
+    m_fontMetrics.setLineGap(height.leading);
+    m_fontMetrics.setLineSpacing(lroundf(height.ascent) + lroundf(height.descent) + lroundf(height.leading));
 }
 
 void SimpleFontData::platformCharWidthInit()
diff --git a/Source/WebCore/platform/graphics/mac/ComplexTextController.cpp b/Source/WebCore/platform/graphics/mac/ComplexTextController.cpp
index 86f6bec..1fe3d28 100644
--- a/Source/WebCore/platform/graphics/mac/ComplexTextController.cpp
+++ b/Source/WebCore/platform/graphics/mac/ComplexTextController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -25,14 +25,13 @@
 #include "config.h"
 #include "ComplexTextController.h"
 
-#include <ApplicationServices/ApplicationServices.h>
-#include "CharacterNames.h"
 #include "FloatSize.h"
 #include "Font.h"
 #include "TextBreakIterator.h"
 #include "TextRun.h"
-
+#include <ApplicationServices/ApplicationServices.h>
 #include <wtf/StdLibExtras.h>
+#include <wtf/unicode/CharacterNames.h>
 
 #if defined(BUILDING_ON_LEOPARD)
 // Undefined when compiling agains the 10.5 SDK.
@@ -71,7 +70,8 @@ ComplexTextController::ComplexTextController(const Font* font, const TextRun& ru
     , m_glyphInCurrentRun(0)
     , m_characterInCurrentGlyph(0)
     , m_finalRoundingWidth(0)
-    , m_padding(run.padding())
+    , m_expansion(run.expansion())
+    , m_afterExpansion(true)
     , m_fallbackFonts(fallbackFonts)
     , m_minGlyphBoundingBoxX(numeric_limits<float>::max())
     , m_maxGlyphBoundingBoxX(numeric_limits<float>::min())
@@ -79,19 +79,18 @@ ComplexTextController::ComplexTextController(const Font* font, const TextRun& ru
     , m_maxGlyphBoundingBoxY(numeric_limits<float>::min())
     , m_lastRoundingGlyph(0)
 {
-    if (!m_padding)
-        m_padPerSpace = 0;
+    if (!m_expansion)
+        m_expansionPerOpportunity = 0;
     else {
-        int numSpaces = 0;
-        for (int s = 0; s < m_run.length(); s++) {
-            if (Font::treatAsSpace(m_run[s]))
-                numSpaces++;
-        }
+        bool isAfterExpansion = true;
+        unsigned expansionOpportunityCount = Font::expansionOpportunityCount(m_run.characters(), m_end, m_run.ltr() ? LTR : RTL, isAfterExpansion);
+        if (isAfterExpansion && !m_run.allowsTrailingExpansion())
+            expansionOpportunityCount--;
 
-        if (!numSpaces)
-            m_padPerSpace = 0;
+        if (!expansionOpportunityCount)
+            m_expansionPerOpportunity = 0;
         else
-            m_padPerSpace = m_padding / numSpaces;
+            m_expansionPerOpportunity = m_expansion / expansionOpportunityCount;
     }
 
     collectComplexTextRuns();
@@ -118,9 +117,9 @@ int ComplexTextController::offsetForPosition(float h, bool includePartialGlyphs)
                 CFIndex hitGlyphStart = complexTextRun.indexAt(j);
                 CFIndex hitGlyphEnd;
                 if (m_run.ltr())
-                    hitGlyphEnd = max<CFIndex>(hitGlyphStart, j + 1 < complexTextRun.glyphCount() ? complexTextRun.indexAt(j + 1) : static_cast<CFIndex>(complexTextRun.stringLength()));
+                    hitGlyphEnd = max<CFIndex>(hitGlyphStart, j + 1 < complexTextRun.glyphCount() ? complexTextRun.indexAt(j + 1) : static_cast<CFIndex>(complexTextRun.indexEnd()));
                 else
-                    hitGlyphEnd = max<CFIndex>(hitGlyphStart, j > 0 ? complexTextRun.indexAt(j - 1) : static_cast<CFIndex>(complexTextRun.stringLength()));
+                    hitGlyphEnd = max<CFIndex>(hitGlyphStart, j > 0 ? complexTextRun.indexAt(j - 1) : static_cast<CFIndex>(complexTextRun.indexEnd()));
 
                 // FIXME: Instead of dividing the glyph's advance equally between the characters, this
                 // could use the glyph's "ligature carets". However, there is no Core Text API to get the
@@ -311,6 +310,7 @@ ComplexTextController::ComplexTextRun::ComplexTextRun(const SimpleFontData* font
     , m_characters(characters)
     , m_stringLocation(stringLocation)
     , m_stringLength(stringLength)
+    , m_indexEnd(stringLength)
     , m_isMonotonic(true)
 {
 #if USE(CORE_TEXT) && USE(ATSUI)
@@ -335,7 +335,7 @@ void ComplexTextController::ComplexTextRun::setIsNonMonotonic()
 
     m_glyphEndOffsets.grow(m_glyphCount);
     for (size_t i = 0; i < m_glyphCount; ++i) {
-        CFIndex nextMappedIndex = m_stringLength;
+        CFIndex nextMappedIndex = m_indexEnd;
         for (size_t j = indexAt(i) + 1; j < m_stringLength; ++j) {
             if (mappedIndices[j]) {
                 nextMappedIndex = j;
@@ -370,9 +370,9 @@ void ComplexTextController::advance(unsigned offset, GlyphBuffer* glyphBuffer)
             unsigned glyphEndOffset;
             if (complexTextRun.isMonotonic()) {
                 if (ltr)
-                    glyphEndOffset = max<unsigned>(glyphStartOffset, g + 1 < glyphCount ? static_cast<unsigned>(complexTextRun.indexAt(g + 1)) : complexTextRun.stringLength());
+                    glyphEndOffset = max<unsigned>(glyphStartOffset, static_cast<unsigned>(g + 1 < glyphCount ? complexTextRun.indexAt(g + 1) : complexTextRun.indexEnd()));
                 else
-                    glyphEndOffset = max<unsigned>(glyphStartOffset, g > 0 ? static_cast<unsigned>(complexTextRun.indexAt(g - 1)) : complexTextRun.stringLength());
+                    glyphEndOffset = max<unsigned>(glyphStartOffset, static_cast<unsigned>(g > 0 ? complexTextRun.indexAt(g - 1) : complexTextRun.indexEnd()));
             } else
                 glyphEndOffset = complexTextRun.endOffsetAt(g);
 
@@ -386,7 +386,7 @@ void ComplexTextController::advance(unsigned offset, GlyphBuffer* glyphBuffer)
 
             unsigned oldCharacterInCurrentGlyph = m_characterInCurrentGlyph;
             m_characterInCurrentGlyph = min(m_currentCharacter - complexTextRun.stringLocation(), glyphEndOffset) - glyphStartOffset;
-            // FIXME: Instead of dividing the glyph's advance equially between the characters, this
+            // FIXME: Instead of dividing the glyph's advance equally between the characters, this
             // could use the glyph's "ligature carets". However, there is no Core Text API to get the
             // ligature carets.
             if (glyphStartOffset == glyphEndOffset) {
@@ -421,6 +421,7 @@ void ComplexTextController::adjustGlyphsAndAdvances()
 {
     CGFloat widthSinceLastRounding = 0;
     size_t runCount = m_complexTextRuns.size();
+    bool hasExtraSpacing = (m_font.letterSpacing() || m_font.wordSpacing() || m_expansion) && !m_run.spacingDisabled();
     for (size_t r = 0; r < runCount; ++r) {
         ComplexTextRun& complexTextRun = *m_complexTextRuns[r];
         unsigned glyphCount = complexTextRun.glyphCount();
@@ -433,7 +434,6 @@ void ComplexTextController::adjustGlyphsAndAdvances()
         const UChar* cp = complexTextRun.characters();
         CGFloat roundedSpaceWidth = roundCGFloat(fontData->spaceWidth());
         bool roundsAdvances = !m_font.isPrinterFont() && fontData->platformData().roundsGlyphAdvances();
-        bool hasExtraSpacing = (m_font.letterSpacing() || m_font.wordSpacing() || m_padding) && !m_run.spacingDisabled();
         CGPoint glyphOrigin = CGPointZero;
         CFIndex lastCharacterIndex = m_run.ltr() ? numeric_limits<CFIndex>::min() : numeric_limits<CFIndex>::max();
         bool isMonotonic = true;
@@ -489,25 +489,29 @@ void ComplexTextController::adjustGlyphsAndAdvances()
                     advance.width += m_font.letterSpacing();
 
                 // Handle justification and word-spacing.
-                if (treatAsSpace) {
-                    // Account for padding. WebCore uses space padding to justify text.
-                    // We distribute the specified padding over the available spaces in the run.
-                    if (m_padding) {
-                        // Use leftover padding if not evenly divisible by number of spaces.
-                        if (m_padding < m_padPerSpace) {
-                            advance.width += m_padding;
-                            m_padding = 0;
-                        } else {
-                            float previousPadding = m_padding;
-                            m_padding -= m_padPerSpace;
-                            advance.width += roundf(previousPadding) - roundf(m_padding);
+                if (treatAsSpace || Font::isCJKIdeographOrSymbol(ch)) {
+                    // Distribute the run's total expansion evenly over all expansion opportunities in the run.
+                    if (m_expansion && (!lastGlyph || m_run.allowsTrailingExpansion())) {
+                        float previousExpansion = m_expansion;
+                        if (!treatAsSpace && !m_afterExpansion) {
+                            // Take the expansion opportunity before this ideograph.
+                            m_expansion -= m_expansionPerOpportunity;
+                            int expansion = roundf(previousExpansion) - roundf(m_expansion);
+                            m_totalWidth += expansion;
+                            m_adjustedAdvances.last().width += expansion;
+                            previousExpansion = m_expansion;
                         }
-                    }
+                        m_expansion -= m_expansionPerOpportunity;
+                        advance.width += roundf(previousExpansion) - roundf(m_expansion);
+                        m_afterExpansion = true;
+                    } else
+                        m_afterExpansion = false;
 
                     // Account for word-spacing.
-                    if (characterIndex > 0 && !Font::treatAsSpace(*m_run.data(characterIndex - 1)) && m_font.wordSpacing())
+                    if (treatAsSpace && characterIndex > 0 && !Font::treatAsSpace(*m_run.data(characterIndex - 1)) && m_font.wordSpacing())
                         advance.width += m_font.wordSpacing();
-                }
+                } else
+                    m_afterExpansion = false;
             }
 
             // Deal with the float/integer impedance mismatch between CG and WebCore. "Words" (characters 
@@ -549,9 +553,9 @@ void ComplexTextController::adjustGlyphsAndAdvances()
             FloatRect glyphBounds = fontData->boundsForGlyph(glyph);
             glyphBounds.move(glyphOrigin.x, glyphOrigin.y);
             m_minGlyphBoundingBoxX = min(m_minGlyphBoundingBoxX, glyphBounds.x());
-            m_maxGlyphBoundingBoxX = max(m_maxGlyphBoundingBoxX, glyphBounds.right());
+            m_maxGlyphBoundingBoxX = max(m_maxGlyphBoundingBoxX, glyphBounds.maxX());
             m_minGlyphBoundingBoxY = min(m_minGlyphBoundingBoxY, glyphBounds.y());
-            m_maxGlyphBoundingBoxY = max(m_maxGlyphBoundingBoxY, glyphBounds.bottom());
+            m_maxGlyphBoundingBoxY = max(m_maxGlyphBoundingBoxY, glyphBounds.maxY());
             glyphOrigin.x += advance.width;
             glyphOrigin.y += advance.height;
             
diff --git a/Source/WebCore/platform/graphics/mac/ComplexTextController.h b/Source/WebCore/platform/graphics/mac/ComplexTextController.h
index 9cf80a6..63f93a2 100644
--- a/Source/WebCore/platform/graphics/mac/ComplexTextController.h
+++ b/Source/WebCore/platform/graphics/mac/ComplexTextController.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -72,9 +72,9 @@ private:
     class ComplexTextRun : public RefCounted<ComplexTextRun> {
     public:
 #if USE(CORE_TEXT)
-        static PassRefPtr<ComplexTextRun> create(CTRunRef ctRun, const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength)
+        static PassRefPtr<ComplexTextRun> create(CTRunRef ctRun, const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength, CFRange runRange)
         {
-            return adoptRef(new ComplexTextRun(ctRun, fontData, characters, stringLocation, stringLength));
+            return adoptRef(new ComplexTextRun(ctRun, fontData, characters, stringLocation, stringLength, runRange));
         }
 #endif
 #if USE(ATSUI)
@@ -94,6 +94,7 @@ private:
         unsigned stringLocation() const { return m_stringLocation; }
         size_t stringLength() const { return m_stringLength; }
         ALWAYS_INLINE CFIndex indexAt(size_t i) const;
+        CFIndex indexEnd() const { return m_indexEnd; }
         CFIndex endOffsetAt(size_t i) const { ASSERT(!m_isMonotonic); return m_glyphEndOffsets[i]; }
         const CGGlyph* glyphs() const { return m_glyphs; }
         const CGSize* advances() const { return m_advances; }
@@ -102,7 +103,7 @@ private:
 
     private:
 #if USE(CORE_TEXT)
-        ComplexTextRun(CTRunRef, const SimpleFontData*, const UChar* characters, unsigned stringLocation, size_t stringLength);
+        ComplexTextRun(CTRunRef, const SimpleFontData*, const UChar* characters, unsigned stringLocation, size_t stringLength, CFRange runRange);
         void createTextRunFromFontDataCoreText(bool ltr);
 #endif
 #if USE(ATSUI)
@@ -133,6 +134,7 @@ private:
 #if USE(ATSUI)
         Vector<CFIndex, 64> m_atsuiIndices;
 #endif
+        CFIndex m_indexEnd;
         Vector<CFIndex, 64> m_glyphEndOffsets;
         Vector<CGGlyph, 64> m_glyphsVector;
         const CGGlyph* m_glyphs;
@@ -175,8 +177,9 @@ private:
     unsigned m_glyphInCurrentRun;
     unsigned m_characterInCurrentGlyph;
     float m_finalRoundingWidth;
-    float m_padding;
-    float m_padPerSpace;
+    float m_expansion;
+    float m_expansionPerOpportunity;
+    bool m_afterExpansion;
 
     HashSet<const SimpleFontData*>* m_fallbackFonts;
 
diff --git a/Source/WebCore/platform/graphics/mac/ComplexTextControllerATSUI.cpp b/Source/WebCore/platform/graphics/mac/ComplexTextControllerATSUI.cpp
index 9c2ab6b..b367fdf 100644
--- a/Source/WebCore/platform/graphics/mac/ComplexTextControllerATSUI.cpp
+++ b/Source/WebCore/platform/graphics/mac/ComplexTextControllerATSUI.cpp
@@ -25,10 +25,10 @@
 
 #if USE(ATSUI)
 
-#include "CharacterNames.h"
 #include "Font.h"
 #include "ShapeArabic.h"
 #include "TextRun.h"
+#include <wtf/unicode/CharacterNames.h>
 
 #ifdef __LP64__
 // ATSUTextInserted() is SPI in 64-bit.
@@ -146,6 +146,7 @@ ComplexTextController::ComplexTextRun::ComplexTextRun(ATSUTextLayout atsuTextLay
     , m_characters(characters)
     , m_stringLocation(stringLocation)
     , m_stringLength(stringLength)
+    , m_indexEnd(stringLength)
     , m_directionalOverride(directionalOverride)
     , m_isMonotonic(true)
 {
diff --git a/Source/WebCore/platform/graphics/mac/ComplexTextControllerCoreText.cpp b/Source/WebCore/platform/graphics/mac/ComplexTextControllerCoreText.cpp
index 07fb153..239113f 100644
--- a/Source/WebCore/platform/graphics/mac/ComplexTextControllerCoreText.cpp
+++ b/Source/WebCore/platform/graphics/mac/ComplexTextControllerCoreText.cpp
@@ -42,12 +42,13 @@ extern const CFStringRef kCTTypesetterOptionForcedEmbeddingLevel;
 
 namespace WebCore {
 
-ComplexTextController::ComplexTextRun::ComplexTextRun(CTRunRef ctRun, const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength)
+ComplexTextController::ComplexTextRun::ComplexTextRun(CTRunRef ctRun, const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength, CFRange runRange)
     : m_coreTextRun(ctRun)
     , m_fontData(fontData)
     , m_characters(characters)
     , m_stringLocation(stringLocation)
     , m_stringLength(stringLength)
+    , m_indexEnd(runRange.location + runRange.length)
     , m_isMonotonic(true)
 {
     m_glyphCount = CTRunGetGlyphCount(m_coreTextRun.get());
@@ -165,7 +166,8 @@ void ComplexTextController::collectComplexTextRunsForCharactersCoreText(const UC
     for (CFIndex r = 0; r < runCount; r++) {
         CTRunRef ctRun = static_cast<CTRunRef>(CFArrayGetValueAtIndex(runArray, r));
         ASSERT(CFGetTypeID(ctRun) == CTRunGetTypeID());
-        m_complexTextRuns.append(ComplexTextRun::create(ctRun, fontData, cp, stringLocation, length));
+        CFRange runRange = CTRunGetStringRange(ctRun);
+        m_complexTextRuns.append(ComplexTextRun::create(ctRun, fontData, cp, stringLocation, length, runRange));
     }
 }
 
diff --git a/Source/WebCore/platform/graphics/mac/FontCacheMac.mm b/Source/WebCore/platform/graphics/mac/FontCacheMac.mm
index 068bd8e..c254906 100644
--- a/Source/WebCore/platform/graphics/mac/FontCacheMac.mm
+++ b/Source/WebCore/platform/graphics/mac/FontCacheMac.mm
@@ -211,7 +211,7 @@ FontPlatformData* FontCache::createFontPlatformData(const FontDescription& fontD
     bool syntheticBold = isAppKitFontWeightBold(weight) && !isAppKitFontWeightBold(actualWeight);
     bool syntheticOblique = (traits & NSFontItalicTrait) && !(actualTraits & NSFontItalicTrait);
 
-    return new FontPlatformData(platformFont, size, syntheticBold, syntheticOblique, fontDescription.orientation());
+    return new FontPlatformData(platformFont, size, syntheticBold, syntheticOblique, fontDescription.orientation(), fontDescription.widthVariant());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/mac/FontComplexTextMac.cpp b/Source/WebCore/platform/graphics/mac/FontComplexTextMac.cpp
index 02bac9c..865051d 100644
--- a/Source/WebCore/platform/graphics/mac/FontComplexTextMac.cpp
+++ b/Source/WebCore/platform/graphics/mac/FontComplexTextMac.cpp
@@ -111,8 +111,8 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
 {
     ComplexTextController controller(this, run, true, fallbackFonts);
     if (glyphOverflow) {
-        glyphOverflow->top = max<int>(glyphOverflow->top, ceilf(-controller.minGlyphBoundingBoxY()) - ascent());
-        glyphOverflow->bottom = max<int>(glyphOverflow->bottom, ceilf(controller.maxGlyphBoundingBoxY()) - descent());
+        glyphOverflow->top = max<int>(glyphOverflow->top, ceilf(-controller.minGlyphBoundingBoxY()) - fontMetrics().ascent());
+        glyphOverflow->bottom = max<int>(glyphOverflow->bottom, ceilf(controller.maxGlyphBoundingBoxY()) - fontMetrics().descent());
         glyphOverflow->left = max<int>(0, ceilf(-controller.minGlyphBoundingBoxX()));
         glyphOverflow->right = max<int>(0, ceilf(controller.maxGlyphBoundingBoxX() - controller.totalWidth()));
     }
diff --git a/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp b/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp
index d04d0e4..f2bc33d 100644
--- a/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp
+++ b/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp
@@ -38,9 +38,9 @@ FontCustomPlatformData::~FontCustomPlatformData()
     CGFontRelease(m_cgFont);
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation orientation, FontRenderingMode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation orientation, FontWidthVariant widthVariant, FontRenderingMode)
 {
-    return FontPlatformData(m_cgFont, size, bold, italic, orientation);
+    return FontPlatformData(m_cgFont, size, bold, italic, orientation, widthVariant);
 }
 
 FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
diff --git a/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.h b/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.h
index 7043d7e..c7ae1ca 100644
--- a/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.h
+++ b/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.h
@@ -23,6 +23,7 @@
 
 #include "FontOrientation.h"
 #include "FontRenderingMode.h"
+#include "FontWidthVariant.h"
 #include <CoreFoundation/CFBase.h>
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
@@ -47,7 +48,7 @@ public:
 
     ~FontCustomPlatformData();
 
-    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontRenderingMode = NormalRenderingMode);
+    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
 
     static bool supportsFormat(const String&);
 
diff --git a/Source/WebCore/platform/graphics/mac/FontMac.mm b/Source/WebCore/platform/graphics/mac/FontMac.mm
index 8519667..acd7562 100644
--- a/Source/WebCore/platform/graphics/mac/FontMac.mm
+++ b/Source/WebCore/platform/graphics/mac/FontMac.mm
@@ -47,6 +47,11 @@ bool Font::canReturnFallbackFontsForComplexText()
     return true;
 }
 
+bool Font::canExpandAroundIdeographsInComplexText()
+{
+    return true;
+}
+
 static void showGlyphsWithAdvances(const SimpleFontData* font, CGContextRef context, const CGGlyph* glyphs, const CGSize* advances, size_t count)
 {
     const FontPlatformData& platformData = font->platformData();
@@ -60,8 +65,8 @@ static void showGlyphsWithAdvances(const SimpleFontData* font, CGContextRef cont
             savedMatrix = CGContextGetTextMatrix(context);
             CGAffineTransform runMatrix = CGAffineTransformConcat(savedMatrix, rotateLeftTransform);
             // Move start point to put glyphs into original region.
-            runMatrix.tx = savedMatrix.tx + font->ascent();
-            runMatrix.ty = savedMatrix.ty + font->descent();
+            runMatrix.tx = savedMatrix.tx + font->fontMetrics().ascent();
+            runMatrix.ty = savedMatrix.ty + font->fontMetrics().descent();
             CGContextSetTextMatrix(context, runMatrix);
         }
 
diff --git a/Source/WebCore/platform/graphics/mac/GlyphPageTreeNodeMac.cpp b/Source/WebCore/platform/graphics/mac/GlyphPageTreeNodeMac.cpp
index 5388c24..8b04ffa 100644
--- a/Source/WebCore/platform/graphics/mac/GlyphPageTreeNodeMac.cpp
+++ b/Source/WebCore/platform/graphics/mac/GlyphPageTreeNodeMac.cpp
@@ -39,8 +39,8 @@ namespace WebCore {
 #ifndef BUILDING_ON_TIGER
 static bool shouldUseCoreText(UChar* buffer, unsigned bufferLength, const SimpleFontData* fontData)
 {
-    if (fontData->orientation() == Vertical && !fontData->isBrokenIdeographFont()) {
-        // Ideographs don't have a vertical variant.
+    if (fontData->platformData().widthVariant() != RegularWidth || (fontData->orientation() == Vertical && !fontData->isBrokenIdeographFont())) {
+        // Ideographs don't have a vertical variant or width variants.
         for (unsigned i = 0; i < bufferLength; ++i) {
             if (!Font::isCJKIdeograph(buffer[i]))
                 return true;
diff --git a/Source/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm b/Source/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm
index 21eb59d..aaa250b 100644
--- a/Source/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm
+++ b/Source/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "GraphicsContext3D.h"
 
@@ -245,6 +245,10 @@ bool GraphicsContext3D::isGLES2Compliant() const
     return false;
 }
 
+void GraphicsContext3D::setContextLostCallback(PassOwnPtr<ContextLostCallback>)
+{
+}
+
 }
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm b/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
index 2361f6a..8b1fb92 100644
--- a/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
+++ b/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
@@ -616,7 +616,7 @@ QTTime MediaPlayerPrivateQTKit::createQTTime(float time) const
     if (!metaDataAvailable())
         return QTMakeTime(0, 600);
     long timeScale = [[m_qtMovie.get() attributeForKey:QTMovieTimeScaleAttribute] longValue];
-    return QTMakeTime(time * timeScale, timeScale);
+    return QTMakeTime(lroundf(time * timeScale), timeScale);
 }
 
 void MediaPlayerPrivateQTKit::resumeLoad()
diff --git a/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm b/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
index 92585c6..3094498 100644
--- a/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
+++ b/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
@@ -218,19 +218,20 @@ void SimpleFontData::platformInit()
     int iAscent;
     int iDescent;
     int iLineGap;
+    unsigned unitsPerEm;
 #ifdef BUILDING_ON_TIGER
-    wkGetFontMetrics(m_platformData.cgFont(), &iAscent, &iDescent, &iLineGap, &m_unitsPerEm);
+    wkGetFontMetrics(m_platformData.cgFont(), &iAscent, &iDescent, &iLineGap, &unitsPerEm);
 #else
     iAscent = CGFontGetAscent(m_platformData.cgFont());
     iDescent = CGFontGetDescent(m_platformData.cgFont());
     iLineGap = CGFontGetLeading(m_platformData.cgFont());
-    m_unitsPerEm = CGFontGetUnitsPerEm(m_platformData.cgFont());
+    unitsPerEm = CGFontGetUnitsPerEm(m_platformData.cgFont());
 #endif
 
     float pointSize = m_platformData.m_size;
-    float fAscent = scaleEmToUnits(iAscent, m_unitsPerEm) * pointSize;
-    float fDescent = -scaleEmToUnits(iDescent, m_unitsPerEm) * pointSize;
-    float fLineGap = scaleEmToUnits(iLineGap, m_unitsPerEm) * pointSize;
+    float ascent = scaleEmToUnits(iAscent, unitsPerEm) * pointSize;
+    float descent = -scaleEmToUnits(iDescent, unitsPerEm) * pointSize;
+    float lineGap = scaleEmToUnits(iLineGap, unitsPerEm) * pointSize;
 
     // We need to adjust Times, Helvetica, and Courier to closely match the
     // vertical metrics of their Microsoft counterparts that are the de facto
@@ -239,25 +240,23 @@ void SimpleFontData::platformInit()
     // and add it to the ascent.
     NSString *familyName = [m_platformData.font() familyName];
     if ([familyName isEqualToString:@"Times"] || [familyName isEqualToString:@"Helvetica"] || [familyName isEqualToString:@"Courier"])
-        fAscent += floorf(((fAscent + fDescent) * 0.15f) + 0.5f);
+        ascent += floorf(((ascent + descent) * 0.15f) + 0.5f);
     else if ([familyName isEqualToString:@"Geeza Pro"]) {
         // Geeza Pro has glyphs that draw slightly above the ascent or far below the descent. Adjust
         // those vertical metrics to better match reality, so that diacritics at the bottom of one line
         // do not overlap diacritics at the top of the next line.
-        fAscent *= 1.08f;
-        fDescent *= 2.f;
+        ascent *= 1.08f;
+        descent *= 2.f;
     }
 
-    m_ascent = lroundf(fAscent);
-    m_descent = lroundf(fDescent);
-    m_lineGap = lroundf(fLineGap);
-    m_lineSpacing = m_ascent + m_descent + m_lineGap;
-    
+    // Compute and store line spacing, before the line metrics hacks are applied.
+    m_fontMetrics.setLineSpacing(lroundf(ascent) + lroundf(descent) + lroundf(lineGap));
+
     // Hack Hiragino line metrics to allow room for marked text underlines.
     // <rdar://problem/5386183>
-    if (m_descent < 3 && m_lineGap >= 3 && [familyName hasPrefix:@"Hiragino"]) {
-        m_lineGap -= 3 - m_descent;
-        m_descent = 3;
+    if (descent < 3 && lineGap >= 3 && [familyName hasPrefix:@"Hiragino"]) {
+        lineGap -= 3 - descent;
+        descent = 3;
     }
     
     if (m_orientation == Vertical) {
@@ -278,6 +277,8 @@ void SimpleFontData::platformInit()
             m_orientation = Horizontal;
     }
 
+    float xHeight;
+
     // Measure the actual character "x", because AppKit synthesizes X height rather than getting it from the font.
     // Unfortunately, NSFont will round this for us so we don't quite get the right value.
     GlyphPage* glyphPageZero = GlyphPageTreeNode::getRootChild(this, 0)->page();
@@ -288,21 +289,27 @@ void SimpleFontData::platformInit()
         // and web pages that foolishly use this metric for width will be laid out
         // poorly if we return an accurate height. Classic case is Times 13 point,
         // which has an "x" that is 7x6 pixels.
-        m_xHeight = static_cast<float>(max(CGRectGetMaxX(xBox), -CGRectGetMinY(xBox)));
+        xHeight = static_cast<float>(max(CGRectGetMaxX(xBox), -CGRectGetMinY(xBox)));
     } else {
 #ifndef BUILDING_ON_TIGER
-        m_xHeight = static_cast<float>(CGFontGetXHeight(m_platformData.cgFont())) / m_unitsPerEm;
+        xHeight = static_cast<float>(CGFontGetXHeight(m_platformData.cgFont())) / unitsPerEm;
 #else
-        m_xHeight = m_platformData.font() ? [m_platformData.font() xHeight] : 0;
+        xHeight = m_platformData.font() ? [m_platformData.font() xHeight] : 0;
 #endif
         // CGFontGetXHeight() returns a wrong value for "Apple Symbols" font (a float close to 0, but not strictly 0).
-        // The following code makes a guess for m_xHeight in that case.
+        // The following code makes a guess for xHeight in that case.
         // The int cast is a workaround for the "almost" zero value returned by CGFontGetXHeight().
-        if (!static_cast<int>(m_xHeight) && fAscent)
-            m_xHeight = 2 * fAscent / 3;
+        if (!static_cast<int>(xHeight) && ascent)
+            xHeight = 2 * ascent / 3;
     }
+
+    m_fontMetrics.setUnitsPerEm(unitsPerEm);
+    m_fontMetrics.setAscent(ascent);
+    m_fontMetrics.setDescent(descent);
+    m_fontMetrics.setLineGap(lineGap);
+    m_fontMetrics.setXHeight(xHeight);
 }
-    
+
 static CFDataRef copyFontTableForTag(FontPlatformData& platformData, FourCharCode tableName)
 {
 #ifdef BUILDING_ON_TIGER
@@ -337,7 +344,7 @@ void SimpleFontData::platformCharWidthInit()
     if (os2Table && CFDataGetLength(os2Table.get()) >= 4) {
         const UInt8* os2 = CFDataGetBytePtr(os2Table.get());
         SInt16 os2AvgCharWidth = os2[2] * 256 + os2[3];
-        m_avgCharWidth = scaleEmToUnits(os2AvgCharWidth, m_unitsPerEm) * m_platformData.m_size;
+        m_avgCharWidth = scaleEmToUnits(os2AvgCharWidth, m_fontMetrics.unitsPerEm()) * m_platformData.m_size;
     }
 
     RetainPtr<CFDataRef> headTable(AdoptCF, copyFontTableForTag(m_platformData, 'head'));
@@ -348,7 +355,7 @@ void SimpleFontData::platformCharWidthInit()
         SInt16 xMin = static_cast<SInt16>(uxMin);
         SInt16 xMax = static_cast<SInt16>(uxMax);
         float diff = static_cast<float>(xMax - xMin);
-        m_maxCharWidth = scaleEmToUnits(diff, m_unitsPerEm) * m_platformData.m_size;
+        m_maxCharWidth = scaleEmToUnits(diff, m_fontMetrics.unitsPerEm()) * m_platformData.m_size;
     }
 
     // Fallback to a cross-platform estimate, which will populate these values if they are non-positive.
@@ -387,7 +394,7 @@ SimpleFontData* SimpleFontData::scaledFontData(const FontDescription& fontDescri
 
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
     float size = m_platformData.size() * scaleFactor;
-    FontPlatformData scaledFontData([[NSFontManager sharedFontManager] convertFont:m_platformData.font() toSize:size], size);
+    FontPlatformData scaledFontData([[NSFontManager sharedFontManager] convertFont:m_platformData.font() toSize:size], size, false, false, m_platformData.orientation());
 
     // AppKit resets the type information (screen/printer) when you convert a font to a different size.
     // We have to fix up the font that we're handed back.
@@ -470,13 +477,13 @@ FloatRect SimpleFontData::platformBoundsForGlyph(Glyph glyph) const
 #ifndef BUILDING_ON_TIGER
     boundingBox = CTFontGetBoundingRectsForGlyphs(m_platformData.ctFont(),
                     orientation() == Vertical ? kCTFontVerticalOrientation : kCTFontHorizontalOrientation, &glyph, 0, 1);
-    boundingBox.setY(-boundingBox.bottom());
+    boundingBox.setY(-boundingBox.maxY());
 #else
     // FIXME: Custom fonts don't have NSFonts, so this function doesn't compute correct bounds for these on Tiger.
     if (!m_platformData.font())
         return boundingBox;
     boundingBox = [m_platformData.font() boundingRectForGlyph:glyph];
-    boundingBox.setY(-boundingBox.bottom());
+    boundingBox.setY(-boundingBox.maxY());
 #endif
     if (m_syntheticBoldOffset)
         boundingBox.setWidth(boundingBox.width() + m_syntheticBoldOffset);
diff --git a/Source/WebCore/platform/graphics/mac/WebGLLayer.mm b/Source/WebCore/platform/graphics/mac/WebGLLayer.mm
index c24181b..d1007b9 100644
--- a/Source/WebCore/platform/graphics/mac/WebGLLayer.mm
+++ b/Source/WebCore/platform/graphics/mac/WebGLLayer.mm
@@ -26,7 +26,7 @@
 #include "config.h"
 
 #if USE(ACCELERATED_COMPOSITING)
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #import "WebGLLayer.h"
 
@@ -163,5 +163,5 @@ static void freeData(void *, const void *data, size_t /* size */)
 
 @end
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
index 3eb5196..df45147 100644
--- a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
+++ b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "Extensions3DOpenGL.h"
 
@@ -79,6 +79,10 @@ bool Extensions3DOpenGL::supports(const String& name)
     if (name == "GL_ANGLE_framebuffer_multisample")
         return m_availableExtensions.contains("GL_EXT_framebuffer_multisample");
 
+    // Desktop GL always supports GL_OES_rgb8_rgba8.
+    if (name == "GL_OES_rgb8_rgba8")
+        return true;
+
     // If GL_ARB_texture_float is available then we report GL_OES_texture_float and
     // GL_OES_texture_half_float as available.
     if (name == "GL_OES_texture_float" || name == "GL_OES_texture_half_float")
@@ -125,4 +129,4 @@ void Extensions3DOpenGL::renderbufferStorageMultisample(unsigned long target, un
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
index 7c103f3..c224e20 100644
--- a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
+++ b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "GraphicsContext3D.h"
 
@@ -83,7 +83,7 @@ void GraphicsContext3D::paintRenderingResultsToCanvas(CanvasRenderingContext* co
     int rowBytes = m_currentWidth * 4;
     int totalBytes = rowBytes * m_currentHeight;
 
-    OwnArrayPtr<unsigned char> pixels(new unsigned char[totalBytes]);
+    OwnArrayPtr<unsigned char> pixels = adoptArrayPtr(new unsigned char[totalBytes]);
     if (!pixels)
         return;
 
@@ -1437,28 +1437,6 @@ void GraphicsContext3D::deleteTexture(Platform3DObject texture)
     glDeleteTextures(1, &texture);
 }
 
-uint32_t GraphicsContext3D::sizeInBytes(GC3Denum type)
-{
-    switch (type) {
-        case GL_BYTE:
-            return sizeof(GLbyte);
-        case GL_UNSIGNED_BYTE:
-            return sizeof(GLubyte);
-        case GL_SHORT:
-            return sizeof(GLshort);
-        case GL_UNSIGNED_SHORT:
-            return sizeof(GLushort);
-        case GL_INT:
-            return sizeof(GLint);
-        case GL_UNSIGNED_INT:
-            return sizeof(GLuint);
-        case GL_FLOAT:
-            return sizeof(GLfloat);
-        default:
-            return 0;
-    }
-}
-
 void GraphicsContext3D::synthesizeGLError(GC3Denum error)
 {
     m_syntheticErrors.add(error);
@@ -1473,4 +1451,4 @@ Extensions3D* GraphicsContext3D::getExtensions()
 
 }
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp b/Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp
index 03f9b7c..2e2082d 100644
--- a/Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp
+++ b/Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp
@@ -390,7 +390,7 @@ void TextureMapperGL::drawTexture(const BitmapTexture& texture, const IntRect& t
     const GLfloat unitRect[] = {0, 0, 1, 0, 1, 1, 0, 1};
     GL_CMD(glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 0, unitRect))
 
-    TransformationMatrix matrix = TransformationMatrix(data().projectionMatrix).multLeft(modelViewMatrix).multLeft(TransformationMatrix(
+    TransformationMatrix matrix = TransformationMatrix(data().projectionMatrix).multiply(modelViewMatrix).multiply(TransformationMatrix(
             targetRect.width(), 0, 0, 0,
             0, targetRect.height(), 0, 0,
             0, 0, 1, 0,
@@ -606,7 +606,7 @@ void TextureMapperGL::paintToTarget(const BitmapTexture& aSurface, const IntSize
     const BitmapTextureGL& surface = static_cast<const BitmapTextureGL&>(aSurface);
 
     // Create the model-view-projection matrix to display on screen.
-    TransformationMatrix matrix = createProjectionMatrix(surfaceSize, true).multLeft(transform).multLeft(
+    TransformationMatrix matrix = createProjectionMatrix(surfaceSize, true).multiply(transform).multiply(
                 TransformationMatrix(
                         surface.m_actualSize.width(), 0, 0, 0,
                         0, surface.m_actualSize.height(), 0, 0,
diff --git a/Source/WebCore/platform/graphics/pango/FontCustomPlatformDataPango.cpp b/Source/WebCore/platform/graphics/pango/FontCustomPlatformDataPango.cpp
index a158689..f9d36d3 100644
--- a/Source/WebCore/platform/graphics/pango/FontCustomPlatformDataPango.cpp
+++ b/Source/WebCore/platform/graphics/pango/FontCustomPlatformDataPango.cpp
@@ -30,7 +30,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
 {
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontRenderingMode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontWidthVariant, FontRenderingMode)
 {
     return FontPlatformData(m_fontFace, size, bold, italic);
 }
diff --git a/Source/WebCore/platform/graphics/pango/SimpleFontDataPango.cpp b/Source/WebCore/platform/graphics/pango/SimpleFontDataPango.cpp
index d0bf836..3fe15b3 100644
--- a/Source/WebCore/platform/graphics/pango/SimpleFontDataPango.cpp
+++ b/Source/WebCore/platform/graphics/pango/SimpleFontDataPango.cpp
@@ -49,21 +49,27 @@ void SimpleFontData::platformInit()
     cairo_font_extents_t font_extents;
     cairo_text_extents_t text_extents;
     cairo_scaled_font_extents(m_platformData.m_scaledFont, &font_extents);
-    m_ascent = static_cast<int>(lroundf(font_extents.ascent));
-    m_descent = static_cast<int>(lroundf(font_extents.descent));
-    m_lineSpacing = static_cast<int>(lroundf(font_extents.height));
+
+    m_fontMetrics.setAscent(font_extents.ascent);
+    m_fontMetrics.setDescent(font_extents.descent);
+
     // There seems to be some rounding error in cairo (or in how we
     // use cairo) with some fonts, like DejaVu Sans Mono, which makes
     // cairo report a height smaller than ascent + descent, which is
     // wrong and confuses WebCore's layout system. Workaround this
     // while we figure out what's going on.
-    if (m_lineSpacing < m_ascent + m_descent)
-        m_lineSpacing = m_ascent + m_descent;
+    float lineSpacing = font_extents.height;
+    if (lineSpacing < font_extents.ascent + font_extents.descent)
+        lineSpacing = font_extents.ascent + font_extents.descent;
+    m_fontMetrics.setLineSpacing(lroundf(lineSpacing));
+    m_fontMetrics.setLineGap(lineSpacing - font_extents.ascent - font_extents.descent);
+
     cairo_scaled_font_text_extents(m_platformData.m_scaledFont, "x", &text_extents);
-    m_xHeight = text_extents.height;
+    m_fontMetrics.setXHeight(text_extents.height);
+
     cairo_scaled_font_text_extents(m_platformData.m_scaledFont, " ", &text_extents);
-    m_spaceWidth =  static_cast<float>(text_extents.x_advance);
-    m_lineGap = m_lineSpacing - m_ascent - m_descent;
+    m_spaceWidth = static_cast<float>(text_extents.x_advance);
+    
     m_syntheticBoldOffset = m_platformData.syntheticBold() ? 1.0f : 0.f;
 }
 
diff --git a/Source/WebCore/platform/graphics/qt/ContextShadowQt.cpp b/Source/WebCore/platform/graphics/qt/ContextShadowQt.cpp
index 37d6b44..9eb31a7 100644
--- a/Source/WebCore/platform/graphics/qt/ContextShadowQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/ContextShadowQt.cpp
@@ -57,7 +57,7 @@ private:
 
 ShadowBuffer::ShadowBuffer(QObject* parent)
     : QObject(parent)
-    , timerId(0)
+    , timerId(-1)
 {
 }
 
@@ -89,7 +89,8 @@ QImage* ShadowBuffer::scratchImage(const QSize& size)
 void ShadowBuffer::schedulePurge()
 {
     static const double BufferPurgeDelay = 2; // seconds
-    killTimer(timerId);
+    if (timerId >= 0)
+        killTimer(timerId);
     timerId = startTimer(BufferPurgeDelay * 1000);
 }
 
diff --git a/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp b/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
index cd28f0e..5238d46 100644
--- a/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "Extensions3DQt.h"
 
@@ -58,4 +58,4 @@ int Extensions3DQt::getGraphicsResetStatusARB()
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/qt/FontCustomPlatformData.h b/Source/WebCore/platform/graphics/qt/FontCustomPlatformData.h
index 54fa679..e8441d2 100644
--- a/Source/WebCore/platform/graphics/qt/FontCustomPlatformData.h
+++ b/Source/WebCore/platform/graphics/qt/FontCustomPlatformData.h
@@ -24,6 +24,7 @@
 
 #include "FontOrientation.h"
 #include "FontRenderingMode.h"
+#include "FontWidthVariant.h"
 #include <wtf/FastAllocBase.h>
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
@@ -42,7 +43,7 @@ public:
     // for use with QFontDatabase::addApplicationFont/removeApplicationFont
     int m_handle;
 
-    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontRenderingMode = NormalRenderingMode);
+    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
 
     static bool supportsFormat(const String&);
 };
diff --git a/Source/WebCore/platform/graphics/qt/FontCustomPlatformDataQt.cpp b/Source/WebCore/platform/graphics/qt/FontCustomPlatformDataQt.cpp
index e2f009b..ec8747d 100644
--- a/Source/WebCore/platform/graphics/qt/FontCustomPlatformDataQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/FontCustomPlatformDataQt.cpp
@@ -34,7 +34,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
     QFontDatabase::removeApplicationFont(m_handle);
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontRenderingMode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontWidthVariant, FontRenderingMode)
 {
     QFont font;
     font.setFamily(QFontDatabase::applicationFontFamilies(m_handle)[0]);
diff --git a/Source/WebCore/platform/graphics/qt/FontQt.cpp b/Source/WebCore/platform/graphics/qt/FontQt.cpp
index 778a13f..646cd0e 100644
--- a/Source/WebCore/platform/graphics/qt/FontQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/FontQt.cpp
@@ -61,14 +61,14 @@ static const QString fromRawDataWithoutRef(const String& string, int start = 0,
 static QTextLine setupLayout(QTextLayout* layout, const TextRun& style)
 {
     int flags = style.rtl() ? Qt::TextForceRightToLeft : Qt::TextForceLeftToRight;
-    if (style.padding())
+    if (style.expansion())
         flags |= Qt::TextJustificationForced;
     layout->setFlags(flags);
     layout->beginLayout();
     QTextLine line = layout->createLine();
     line.setLineWidth(INT_MAX/256);
-    if (style.padding())
-        line.setLineWidth(line.naturalTextWidth() + style.padding());
+    if (style.expansion())
+        line.setLineWidth(line.naturalTextWidth() + style.expansion());
     layout->endLayout();
     return line;
 }
@@ -107,7 +107,7 @@ static void drawTextCommon(GraphicsContext* ctx, const TextRun& run, const Float
             textStrokePen = QPen(QColor(ctx->strokeColor()), ctx->strokeThickness());
     }
 
-    String sanitized = Font::normalizeSpaces(String(run.characters(), run.length()));
+    String sanitized = Font::normalizeSpaces(run.characters(), run.length());
     QString string = fromRawDataWithoutRef(sanitized);
     QPointF pt(point.x(), point.y());
 
@@ -196,7 +196,7 @@ static void drawTextCommon(GraphicsContext* ctx, const TextRun& run, const Float
                 p->save();
                 p->setPen(ctxShadow->m_color);
                 p->translate(ctxShadow->offset());
-                p->drawText(pt, string, flags, run.padding());
+                p->drawText(pt, string, flags, run.expansion());
                 p->restore();
             } else {
                 QFontMetrics fm(font);
@@ -210,7 +210,7 @@ static void drawTextCommon(GraphicsContext* ctx, const TextRun& run, const Float
                     // Since it will be blurred anyway, we don't care about render hints.
                     shadowPainter->setFont(p->font());
                     shadowPainter->setPen(ctxShadow->m_color);
-                    shadowPainter->drawText(pt, string, flags, run.padding());
+                    shadowPainter->drawText(pt, string, flags, run.expansion());
                     ctxShadow->endShadowLayer(ctx);
                 }
             }
@@ -243,7 +243,7 @@ static void drawTextCommon(GraphicsContext* ctx, const TextRun& run, const Float
     if (ctx->textDrawingMode() & TextModeFill) {
         QPen previousPen = p->pen();
         p->setPen(textFillPen);
-        p->drawText(pt, string, flags, run.padding());
+        p->drawText(pt, string, flags, run.expansion());
         p->setPen(previousPen);
     }
 }
@@ -299,7 +299,7 @@ float Font::floatWidthForSimpleText(const TextRun& run, GlyphBuffer* glyphBuffer
     if (!run.length())
         return 0;
 
-    String sanitized = Font::normalizeSpaces(String(run.characters(), run.length()));
+    String sanitized = Font::normalizeSpaces(run.characters(), run.length());
     QString string = fromRawDataWithoutRef(sanitized);
 
     int w = QFontMetrics(font()).width(string, -1, Qt::TextBypassShaping);
@@ -308,7 +308,7 @@ float Font::floatWidthForSimpleText(const TextRun& run, GlyphBuffer* glyphBuffer
     if (treatAsSpace(run[0]))
         w -= m_wordSpacing;
 
-    return w + run.padding();
+    return w + run.expansion();
 #else
     Q_ASSERT(false);
     return 0;
@@ -324,9 +324,9 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
         return 0;
 
     if (run.length() == 1 && treatAsSpace(run[0]))
-        return QFontMetrics(font()).width(space) + run.padding();
+        return QFontMetrics(font()).width(space) + run.expansion();
 
-    String sanitized = Font::normalizeSpaces(String(run.characters(), run.length()));
+    String sanitized = Font::normalizeSpaces(run.characters(), run.length());
     QString string = fromRawDataWithoutRef(sanitized);
 
     int w = QFontMetrics(font()).width(string);
@@ -334,13 +334,13 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
     if (treatAsSpace(run[0]))
         w -= m_wordSpacing;
 
-    return w + run.padding();
+    return w + run.expansion();
 }
 
 int Font::offsetForPositionForSimpleText(const TextRun& run, float position, bool includePartialGlyphs) const
 {
 #if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
-    String sanitized = Font::normalizeSpaces(String(run.characters(), run.length()));
+    String sanitized = Font::normalizeSpaces(run.characters(), run.length());
     QString string = fromRawDataWithoutRef(sanitized);
 
     QFontMetrics fm(font());
@@ -367,7 +367,7 @@ int Font::offsetForPositionForSimpleText(const TextRun& run, float position, boo
 
 int Font::offsetForPositionForComplexText(const TextRun& run, float position, bool) const
 {
-    String sanitized = Font::normalizeSpaces(String(run.characters(), run.length()));
+    String sanitized = Font::normalizeSpaces(run.characters(), run.length());
     QString string = fromRawDataWithoutRef(sanitized);
 
     QTextLayout layout(string, font());
@@ -378,7 +378,7 @@ int Font::offsetForPositionForComplexText(const TextRun& run, float position, bo
 FloatRect Font::selectionRectForSimpleText(const TextRun& run, const FloatPoint& pt, int h, int from, int to) const
 {
 #if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
-    String sanitized = Font::normalizeSpaces(String(run.characters(), run.length()));
+    String sanitized = Font::normalizeSpaces(run.characters(), run.length());
     QString wholeText = fromRawDataWithoutRef(sanitized);
     QString selectedText = fromRawDataWithoutRef(sanitized, from, qMin(to - from, wholeText.length() - from));
 
@@ -394,7 +394,7 @@ FloatRect Font::selectionRectForSimpleText(const TextRun& run, const FloatPoint&
 
 FloatRect Font::selectionRectForComplexText(const TextRun& run, const FloatPoint& pt, int h, int from, int to) const
 {
-    String sanitized = Font::normalizeSpaces(String(run.characters(), run.length()));
+    String sanitized = Font::normalizeSpaces(run.characters(), run.length());
     QString string = fromRawDataWithoutRef(sanitized);
 
     QTextLayout layout(string, font());
@@ -413,6 +413,11 @@ bool Font::canReturnFallbackFontsForComplexText()
     return false;
 }
 
+bool Font::canExpandAroundIdeographsInComplexText()
+{
+    return false;
+}
+
 bool Font::primaryFontHasGlyphForCharacter(UChar32) const
 {
     notImplemented();
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
index 295212c..8b87f5f 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
@@ -34,7 +34,7 @@
 #include <wtf/UnusedParam.h>
 #include <wtf/text/CString.h>
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 namespace WebCore {
 
@@ -1611,28 +1611,6 @@ void GraphicsContext3D::deleteTexture(Platform3DObject texture)
     glDeleteTextures(1, &texture);
 }
 
-unsigned int GraphicsContext3D::sizeInBytes(GC3Denum type)
-{
-    switch (type) {
-    case GraphicsContext3D::BYTE:
-        return sizeof(GLbyte);
-    case GraphicsContext3D::UNSIGNED_BYTE:
-        return sizeof(GLubyte);
-    case GraphicsContext3D::SHORT:
-        return sizeof(GLshort);
-    case GraphicsContext3D::UNSIGNED_SHORT:
-        return sizeof(GLushort);
-    case GraphicsContext3D::INT:
-        return sizeof(GLint);
-    case GraphicsContext3D::UNSIGNED_INT:
-        return sizeof(GLuint);
-    case GraphicsContext3D::FLOAT:
-        return sizeof(GLfloat);
-    default:
-        return 0;
-    }
-}
-
 void GraphicsContext3D::synthesizeGLError(GC3Denum error)
 {
     m_internal->m_syntheticErrors.add(error);
@@ -1669,6 +1647,10 @@ bool GraphicsContext3D::getImageData(Image* image,
                       format, type, neededAlphaOp, outputVector.data());
 }
 
+void GraphicsContext3D::setContextLostCallback(PassOwnPtr<ContextLostCallback>)
+{
+}
+
 }
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index 4dabe09..bf2826c 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -62,14 +62,11 @@
 #include <QPolygonF>
 #include <QStack>
 #include <QVector>
-
-#ifndef M_PI
-#define M_PI 3.14159265358979323846
-#endif
+#include <wtf/MathExtras.h>
 
 namespace WebCore {
 
-QPainter::CompositionMode GraphicsContext::toQtCompositionMode(CompositeOperator op)
+static inline QPainter::CompositionMode toQtCompositionMode(CompositeOperator op)
 {
     switch (op) {
     case CompositeClear:
@@ -231,8 +228,15 @@ GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate(QPainter* p, cons
     if (!painter)
         return;
 
+#if OS(SYMBIAN)
+    if (painter->paintEngine()->type() == QPaintEngine::OpenVG)
+        antiAliasingForRectsAndLines = true;
+    else
+        antiAliasingForRectsAndLines = painter->testRenderHint(QPainter::Antialiasing);
+#else
     // Use the default the QPainter was constructed with.
     antiAliasingForRectsAndLines = painter->testRenderHint(QPainter::Antialiasing);
+#endif
 
     // Used for default image interpolation quality.
     initialSmoothPixmapTransformHint = painter->testRenderHint(QPainter::SmoothPixmapTransform);
@@ -784,7 +788,7 @@ void GraphicsContext::clipPath(const Path& path, WindRule clipRule)
     p->setClipPath(platformPath, Qt::IntersectClip);
 }
 
-void drawFocusRingForPath(QPainter* p, const QPainterPath& path, int width, const Color& color, bool antiAliasing)
+void drawFocusRingForPath(QPainter* p, const QPainterPath& path, const Color& color, bool antiAliasing)
 {
     const bool antiAlias = p->testRenderHint(QPainter::Antialiasing);
     p->setRenderHint(QPainter::Antialiasing, antiAliasing);
@@ -794,9 +798,8 @@ void drawFocusRingForPath(QPainter* p, const QPainterPath& path, int width, cons
 
     QPen nPen = p->pen();
     nPen.setColor(color);
-    nPen.setWidth(width);
     p->setBrush(Qt::NoBrush);
-    nPen.setStyle(Qt::SolidLine);
+    nPen.setStyle(Qt::DotLine);
 
     p->strokePath(path, nPen);
     p->setBrush(oldBrush);
@@ -805,14 +808,14 @@ void drawFocusRingForPath(QPainter* p, const QPainterPath& path, int width, cons
     p->setRenderHint(QPainter::Antialiasing, antiAlias);
 }
 
-void GraphicsContext::drawFocusRing(const Path& path, int width, int offset, const Color& color)
+void GraphicsContext::drawFocusRing(const Path& path, int /* width */, int offset, const Color& color)
 {
     // FIXME: Use 'offset' for something? http://webkit.org/b/49909
 
     if (paintingDisabled() || !color.isValid())
         return;
 
-    drawFocusRingForPath(m_data->p(), path.platformPath(), width, color, m_data->antiAliasingForRectsAndLines);
+    drawFocusRingForPath(m_data->p(), path.platformPath(), color, m_data->antiAliasingForRectsAndLines);
 }
 
 /**
@@ -840,8 +843,7 @@ void GraphicsContext::drawFocusRing(const Vector<IntRect>& rects, int width, int
         tmpPath.addRoundedRect(rect, radius, radius);
         path = path.united(tmpPath);
     }
-
-    drawFocusRingForPath(m_data->p(), path, width, color, m_data->antiAliasingForRectsAndLines);
+    drawFocusRingForPath(m_data->p(), path, color, m_data->antiAliasingForRectsAndLines);
 }
 
 void GraphicsContext::drawLineForText(const IntPoint& origin, int width, bool)
@@ -896,7 +898,7 @@ FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& frect)
     qreal deviceScaleY = sqrtf(deviceTransform.m21() * deviceTransform.m21() + deviceTransform.m22() * deviceTransform.m22());
 
     QPoint deviceOrigin(frect.x() * deviceScaleX, frect.y() * deviceScaleY);
-    QPoint deviceLowerRight(frect.right() * deviceScaleX, frect.bottom() * deviceScaleY);
+    QPoint deviceLowerRight(frect.maxX() * deviceScaleX, frect.maxY() * deviceScaleY);
 
     // Don't let the height or width round to 0 unless either was originally 0
     if (deviceOrigin.y() == deviceLowerRight.y() && frect.height())
@@ -1135,7 +1137,7 @@ void GraphicsContext::rotate(float radians)
     if (paintingDisabled())
         return;
 
-    m_data->p()->rotate(180 / M_PI*radians);
+    m_data->p()->rotate(rad2deg(qreal(radians)));
 }
 
 void GraphicsContext::scale(const FloatSize& s)
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp
index 75fb427..0d7aa45 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp
@@ -305,7 +305,7 @@ public:
         }
     } m_state;
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
     const GraphicsContext3D* m_gc3D;
 #endif
 
@@ -335,7 +335,7 @@ GraphicsLayerQtImpl::GraphicsLayerQtImpl(GraphicsLayerQt* newLayer)
 #if ENABLE(TILED_BACKING_STORE)
     , m_tiledBackingStore(0)
 #endif
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
     , m_gc3D(0)
 #endif
 {
@@ -529,12 +529,12 @@ void GraphicsLayerQtImpl::updateTransform()
     // have to maintain that ourselves for 3D.
     localTransform
             .translate3d(originX + m_state.pos.x(), originY + m_state.pos.y(), m_state.anchorPoint.z())
-            .multLeft(m_baseTransform)
+            .multiply(m_baseTransform)
             .translate3d(-originX, -originY, -m_state.anchorPoint.z());
 
     // This is the actual 3D transform of this item, with the ancestors' transform baked in.
     m_transformRelativeToRootLayer = TransformationMatrix(parent ? parent->m_transformRelativeToRootLayer : TransformationMatrix())
-                                         .multLeft(localTransform);
+                                         .multiply(localTransform);
 
     // Now we have enough information to determine if the layer is facing backwards.
     if (!m_state.backfaceVisibility && m_transformRelativeToRootLayer.inverse().m33() < 0) {
@@ -562,7 +562,7 @@ void GraphicsLayerQtImpl::updateTransform()
     if (!m_state.childrenTransform.isIdentity()) {
         m_transformRelativeToRootLayer
             .translate(m_size.width() / 2, m_size.height() /2)
-            .multLeft(m_state.childrenTransform)
+            .multiply(m_state.childrenTransform)
             .translate(-m_size.width() / 2, -m_size.height() /2);
     }
 
@@ -647,7 +647,7 @@ void GraphicsLayerQtImpl::paint(QPainter* painter, const QStyleOptionGraphicsIte
     case MediaContentType:
         // we don't need to paint anything: we have a QGraphicsItem from the media element
         break;
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
     case Canvas3DContentType:
         m_gc3D->paint(painter, option->rect);
         break;
@@ -791,7 +791,7 @@ void GraphicsLayerQtImpl::flushChanges(bool recursive, bool forceUpdateTransform
             setFlag(ItemHasNoContents, !m_layer->drawsContent());
             break;
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
         case Canvas3DContentType:
             if (m_pendingContent.contentType != m_currentContent.contentType)
                 update();
@@ -1250,7 +1250,7 @@ void GraphicsLayerQt::setContentsBackgroundColor(const Color& color)
     GraphicsLayer::setContentsBackgroundColor(color);
 }
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 void GraphicsLayerQt::setContentsToGraphicsContext3D(const GraphicsContext3D* ctx)
 {
     if (ctx == m_impl->m_gc3D)
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.h b/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.h
index 8027143..569bd8d 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.h
+++ b/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.h
@@ -20,7 +20,7 @@
 #ifndef GraphicsLayerQt_h
 #define GraphicsLayerQt_h
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 #include "GraphicsContext3D.h"
 #endif
 #include "GraphicsLayer.h"
@@ -79,7 +79,7 @@ public:
     virtual void setContentsNeedsDisplay();
     virtual void setContentsToMedia(PlatformLayer*);
     virtual void setContentsBackgroundColor(const Color&);
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
     virtual void setContentsToGraphicsContext3D(const GraphicsContext3D*);
     virtual void setGraphicsContext3DNeedsDisplay();
 #endif
diff --git a/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp b/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp
index d1567ec..62f5c3e 100644
--- a/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp
@@ -188,7 +188,7 @@ PassRefPtr<ByteArray> getImageData(const IntRect& rect, const ImageBufferData& i
     RefPtr<ByteArray> result = ByteArray::create(rect.width() * rect.height() * 4);
     unsigned char* data = result->data();
 
-    if (rect.x() < 0 || rect.y() < 0 || rect.right() > size.width() || rect.bottom() > size.height())
+    if (rect.x() < 0 || rect.y() < 0 || rect.maxX() > size.width() || rect.maxY() > size.height())
         memset(data, 0, result->length());
 
     int originx = rect.x();
@@ -197,7 +197,7 @@ PassRefPtr<ByteArray> getImageData(const IntRect& rect, const ImageBufferData& i
         destx = -originx;
         originx = 0;
     }
-    int endx = rect.right();
+    int endx = rect.maxX();
     if (endx > size.width())
         endx = size.width();
     int numColumns = endx - originx;
@@ -208,7 +208,7 @@ PassRefPtr<ByteArray> getImageData(const IntRect& rect, const ImageBufferData& i
         desty = -originy;
         originy = 0;
     }
-    int endy = rect.bottom();
+    int endy = rect.maxY();
     if (endy > size.height())
         endy = size.height();
     int numRows = endy - originy;
@@ -302,9 +302,9 @@ void putImageData(ByteArray*& source, const IntSize& sourceSize, const IntRect&
     ASSERT(destx >= 0);
     ASSERT(destx < size.width());
     ASSERT(originx >= 0);
-    ASSERT(originx <= sourceRect.right());
+    ASSERT(originx <= sourceRect.maxX());
 
-    int endx = destPoint.x() + sourceRect.right();
+    int endx = destPoint.x() + sourceRect.maxX();
     ASSERT(endx <= size.width());
 
     int numColumns = endx - destx;
@@ -314,9 +314,9 @@ void putImageData(ByteArray*& source, const IntSize& sourceSize, const IntRect&
     ASSERT(desty >= 0);
     ASSERT(desty < size.height());
     ASSERT(originy >= 0);
-    ASSERT(originy <= sourceRect.bottom());
+    ASSERT(originy <= sourceRect.maxY());
 
-    int endy = destPoint.y() + sourceRect.bottom();
+    int endy = destPoint.y() + sourceRect.maxY();
     ASSERT(endy <= size.height());
     int numRows = endy - desty;
 
diff --git a/Source/WebCore/platform/graphics/qt/ImageDecoderQt.cpp b/Source/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
index 71352e4..3540994 100644
--- a/Source/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
@@ -213,7 +213,7 @@ bool ImageDecoderQt::internalHandleCurrentImage(size_t frameIndex)
 
     // now into the ImageFrame - even if the image is not
     ImageFrame* const buffer = &m_frameBufferCache[frameIndex];
-    buffer->setRect(m_reader->currentImageRect());
+    buffer->setOriginalFrameRect(m_reader->currentImageRect());
     buffer->setStatus(ImageFrame::FrameComplete);
     buffer->setDuration(m_reader->nextImageDelay());
     buffer->setPixmap(pixmap);
diff --git a/Source/WebCore/platform/graphics/qt/ImageQt.cpp b/Source/WebCore/platform/graphics/qt/ImageQt.cpp
index 58f82ef..0c8ce9e 100644
--- a/Source/WebCore/platform/graphics/qt/ImageQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/ImageQt.cpp
@@ -120,11 +120,9 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const
 
     CompositeOperator previousOperator = ctxt->compositeOperation();
 
-    ctxt->setCompositeOperation(op);
-    QPainter* p = ctxt->platformContext();
-    if (!pixmap.hasAlpha() && p->compositionMode() == QPainter::CompositionMode_SourceOver)
-        p->setCompositionMode(QPainter::CompositionMode_Source);
+    ctxt->setCompositeOperation(!pixmap.hasAlpha() && op == CompositeSourceOver ? CompositeCopy : op);
 
+    QPainter* p = ctxt->platformContext();
     QTransform transform(patternTransform);
 
     // If this would draw more than one scaled tile, we scale the pixmap first and then use the result to draw.
@@ -223,15 +221,8 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst,
         return;
     }
 
-    QPainter* painter(ctxt->platformContext());
-
-    QPainter::CompositionMode compositionMode = GraphicsContext::toQtCompositionMode(op);
-
-    if (!image->hasAlpha() && painter->compositionMode() == QPainter::CompositionMode_SourceOver)
-        compositionMode = QPainter::CompositionMode_Source;
-
-    QPainter::CompositionMode lastCompositionMode = painter->compositionMode();
-    painter->setCompositionMode(compositionMode);
+    CompositeOperator previousOperator = ctxt->compositeOperation();
+    ctxt->setCompositeOperation(!image->hasAlpha() && op == CompositeSourceOver ? CompositeCopy : op);
 
     ContextShadow* shadow = ctxt->contextShadow();
     if (shadow->m_type != ContextShadow::NoShadow) {
@@ -243,11 +234,9 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst,
         }
     }
 
-    // Test using example site at
-    // http://www.meyerweb.com/eric/css/edge/complexspiral/demo.html
-    painter->drawPixmap(normalizedDst, *image, normalizedSrc);
+    ctxt->platformContext()->drawPixmap(normalizedDst, *image, normalizedSrc);
 
-    painter->setCompositionMode(lastCompositionMode);
+    ctxt->setCompositeOperation(previousOperator);
 
     if (imageObserver())
         imageObserver()->didDraw(this);
diff --git a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
index b881036..fab4db1 100644
--- a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
+++ b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
@@ -102,7 +102,7 @@ MediaPlayerPrivatePhonon::MediaPlayerPrivatePhonon(MediaPlayer* player)
 
     // Make sure we get updates for each frame
     m_videoWidget->installEventFilter(this);
-    foreach (QWidget* widget, qFindChildren<QWidget*>(m_videoWidget))
+    foreach (QWidget* widget, m_videoWidget->findChildren<QWidget*>())
         widget->installEventFilter(this);
 
     connect(m_mediaObject, SIGNAL(stateChanged(Phonon::State,Phonon::State)),
diff --git a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
index 0a4c0f6..caf9c2d 100644
--- a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
@@ -215,7 +215,7 @@ void MediaPlayerPrivateQt::commitLoad(const String& url)
             // Don't set the header if there are no cookies.
             // This prevents a warning from being emitted.
             if (!cookies.isEmpty())
-                request.setHeader(QNetworkRequest::CookieHeader, qVariantFromValue(cookies));
+                request.setHeader(QNetworkRequest::CookieHeader, QVariant::fromValue(cookies));
 
             // Set the refferer, but not when requesting insecure content from a secure page
             QUrl documentUrl = QUrl(QString(document->documentURI()));
@@ -543,7 +543,7 @@ void MediaPlayerPrivateQt::updateStates()
         m_readyState = MediaPlayer::HaveCurrentData;
     } else if (currentStatus == QMediaPlayer::BufferedMedia
                || currentStatus == QMediaPlayer::EndOfMedia) {
-        m_networkState = MediaPlayer::Idle;
+        m_networkState = MediaPlayer::Loaded;
         m_readyState = MediaPlayer::HaveEnoughData;
     } else if (currentStatus == QMediaPlayer::InvalidMedia) {
         m_networkState = MediaPlayer::NetworkError;
@@ -618,6 +618,21 @@ void MediaPlayerPrivateQt::paint(GraphicsContext* context, const IntRect& rect)
     m_videoScene->render(painter, QRectF(QRect(rect)), m_videoItem->sceneBoundingRect());
 }
 
+void MediaPlayerPrivateQt::paintCurrentFrameInContext(GraphicsContext* context, const IntRect& rect)
+{
+    if (context->paintingDisabled())
+        return;
+
+    if (!m_isVisible)
+        return;
+
+    // Grab the painter and widget
+    QPainter* painter = context->platformContext();
+
+    // Render the video, using the item as it might not be in the scene
+    m_videoItem->paint(painter, 0, 0);
+}
+
 void MediaPlayerPrivateQt::repaint()
 {
     m_webCorePlayer->repaint();
diff --git a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h
index 2621432..e4133db 100644
--- a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h
+++ b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h
@@ -89,6 +89,8 @@ public:
     void setSize(const IntSize&);
 
     void paint(GraphicsContext*, const IntRect&);
+    // reimplemented for canvas drawImage(HTMLVideoElement)
+    void paintCurrentFrameInContext(GraphicsContext*, const IntRect&);
 
     bool supportsFullscreen() const { return true; }
 
diff --git a/Source/WebCore/platform/graphics/qt/PathQt.cpp b/Source/WebCore/platform/graphics/qt/PathQt.cpp
index 571b405..ad482f7 100644
--- a/Source/WebCore/platform/graphics/qt/PathQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/PathQt.cpp
@@ -39,15 +39,9 @@
 #include <QPainterPath>
 #include <QTransform>
 #include <QString>
+#include <wtf/MathExtras.h>
 #include <wtf/OwnPtr.h>
 
-#define _USE_MATH_DEFINES
-#include <math.h>
-
-#ifndef M_PI
-#   define M_PI 3.14159265358979323846
-#endif
-
 namespace WebCore {
 
 Path::Path()
@@ -263,7 +257,6 @@ void Path::closeSubpath()
     m_path.closeSubpath();
 }
 
-#define DEGREES(t) ((t) * 180.0 / M_PI)
 void Path::addArc(const FloatPoint& p, float r, float sar, float ear, bool anticlockwise)
 {
     qreal xc = p.x();
@@ -280,8 +273,8 @@ void Path::addArc(const FloatPoint& p, float r, float sar, float ear, bool antic
     anticlockwise = !anticlockwise;
     //end hack
 
-    float sa = DEGREES(sar);
-    float ea = DEGREES(ear);
+    float sa = rad2deg(sar);
+    float ea = rad2deg(ear);
 
     double span = 0;
 
@@ -438,6 +431,14 @@ float Path::normalAngleAtLength(float length, bool& ok)
     qreal percent = m_path.percentAtLength(length);
     qreal angle = m_path.angleAtPercent(percent);
 
+    // Normalize angle value.
+    // QPainterPath returns angle values with the origo being at the top left corner.
+    // In case of moveTo(0, 0) and addLineTo(0, 10) the angle is 270,
+    // while the caller expects it to be 90.
+    // Normalize the value by mirroring it to the x-axis.
+    // For more info look at pathLengthApplierFunction().
+    if (angle > 0)
+        angle = 360 - angle;
     return angle;
 }
 
diff --git a/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp b/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
index 47ddf02..9e43558 100644
--- a/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
@@ -24,7 +24,7 @@
 #include "config.h"
 #include "SimpleFontData.h"
 
-#include <QFontMetrics>
+#include <QFontMetricsF>
 
 namespace WebCore {
 
@@ -41,25 +41,19 @@ bool SimpleFontData::containsCharacters(const UChar*, int) const
 void SimpleFontData::platformInit()
 {
     if (!m_platformData.size()) {
-         m_ascent = 0;
-         m_descent = 0;
-         m_lineGap = 0;
-         m_lineSpacing = 0;
+         m_fontMetrics.reset();
          m_avgCharWidth = 0;
          m_maxCharWidth = 0;
-         m_xHeight = 0;
-         m_unitsPerEm = 0;
          return;
     }
 
-    QFontMetrics fm(m_platformData.font());
-
-    m_ascent = fm.ascent();
-    m_descent = fm.descent();
-    m_lineSpacing = fm.lineSpacing();
-    m_xHeight = fm.xHeight();
+    QFontMetricsF fm(m_platformData.font());
+    m_fontMetrics.setAscent(fm.ascent());
+    m_fontMetrics.setDescent(fm.descent());
+    m_fontMetrics.setXHeight(fm.xHeight());
+    m_fontMetrics.setLineGap(fm.leading());
+    m_fontMetrics.setLineSpacing(fm.lineSpacing());
     m_spaceWidth = fm.width(QLatin1Char(' '));
-    m_lineGap = fm.leading();
 }
 
 void SimpleFontData::platformGlyphInit()
diff --git a/Source/WebCore/platform/graphics/qt/TransparencyLayer.h b/Source/WebCore/platform/graphics/qt/TransparencyLayer.h
index ff9ef20..f13deb0 100644
--- a/Source/WebCore/platform/graphics/qt/TransparencyLayer.h
+++ b/Source/WebCore/platform/graphics/qt/TransparencyLayer.h
@@ -59,9 +59,8 @@ public:
         painter.setPen(p->pen());
         painter.setBrush(p->brush());
         painter.setTransform(p->transform(), true);
-        painter.setOpacity(p->opacity());
         painter.setFont(p->font());
-        painter.setCompositionMode(p->compositionMode());
+        painter.setOpacity(1);
     }
 
     TransparencyLayer()
diff --git a/Source/WebCore/platform/graphics/skia/FloatRectSkia.cpp b/Source/WebCore/platform/graphics/skia/FloatRectSkia.cpp
index a10371f..23045ba 100644
--- a/Source/WebCore/platform/graphics/skia/FloatRectSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/FloatRectSkia.cpp
@@ -43,7 +43,7 @@ FloatRect::FloatRect(const SkRect& r)
 
 FloatRect::operator SkRect() const
 {
-    SkRect rect = { x(), y(), right(), bottom() };
+    SkRect rect = { x(), y(), maxX(), maxY() };
     return rect;
 }
 
diff --git a/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp b/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp
index 0b31dfa..0e68c21 100644
--- a/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp
+++ b/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp
@@ -65,7 +65,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
 #endif
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation orientation, FontRenderingMode mode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation orientation, FontWidthVariant, FontRenderingMode mode)
 {
 #if OS(WINDOWS)
     ASSERT(m_fontReference);
@@ -114,13 +114,12 @@ FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, b
 // not allow access from CSS.
 static String createUniqueFontName()
 {
-    Vector<char> fontUuid(sizeof(GUID));
-    CoCreateGuid(reinterpret_cast<GUID*>(fontUuid.data()));
+    GUID fontUuid;
+    CoCreateGuid(&fontUuid);
 
-    Vector<char> fontNameVector;
-    base64Encode(fontUuid, fontNameVector);
-    ASSERT(fontNameVector.size() < LF_FACESIZE);
-    return String(fontNameVector.data(), fontNameVector.size());
+    String fontName = base64Encode(reinterpret_cast<char*>(&fontUuid), sizeof(fontUuid));
+    ASSERT(fontName.length() < LF_FACESIZE);
+    return fontName;
 }
 #endif
 
diff --git a/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.h b/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.h
index 4228b40..2dee3ab 100644
--- a/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.h
+++ b/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.h
@@ -34,6 +34,7 @@
 
 #include "FontOrientation.h"
 #include "FontRenderingMode.h"
+#include "FontWidthVariant.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 
@@ -65,7 +66,7 @@ public:
 
     ~FontCustomPlatformData();
 
-    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal,
+    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth,
                                       FontRenderingMode = NormalRenderingMode);
 
     static bool supportsFormat(const String&);
diff --git a/Source/WebCore/platform/graphics/skia/GraphicsContext3DSkia.cpp b/Source/WebCore/platform/graphics/skia/GraphicsContext3DSkia.cpp
index c4b753b..5950c35 100644
--- a/Source/WebCore/platform/graphics/skia/GraphicsContext3DSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/GraphicsContext3DSkia.cpp
@@ -26,7 +26,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "GraphicsContext3D.h"
 
@@ -87,4 +87,4 @@ bool GraphicsContext3D::getImageData(Image* image,
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp b/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
index 1a7112b..9f2ed32 100644
--- a/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
@@ -309,20 +309,6 @@ void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect, int thickness
     platformContext()->clipPathAntiAliased(path);
 }
 
-void GraphicsContext::addPath(const Path& path)
-{
-    if (paintingDisabled())
-        return;
-    platformContext()->addPath(*path.platformPath());
-}
-
-void GraphicsContext::beginPath()
-{
-    if (paintingDisabled())
-        return;
-    platformContext()->beginPath();
-}
-
 void GraphicsContext::clearPlatformShadow()
 {
     if (paintingDisabled())
@@ -431,11 +417,7 @@ void GraphicsContext::clipPath(const Path& pathToClip, WindRule clipRule)
     if (platformContext()->useGPU())
         platformContext()->gpuCanvas()->clipPath(pathToClip);
 
-    // FIXME: Be smarter about this.
-    beginPath();
-    addPath(pathToClip);
-
-    SkPath path = platformContext()->currentPathInLocalCoordinates();
+    SkPath path = *pathToClip.platformPath();
     if (!isPathSkiaSafe(getCTM(), path))
         return;
 
@@ -738,17 +720,13 @@ void GraphicsContext::fillPath(const Path& pathToFill)
     if (paintingDisabled())
         return;
 
-    // FIXME: Be smarter about this.
-    beginPath();
-    addPath(pathToFill);
-
     if (platformContext()->useGPU() && platformContext()->canAccelerate()) {
         platformContext()->prepareForHardwareDraw();
         platformContext()->gpuCanvas()->fillPath(pathToFill);
         return;
     }
 
-    SkPath path = platformContext()->currentPathInLocalCoordinates();
+    SkPath path = *pathToFill.platformPath();
     if (!isPathSkiaSafe(getCTM(), path))
       return;
 
@@ -1204,11 +1182,7 @@ void GraphicsContext::strokePath(const Path& pathToStroke)
     if (paintingDisabled())
         return;
 
-    // FIXME: Be smarter about this.
-    beginPath();
-    addPath(pathToStroke);
-
-    SkPath path = platformContext()->currentPathInLocalCoordinates();
+    SkPath path = *pathToStroke.platformPath();
     if (!isPathSkiaSafe(getCTM(), path))
         return;
 
diff --git a/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp b/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
index 2c489ef..2721523 100644
--- a/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
@@ -2,11 +2,11 @@
  * Copyright (c) 2008, Google Inc. All rights reserved.
  * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
  * Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -16,7 +16,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -162,12 +162,14 @@ void ImageBuffer::platformTransformColorSpace(const Vector<int>& lookUpTable)
 }
 
 template <Multiply multiplied>
-PassRefPtr<ByteArray> getImageData(const IntRect& rect, const SkBitmap& bitmap, 
+PassRefPtr<ByteArray> getImageData(const IntRect& rect, SkDevice& srcDevice,
                                    const IntSize& size)
 {
     RefPtr<ByteArray> result = ByteArray::create(rect.width() * rect.height() * 4);
 
-    if (bitmap.config() == SkBitmap::kNo_Config) {
+    SkBitmap::Config srcConfig = srcDevice.accessBitmap(false).config();
+
+    if (srcConfig == SkBitmap::kNo_Config) {
         // This is an empty SkBitmap that could not be configured.
         ASSERT(!size.width() || !size.height());
         return result.release();
@@ -177,8 +179,8 @@ PassRefPtr<ByteArray> getImageData(const IntRect& rect, const SkBitmap& bitmap,
 
     if (rect.x() < 0
         || rect.y() < 0
-        || rect.right() > size.width()
-        || rect.bottom() > size.height())
+        || rect.maxX() > size.width()
+        || rect.maxY() > size.height())
         memset(data, 0, result->length());
 
     int originX = rect.x();
@@ -187,12 +189,12 @@ PassRefPtr<ByteArray> getImageData(const IntRect& rect, const SkBitmap& bitmap,
         destX = -originX;
         originX = 0;
     }
-    int endX = rect.right();
+    int endX = rect.maxX();
     if (endX > size.width())
         endX = size.width();
     int numColumns = endX - originX;
 
-    if (numColumns <= 0) 
+    if (numColumns <= 0)
         return result.release();
 
     int originY = rect.y();
@@ -201,38 +203,42 @@ PassRefPtr<ByteArray> getImageData(const IntRect& rect, const SkBitmap& bitmap,
         destY = -originY;
         originY = 0;
     }
-    int endY = rect.bottom();
+    int endY = rect.maxY();
     if (endY > size.height())
         endY = size.height();
     int numRows = endY - originY;
 
-    if (numRows <= 0) 
+    if (numRows <= 0)
         return result.release();
 
-    ASSERT(bitmap.config() == SkBitmap::kARGB_8888_Config);
-    SkAutoLockPixels bitmapLock(bitmap);
+    ASSERT(srcConfig == SkBitmap::kARGB_8888_Config);
 
     unsigned destBytesPerRow = 4 * rect.width();
+
+    SkBitmap srcBitmap;
+    srcDevice.readPixels(SkIRect::MakeXYWH(originX, originY, numColumns, numRows), &srcBitmap);
+
     unsigned char* destRow = data + destY * destBytesPerRow + destX * 4;
 
+    // Do conversion of byte order and alpha divide (if necessary)
     for (int y = 0; y < numRows; ++y) {
-        uint32_t* srcRow = bitmap.getAddr32(originX, originY + y);
+        SkPMColor* srcBitmapRow = srcBitmap.getAddr32(0, y);
         for (int x = 0; x < numColumns; ++x) {
+            SkPMColor srcPMColor = srcBitmapRow[x];
             unsigned char* destPixel = &destRow[x * 4];
             if (multiplied == Unmultiplied) {
-                SkColor color = srcRow[x];
-                unsigned a = SkColorGetA(color);
-                destPixel[0] = a ? SkColorGetR(color) * 255 / a : 0;
-                destPixel[1] = a ? SkColorGetG(color) * 255 / a : 0;
-                destPixel[2] = a ? SkColorGetB(color) * 255 / a : 0;
+                unsigned char a = SkGetPackedA32(srcPMColor);
+                destPixel[0] = a ? SkGetPackedR32(srcPMColor) * 255 / a : 0;
+                destPixel[1] = a ? SkGetPackedG32(srcPMColor) * 255 / a : 0;
+                destPixel[2] = a ? SkGetPackedB32(srcPMColor) * 255 / a : 0;
                 destPixel[3] = a;
             } else {
                 // Input and output are both pre-multiplied, we just need to re-arrange the
                 // bytes from the bitmap format to RGBA.
-                destPixel[0] = SkGetPackedR32(srcRow[x]);
-                destPixel[1] = SkGetPackedG32(srcRow[x]);
-                destPixel[2] = SkGetPackedB32(srcRow[x]);
-                destPixel[3] = SkGetPackedA32(srcRow[x]);
+                destPixel[0] = SkGetPackedR32(srcPMColor);
+                destPixel[1] = SkGetPackedG32(srcPMColor);
+                destPixel[2] = SkGetPackedB32(srcPMColor);
+                destPixel[3] = SkGetPackedA32(srcPMColor);
             }
         }
         destRow += destBytesPerRow;
@@ -244,18 +250,18 @@ PassRefPtr<ByteArray> getImageData(const IntRect& rect, const SkBitmap& bitmap,
 PassRefPtr<ByteArray> ImageBuffer::getUnmultipliedImageData(const IntRect& rect) const
 {
     context()->platformContext()->syncSoftwareCanvas();
-    return getImageData<Unmultiplied>(rect, *context()->platformContext()->bitmap(), m_size);
+    return getImageData<Unmultiplied>(rect, *context()->platformContext()->canvas()->getDevice(), m_size);
 }
 
 PassRefPtr<ByteArray> ImageBuffer::getPremultipliedImageData(const IntRect& rect) const
 {
     context()->platformContext()->syncSoftwareCanvas();
-    return getImageData<Premultiplied>(rect, *context()->platformContext()->bitmap(), m_size);
+    return getImageData<Premultiplied>(rect, *context()->platformContext()->canvas()->getDevice(), m_size);
 }
 
 template <Multiply multiplied>
-void putImageData(ByteArray*& source, const IntSize& sourceSize, const IntRect& sourceRect, const IntPoint& destPoint, 
-                  const SkBitmap& bitmap, const IntSize& size)
+void putImageData(ByteArray*& source, const IntSize& sourceSize, const IntRect& sourceRect, const IntPoint& destPoint,
+                  SkDevice* dstDevice, const IntSize& size)
 {
     ASSERT(sourceRect.width() > 0);
     ASSERT(sourceRect.height() > 0);
@@ -265,9 +271,9 @@ void putImageData(ByteArray*& source, const IntSize& sourceSize, const IntRect&
     ASSERT(destX >= 0);
     ASSERT(destX < size.width());
     ASSERT(originX >= 0);
-    ASSERT(originX < sourceRect.right());
+    ASSERT(originX < sourceRect.maxX());
 
-    int endX = destPoint.x() + sourceRect.right();
+    int endX = destPoint.x() + sourceRect.maxX();
     ASSERT(endX <= size.width());
 
     int numColumns = endX - destX;
@@ -277,21 +283,33 @@ void putImageData(ByteArray*& source, const IntSize& sourceSize, const IntRect&
     ASSERT(destY >= 0);
     ASSERT(destY < size.height());
     ASSERT(originY >= 0);
-    ASSERT(originY < sourceRect.bottom());
+    ASSERT(originY < sourceRect.maxY());
 
-    int endY = destPoint.y() + sourceRect.bottom();
+    int endY = destPoint.y() + sourceRect.maxY();
     ASSERT(endY <= size.height());
     int numRows = endY - destY;
 
-    ASSERT(bitmap.config() == SkBitmap::kARGB_8888_Config);
-    SkAutoLockPixels bitmapLock(bitmap);
-
     unsigned srcBytesPerRow = 4 * sourceSize.width();
 
-    const unsigned char* srcRow = source->data() + originY * srcBytesPerRow + originX * 4;
+    SkBitmap deviceBitmap = dstDevice->accessBitmap(true);
+    SkAutoLockPixels deviceAutoLock(deviceBitmap);
 
+    // If the device's bitmap doesn't have pixels we will make a temp and call writePixels on the device.
+    bool temporaryBitmap = !deviceBitmap.getPixels();
+    SkBitmap destBitmap;
+
+    if (temporaryBitmap) {
+        destBitmap.setConfig(SkBitmap::kARGB_8888_Config, numColumns, numRows, srcBytesPerRow);
+        if (!destBitmap.allocPixels())
+            CRASH();
+    } else
+        deviceBitmap.extractSubset(&destBitmap, SkIRect::MakeXYWH(destX, destY, numColumns, numRows));
+
+    // Whether we made a temporary or not destBitmap is always configured to be written at 0,0
+    SkAutoLockPixels destAutoLock(destBitmap);
+    const unsigned char* srcRow = source->data() + originY * srcBytesPerRow + originX * 4;
     for (int y = 0; y < numRows; ++y) {
-        uint32_t* destRow = bitmap.getAddr32(destX, destY + y);
+        SkPMColor* destRow = destBitmap.getAddr32(0, y);
         for (int x = 0; x < numColumns; ++x) {
             const unsigned char* srcPixel = &srcRow[x * 4];
             if (multiplied == Unmultiplied) {
@@ -301,22 +319,26 @@ void putImageData(ByteArray*& source, const IntSize& sourceSize, const IntRect&
                 unsigned char b = SkMulDiv255Ceiling(srcPixel[2], alpha);
                 destRow[x] = SkPackARGB32(alpha, r, g, b);
             } else
-                destRow[x] = SkPackARGB32(srcPixel[3], srcPixel[0],
-                                          srcPixel[1], srcPixel[2]);
+                destRow[x] = SkPackARGB32(srcPixel[3], srcPixel[0], srcPixel[1], srcPixel[2]);
         }
         srcRow += srcBytesPerRow;
     }
+
+    // If we used a temporary then write it to the device
+    if (temporaryBitmap)
+        dstDevice->writePixels(destBitmap, destX, destY);
 }
 
 void ImageBuffer::putUnmultipliedImageData(ByteArray* source, const IntSize& sourceSize, const IntRect& sourceRect, const IntPoint& destPoint)
 {
-    context()->platformContext()->prepareForSoftwareDraw();
-    putImageData<Unmultiplied>(source, sourceSize, sourceRect, destPoint, *context()->platformContext()->bitmap(), m_size);
+    context()->platformContext()->syncSoftwareCanvas();
+    putImageData<Unmultiplied>(source, sourceSize, sourceRect, destPoint, context()->platformContext()->canvas()->getDevice(), m_size);
 }
 
 void ImageBuffer::putPremultipliedImageData(ByteArray* source, const IntSize& sourceSize, const IntRect& sourceRect, const IntPoint& destPoint)
 {
-    putImageData<Premultiplied>(source, sourceSize, sourceRect, destPoint, *context()->platformContext()->bitmap(), m_size);
+    context()->platformContext()->syncSoftwareCanvas();
+    putImageData<Premultiplied>(source, sourceSize, sourceRect, destPoint, context()->platformContext()->canvas()->getDevice(), m_size);
 }
 
 String ImageBuffer::toDataURL(const String& mimeType, const double* quality) const
@@ -324,14 +346,27 @@ String ImageBuffer::toDataURL(const String& mimeType, const double* quality) con
     ASSERT(MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(mimeType));
 
     Vector<unsigned char> encodedImage;
+    SkDevice* device = context()->platformContext()->canvas()->getDevice();
+    SkBitmap bitmap = device->accessBitmap(false);
+
+    // if we can't see the pixels directly, call readPixels() to get a copy.
+    // this could happen if the device is backed by a GPU.
+    bitmap.lockPixels(); // balanced by our destructor, or explicitly if getPixels() fails
+    if (!bitmap.getPixels()) {
+        bitmap.unlockPixels();
+        SkIRect bounds = SkIRect::MakeWH(device->width(), device->height());
+        if (!device->readPixels(bounds, &bitmap))
+            return "data:,";
+    }
+    
     if (mimeType == "image/jpeg") {
         int compressionQuality = JPEGImageEncoder::DefaultCompressionQuality;
         if (quality && *quality >= 0.0 && *quality <= 1.0)
             compressionQuality = static_cast<int>(*quality * 100 + 0.5);
-        if (!JPEGImageEncoder::encode(*context()->platformContext()->bitmap(), compressionQuality, &encodedImage))
+        if (!JPEGImageEncoder::encode(bitmap, compressionQuality, &encodedImage))
             return "data:,";
     } else {
-        if (!PNGImageEncoder::encode(*context()->platformContext()->bitmap(), &encodedImage))
+        if (!PNGImageEncoder::encode(bitmap, &encodedImage))
             return "data:,";
         ASSERT(mimeType == "image/png");
     }
diff --git a/Source/WebCore/platform/graphics/skia/IntRectSkia.cpp b/Source/WebCore/platform/graphics/skia/IntRectSkia.cpp
index ea138ee..0024086 100644
--- a/Source/WebCore/platform/graphics/skia/IntRectSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/IntRectSkia.cpp
@@ -37,14 +37,14 @@ namespace WebCore {
 
 IntRect::operator SkIRect() const
 {
-    SkIRect rect = { x(), y(), right(), bottom() };
+    SkIRect rect = { x(), y(), maxX(), maxY() };
     return rect;
 }
 
 IntRect::operator SkRect() const
 {
     SkRect rect;
-    rect.set(SkIntToScalar(x()), SkIntToScalar(y()), SkIntToScalar(right()), SkIntToScalar(bottom()));
+    rect.set(SkIntToScalar(x()), SkIntToScalar(y()), SkIntToScalar(maxX()), SkIntToScalar(maxY()));
     return rect;
 }
 
diff --git a/Source/WebCore/platform/graphics/skia/PathSkia.cpp b/Source/WebCore/platform/graphics/skia/PathSkia.cpp
index 89323c4..6318c21 100644
--- a/Source/WebCore/platform/graphics/skia/PathSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/PathSkia.cpp
@@ -227,28 +227,20 @@ void Path::transform(const AffineTransform& xform)
     m_path->transform(xform);
 }
 
-// Computes the bounding box for the stroke and style currently selected into
-// the given bounding box. This also takes into account the stroke width.
-static FloatRect boundingBoxForCurrentStroke(const GraphicsContext* context)
-{
-    SkPaint paint;
-    context->platformContext()->setupPaintForStroking(&paint, 0, 0);
-    SkPath boundingPath;
-    paint.getFillPath(context->platformContext()->currentPathInLocalCoordinates(), &boundingPath);
-    return boundingPath.getBounds();
-}
-
 FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier)
 {
     GraphicsContext* scratch = scratchContext();
     scratch->save();
-    scratch->beginPath();
-    scratch->addPath(*this);
 
     if (applier)
         applier->strokeStyle(scratch);
 
-    FloatRect r = boundingBoxForCurrentStroke(scratch);
+    SkPaint paint;
+    scratch->platformContext()->setupPaintForStroking(&paint, 0, 0);
+    SkPath boundingPath;
+    paint.getFillPath(*platformPath(), &boundingPath);
+
+    FloatRect r = boundingPath.getBounds();
     scratch->restore();
     return r;
 }
diff --git a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
index d852e9b..5e08b3c 100644
--- a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
@@ -51,6 +51,12 @@
 #include "SkDashPathEffect.h"
 #include "SkShader.h"
 
+#if ENABLE(SKIA_GPU)
+#include "GrContext.h"
+#include "SkGpuDevice.h"
+#include "SkGpuDeviceFactory.h"
+#endif
+
 #include <wtf/MathExtras.h>
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/Vector.h>
@@ -62,6 +68,18 @@
 
 namespace WebCore {
 
+#if ENABLE(SKIA_GPU)
+GrContext* GetGlobalGrContext()
+{
+    static GrContext* gGR;
+    if (!gGR) {
+        gGR = GrContext::CreateGLShaderContext();
+        gGR->setTextureCacheLimits(512, 50 * 1024 * 1024);
+    }
+    return gGR;
+}
+#endif
+
 extern bool isPathSkiaSafe(const SkMatrix& transform, const SkPath& path);
 
 // State -----------------------------------------------------------------------
@@ -266,7 +284,7 @@ void PlatformContextSkia::beginLayerClippedToImage(const FloatRect& rect,
     // create the resulting image.
     m_state->m_clip = rect;
     SkRect bounds = { SkFloatToScalar(rect.x()), SkFloatToScalar(rect.y()),
-                      SkFloatToScalar(rect.right()), SkFloatToScalar(rect.bottom()) };
+                      SkFloatToScalar(rect.maxX()), SkFloatToScalar(rect.maxY()) };
 
     canvas()->clipRect(bounds);
     canvas()->saveLayerAlpha(&bounds, 255,
@@ -550,38 +568,12 @@ SkColor PlatformContextSkia::effectiveStrokeColor() const
     return m_state->applyAlpha(m_state->m_strokeColor);
 }
 
-void PlatformContextSkia::beginPath()
-{
-    m_path.reset();
-}
-
-void PlatformContextSkia::addPath(const SkPath& path)
-{
-    m_path.addPath(path, m_canvas->getTotalMatrix());
-}
-
-SkPath PlatformContextSkia::currentPathInLocalCoordinates() const
-{
-    SkPath localPath = m_path;
-    const SkMatrix& matrix = m_canvas->getTotalMatrix();
-    SkMatrix inverseMatrix;
-    if (!matrix.invert(&inverseMatrix))
-        return SkPath();
-    localPath.transform(inverseMatrix);
-    return localPath;
-}
-
 void PlatformContextSkia::canvasClipPath(const SkPath& path)
 {
     m_state->m_canvasClipApplied = true;
     m_canvas->clipPath(path);
 }
 
-void PlatformContextSkia::setFillRule(SkPath::FillType fr)
-{
-    m_path.setFillType(fr);
-}
-
 void PlatformContextSkia::setFillShader(SkShader* fillShader)
 {
     if (fillShader)
@@ -625,7 +617,11 @@ const SkBitmap* PlatformContextSkia::bitmap() const
 
 bool PlatformContextSkia::isPrinting()
 {
+#if ENABLE(SKIA_GPU)
+    return true;
+#else
     return m_canvas->getTopPlatformDevice().IsVectorial();
+#endif
 }
 
 void PlatformContextSkia::getImageResamplingHint(IntSize* srcSize, FloatSize* dstSize) const
@@ -739,6 +735,19 @@ void PlatformContextSkia::setSharedGraphicsContext3D(SharedGraphicsContext3D* co
         m_gpuCanvas = new GLES2Canvas(context, drawingBuffer, size);
         m_uploadTexture.clear();
         drawingBuffer->setWillPublishCallback(WillPublishCallbackImpl::create(this));
+
+#if ENABLE(SKIA_GPU)
+        m_useGPU = false;
+        context->makeContextCurrent();
+        m_gpuCanvas->bindFramebuffer();
+
+        GrContext* gr = GetGlobalGrContext();
+        gr->resetContext();
+        SkDeviceFactory* factory = new SkGpuDeviceFactory(gr, SkGpuDevice::Current3DApiRenderTarget());
+        SkDevice* device = factory->newDevice(m_canvas, SkBitmap::kARGB_8888_Config, drawingBuffer->size().width(), drawingBuffer->size().height(), false, false);
+        m_canvas->setDevice(device)->unref();
+        m_canvas->setDeviceFactory(factory);
+#endif
     } else {
         syncSoftwareCanvas();
         m_uploadTexture.clear();
@@ -750,8 +759,13 @@ void PlatformContextSkia::setSharedGraphicsContext3D(SharedGraphicsContext3D* co
 
 void PlatformContextSkia::prepareForSoftwareDraw() const
 {
-    if (!m_useGPU)
+    if (!m_useGPU) {
+#if ENABLE(SKIA_GPU)
+        if (m_gpuCanvas)
+            m_gpuCanvas->context()->makeContextCurrent();
+#endif
         return;
+    }
 
     if (m_backingStoreState == Hardware) {
         // Depending on the blend mode we need to do one of a few things:
@@ -804,8 +818,13 @@ void PlatformContextSkia::prepareForHardwareDraw() const
 
 void PlatformContextSkia::syncSoftwareCanvas() const
 {
-    if (!m_useGPU)
+    if (!m_useGPU) {
+#if ENABLE(SKIA_GPU)
+        if (m_gpuCanvas)
+            m_gpuCanvas->bindFramebuffer();
+#endif
         return;
+    }
 
     if (m_backingStoreState == Hardware)
         readbackHardwareToSoftware();
@@ -865,7 +884,7 @@ void PlatformContextSkia::readbackHardwareToSoftware() const
     const SkBitmap& bitmap = m_canvas->getDevice()->accessBitmap(true);
     SkAutoLockPixels lock(bitmap);
     int width = bitmap.width(), height = bitmap.height();
-    OwnArrayPtr<uint32_t> buf(new uint32_t[width]);
+    OwnArrayPtr<uint32_t> buf = adoptArrayPtr(new uint32_t[width]);
     SharedGraphicsContext3D* context = m_gpuCanvas->context();
     m_gpuCanvas->bindFramebuffer();
     // Flips the image vertically.
diff --git a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.h b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.h
index 0304486..d7dd6a9 100644
--- a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.h
+++ b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.h
@@ -118,7 +118,6 @@ public:
     void setAlpha(float);
     void setLineCap(SkPaint::Cap);
     void setLineJoin(SkPaint::Join);
-    void setFillRule(SkPath::FillType);
     void setXfermodeMode(SkXfermode::Mode);
     void setFillColor(SkColor);
     void setFillShader(SkShader*);
@@ -137,10 +136,6 @@ public:
     float getAlpha() const;
     int getNormalizedAlpha() const;
 
-    void beginPath();
-    void addPath(const SkPath&);
-    SkPath currentPathInLocalCoordinates() const;
-
     void canvasClipPath(const SkPath&);
 
     // Returns the fill color. The returned color has it's alpha adjusted
@@ -220,9 +215,6 @@ private:
     // mStateStack.back().
     State* m_state;
 
-    // Current path in global coordinates.
-    SkPath m_path;
-
     // Stores image sizes for a hint to compute image resampling modes.
     // Values are used in ImageSkia.cpp
     IntSize m_imageResamplingHintSrcSize;
diff --git a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
index 85fa3ee..47a27c6 100644
--- a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
+++ b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
@@ -26,7 +26,7 @@
 #include "Image.h"
 #include "TextureMapperNode.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 #include "GraphicsContext3D.h"
 #endif
 
@@ -73,7 +73,7 @@ public:
     virtual void setContentsToImage(Image*);
     virtual void setContentsToMedia(PlatformLayer*);
     virtual void setContentsBackgroundColor(const Color&);
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
     virtual void setContentsToGraphicsContext3D(const GraphicsContext3D*);
     virtual void setGraphicsContext3DNeedsDisplay();
 #endif
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperNode.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperNode.cpp
index 09051f9..bf53e61 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperNode.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperNode.cpp
@@ -318,7 +318,7 @@ void TextureMapperNode::computeLocalTransform()
     m_transforms.local =
         TransformationMatrix()
         .translate3d(originX + m_state.pos.x(), originY + m_state.pos.y(), m_state.anchorPoint.z())
-        .multLeft(m_state.transform)
+        .multiply(m_state.transform)
         .translate3d(-originX, -originY, -m_state.anchorPoint.z());
     m_transforms.localDirty = false;
 }
@@ -352,7 +352,7 @@ void TextureMapperNode::computeReplicaTransform()
     m_nearestSurfaceSize = nearestSurfaceSize();
 
     if (m_layerType != TransparencyLayer) {
-        m_transforms.replica = TransformationMatrix(m_transforms.target).multLeft(m_state.replicaLayer->m_transforms.local);
+        m_transforms.replica = TransformationMatrix(m_transforms.target).multiply(m_state.replicaLayer->m_transforms.local);
         return;
     }
 
@@ -361,7 +361,7 @@ void TextureMapperNode::computeReplicaTransform()
     m_transforms.replica =
             TransformationMatrix()
                 .translate(originX, originY)
-                .multLeft(m_state.replicaLayer->m_transforms.local)
+                .multiply(m_state.replicaLayer->m_transforms.local)
                 .translate(-originX, -originY);
 }
 
@@ -377,7 +377,7 @@ void TextureMapperNode::computeTransformations()
     TextureMapperNode* parent = m_parent;
     computeLocalTransform();
 
-    m_transforms.target = TransformationMatrix(parent ? parent->m_transforms.forDescendants : TransformationMatrix()).multLeft(m_transforms.local);
+    m_transforms.target = TransformationMatrix(parent ? parent->m_transforms.forDescendants : TransformationMatrix()).multiply(m_transforms.local);
     m_transforms.forDescendants = (m_layerType == ClipLayer ? TransformationMatrix() : m_transforms.target);
 
     if (m_effectTarget)
@@ -408,10 +408,10 @@ void TextureMapperNode::computeTransformations()
     if (m_transforms.perspectiveDirty)
         m_transforms.perspective = TransformationMatrix()
             .translate(centerPoint.x(), centerPoint.y())
-            .multLeft(m_state.childrenTransform)
+            .multiply(m_state.childrenTransform)
             .translate(-centerPoint.x(), -centerPoint.y());
     m_transforms.perspectiveDirty = false;
-    m_transforms.forDescendants.multLeft(m_transforms.perspective);
+    m_transforms.forDescendants.multiply(m_transforms.perspective);
 }
 
 void TextureMapperNode::uploadTextureFromContent(TextureMapper* textureMapper, const IntRect& visibleRect, GraphicsLayer* layer)
diff --git a/Source/WebCore/platform/graphics/transforms/AffineTransform.cpp b/Source/WebCore/platform/graphics/transforms/AffineTransform.cpp
index 3f88140..a1ffa30 100644
--- a/Source/WebCore/platform/graphics/transforms/AffineTransform.cpp
+++ b/Source/WebCore/platform/graphics/transforms/AffineTransform.cpp
@@ -222,14 +222,6 @@ AffineTransform& AffineTransform::translate(double tx, double ty)
     return *this;
 }
 
-// *this = translation * *this
-AffineTransform& AffineTransform::translateRight(double tx, double ty)
-{
-    m_transform[4] += tx;
-    m_transform[5] += ty;
-    return *this;
-}
-
 AffineTransform& AffineTransform::scaleNonUniform(double sx, double sy)
 {
     return scale(sx, sy);
@@ -324,9 +316,9 @@ FloatRect AffineTransform::mapRect(const FloatRect& rect) const
 
     FloatQuad result;
     result.setP1(mapPoint(rect.location()));
-    result.setP2(mapPoint(FloatPoint(rect.right(), rect.y())));
-    result.setP3(mapPoint(FloatPoint(rect.right(), rect.bottom())));
-    result.setP4(mapPoint(FloatPoint(rect.x(), rect.bottom())));
+    result.setP2(mapPoint(FloatPoint(rect.maxX(), rect.y())));
+    result.setP3(mapPoint(FloatPoint(rect.maxX(), rect.maxY())));
+    result.setP4(mapPoint(FloatPoint(rect.x(), rect.maxY())));
     return result.boundingBox();
 }
 
diff --git a/Source/WebCore/platform/graphics/transforms/AffineTransform.h b/Source/WebCore/platform/graphics/transforms/AffineTransform.h
index 50d0655..3e3995f 100644
--- a/Source/WebCore/platform/graphics/transforms/AffineTransform.h
+++ b/Source/WebCore/platform/graphics/transforms/AffineTransform.h
@@ -103,7 +103,6 @@ public:
     AffineTransform& rotate(double d);
     AffineTransform& rotateFromVector(double x, double y);
     AffineTransform& translate(double tx, double ty);
-    AffineTransform& translateRight(double tx, double ty);
     AffineTransform& shear(double sx, double sy);
     AffineTransform& flipX();
     AffineTransform& flipY();
@@ -172,6 +171,11 @@ public:
     operator wxGraphicsMatrix() const;
 #endif
 
+    static AffineTransform translation(double x, double y)
+    {
+        return AffineTransform(1, 0, 0, 1, x, y);
+    }
+
 private:
     void setMatrix(const Transform m)
     {
diff --git a/Source/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.h b/Source/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.h
index 0a0aaf0..dd5dae2 100644
--- a/Source/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.h
+++ b/Source/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.h
@@ -55,7 +55,7 @@ private:
 
     virtual bool apply(TransformationMatrix& transform, const IntSize&) const
     {
-        transform.multLeft(TransformationMatrix(m_matrix));
+        transform.multiply(TransformationMatrix(m_matrix));
         return false;
     }
 
diff --git a/Source/WebCore/platform/graphics/transforms/MatrixTransformOperation.h b/Source/WebCore/platform/graphics/transforms/MatrixTransformOperation.h
index fd9b27e..6f4e725 100644
--- a/Source/WebCore/platform/graphics/transforms/MatrixTransformOperation.h
+++ b/Source/WebCore/platform/graphics/transforms/MatrixTransformOperation.h
@@ -62,7 +62,7 @@ private:
     virtual bool apply(TransformationMatrix& transform, const IntSize&) const
     {
         TransformationMatrix matrix(m_a, m_b, m_c, m_d, m_e, m_f);
-        transform.multLeft(TransformationMatrix(matrix));
+        transform.multiply(matrix);
         return false;
     }
 
diff --git a/Source/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.cpp b/Source/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.cpp
index 9fd03a1..18bfe37 100644
--- a/Source/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.cpp
+++ b/Source/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "PerspectiveTransformOperation.h"
 
-#include <algorithm>
+#include <wtf/MathExtras.h>
 
 using namespace std;
 
@@ -37,22 +37,29 @@ PassRefPtr<TransformOperation> PerspectiveTransformOperation::blend(const Transf
     if (from && !from->isSameType(*this))
         return this;
     
-    if (blendToIdentity)
-        return PerspectiveTransformOperation::create(m_p + (1. - m_p) * progress);
+    if (blendToIdentity) {
+        double p = m_p.calcFloatValue(1);
+        p = p + (1. - p) * progress; // FIXME: this seems wrong. https://bugs.webkit.org/show_bug.cgi?id=52700
+        return PerspectiveTransformOperation::create(Length(clampToPositiveInteger(p), Fixed));
+    }
     
     const PerspectiveTransformOperation* fromOp = static_cast<const PerspectiveTransformOperation*>(from);
-    double fromP = fromOp ? fromOp->m_p : 0;
-    double toP = m_p;
+    Length fromP = fromOp ? fromOp->m_p : Length(m_p.type());
+    Length toP = m_p;
 
     TransformationMatrix fromT;
     TransformationMatrix toT;
-    fromT.applyPerspective(fromP);
-    toT.applyPerspective(toP);
+    fromT.applyPerspective(fromP.calcFloatValue(1));
+    toT.applyPerspective(toP.calcFloatValue(1));
     toT.blend(fromT, progress);
     TransformationMatrix::DecomposedType decomp;
     toT.decompose(decomp);
-    
-    return PerspectiveTransformOperation::create(decomp.perspectiveZ ? -1.0 / decomp.perspectiveZ : 0.0);
+
+    if (decomp.perspectiveZ) {
+        double val = -1.0 / decomp.perspectiveZ;
+        return PerspectiveTransformOperation::create(Length(clampToPositiveInteger(val), Fixed));
+    }
+    return PerspectiveTransformOperation::create(Length(0, Fixed));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.h b/Source/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.h
index 834cc83..886d3dc 100644
--- a/Source/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.h
+++ b/Source/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.h
@@ -26,21 +26,22 @@
 #ifndef PerspectiveTransformOperation_h
 #define PerspectiveTransformOperation_h
 
+#include "Length.h"
 #include "TransformOperation.h"
 
 namespace WebCore {
 
 class PerspectiveTransformOperation : public TransformOperation {
 public:
-    static PassRefPtr<PerspectiveTransformOperation> create(double p)
+    static PassRefPtr<PerspectiveTransformOperation> create(const Length& p)
     {
         return adoptRef(new PerspectiveTransformOperation(p));
     }
 
-    double perspective() const { return m_p; }
+    Length perspective() const { return m_p; }
     
 private:
-    virtual bool isIdentity() const { return m_p == 0; }
+    virtual bool isIdentity() const { return m_p.calcFloatValue(1) == 0; }
     virtual OperationType getOperationType() const { return PERSPECTIVE; }
     virtual bool isSameType(const TransformOperation& o) const { return o.getOperationType() == PERSPECTIVE; }
 
@@ -54,18 +55,19 @@ private:
 
     virtual bool apply(TransformationMatrix& transform, const IntSize&) const
     {
-        transform.applyPerspective(m_p);
+        transform.applyPerspective(m_p.calcFloatValue(1));
         return false;
     }
 
     virtual PassRefPtr<TransformOperation> blend(const TransformOperation* from, double progress, bool blendToIdentity = false);
 
-    PerspectiveTransformOperation(double p)
+    PerspectiveTransformOperation(const Length& p)
         : m_p(p)
     {
+        ASSERT(p.isFixed());
     }
 
-    double m_p;
+    Length m_p;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
index 357a140..c7283a5 100644
--- a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
+++ b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
@@ -55,21 +55,17 @@ namespace WebCore {
 // webmasters - are to be held responsible. Basically, don't be a jerk, and remember that anything free comes 
 // with no guarantee.
 
-// A Note About row-major vs. column major matrixes
+// A clarification about the storage of matrix elements
 //
-// The clients of this class (CSSMatrix and SVGMatrix) assume a column-major ordering.
-// That means that when the matrix is initialized with 16 values, the first 4 values
-// go in the 4 rows of the first column, etc. And in the dereferencing calls, the first
-// digit is the column (e.g., m23() is column 2 row 3). Because C++ uses row-major arrays 
-// the internal matrix is stored in row-major order, so m[2][0] means row 2, column 0. This
-// has no bearing on how the matrix is viewed on the outside, since all access is done
-// with function calls. But it does help make the code more clear if you know that.
+// This class uses a 2 dimensional array internally to store the elements of the matrix.  The first index into 
+// the array refers to the column that the element lies in; the second index refers to the row.
 //
-// FIXME: Multiply calls are named for what they do in the internal, row-major world. 
-// multLeft is actually a multRight in a column-major world, and multiply is a multLeft 
-// in a column-major world. For now I've left it that way to avoid too many confusing 
-// changes to the code. In particular AffineTransform uses these same terms for the
-// opposite operations. So we have to be VERY careful when we change them.
+// In other words, this is the layout of the matrix:
+//
+// | m_matrix[0][0] m_matrix[1][0] m_matrix[2][0] m_matrix[3][0] |
+// | m_matrix[0][1] m_matrix[1][1] m_matrix[2][1] m_matrix[3][1] |
+// | m_matrix[0][2] m_matrix[1][2] m_matrix[2][2] m_matrix[3][2] |
+// | m_matrix[0][3] m_matrix[1][3] m_matrix[2][3] m_matrix[3][3] |
 
 typedef double Vector4[4];
 typedef double Vector3[3];
@@ -634,7 +630,7 @@ TransformationMatrix& TransformationMatrix::scaleNonUniform(double sx, double sy
     mat.m_matrix[0][0] = sx;
     mat.m_matrix[1][1] = sy;
 
-    multLeft(mat);
+    multiply(mat);
     return *this;
 }
 
@@ -645,7 +641,7 @@ TransformationMatrix& TransformationMatrix::scale3d(double sx, double sy, double
     mat.m_matrix[1][1] = sy;
     mat.m_matrix[2][2] = sz;
 
-    multLeft(mat);
+    multiply(mat);
     return *this;
 }
 
@@ -732,7 +728,7 @@ TransformationMatrix& TransformationMatrix::rotate3d(double x, double y, double
         mat.m_matrix[3][0] = mat.m_matrix[3][1] = mat.m_matrix[3][2] = 0.0f;
         mat.m_matrix[3][3] = 1.0f;
     }
-    multLeft(mat);
+    multiply(mat);
     return *this;
 }
 
@@ -783,7 +779,7 @@ TransformationMatrix& TransformationMatrix::rotate3d(double rx, double ry, doubl
     mat.m_matrix[3][0] = mat.m_matrix[3][1] = mat.m_matrix[3][2] = 0.0f;
     mat.m_matrix[3][3] = 1.0f;
     
-    rmat.multLeft(mat);
+    rmat.multiply(mat);
 
     rx /= 2.0f;
     sinA = sin(rx);
@@ -803,9 +799,9 @@ TransformationMatrix& TransformationMatrix::rotate3d(double rx, double ry, doubl
     mat.m_matrix[3][0] = mat.m_matrix[3][1] = mat.m_matrix[3][2] = 0.0f;
     mat.m_matrix[3][3] = 1.0f;
     
-    rmat.multLeft(mat);
+    rmat.multiply(mat);
 
-    multLeft(rmat);
+    multiply(rmat);
     return *this;
 }
 
@@ -869,7 +865,7 @@ TransformationMatrix& TransformationMatrix::skew(double sx, double sy)
     mat.m_matrix[0][1] = tan(sy); // note that the y shear goes in the first row
     mat.m_matrix[1][0] = tan(sx); // and the x shear in the second row
 
-    multLeft(mat);
+    multiply(mat);
     return *this;
 }
 
@@ -879,7 +875,7 @@ TransformationMatrix& TransformationMatrix::applyPerspective(double p)
     if (p != 0)
         mat.m_matrix[2][3] = -1/p;
 
-    multLeft(mat);
+    multiply(mat);
     return *this;
 }
 
@@ -896,7 +892,7 @@ TransformationMatrix TransformationMatrix::rectToRect(const FloatRect& from, con
 //
 // *this = mat * *this
 //
-TransformationMatrix& TransformationMatrix::multLeft(const TransformationMatrix& mat)
+TransformationMatrix& TransformationMatrix::multiply(const TransformationMatrix& mat)
 {
     Matrix4 tmp;
     
@@ -1105,25 +1101,25 @@ void TransformationMatrix::recompose(const DecomposedType& decomp)
                            2 * (xz - yw), 2 * (yz + xw), 1 - 2 * (xx + yy), 0,
                            0, 0, 0, 1);
     
-    multLeft(rotationMatrix);
+    multiply(rotationMatrix);
     
     // now apply skew
     if (decomp.skewYZ) {
         TransformationMatrix tmp;
         tmp.setM32((float) decomp.skewYZ);
-        multLeft(tmp);
+        multiply(tmp);
     }
     
     if (decomp.skewXZ) {
         TransformationMatrix tmp;
         tmp.setM31((float) decomp.skewXZ);
-        multLeft(tmp);
+        multiply(tmp);
     }
     
     if (decomp.skewXY) {
         TransformationMatrix tmp;
         tmp.setM21((float) decomp.skewXY);
-        multLeft(tmp);
+        multiply(tmp);
     }
     
     // finally, apply scale
diff --git a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
index c883675..fa27c0e 100644
--- a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
+++ b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
@@ -208,11 +208,8 @@ public:
     void setF(double f) { m_matrix[3][1] = f; }
 
     // this = this * mat
-    TransformationMatrix& multiply(const TransformationMatrix& t) { return *this *= t; }
+    TransformationMatrix& multiply(const TransformationMatrix&);
 
-    // this = mat * this
-    TransformationMatrix& multLeft(const TransformationMatrix& mat);
-    
     TransformationMatrix& scale(double);
     TransformationMatrix& scaleNonUniform(double sx, double sy);
     TransformationMatrix& scale3d(double sx, double sy, double sz);
@@ -296,19 +293,18 @@ public:
     }
 
     bool operator!=(const TransformationMatrix& other) const { return !(*this == other); }
-    
-    // *this = *this * t (i.e., a multRight)
+
+    // *this = *this * t
     TransformationMatrix& operator*=(const TransformationMatrix& t)
     {
-        *this = *this * t;
-        return *this;
+        return multiply(t);
     }
     
-    // result = *this * t (i.e., a multRight)
+    // result = *this * t
     TransformationMatrix operator*(const TransformationMatrix& t) const
     {
-        TransformationMatrix result = t;
-        result.multLeft(*this);
+        TransformationMatrix result = *this;
+        result.multiply(t);
         return result;
     }
 
diff --git a/Source/WebCore/platform/graphics/win/FontCGWin.cpp b/Source/WebCore/platform/graphics/win/FontCGWin.cpp
index 8012722..fe26c43 100644
--- a/Source/WebCore/platform/graphics/win/FontCGWin.cpp
+++ b/Source/WebCore/platform/graphics/win/FontCGWin.cpp
@@ -167,8 +167,12 @@ static void drawGDIGlyphs(GraphicsContext* graphicsContext, const SimpleFontData
         drawIntoBitmap = true;
         // We put slop into this rect, since glyphs can overflow the ascent/descent bounds and the left/right edges.
         // FIXME: Can get glyphs' optical bounds (even from CG) to get this right.
-        int lineGap = font->lineGap();
-        textRect = IntRect(point.x() - (font->ascent() + font->descent()) / 2, point.y() - font->ascent() - lineGap, totalWidth + font->ascent() + font->descent(), font->lineSpacing());
+        const FontMetrics& fontMetrics = font->fontMetrics();
+        int lineGap = fontMetrics.lineGap();
+        textRect = IntRect(point.x() - (fontMetrics.ascent() + fontMetrics.descent()) / 2,
+                           point.y() - fontMetrics.ascent() - lineGap,
+                           totalWidth + fontMetrics.ascent() + fontMetrics.descent(),
+                           fontMetrics.lineSpacing());
         bitmap.set(graphicsContext->createWindowsBitmap(textRect.size()));
         memset(bitmap->buffer(), 255, bitmap->bufferLength());
         hdc = bitmap->hdc();
@@ -288,7 +292,7 @@ static void drawGDIGlyphs(GraphicsContext* graphicsContext, const SimpleFontData
             buffer[i + 2] = fillColor.red();
             buffer[i + 3] = alpha;
         }
-        graphicsContext->drawWindowsBitmap(bitmap.get(), textRect.topLeft());
+        graphicsContext->drawWindowsBitmap(bitmap.get(), textRect.location());
     } else
         graphicsContext->releaseWindowsContext(hdc, textRect, true, false);
 }
diff --git a/Source/WebCore/platform/graphics/win/FontCustomPlatformData.cpp b/Source/WebCore/platform/graphics/win/FontCustomPlatformData.cpp
index 9cae99b..4aee6cd 100644
--- a/Source/WebCore/platform/graphics/win/FontCustomPlatformData.cpp
+++ b/Source/WebCore/platform/graphics/win/FontCustomPlatformData.cpp
@@ -59,7 +59,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
     }
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontRenderingMode renderingMode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontWidthVariant, FontRenderingMode renderingMode)
 {
     ASSERT(m_fontReference);
     ASSERT(T2embedLibrary());
@@ -154,13 +154,12 @@ static unsigned long WINAPIV readEmbedProc(void* stream, void* buffer, unsigned
 // not allow access from CSS.
 static String createUniqueFontName()
 {
-    Vector<char> fontUuid(sizeof(GUID));
-    CoCreateGuid(reinterpret_cast<GUID*>(fontUuid.data()));
+    GUID fontUuid;
+    CoCreateGuid(&fontUuid);
 
-    Vector<char> fontNameVector;
-    base64Encode(fontUuid, fontNameVector);
-    ASSERT(fontNameVector.size() < LF_FACESIZE);
-    return String(fontNameVector.data(), fontNameVector.size());
+    String fontName = base64Encode(reinterpret_cast<char*>(&fontUuid), sizeof(fontUuid));
+    ASSERT(fontName.length() < LF_FACESIZE);
+    return fontName;
 }
 
 FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
diff --git a/Source/WebCore/platform/graphics/win/FontCustomPlatformData.h b/Source/WebCore/platform/graphics/win/FontCustomPlatformData.h
index de33c63..abdb356 100644
--- a/Source/WebCore/platform/graphics/win/FontCustomPlatformData.h
+++ b/Source/WebCore/platform/graphics/win/FontCustomPlatformData.h
@@ -23,6 +23,7 @@
 
 #include "FontOrientation.h"
 #include "FontRenderingMode.h"
+#include "FontWidthVariant.h"
 #include "PlatformString.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
@@ -45,7 +46,7 @@ public:
 
     ~FontCustomPlatformData();
 
-    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontRenderingMode = NormalRenderingMode);
+    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
 
     static bool supportsFormat(const String&);
 
diff --git a/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.cpp b/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.cpp
index c3decbf..fd30a6d 100644
--- a/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.cpp
+++ b/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.cpp
@@ -32,7 +32,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
    cairo_font_face_destroy(m_fontFace);
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontWidthVariant)
 {
     return FontPlatformData(m_fontFace, size, bold, italic);
 }
diff --git a/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.h b/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.h
index 9c67037..ea3ae38 100644
--- a/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.h
+++ b/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.h
@@ -42,7 +42,7 @@ public:
     }
     ~FontCustomPlatformData();
 
-    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal);
+    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth);
 
     static bool supportsFormat(const String&);
 
diff --git a/Source/WebCore/platform/graphics/win/FontWin.cpp b/Source/WebCore/platform/graphics/win/FontWin.cpp
index 2ed9eb3..47c44bc 100644
--- a/Source/WebCore/platform/graphics/win/FontWin.cpp
+++ b/Source/WebCore/platform/graphics/win/FontWin.cpp
@@ -45,6 +45,11 @@ bool Font::canReturnFallbackFontsForComplexText()
     return true;
 }
 
+bool Font::canExpandAroundIdeographsInComplexText()
+{
+    return false;
+}
+
 FloatRect Font::selectionRectForComplexText(const TextRun& run, const FloatPoint& point, int h,
                                             int from, int to) const
 {
@@ -122,8 +127,8 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
     UniscribeController controller(this, run, fallbackFonts);
     controller.advance(run.length());
     if (glyphOverflow) {
-        glyphOverflow->top = max<int>(glyphOverflow->top, ceilf(-controller.minGlyphBoundingBoxY()) - ascent());
-        glyphOverflow->bottom = max<int>(glyphOverflow->bottom, ceilf(controller.maxGlyphBoundingBoxY()) - descent());
+        glyphOverflow->top = max<int>(glyphOverflow->top, ceilf(-controller.minGlyphBoundingBoxY()) - fontMetrics().ascent());
+        glyphOverflow->bottom = max<int>(glyphOverflow->bottom, ceilf(controller.maxGlyphBoundingBoxY()) - fontMetrics().descent());
         glyphOverflow->left = max<int>(0, ceilf(-controller.minGlyphBoundingBoxX()));
         glyphOverflow->right = max<int>(0, ceilf(controller.maxGlyphBoundingBoxX() - controller.runWidthSoFar()));
     }
diff --git a/Source/WebCore/platform/graphics/win/GraphicsContextWin.cpp b/Source/WebCore/platform/graphics/win/GraphicsContextWin.cpp
index f1953e4..bb22024 100644
--- a/Source/WebCore/platform/graphics/win/GraphicsContextWin.cpp
+++ b/Source/WebCore/platform/graphics/win/GraphicsContextWin.cpp
@@ -154,7 +154,7 @@ void GraphicsContextPlatformPrivate::clip(const FloatRect& clipRect)
 {
     if (!m_hdc)
         return;
-    IntersectClipRect(m_hdc, clipRect.x(), clipRect.y(), clipRect.right(), clipRect.bottom());
+    IntersectClipRect(m_hdc, clipRect.x(), clipRect.y(), clipRect.maxX(), clipRect.maxY());
 }
 
 void GraphicsContextPlatformPrivate::clip(const Path&)
diff --git a/Source/WebCore/platform/graphics/win/IconWin.cpp b/Source/WebCore/platform/graphics/win/IconWin.cpp
index 4d4d219..7e03362 100644
--- a/Source/WebCore/platform/graphics/win/IconWin.cpp
+++ b/Source/WebCore/platform/graphics/win/IconWin.cpp
@@ -25,7 +25,6 @@
 #include "GraphicsContext.h"
 #include "LocalWindowsContext.h"
 #include "PlatformString.h"
-#include <tchar.h>
 #include <windows.h>
 
 #if OS(WINCE)
@@ -68,16 +67,16 @@ PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
 #if OS(WINCE)
     return 0;
 #else
-    TCHAR buffer[MAX_PATH];    
-    UINT length = ::GetSystemDirectory(buffer, WTF_ARRAY_LENGTH(buffer));
+    WCHAR buffer[MAX_PATH];
+    UINT length = ::GetSystemDirectoryW(buffer, WTF_ARRAY_LENGTH(buffer));
     if (!length)
         return 0;
-    
-    if (_tcscat_s(buffer, TEXT("\\shell32.dll")))
+
+    if (wcscat_s(buffer, L"\\shell32.dll"))
         return 0;
 
     HICON hIcon;
-    if (!::ExtractIconEx(buffer, shell32MultipleFileIconIndex, 0, &hIcon, 1))
+    if (!::ExtractIconExW(buffer, shell32MultipleFileIconIndex, 0, &hIcon, 1))
         return 0;
     return adoptRef(new Icon(hIcon));
 #endif
diff --git a/Source/WebCore/platform/graphics/win/IntRectWin.cpp b/Source/WebCore/platform/graphics/win/IntRectWin.cpp
index fe25a7f..6af6735 100644
--- a/Source/WebCore/platform/graphics/win/IntRectWin.cpp
+++ b/Source/WebCore/platform/graphics/win/IntRectWin.cpp
@@ -38,7 +38,7 @@ IntRect::IntRect(const RECT& r)
 
 IntRect::operator RECT() const
 {
-    RECT rect = { x(), y(), right(), bottom() };
+    RECT rect = { x(), y(), maxX(), maxY() };
     return rect;
 }
 
diff --git a/Source/WebCore/platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp b/Source/WebCore/platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp
index 01db7f2..dd3cd32 100644
--- a/Source/WebCore/platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp
+++ b/Source/WebCore/platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp
@@ -34,6 +34,11 @@
 #include <CoreGraphics/CGColor.h>
 #endif
 
+#if USE(ACCELERATED_COMPOSITING)
+#include "CACFLayerTreeHost.h"
+#include "PlatformCALayer.h"
+#endif
+
 namespace WebCore {
 
 MediaPlayerPrivateFullscreenWindow::MediaPlayerPrivateFullscreenWindow(MediaPlayerPrivateFullscreenClient* client)
@@ -47,8 +52,11 @@ MediaPlayerPrivateFullscreenWindow::MediaPlayerPrivateFullscreenWindow(MediaPlay
 
 MediaPlayerPrivateFullscreenWindow::~MediaPlayerPrivateFullscreenWindow()
 {
-    if (m_hwnd)
-        close();
+    if (!m_hwnd)
+        return;
+
+    ::DestroyWindow(m_hwnd);
+    ASSERT(!m_hwnd);
 }
 
 void MediaPlayerPrivateFullscreenWindow::createWindow(HWND parentHwnd)
@@ -65,8 +73,7 @@ void MediaPlayerPrivateFullscreenWindow::createWindow(HWND parentHwnd)
         windowAtom = ::RegisterClassEx(&wcex);
     }
 
-    if (m_hwnd)
-        close();
+    ASSERT(!m_hwnd);
 
     MONITORINFO mi = {0};
     mi.cbSize = sizeof(MONITORINFO);
@@ -87,12 +94,6 @@ void MediaPlayerPrivateFullscreenWindow::createWindow(HWND parentHwnd)
     ::SetFocus(m_hwnd);
 }
 
-void MediaPlayerPrivateFullscreenWindow::close()
-{
-    ::DestroyWindow(m_hwnd);
-    ASSERT(!m_hwnd);
-}
-
 #if USE(ACCELERATED_COMPOSITING)
 void MediaPlayerPrivateFullscreenWindow::setRootChildLayer(PassRefPtr<PlatformCALayer> rootChild)
 {
diff --git a/Source/WebCore/platform/graphics/win/MediaPlayerPrivateFullscreenWindow.h b/Source/WebCore/platform/graphics/win/MediaPlayerPrivateFullscreenWindow.h
index c1ae762..e07bbac 100644
--- a/Source/WebCore/platform/graphics/win/MediaPlayerPrivateFullscreenWindow.h
+++ b/Source/WebCore/platform/graphics/win/MediaPlayerPrivateFullscreenWindow.h
@@ -26,9 +26,10 @@
 #ifndef MediaPlayerPrivateFullscreenWindow_h
 #define MediaPlayerPrivateFullscreenWindow_h
 
+#include <wtf/RefPtr.h>
+
 #if USE(ACCELERATED_COMPOSITING)
-#include "CACFLayerTreeHost.h"
-#include "PlatformCALayer.h"
+#include "CACFLayerTreeHostClient.h"
 #endif
 
 typedef unsigned WPARAM;
@@ -40,6 +41,11 @@ typedef unsigned int UINT;
 
 namespace WebCore {
 
+#if USE(ACCELERATED_COMPOSITING)
+class CACFLayerTreeHost;
+class PlatformCALayer;
+#endif
+
 class MediaPlayerPrivateFullscreenClient {
 public:
     virtual LRESULT fullscreenClientWndProc(HWND, UINT message, WPARAM, LPARAM) = 0;
@@ -53,13 +59,10 @@ public:
     ~MediaPlayerPrivateFullscreenWindow();
 
     void createWindow(HWND ownerWindow);
-    void close();
     
     HWND hwnd() const { return m_hwnd; }
 
 #if USE(ACCELERATED_COMPOSITING)
-    CACFLayerTreeHost* layerView() const { return m_layerTreeHost.get(); }
-
     PlatformCALayer* rootChildLayer() const { return m_rootChild.get(); }
     void setRootChildLayer(PassRefPtr<PlatformCALayer>);
 #endif
diff --git a/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp b/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp
index 0b91455..d47de2b 100644
--- a/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp
+++ b/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp
@@ -1059,7 +1059,7 @@ float MediaPlayerPrivateQuickTimeVisualContext::mediaTimeForTimeValue(float time
     if (m_readyState < MediaPlayer::HaveMetadata || !(timeScale = m_movie->timeScale()))
         return timeValue;
 
-    long mediaTimeValue = static_cast<long>(timeValue * timeScale);
+    long mediaTimeValue = lroundf(timeValue * timeScale);
     return static_cast<float>(mediaTimeValue) / timeScale;
 }
 
diff --git a/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp b/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
index 431d624..07b7621 100644
--- a/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
+++ b/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
@@ -622,7 +622,7 @@ void MediaPlayerPrivate::paint(GraphicsContext* p, const IntRect& r)
 
     m_qtGWorld->paint(hdc, r.x(), r.y());
     if (usingTempBitmap)
-        p->drawWindowsBitmap(bitmap.get(), r.topLeft());
+        p->drawWindowsBitmap(bitmap.get(), r.location());
     else
         p->releaseWindowsContext(hdc, r);
 
diff --git a/Source/WebCore/platform/graphics/win/QTMovie.cpp b/Source/WebCore/platform/graphics/win/QTMovie.cpp
index dfa1d36..4cd8161 100644
--- a/Source/WebCore/platform/graphics/win/QTMovie.cpp
+++ b/Source/WebCore/platform/graphics/win/QTMovie.cpp
@@ -33,7 +33,9 @@
 #include <Movies.h>
 #include <QTML.h>
 #include <QuickTimeComponents.h>
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
 #include <wtf/Assertions.h>
+#include <wtf/MathExtras.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/Vector.h>
 
@@ -46,7 +48,6 @@ static const long subTitleTrackType = 'sbtl';
 static const long mpeg4ObjectDescriptionTrackType = 'odsm';
 static const long mpeg4SceneDescriptionTrackType = 'sdsm';
 static const long closedCaptionDisplayPropertyID = 'disp';
-static LPCTSTR fullscreenQTMoviePointerProp = TEXT("fullscreenQTMoviePointer");
 
 // Resizing GWorlds is slow, give them a minimum size so size of small 
 // videos can be animated smoothly
@@ -60,7 +61,7 @@ union UppParam {
     void* ptr;
 };
 
-static Vector<CFStringRef>* gSupportedTypes = 0;
+static CFMutableArrayRef gSupportedTypes = 0;
 static SInt32 quickTimeVersion = 0;
 
 class QTMoviePrivate : public QTMovieTaskClient {
@@ -374,10 +375,10 @@ void QTMovie::setCurrentTime(float time) const
     m_private->m_seeking = true;
     TimeScale scale = GetMovieTimeScale(m_private->m_movie);
     if (m_private->m_movieController) {
-        QTRestartAtTimeRecord restart = { time * scale , 0 };
+        QTRestartAtTimeRecord restart = { lroundf(time * scale) , 0 };
         MCDoAction(m_private->m_movieController, mcActionRestartAtTime, (void *)&restart);
     } else
-        SetMovieTimeValue(m_private->m_movie, TimeValue(time * scale));
+        SetMovieTimeValue(m_private->m_movie, TimeValue(lroundf(time * scale)));
     QTMovieTask::sharedTask()->updateTaskTimer();
 }
 
@@ -747,112 +748,59 @@ long QTMovie::timeScale() const
     return GetMovieTimeScale(m_private->m_movie);
 }
 
+static void getMIMETypeCallBack(const char* type);
+
 static void initializeSupportedTypes() 
 {
     if (gSupportedTypes)
         return;
 
-    gSupportedTypes = new Vector<CFStringRef>;
+    gSupportedTypes = CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
     if (quickTimeVersion < minimumQuickTimeVersion) {
         LOG_ERROR("QuickTime version %x detected, at least %x required. Returning empty list of supported media MIME types.", quickTimeVersion, minimumQuickTimeVersion);
         return;
     }
 
     // QuickTime doesn't have an importer for video/quicktime. Add it manually.
-    gSupportedTypes->append(CFSTR("video/quicktime"));
-
-    for (int index = 0; index < 2; index++) {
-        ComponentDescription findCD;
-
-        // look at all movie importers that can import in place and are installed. 
-        findCD.componentType = MovieImportType;
-        findCD.componentSubType = 0;
-        findCD.componentManufacturer = 0;
-        findCD.componentFlagsMask = cmpIsMissing | movieImportSubTypeIsFileExtension | canMovieImportInPlace | dontAutoFileMovieImport;
-
-        // look at those registered by HFS file types the first time through, by file extension the second time
-        findCD.componentFlags = canMovieImportInPlace | (index ? movieImportSubTypeIsFileExtension : 0);
-        
-        long componentCount = CountComponents(&findCD);
-        if (!componentCount)
-            continue;
+    CFArrayAppendValue(gSupportedTypes, CFSTR("video/quicktime"));
+    
+    wkGetQuickTimeMIMETypeList(getMIMETypeCallBack);
+}
 
-        Component comp = 0;
-        while (comp = FindNextComponent(comp, &findCD)) {
-            // Does this component have a MIME type container?
-            ComponentDescription infoCD;
-            OSErr err = GetComponentInfo(comp, &infoCD, nil /*name*/, nil /*info*/, nil /*icon*/);
-            if (err)
-                continue;
-            if (!(infoCD.componentFlags & hasMovieImportMIMEList))
-                continue;
-            QTAtomContainer mimeList = 0;
-            err = MovieImportGetMIMETypeList((ComponentInstance)comp, &mimeList);
-            if (err || !mimeList)
-                continue;
+static void getMIMETypeCallBack(const char* type)
+{
+    ASSERT(type);
+    CFStringRef cfType = CFStringCreateWithCString(kCFAllocatorDefault, type, kCFStringEncodingMacRoman);
+    if (!cfType)
+        return;
 
-            // Grab every type from the container.
-            QTLockContainer(mimeList);
-            int typeCount = QTCountChildrenOfType(mimeList, kParentAtomIsContainer, kMimeInfoMimeTypeTag);
-            for (int typeIndex = 1; typeIndex <= typeCount; typeIndex++) {
-                QTAtom mimeTag = QTFindChildByIndex(mimeList, 0, kMimeInfoMimeTypeTag, typeIndex, 0);
-                if (!mimeTag)
-                    continue;
-                char* atomData;
-                long typeLength;
-                if (noErr != QTGetAtomDataPtr(mimeList, mimeTag, &typeLength, &atomData))
-                    continue;
-
-                char typeBuffer[256];
-                if (typeLength >= sizeof(typeBuffer))
-                    continue;
-                memcpy(typeBuffer, atomData, typeLength);
-                typeBuffer[typeLength] = 0;
-
-                // Only add "audio/..." and "video/..." types.
-                if (strncmp(typeBuffer, "audio/", 6) && strncmp(typeBuffer, "video/", 6))
-                    continue;
-
-                CFStringRef cfMimeType = CFStringCreateWithCString(0, typeBuffer, kCFStringEncodingUTF8);
-                if (!cfMimeType)
-                    continue;
-
-                // Only add each type once.
-                bool alreadyAdded = false;
-                for (int addedIndex = 0; addedIndex < gSupportedTypes->size(); addedIndex++) {
-                    CFStringRef type = gSupportedTypes->at(addedIndex);
-                    if (kCFCompareEqualTo == CFStringCompare(cfMimeType, type, kCFCompareCaseInsensitive)) {
-                        alreadyAdded = true;
-                        break;
-                    }
-                }
-                if (!alreadyAdded)
-                    gSupportedTypes->append(cfMimeType);
-                else
-                    CFRelease(cfMimeType);
-            }
-            DisposeHandle(mimeList);
-        }
+    // Filter out all non-audio or -video MIME Types, and only add each type once:
+    if (CFStringHasPrefix(cfType, CFSTR("audio/")) || CFStringHasPrefix(cfType, CFSTR("video/"))) {
+        CFRange range = CFRangeMake(0, CFArrayGetCount(gSupportedTypes));
+        if (!CFArrayContainsValue(gSupportedTypes, range, cfType))
+            CFArrayAppendValue(gSupportedTypes, cfType);
     }
+
+    CFRelease(cfType);
 }
 
 unsigned QTMovie::countSupportedTypes()
 {
     initializeSupportedTypes();
-    return static_cast<unsigned>(gSupportedTypes->size());
+    return static_cast<unsigned>(CFArrayGetCount(gSupportedTypes));
 }
 
 void QTMovie::getSupportedType(unsigned index, const UChar*& str, unsigned& len)
 {
     initializeSupportedTypes();
-    ASSERT(index < gSupportedTypes->size());
+    ASSERT(index < CFArrayGetCount(gSupportedTypes));
 
     // Allocate sufficient buffer to hold any MIME type
     static UniChar* staticBuffer = 0;
     if (!staticBuffer)
         staticBuffer = new UniChar[32];
 
-    CFStringRef cfstr = gSupportedTypes->at(index);
+    CFStringRef cfstr = (CFStringRef)CFArrayGetValueAtIndex(gSupportedTypes, index);
     len = CFStringGetLength(cfstr);
     CFRange range = { 0, len };
     CFStringGetCharacters(cfstr, range, staticBuffer);
diff --git a/Source/WebCore/platform/graphics/win/QTMovieGWorld.cpp b/Source/WebCore/platform/graphics/win/QTMovieGWorld.cpp
index e13f732..4be1bbb 100644
--- a/Source/WebCore/platform/graphics/win/QTMovieGWorld.cpp
+++ b/Source/WebCore/platform/graphics/win/QTMovieGWorld.cpp
@@ -40,7 +40,7 @@ using namespace std;
 
 static const long minimumQuickTimeVersion = 0x07300000; // 7.3
 
-static LPCTSTR fullscreenQTMovieGWorldPointerProp = TEXT("fullscreenQTMovieGWorldPointer");
+static LPCWSTR fullscreenQTMovieGWorldPointerProp = L"fullscreenQTMovieGWorldPointer";
 
 // Resizing GWorlds is slow, give them a minimum size so size of small 
 // videos can be animated smoothly
@@ -378,10 +378,10 @@ bool QTMovieGWorld::isDisabled() const
 
 LRESULT QTMovieGWorld::fullscreenWndProc(HWND wnd, UINT message, WPARAM wParam, LPARAM lParam)
 {
-    QTMovieGWorld* movie = static_cast<QTMovieGWorld*>(GetProp(wnd, fullscreenQTMovieGWorldPointerProp));
+    QTMovieGWorld* movie = static_cast<QTMovieGWorld*>(GetPropW(wnd, fullscreenQTMovieGWorldPointerProp));
 
     if (message == WM_DESTROY)
-        RemoveProp(wnd, fullscreenQTMovieGWorldPointerProp);
+        RemovePropW(wnd, fullscreenQTMovieGWorldPointerProp);
 
     if (!movie)
         return DefWindowProc(wnd, message, wParam, lParam);
@@ -423,7 +423,7 @@ HWND QTMovieGWorld::enterFullscreen(QTMovieGWorldFullscreenClient* client)
 
     // Set the 'this' pointer on the HWND
     HWND wnd = static_cast<HWND>(GetPortNativeWindow(m_private->m_fullscreenWindow));
-    SetProp(wnd, fullscreenQTMovieGWorldPointerProp, static_cast<HANDLE>(this));
+    SetPropW(wnd, fullscreenQTMovieGWorldPointerProp, static_cast<HANDLE>(this));
 
     return wnd;
 }
diff --git a/Source/WebCore/platform/graphics/win/SimpleFontDataCGWin.cpp b/Source/WebCore/platform/graphics/win/SimpleFontDataCGWin.cpp
index 20d42ff..30a931e 100644
--- a/Source/WebCore/platform/graphics/win/SimpleFontDataCGWin.cpp
+++ b/Source/WebCore/platform/graphics/win/SimpleFontDataCGWin.cpp
@@ -29,20 +29,19 @@
 #include "config.h"
 #include "SimpleFontData.h"
 
-#include <winsock2.h>
 #include "Font.h"
 #include "FontCache.h"
 #include "FloatRect.h"
 #include "FontDescription.h"
 #include "PlatformString.h"
-#include <wtf/MathExtras.h>
-#include <wtf/RetainPtr.h>
-#include <unicode/uchar.h>
-#include <unicode/unorm.h>
 #include <ApplicationServices/ApplicationServices.h>
 #include <WebKitSystemInterface/WebKitSystemInterface.h>
 #include <mlang.h>
-#include <tchar.h>
+#include <unicode/uchar.h>
+#include <unicode/unorm.h>
+#include <winsock2.h>
+#include <wtf/MathExtras.h>
+#include <wtf/RetainPtr.h>
 
 namespace WebCore {
 
@@ -64,19 +63,19 @@ void SimpleFontData::platformInit()
     int iAscent = CGFontGetAscent(font);
     int iDescent = CGFontGetDescent(font);
     int iLineGap = CGFontGetLeading(font);
-    m_unitsPerEm = CGFontGetUnitsPerEm(font);
+    unsigned unitsPerEm = CGFontGetUnitsPerEm(font);
     float pointSize = m_platformData.size();
-    float fAscent = scaleEmToUnits(iAscent, m_unitsPerEm) * pointSize;
-    float fDescent = -scaleEmToUnits(iDescent, m_unitsPerEm) * pointSize;
-    float fLineGap = scaleEmToUnits(iLineGap, m_unitsPerEm) * pointSize;
+    float fAscent = scaleEmToUnits(iAscent, unitsPerEm) * pointSize;
+    float fDescent = -scaleEmToUnits(iDescent, unitsPerEm) * pointSize;
+    float fLineGap = scaleEmToUnits(iLineGap, unitsPerEm) * pointSize;
 
     if (!isCustomFont()) {
         HDC dc = GetDC(0);
         HGDIOBJ oldFont = SelectObject(dc, m_platformData.hfont());
         int faceLength = GetTextFace(dc, 0, 0);
-        Vector<TCHAR> faceName(faceLength);
+        Vector<WCHAR> faceName(faceLength);
         GetTextFace(dc, faceLength, faceName.data());
-        m_isSystemFont = !_tcscmp(faceName.data(), _T("Lucida Grande"));
+        m_isSystemFont = !wcscmp(faceName.data(), L"Lucida Grande");
         SelectObject(dc, oldFont);
         ReleaseDC(0, dc);
 
@@ -88,15 +87,15 @@ void SimpleFontData::platformInit()
             // web standard. The AppKit adjustment of 20% is too big and is
             // incorrectly added to line spacing, so we use a 15% adjustment instead
             // and add it to the ascent.
-            if (!_tcscmp(faceName.data(), _T("Times")) || !_tcscmp(faceName.data(), _T("Helvetica")) || !_tcscmp(faceName.data(), _T("Courier")))
+            if (!wcscmp(faceName.data(), L"Times") || !wcscmp(faceName.data(), L"Helvetica") || !wcscmp(faceName.data(), L"Courier"))
                 fAscent += floorf(((fAscent + fDescent) * 0.15f) + 0.5f);
         }
     }
 
-    m_ascent = lroundf(fAscent);
-    m_descent = lroundf(fDescent);
-    m_lineGap = lroundf(fLineGap);
-    m_lineSpacing = m_ascent + m_descent + m_lineGap;
+    m_fontMetrics.setAscent(fAscent);
+    m_fontMetrics.setDescent(fDescent);
+    m_fontMetrics.setLineGap(fLineGap);
+    m_fontMetrics.setLineSpacing(lroundf(fAscent) + lroundf(fDescent) + lroundf(fLineGap));
 
     // Measure the actual character "x", because AppKit synthesizes X height rather than getting it from the font.
     // Unfortunately, NSFont will round this for us so we don't quite get the right value.
@@ -109,11 +108,13 @@ void SimpleFontData::platformInit()
         // and web pages that foolishly use this metric for width will be laid out
         // poorly if we return an accurate height. Classic case is Times 13 point,
         // which has an "x" that is 7x6 pixels.
-        m_xHeight = scaleEmToUnits(max(CGRectGetMaxX(xBox), CGRectGetMaxY(xBox)), m_unitsPerEm) * pointSize;
+        m_fontMetrics.setXHeight(scaleEmToUnits(max(CGRectGetMaxX(xBox), CGRectGetMaxY(xBox)), unitsPerEm) * pointSize);
     } else {
         int iXHeight = CGFontGetXHeight(font);
-        m_xHeight = scaleEmToUnits(iXHeight, m_unitsPerEm) * pointSize;
+        m_fontMetrics.setXHeight(scaleEmToUnits(iXHeight, unitsPerEm) * pointSize);
     }
+
+    m_fontMetrics.setUnitsPerEm(unitsPerEm);
 }
 
 void SimpleFontData::platformCharWidthInit()
@@ -133,7 +134,7 @@ FloatRect SimpleFontData::platformBoundsForGlyph(Glyph glyph) const
     CGRect box;
     CGFontGetGlyphBBoxes(m_platformData.cgFont(), &glyph, 1, &box);
     float pointSize = m_platformData.size();
-    CGFloat scale = pointSize / unitsPerEm();
+    CGFloat scale = pointSize / fontMetrics().unitsPerEm();
     FloatRect boundingBox = CGRectApplyAffineTransform(box, CGAffineTransformMakeScale(scale, -scale));
     if (m_syntheticBoldOffset)
         boundingBox.setWidth(boundingBox.width() + m_syntheticBoldOffset);
diff --git a/Source/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp b/Source/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
index 62ea060..277a13f 100644
--- a/Source/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
+++ b/Source/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
@@ -37,7 +37,6 @@
 #include <cairo.h>
 #include <cairo-win32.h>
 #include <mlang.h>
-#include <tchar.h>
 #include <wtf/MathExtras.h>
 
 namespace WebCore {
@@ -63,13 +62,16 @@ void SimpleFontData::platformInit()
 
     TEXTMETRIC textMetrics;
     GetTextMetrics(hdc, &textMetrics);
-    m_ascent = lroundf(textMetrics.tmAscent * metricsMultiplier);
-    m_descent = lroundf(textMetrics.tmDescent * metricsMultiplier);
-    m_xHeight = m_ascent * 0.56f; // Best guess for xHeight for non-Truetype fonts.
-    m_lineGap = lroundf(textMetrics.tmExternalLeading * metricsMultiplier);
-    m_lineSpacing = m_ascent + m_descent + m_lineGap;
-    m_avgCharWidth = lroundf(textMetrics.tmAveCharWidth * metricsMultiplier);
-    m_maxCharWidth = lroundf(textMetrics.tmMaxCharWidth * metricsMultiplier);
+    float ascent = textMetrics.tmAscent * metricsMultiplier;
+    float descent = textMetrics.tmDescent * metricsMultiplier;
+    float xHeight = ascent * 0.56f; // Best guess for xHeight for non-Truetype fonts.
+    float lineGap = textMetrics.tmExternalLeading * metricsMultiplier;
+    m_fontMetrics.setAscent(ascent);
+    m_fontMetrics.setDescent(descent);
+    m_fontMetrics.setLineGap(lineGap);
+    m_fontMetrics.setLineSpacing(lroundf(ascent) + lroundf(descent) + lroundf(lineGap));
+    m_avgCharWidth = textMetrics.tmAveCharWidth * metricsMultiplier;
+    m_maxCharWidth = textMetrics.tmMaxCharWidth * metricsMultiplier;
 
     OUTLINETEXTMETRIC metrics;
     if (GetOutlineTextMetrics(hdc, sizeof(metrics), &metrics) > 0) {
@@ -78,9 +80,10 @@ void SimpleFontData::platformInit()
         MAT2 mat = { 1, 0, 0, 1 };
         DWORD len = GetGlyphOutline(hdc, 'x', GGO_METRICS, &gm, 0, 0, &mat);
         if (len != GDI_ERROR && gm.gmptGlyphOrigin.y > 0)
-            m_xHeight = gm.gmptGlyphOrigin.y * metricsMultiplier;
+            xHeight = gm.gmptGlyphOrigin.y * metricsMultiplier;
     }
 
+    m_fontMetrics.setXHeight(xHeight);
     cairo_win32_scaled_font_done_font(scaledFont);
 
     m_isSystemFont = false;
diff --git a/Source/WebCore/platform/graphics/win/SimpleFontDataWin.cpp b/Source/WebCore/platform/graphics/win/SimpleFontDataWin.cpp
index 60afe6a..323ff73 100644
--- a/Source/WebCore/platform/graphics/win/SimpleFontDataWin.cpp
+++ b/Source/WebCore/platform/graphics/win/SimpleFontDataWin.cpp
@@ -29,16 +29,15 @@
 #include "config.h"
 #include "SimpleFontData.h"
 
-#include <winsock2.h>
 #include "Font.h"
 #include "FontCache.h"
 #include "FloatRect.h"
 #include "FontDescription.h"
-#include <wtf/MathExtras.h>
+#include <mlang.h>
 #include <unicode/uchar.h>
 #include <unicode/unorm.h>
-#include <mlang.h>
-#include <tchar.h>
+#include <winsock2.h>
+#include <wtf/MathExtras.h>
 
 #if PLATFORM(CG)
 #include <ApplicationServices/ApplicationServices.h>
@@ -66,14 +65,9 @@ bool SimpleFontData::shouldApplyMacAscentHack()
 void SimpleFontData::initGDIFont()
 {
     if (!m_platformData.size()) {
-        m_ascent = 0;
-        m_descent = 0;
-        m_lineGap = 0;
-        m_lineSpacing = 0;
+        m_fontMetrics.reset();
         m_avgCharWidth = 0;
         m_maxCharWidth = 0;
-        m_xHeight = 0;
-        m_unitsPerEm = 0;
         return;
     }
 
@@ -82,21 +76,25 @@ void SimpleFontData::initGDIFont()
      OUTLINETEXTMETRIC metrics;
      GetOutlineTextMetrics(hdc, sizeof(metrics), &metrics);
      TEXTMETRIC& textMetrics = metrics.otmTextMetrics;
-     m_ascent = textMetrics.tmAscent;
-     m_descent = textMetrics.tmDescent;
-     m_lineGap = textMetrics.tmExternalLeading;
-     m_lineSpacing = m_ascent + m_descent + m_lineGap;
+     float ascent = textMetrics.tmAscent;
+     float descent = textMetrics.tmDescent;
+     float lineGap = textMetrics.tmExternalLeading;
+     m_fontMetrics.setAscent(ascent);
+     m_fontMetrics.setDescent(descent);
+     m_fontMetrics.setLineGap(lineGap);
+     m_fontMetrics.setLineSpacing(lroundf(ascent) + lroundf(descent) + lroundf(lineGap));
      m_avgCharWidth = textMetrics.tmAveCharWidth;
      m_maxCharWidth = textMetrics.tmMaxCharWidth;
-     m_xHeight = m_ascent * 0.56f; // Best guess for xHeight if no x glyph is present.
+     float xHeight = ascent * 0.56f; // Best guess for xHeight if no x glyph is present.
 
      GLYPHMETRICS gm;
      MAT2 mat = { 1, 0, 0, 1 };
      DWORD len = GetGlyphOutline(hdc, 'x', GGO_METRICS, &gm, 0, 0, &mat);
      if (len != GDI_ERROR && gm.gmptGlyphOrigin.y > 0)
-         m_xHeight = gm.gmptGlyphOrigin.y;
+         xHeight = gm.gmptGlyphOrigin.y;
 
-     m_unitsPerEm = metrics.otmEMSquare;
+     m_fontMetrics.setXHeight(xHeight);
+     m_fontMetrics.setUnitsPerEm(metrics.otmEMSquare);
 
      SelectObject(hdc, oldFont);
      ReleaseDC(0, hdc);
diff --git a/Source/WebCore/platform/graphics/win/UniscribeController.cpp b/Source/WebCore/platform/graphics/win/UniscribeController.cpp
index dac6c3e..ebbed51 100644
--- a/Source/WebCore/platform/graphics/win/UniscribeController.cpp
+++ b/Source/WebCore/platform/graphics/win/UniscribeController.cpp
@@ -49,7 +49,7 @@ UniscribeController::UniscribeController(const Font* font, const TextRun& run, H
     , m_end(run.length())
     , m_currentCharacter(0)
     , m_runWidthSoFar(0)
-    , m_padding(run.padding())
+    , m_padding(run.expansion())
     , m_computingOffsetPosition(false)
     , m_includePartialGlyphs(false)
     , m_offsetX(0)
@@ -394,9 +394,9 @@ bool UniscribeController::shapeAndPlaceItem(const UChar* cp, unsigned i, const S
         FloatRect glyphBounds = fontData->boundsForGlyph(glyph);
         glyphBounds.move(m_glyphOrigin.x(), m_glyphOrigin.y());
         m_minGlyphBoundingBoxX = min(m_minGlyphBoundingBoxX, glyphBounds.x());
-        m_maxGlyphBoundingBoxX = max(m_maxGlyphBoundingBoxX, glyphBounds.right());
+        m_maxGlyphBoundingBoxX = max(m_maxGlyphBoundingBoxX, glyphBounds.maxX());
         m_minGlyphBoundingBoxY = min(m_minGlyphBoundingBoxY, glyphBounds.y());
-        m_maxGlyphBoundingBoxY = max(m_maxGlyphBoundingBoxY, glyphBounds.bottom());
+        m_maxGlyphBoundingBoxY = max(m_maxGlyphBoundingBoxY, glyphBounds.maxY());
         m_glyphOrigin.move(advance + offsetX, -offsetY);
 
         // Mutate the glyph array to contain our altered advances.
diff --git a/Source/WebCore/platform/graphics/win/WKCAImageQueue.cpp b/Source/WebCore/platform/graphics/win/WKCAImageQueue.cpp
index c2a178b..c8f2116 100644
--- a/Source/WebCore/platform/graphics/win/WKCAImageQueue.cpp
+++ b/Source/WebCore/platform/graphics/win/WKCAImageQueue.cpp
@@ -24,11 +24,11 @@
  */
 
 #include "config.h"
+#include "WKCAImageQueue.h"
 
 #if USE(ACCELERATED_COMPOSITING)
 
-#include "WKCAImageQueue.h"
-
+#include <CoreFoundation/CoreFoundation.h>
 #include <WebKitSystemInterface/WebKitSystemInterface.h>
 #include <wtf/RetainPtr.h>
 
diff --git a/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.cpp b/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.cpp
index f61ae8e..fb97fe1 100644
--- a/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.cpp
+++ b/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.cpp
@@ -45,7 +45,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
         g_customFontCache->unregisterFont(m_name);
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontRenderingMode renderingMode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontWidthVariant, FontRenderingMode renderingMode)
 {
     FontDescription fontDesc;
     fontDesc.setComputedSize(size);
@@ -59,16 +59,14 @@ FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, b
 // not allow access from CSS.
 static String createUniqueFontName()
 {
-    Vector<char> fontUuid(sizeof(GUID));
+    GUID fontUuid;
 
-    unsigned int* ptr = reinterpret_cast<unsigned int*>(fontUuid.data());
+    unsigned int* ptr = reinterpret_cast<unsigned int*>(&fontUuid);
     for (int i = 0; i < sizeof(GUID) / sizeof(int) ; ++i)
         *(ptr + i) = static_cast<unsigned int>(randomNumber() * (std::numeric_limits<unsigned>::max() + 1.0));
 
-    Vector<char> fontNameVector;
-    base64Encode(fontUuid, fontNameVector);
-    ASSERT(fontNameVector.size() < LF_FACESIZE);
-    String fontName(fontNameVector.data(), fontNameVector.size());
+    String fontName = base64Encode(reinterpret_cast<char*>(&fontUuid), sizeof(fontUuid));
+    ASSERT(fontName.length() < LF_FACESIZE);
     return fontName.replace('/', '_');
 }
 
diff --git a/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.h b/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.h
index 0508246..fe7ee94 100644
--- a/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.h
+++ b/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.h
@@ -23,6 +23,7 @@
 
 #include "FontDescription.h"
 #include "FontRenderingMode.h"
+#include "FontWidthVariant.h"
 #include "PlatformString.h"
 #include <wtf/Noncopyable.h>
 
@@ -47,7 +48,7 @@ namespace WebCore {
 
         ~FontCustomPlatformData();
 
-        FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation fontOrientation = Horizontal, FontRenderingMode = NormalRenderingMode);
+        FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
 
         static bool supportsFormat(const String&);
 
diff --git a/Source/WebCore/platform/graphics/wince/FontWinCE.cpp b/Source/WebCore/platform/graphics/wince/FontWinCE.cpp
index 5a4c8da..c3e6ce4 100644
--- a/Source/WebCore/platform/graphics/wince/FontWinCE.cpp
+++ b/Source/WebCore/platform/graphics/wince/FontWinCE.cpp
@@ -86,6 +86,7 @@ public:
 
 TextRunComponent::TextRunComponent(const UChar *start, int length, const TextRun& parentTextRun, const Font &font, int o)
     : m_textRun(start, length, parentTextRun.allowTabs(), 0, 0
+        , parentTextRun.allowsTrailingExpansion() ? TextRun::AllowTrailingExpansion : TextRun::ForbidTrailingExpansion
         , parentTextRun.rtl()
         , parentTextRun.directionalOverride()
         , parentTextRun.applyRunRounding()
@@ -112,7 +113,7 @@ static int generateComponents(TextRunComponents* components, const Font &font, c
 {
     int letterSpacing = font.letterSpacing();
     int wordSpacing = font.wordSpacing();
-    int padding = run.padding();
+    int padding = run.expansion();
     int numSpaces = 0;
     if (padding) {
         for (int i = 0; i < run.length(); i++)
@@ -340,4 +341,9 @@ bool Font::canReturnFallbackFontsForComplexText()
     return false;
 }
 
+bool Font::canExpandAroundIdeographsInComplexText()
+{
+    return false;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/wince/GraphicsContextWinCE.cpp b/Source/WebCore/platform/graphics/wince/GraphicsContextWinCE.cpp
index 9b672d2..7b1c27b 100644
--- a/Source/WebCore/platform/graphics/wince/GraphicsContextWinCE.cpp
+++ b/Source/WebCore/platform/graphics/wince/GraphicsContextWinCE.cpp
@@ -23,7 +23,6 @@
 #include "GraphicsContext.h"
 
 #include "AffineTransform.h"
-#include "CharacterNames.h"
 #include "Font.h"
 #include "GDIExtras.h"
 #include "GlyphBuffer.h"
@@ -33,9 +32,9 @@
 #include "PlatformPathWinCE.h"
 #include "SharedBitmap.h"
 #include "SimpleFontData.h"
-#include <wtf/OwnPtr.h>
-
 #include <windows.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/unicode/CharacterNames.h>
 
 namespace WebCore {
 
@@ -62,7 +61,7 @@ static inline int stableRound(double d)
 // Unlike enclosingIntRect(), this function does strict rounding.
 static inline IntRect roundRect(const FloatRect& r)
 {
-    return IntRect(stableRound(r.x()), stableRound(r.y()), stableRound(r.right()) - stableRound(r.x()), stableRound(r.bottom()) - stableRound(r.y()));
+    return IntRect(stableRound(r.x()), stableRound(r.y()), stableRound(r.maxX()) - stableRound(r.x()), stableRound(r.maxY()) - stableRound(r.y()));
 }
 
 // Rotation transformation
@@ -129,8 +128,8 @@ template<class Transform, class Rect, class Value> static inline Rect mapRect(co
 {
     Value x[4], y[4];
     Value l, t, r, b;
-    r = rect.right() - 1;
-    b = rect.bottom() - 1;
+    r = rect.maxX() - 1;
+    b = rect.maxY() - 1;
     transform.map(rect.x(), rect.y(), x, y);
     transform.map(rect.x(), b, x + 1, y + 1);
     transform.map(r, b, x + 2, y + 2);
@@ -503,10 +502,10 @@ TransparentLayerDC::TransparentLayerDC(GraphicsContextPlatformPrivate* data, Int
             m_rotation.m_postShiftX -= m_origRect.x();
             m_rotation.m_postShiftY -= m_origRect.y();
 
-            FloatPoint topLeft = m_data->m_transform.mapPoint(FloatPoint(rectBeforeTransform->topLeft()));
-            FloatPoint topRight(rectBeforeTransform->right() - 1, rectBeforeTransform->y());
+            FloatPoint topLeft = m_data->m_transform.mapPoint(FloatPoint(rectBeforeTransform->location()));
+            FloatPoint topRight(rectBeforeTransform->maxX() - 1, rectBeforeTransform->y());
             topRight = m_data->m_transform.mapPoint(topRight);
-            FloatPoint bottomLeft(rectBeforeTransform->x(), rectBeforeTransform->bottom() - 1);
+            FloatPoint bottomLeft(rectBeforeTransform->x(), rectBeforeTransform->maxY() - 1);
             bottomLeft = m_data->m_transform.mapPoint(bottomLeft);
             FloatSize sideTop = topRight - topLeft;
             FloatSize sideLeft = bottomLeft - topLeft;
@@ -656,7 +655,7 @@ void GraphicsContext::drawRect(const IntRect& rect)
         if (trRect.height() <= 0)
             trRect.setHeight(1);
 
-        Rectangle(dc, trRect.x(), trRect.y(), trRect.right(), trRect.bottom());
+        Rectangle(dc, trRect.x(), trRect.y(), trRect.maxX(), trRect.maxY());
     }
 
     SelectObject(dc, oldPen);
@@ -726,7 +725,7 @@ void GraphicsContext::drawEllipse(const IntRect& rect)
         oldPen = SelectObject(dc, GetStockObject(NULL_PEN));
 
     if (brush || pen)
-        Ellipse(dc, trRect.x(), trRect.y(), trRect.right(), trRect.bottom());
+        Ellipse(dc, trRect.x(), trRect.y(), trRect.maxX(), trRect.maxY());
 
     SelectObject(dc, oldPen);
     SelectObject(dc, oldBrush);
@@ -839,7 +838,7 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
     }
 
     HGDIOBJ oldBrush = SelectObject(dc, GetStockObject(NULL_BRUSH));
-    Ellipse(dc, trRect.x(), trRect.y(), trRect.right(), trRect.bottom());
+    Ellipse(dc, trRect.x(), trRect.y(), trRect.maxX(), trRect.maxY());
     SelectObject(dc, oldBrush);
 
     if (newClip)
@@ -960,9 +959,9 @@ void GraphicsContext::clip(const FloatRect& rect)
 
     OwnPtr<HRGN> clipRgn(CreateRectRgn(0, 0, 0, 0));
     if (GetClipRgn(m_data->m_dc, clipRgn.get()) > 0)
-        IntersectClipRect(m_data->m_dc, trRect.x(), trRect.y(), trRect.right(), trRect.bottom());
+        IntersectClipRect(m_data->m_dc, trRect.x(), trRect.y(), trRect.maxX(), trRect.maxY());
     else {
-        clipRgn.set(CreateRectRgn(trRect.x(), trRect.y(), trRect.right(), trRect.bottom()));
+        clipRgn.set(CreateRectRgn(trRect.x(), trRect.y(), trRect.maxX(), trRect.maxY()));
         SelectClipRgn(m_data->m_dc, clipRgn.get());
     }
 }
@@ -977,7 +976,7 @@ void GraphicsContext::clipOut(const IntRect& rect)
 
     IntRect trRect = m_data->mapRect(rect);
 
-    ExcludeClipRect(m_data->m_dc, trRect.x(), trRect.y(), trRect.right(), trRect.bottom());
+    ExcludeClipRect(m_data->m_dc, trRect.x(), trRect.y(), trRect.maxX(), trRect.maxY());
 }
 
 void GraphicsContext::drawFocusRing(const Path& path, int width, int offset, const Color& color)
@@ -1093,8 +1092,8 @@ void GraphicsContext::strokeRect(const FloatRect& rect, float width)
     OwnPtr<HPEN> pen = createPen(strokeColor(), strokeThickness(), strokeStyle());
     HGDIOBJ oldPen = SelectObject(dc, pen.get());
 
-    int right = trRect.right() - 1;
-    int bottom = trRect.bottom() - 1;
+    int right = trRect.maxX() - 1;
+    int bottom = trRect.maxY() - 1;
     const POINT intPoints[5] =
     {
         { trRect.x(), trRect.y() },
@@ -1536,8 +1535,8 @@ void GraphicsContext::drawText(const Font& font, const TextRun& run, const IntPo
     float oldOpacity = m_data->m_opacity;
     m_data->m_opacity *= fillColor().alpha() / 255.0;
 
-    FloatRect textRect = font.selectionRectForText(run, point, font.height(), from, to);
-    textRect.setY(textRect.y() - font.ascent());
+    FloatRect textRect = font.selectionRectForText(run, point, font.fontMetrics().height(), from, to);
+    textRect.setY(textRect.y() - font.fontMetrics().ascent());
     IntRect trRect = enclosingIntRect(m_data->mapRect(textRect));
     RECT bmpRect;
     AlphaPaintType alphaPaintType = mustSupportAlpha ? AlphaPaintOther : AlphaPaintNone;
@@ -1546,7 +1545,7 @@ void GraphicsContext::drawText(const Font& font, const TextRun& run, const IntPo
             GraphicsContext gc(0);
             gc.setBitmap(bmp);
             gc.scale(FloatSize(m_data->m_transform.a(), m_data->m_transform.d()));
-            font.drawText(&gc, run, IntPoint(0, font.ascent()), from, to);
+            font.drawText(&gc, run, IntPoint(0, font.fontMetrics().ascent()), from, to);
         }
         unsigned key1;
         HDC memDC = bmp->getDC(&key1);
@@ -1591,7 +1590,7 @@ void GraphicsContext::drawText(const SimpleFontData* fontData, const GlyphBuffer
         ? fontData->platformData().getScaledFontHandle(height, scaleX == scaleY ? 0 : width)
         : 0;
 
-    FloatPoint startPoint(point.x(), point.y() - fontData->ascent());
+    FloatPoint startPoint(point.x(), point.y() - fontData->fontMetrics().ascent());
     FloatPoint trPoint = m_data->mapPoint(startPoint);
     int y = stableRound(trPoint.y());
 
diff --git a/Source/WebCore/platform/graphics/wince/PlatformPathWinCE.cpp b/Source/WebCore/platform/graphics/wince/PlatformPathWinCE.cpp
index 8534f89..8efe661 100644
--- a/Source/WebCore/platform/graphics/wince/PlatformPathWinCE.cpp
+++ b/Source/WebCore/platform/graphics/wince/PlatformPathWinCE.cpp
@@ -119,7 +119,7 @@ static inline void bezier(int segments, Vector<PathPoint>& pts, const PathPoint*
 
 static bool containsPoint(const FloatRect& r, const FloatPoint& p)
 {
-    return p.x() >= r.x() && p.y() >= r.y() && p.x() < r.right() && p.y() < r.bottom();
+    return p.x() >= r.x() && p.y() >= r.y() && p.x() < r.maxX() && p.y() < r.maxY();
 }
 
 static void normalizeAngle(float& angle)
@@ -146,7 +146,7 @@ static void inflateRectToContainPoint(FloatRect& r, float x, float y)
         return;
     }
     if (x < r.x()) {
-        r.setWidth(r.right() - x);
+        r.setWidth(r.maxX() - x);
         r.setX(x);
     } else {
         float w = x - r.x() + 1;
@@ -154,7 +154,7 @@ static void inflateRectToContainPoint(FloatRect& r, float x, float y)
             r.setWidth(w);
     }
     if (y < r.y()) {
-        r.setHeight(r.bottom() - y);
+        r.setHeight(r.maxY() - y);
         r.setY(y);
     } else {
         float h =  y - r.y() + 1;
@@ -740,8 +740,8 @@ void PlatformPath::addRect(const FloatRect& r)
 {
     moveTo(r.location());
 
-    float right = r.right() - 1;
-    float bottom = r.bottom() - 1;
+    float right = r.maxX() - 1;
+    float bottom = r.maxY() - 1;
     addLineTo(FloatPoint(right, r.y()));
     addLineTo(FloatPoint(right, bottom));
     addLineTo(FloatPoint(r.x(), bottom));
diff --git a/Source/WebCore/platform/graphics/wince/SharedBitmap.cpp b/Source/WebCore/platform/graphics/wince/SharedBitmap.cpp
index 168a5e2..2bf0028 100644
--- a/Source/WebCore/platform/graphics/wince/SharedBitmap.cpp
+++ b/Source/WebCore/platform/graphics/wince/SharedBitmap.cpp
@@ -135,7 +135,7 @@ bool SharedBitmap::to16bit()
     int width = newBmpInfo.width();
     int paddedWidth = newBmpInfo.paddedWidth();
     int bufferSize = paddedWidth * newBmpInfo.height();
-    OwnArrayPtr<unsigned> newPixelData(new unsigned[bufferSize / 2]);
+    OwnArrayPtr<unsigned> newPixelData = adoptArrayPtr(new unsigned[bufferSize / 2]);
     void* newPixels = newPixelData.get();
 
     if (!newPixels)
@@ -481,8 +481,8 @@ void SharedBitmap::drawPattern(HDC hdc, const AffineTransform& transform, const
     RECT dstRectWin = {
         stableRound(trRect.x()),
         stableRound(trRect.y()),
-        stableRound(trRect.right()),
-        stableRound(trRect.bottom()),
+        stableRound(trRect.maxX()),
+        stableRound(trRect.maxY()),
     };
     if (dstRectWin.right <= dstRectWin.left || dstRectWin.bottom <= dstRectWin.top)
         return;
@@ -497,8 +497,8 @@ void SharedBitmap::drawPattern(HDC hdc, const AffineTransform& transform, const
     RECT srcRectWin = {
         0,
         0,
-        stableRound(visibleDstRect.right()) - stableRound(visibleDstRect.x()),
-        stableRound(visibleDstRect.bottom()) - stableRound(visibleDstRect.y())
+        stableRound(visibleDstRect.maxX()) - stableRound(visibleDstRect.x()),
+        stableRound(visibleDstRect.maxY()) - stableRound(visibleDstRect.y())
     };
     if (srcRectWin.right <= 0 || srcRectWin.bottom <= 0)
         return;
diff --git a/Source/WebCore/platform/graphics/wince/SimpleFontDataWinCE.cpp b/Source/WebCore/platform/graphics/wince/SimpleFontDataWinCE.cpp
index 27a021e..8abafbd 100644
--- a/Source/WebCore/platform/graphics/wince/SimpleFontDataWinCE.cpp
+++ b/Source/WebCore/platform/graphics/wince/SimpleFontDataWinCE.cpp
@@ -27,7 +27,6 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 #include "config.h"
 #include "SimpleFontData.h"
 
@@ -35,9 +34,8 @@
 #include "Font.h"
 #include "FontCache.h"
 #include "FontDescription.h"
-#include <wtf/MathExtras.h>
 #include <mlang.h>
-#include <tchar.h>
+#include <wtf/MathExtras.h>
 
 namespace WebCore {
 
@@ -51,11 +49,14 @@ void SimpleFontData::platformInit()
     const TEXTMETRIC& tm = m_platformData.metrics();
     m_isSystemFont = m_platformData.isSystemFont();
 
-    m_ascent = (tm.tmAscent * m_platformData.size() + 36) / 72;
-    m_descent = (tm.tmDescent * m_platformData.size() + 36) / 72;
-    m_lineGap = (tm.tmExternalLeading * m_platformData.size() + 36) / 72;
-    m_lineSpacing = m_ascent + m_descent + m_lineGap;
-    m_xHeight = m_ascent * 0.56f;
+    float ascent = (tm.tmAscent * m_platformData.size() + 36) / 72.0f;
+    float descent = (tm.tmDescent * m_platformData.size() + 36) / 72.0f;
+    float lineGap = (tm.tmExternalLeading * m_platformData.size() + 36) / 72.0f;
+    m_fontMetrics.setAscent(ascent);
+    m_fontMetrics.setDescent(descent);
+    m_fontMetrics.setLineGap(lineGap);
+    m_fontMetrics.setLineSpacing(lroundf(ascent) + lroundf(descent) + lroundf(lineGap));
+    m_fontMetrics.setXHeight(ascent * 0.56f);
 }
 
 void SimpleFontData::platformDestroy()
diff --git a/Source/WebCore/platform/graphics/wx/FontCustomPlatformData.cpp b/Source/WebCore/platform/graphics/wx/FontCustomPlatformData.cpp
index 6133372..055f0fc 100644
--- a/Source/WebCore/platform/graphics/wx/FontCustomPlatformData.cpp
+++ b/Source/WebCore/platform/graphics/wx/FontCustomPlatformData.cpp
@@ -31,7 +31,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
 {
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontRenderingMode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontWidthVariant, FontRenderingMode)
 {
     return FontPlatformData(size, bold, italic);
 }
diff --git a/Source/WebCore/platform/graphics/wx/FontCustomPlatformData.h b/Source/WebCore/platform/graphics/wx/FontCustomPlatformData.h
index 86f99b2..c975296 100644
--- a/Source/WebCore/platform/graphics/wx/FontCustomPlatformData.h
+++ b/Source/WebCore/platform/graphics/wx/FontCustomPlatformData.h
@@ -23,7 +23,9 @@
 
 #include "FontOrientation.h"
 #include "FontRenderingMode.h"
+#include "FontWidthVariant.h"
 #include <wtf/Forward.h>
+#include <wtf/Noncopyable.h>
 
 namespace WebCore {
 
@@ -38,7 +40,7 @@ namespace WebCore {
 
         static bool supportsFormat(const String&);
 
-        FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontRenderingMode = NormalRenderingMode);
+        FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
     };
 
     FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer*);
diff --git a/Source/WebCore/platform/graphics/wx/FontPlatformData.h b/Source/WebCore/platform/graphics/wx/FontPlatformData.h
index 9ae8b54..3ef0179 100644
--- a/Source/WebCore/platform/graphics/wx/FontPlatformData.h
+++ b/Source/WebCore/platform/graphics/wx/FontPlatformData.h
@@ -30,6 +30,7 @@
 #define FontPlatformData_h
 
 #include "FontDescription.h"
+#include "FontWidthVariant.h"
 #include "FontOrientation.h"
 #include "StringImpl.h"
 #include <wtf/Forward.h>
@@ -150,6 +151,9 @@ public:
     
     FontOrientation orientation() const { return Horizontal; } // FIXME: Implement.
 
+    // We don't support this yet, so just return the default value for now.
+    FontWidthVariant widthVariant() const { return RegularWidth; }
+
 #if OS(WINDOWS)
     bool useGDI() const;
     HFONT hfont() const;
diff --git a/Source/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp b/Source/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp
index 66c69ee..c125b7c 100644
--- a/Source/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp
+++ b/Source/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp
@@ -126,7 +126,7 @@ unsigned FontPlatformData::computeHash() const
         thisFont->GetStyle(),
         thisFont->GetWeight(),
         thisFont->GetUnderlined(), 
-        StringImpl::computeHash(thisFont->GetFaceName().utf8_str())
+        WTF::StringHasher::createHash(thisFont->GetFaceName().utf8_str().data())
     };
 
     return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
diff --git a/Source/WebCore/platform/graphics/wx/FontWx.cpp b/Source/WebCore/platform/graphics/wx/FontWx.cpp
index c01e249..c48f3c7 100644
--- a/Source/WebCore/platform/graphics/wx/FontWx.cpp
+++ b/Source/WebCore/platform/graphics/wx/FontWx.cpp
@@ -32,6 +32,7 @@
 #include "IntRect.h"
 #include "NotImplemented.h"
 #include "SimpleFontData.h"
+#include "TextRun.h"
 
 #if OS(WINDOWS)
 #include "UniscribeController.h"
@@ -57,6 +58,15 @@ bool Font::canReturnFallbackFontsForComplexText()
 #endif
 }
 
+bool Font::canExpandAroundIdeographsInComplexText()
+{
+#if OS(DARWIN)
+    return true;
+#else
+    return false;
+#endif
+}
+
 void Font::drawGlyphs(GraphicsContext* graphicsContext, const SimpleFontData* font, const GlyphBuffer& glyphBuffer, 
                       int from, int numGlyphs, const FloatPoint& point) const
 {
diff --git a/Source/WebCore/platform/graphics/wx/GraphicsContextWx.cpp b/Source/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
index f1c09c5..991be79 100644
--- a/Source/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
+++ b/Source/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
@@ -515,7 +515,7 @@ void GraphicsContext::fillPath(const Path& path)
 #if USE(WXGC)
     wxGraphicsContext* gc = m_data->context->GetGraphicsContext();
     if (gc)
-        gc->FillPath(path.platformPath());
+        gc->FillPath(*path.platformPath());
 #endif
 }
 
@@ -524,7 +524,7 @@ void GraphicsContext::strokePath(const Path& path)
 #if USE(WXGC)
     wxGraphicsContext* gc = m_data->context->GetGraphicsContext();
     if (gc)
-        gc->StrokePath(path.platformPath());
+        gc->StrokePath(*path.platformPath());
 #endif
 }
 
diff --git a/Source/WebCore/platform/graphics/wx/SimpleFontDataWx.cpp b/Source/WebCore/platform/graphics/wx/SimpleFontDataWx.cpp
index 0e24bfc..4f24e4c 100644
--- a/Source/WebCore/platform/graphics/wx/SimpleFontDataWx.cpp
+++ b/Source/WebCore/platform/graphics/wx/SimpleFontDataWx.cpp
@@ -53,12 +53,12 @@ void SimpleFontData::platformInit()
     wxFont *font = m_platformData.font();
     if (font && font->IsOk()) {
         wxFontProperties props = wxFontProperties(font);
-        m_ascent = props.GetAscent();
-        m_descent = props.GetDescent();
-        m_lineSpacing = props.GetLineSpacing();
-        m_xHeight = props.GetXHeight();
-        m_unitsPerEm = 1; // FIXME!
-        m_lineGap = props.GetLineGap();
+        m_fontMetrics.setAscent(props.GetAscent());
+        m_fontMetrics.setDescent(props.GetDescent());
+        m_fontMetrics.setXHeight(props.GetXHeight());
+        m_fontMetrics.setUnitsPerEm(1); // FIXME!
+        m_fontMetrics.setLineGap(props.GetLineGap());
+        m_fontMetrics.setLineSpacing(props.GetLineSpacing());
     }
 
     m_syntheticBoldOffset = 0.0f;
diff --git a/Source/WebCore/platform/gtk/GtkVersioning.h b/Source/WebCore/platform/gtk/GtkVersioning.h
index 7e9fcd1..70e1bbe 100644
--- a/Source/WebCore/platform/gtk/GtkVersioning.h
+++ b/Source/WebCore/platform/gtk/GtkVersioning.h
@@ -94,7 +94,10 @@ const gchar* gtk_menu_item_get_label(GtkMenuItem*);
 #define gtk_selection_data_get_length(data) (data)->length
 #define gtk_selection_data_get_data(data) (data)->data
 #define gtk_selection_data_get_target(data) (data)->target
-#define gtk_adjustment_set_page_size(adj, value) (adj)->page_size = value
+#define gtk_adjustment_set_page_size(adj, newValue) ((adj)->page_size = newValue)
+#define gtk_adjustment_set_value(adj, newValue) ((adj)->value = newValue)
+#define gtk_adjustment_set_lower(adj, newValue) ((adj)->lower = newValue)
+#define gtk_adjustment_set_upper(adj, newValue) ((adj)->upper = newValue)
 
 void gtk_adjustment_configure(GtkAdjustment* adjustment, gdouble value, gdouble lower, gdouble upper,
                               gdouble stepIncrement, gdouble pageIncrement, gdouble pageSize);
diff --git a/Source/WebCore/platform/gtk/MIMETypeRegistryGtk.cpp b/Source/WebCore/platform/gtk/MIMETypeRegistryGtk.cpp
index 8fc3020..9f7f14c 100644
--- a/Source/WebCore/platform/gtk/MIMETypeRegistryGtk.cpp
+++ b/Source/WebCore/platform/gtk/MIMETypeRegistryGtk.cpp
@@ -28,6 +28,9 @@
 #include "config.h"
 #include "MIMETypeRegistry.h"
 
+#include <wtf/Assertions.h>
+#include <wtf/MainThread.h>
+
 namespace WebCore {
 
 struct ExtensionMap {
@@ -62,6 +65,8 @@ static const ExtensionMap extensionMap [] = {
 
 String MIMETypeRegistry::getMIMETypeForExtension(const String &ext)
 {
+    ASSERT(isMainThread());
+
     String s = ext.lower();
     const ExtensionMap *e = extensionMap;
     while (e->extension) {
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk.cpp b/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
index bfe3901..1e9f159 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
@@ -224,15 +224,47 @@ bool RenderThemeGtk::paintTextArea(RenderObject* o, const PaintInfo& i, const In
     return paintTextField(o, i, r);
 }
 
-static void paintGdkPixbuf(GraphicsContext* context, const GdkPixbuf* icon, const IntPoint& iconPoint)
-{
+static void paintGdkPixbuf(GraphicsContext* context, const GdkPixbuf* icon, const IntRect& iconRect)
+{
+    IntSize iconSize(gdk_pixbuf_get_width(icon), gdk_pixbuf_get_height(icon));
+    if (iconRect.size() != iconSize) {
+        // We could use cairo_scale() here but cairo/pixman downscale quality is quite bad.
+        GRefPtr<GdkPixbuf> scaledIcon = gdk_pixbuf_scale_simple(icon, iconRect.width(), iconRect.height(),
+                                                                GDK_INTERP_BILINEAR);
+        icon = scaledIcon.get();
+    }
+
     cairo_t* cr = context->platformContext();
     cairo_save(cr);
-    gdk_cairo_set_source_pixbuf(cr, icon, iconPoint.x(), iconPoint.y());
+    gdk_cairo_set_source_pixbuf(cr, icon, iconRect.x(), iconRect.y());
     cairo_paint(cr);
     cairo_restore(cr);
 }
 
+// Defined in GTK+ (gtk/gtkiconfactory.c)
+static const gint gtkIconSizeMenu = 16;
+static const gint gtkIconSizeSmallToolbar = 18;
+static const gint gtkIconSizeButton = 20;
+static const gint gtkIconSizeLargeToolbar = 24;
+static const gint gtkIconSizeDnd = 32;
+static const gint gtkIconSizeDialog = 48;
+
+static GtkIconSize getIconSizeForPixelSize(gint pixelSize)
+{
+    if (pixelSize < gtkIconSizeSmallToolbar)
+        return GTK_ICON_SIZE_MENU;
+    if (pixelSize >= gtkIconSizeSmallToolbar && pixelSize < gtkIconSizeButton)
+        return GTK_ICON_SIZE_SMALL_TOOLBAR;
+    if (pixelSize >= gtkIconSizeButton && pixelSize < gtkIconSizeLargeToolbar)
+        return GTK_ICON_SIZE_BUTTON;
+    if (pixelSize >= gtkIconSizeLargeToolbar && pixelSize < gtkIconSizeDnd)
+        return GTK_ICON_SIZE_LARGE_TOOLBAR;
+    if (pixelSize >= gtkIconSizeDnd && pixelSize < gtkIconSizeDialog)
+        return GTK_ICON_SIZE_DND;
+
+    return GTK_ICON_SIZE_DIALOG;
+}
+
 void RenderThemeGtk::adjustSearchFieldResultsButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
 {
     adjustSearchFieldCancelButtonStyle(selector, style, e);
@@ -243,57 +275,77 @@ bool RenderThemeGtk::paintSearchFieldResultsButton(RenderObject* o, const PaintI
     return paintSearchFieldResultsDecoration(o, i, rect);
 }
 
-void RenderThemeGtk::adjustSearchFieldResultsDecorationStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+static void adjustSearchFieldIconStyle(RenderStyle* style)
 {
     style->resetBorder();
     style->resetPadding();
 
+    // Get the icon size based on the font size.
+    int fontSize = style->fontSize();
+    if (fontSize < gtkIconSizeMenu) {
+        style->setWidth(Length(fontSize, Fixed));
+        style->setHeight(Length(fontSize, Fixed));
+        return;
+    }
     gint width = 0, height = 0;
-    gtk_icon_size_lookup(GTK_ICON_SIZE_MENU, &width, &height);
+    gtk_icon_size_lookup(getIconSizeForPixelSize(fontSize), &width, &height);
     style->setWidth(Length(width, Fixed));
     style->setHeight(Length(height, Fixed));
 }
 
-static IntPoint centerRectVerticallyInParentInputElement(RenderObject* object, const IntRect& rect)
+void RenderThemeGtk::adjustSearchFieldResultsDecorationStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+{
+    adjustSearchFieldIconStyle(style);
+}
+
+static IntRect centerRectVerticallyInParentInputElement(RenderObject* renderObject, const IntRect& rect)
 {
-    Node* input = object->node()->shadowAncestorNode(); // Get the renderer of <input> element.
+    // Get the renderer of <input> element.
+    Node* input = renderObject->node()->shadowAncestorNode();
     if (!input->renderer()->isBox())
-        return rect.topLeft();
+        return IntRect();
 
     // If possible center the y-coordinate of the rect vertically in the parent input element.
     // We also add one pixel here to ensure that the y coordinate is rounded up for box heights
     // that are even, which looks in relation to the box text.
     IntRect inputContentBox = toRenderBox(input->renderer())->absoluteContentBox();
 
-    return IntPoint(rect.x(), inputContentBox.y() + (inputContentBox.height() - rect.height() + 1) / 2);
+    // Make sure the scaled decoration stays square and will fit in its parent's box.
+    int iconSize = std::min(inputContentBox.width(), std::min(inputContentBox.height(), rect.height()));
+    IntRect scaledRect(rect.x(), inputContentBox.y() + (inputContentBox.height() - iconSize + 1) / 2, iconSize, iconSize);
+    return scaledRect;
 }
 
 bool RenderThemeGtk::paintSearchFieldResultsDecoration(RenderObject* renderObject, const PaintInfo& paintInfo, const IntRect& rect)
 {
+    IntRect iconRect = centerRectVerticallyInParentInputElement(renderObject, rect);
+    if (iconRect.isEmpty())
+        return false;
+
     GRefPtr<GdkPixbuf> icon = getStockIcon(GTK_TYPE_ENTRY, GTK_STOCK_FIND,
                                            gtkTextDirection(renderObject->style()->direction()),
-                                           gtkIconState(this, renderObject), GTK_ICON_SIZE_MENU);
-    paintGdkPixbuf(paintInfo.context, icon.get(), centerRectVerticallyInParentInputElement(renderObject, rect));
+                                           gtkIconState(this, renderObject),
+                                           getIconSizeForPixelSize(rect.height()));
+    paintGdkPixbuf(paintInfo.context, icon.get(), iconRect);
     return false;
 }
 
 void RenderThemeGtk::adjustSearchFieldCancelButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
 {
-    style->resetBorder();
-    style->resetPadding();
-
-    gint width = 0, height = 0;
-    gtk_icon_size_lookup(GTK_ICON_SIZE_MENU, &width, &height);
-    style->setWidth(Length(width, Fixed));
-    style->setHeight(Length(height, Fixed));
+    adjustSearchFieldIconStyle(style);
 }
 
 bool RenderThemeGtk::paintSearchFieldCancelButton(RenderObject* renderObject, const PaintInfo& paintInfo, const IntRect& rect)
 {
+    IntRect iconRect = centerRectVerticallyInParentInputElement(renderObject, rect);
+    if (iconRect.isEmpty())
+        return false;
+
     GRefPtr<GdkPixbuf> icon = getStockIcon(GTK_TYPE_ENTRY, GTK_STOCK_CLEAR,
                                            gtkTextDirection(renderObject->style()->direction()),
-                                           gtkIconState(this, renderObject), GTK_ICON_SIZE_MENU);
-    paintGdkPixbuf(paintInfo.context, icon.get(), centerRectVerticallyInParentInputElement(renderObject, rect));
+                                           gtkIconState(this, renderObject),
+                                           getIconSizeForPixelSize(rect.height()));
+    paintGdkPixbuf(paintInfo.context, icon.get(), iconRect);
     return false;
 }
 
@@ -316,14 +368,21 @@ bool RenderThemeGtk::paintCapsLockIndicator(RenderObject* renderObject, const Pa
     if (paintInfo.context->paintingDisabled())
         return true;
 
+    int iconSize = std::min(rect.width(), rect.height());
     GRefPtr<GdkPixbuf> icon = getStockIcon(GTK_TYPE_ENTRY, GTK_STOCK_CAPS_LOCK_WARNING,
                                            gtkTextDirection(renderObject->style()->direction()),
-                                           gtkIconState(this, renderObject), GTK_ICON_SIZE_MENU);
+                                           0, getIconSizeForPixelSize(iconSize));
+
+    // Only re-scale the icon when it's smaller than the minimum icon size.
+    if (iconSize >= gtkIconSizeMenu)
+        iconSize = gdk_pixbuf_get_height(icon.get());
 
     // GTK+ locates the icon right aligned in the entry. The given rectangle is already
     // centered vertically by RenderTextControlSingleLine.
-    IntPoint iconPosition(rect.x() + rect.width() - gdk_pixbuf_get_width(icon.get()), rect.y());
-    paintGdkPixbuf(paintInfo.context, icon.get(), iconPosition);
+    IntRect iconRect(rect.x() + rect.width() - iconSize,
+                     rect.y() + (rect.height() - iconSize) / 2,
+                     iconSize, iconSize);
+    paintGdkPixbuf(paintInfo.context, icon.get(), iconRect);
     return true;
 }
 
@@ -421,10 +480,11 @@ bool RenderThemeGtk::paintMediaButton(RenderObject* renderObject, GraphicsContex
                                            gtkTextDirection(renderObject->style()->direction()),
                                            gtkIconState(this, renderObject),
                                            getMediaButtonIconSize(m_mediaIconSize));
-    IntPoint iconPoint(rect.x() + (rect.width() - m_mediaIconSize) / 2,
-                       rect.y() + (rect.height() - m_mediaIconSize) / 2);
+    IntRect iconRect(rect.x() + (rect.width() - m_mediaIconSize) / 2,
+                     rect.y() + (rect.height() - m_mediaIconSize) / 2,
+                     m_mediaIconSize, m_mediaIconSize);
     context->fillRect(FloatRect(rect), m_panelColor, ColorSpaceDeviceRGB);
-    paintGdkPixbuf(context, icon.get(), iconPoint);
+    paintGdkPixbuf(context, icon.get(), iconRect);
     return false;
 }
 
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk.h b/Source/WebCore/platform/gtk/RenderThemeGtk.h
index 5765782..f5e03a9 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk.h
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk.h
@@ -31,11 +31,8 @@
 #include "GRefPtr.h"
 #include "RenderTheme.h"
 
-#ifdef GTK_API_VERSION_2
-#include "gtkdrawing.h"
-#endif
-
 typedef gulong GType;
+typedef struct _GdkColormap GdkColormap;
 
 namespace WebCore {
 
@@ -92,7 +89,8 @@ public:
 #endif
 
 #ifdef GTK_API_VERSION_2
-    GtkWidget* gtkScrollbar();
+    GtkWidget* gtkVScrollbar() const;
+    GtkWidget* gtkHScrollbar() const;
     static void getIndicatorMetrics(ControlPart, int& indicatorSize, int& indicatorSpacing);
 #else
     GtkStyleContext* gtkScrollbarStyle();
@@ -171,6 +169,9 @@ protected:
 
     virtual bool paintCapsLockIndicator(RenderObject*, const PaintInfo&, const IntRect&);
 
+    virtual void adjustInnerSpinButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintInnerSpinButton(RenderObject*, const PaintInfo&, const IntRect&);
+
 private:
     void platformInit();
     static void setTextInputBorders(RenderStyle*);
@@ -195,12 +196,10 @@ private:
 
 #ifdef GTK_API_VERSION_2
     void setupWidgetAndAddToContainer(GtkWidget*, GtkWidget*) const;
-    bool paintRenderObject(GtkThemeWidgetType, RenderObject*, GraphicsContext*, const IntRect&, int flags = 0);
     void refreshComboBoxChildren() const;
     void getComboBoxPadding(RenderStyle*, int& left, int& top, int& right, int& bottom) const;
     int getComboBoxSeparatorWidth() const;
     int comboBoxArrowSize(RenderStyle*) const;
-    GtkThemeParts m_themeParts;
 
     GtkWidget* gtkButton() const;
     GtkWidget* gtkEntry() const;
@@ -216,6 +215,7 @@ private:
     GtkWidget* gtkComboBoxArrow() const;
     GtkWidget* gtkComboBoxSeparator() const;
 
+    GdkColormap* m_colormap;
     mutable GtkWidget* m_gtkWindow;
     mutable GtkWidget* m_gtkContainer;
     mutable GtkWidget* m_gtkButton;
@@ -230,6 +230,8 @@ private:
     mutable GtkWidget* m_gtkComboBoxButton;
     mutable GtkWidget* m_gtkComboBoxArrow;
     mutable GtkWidget* m_gtkComboBoxSeparator;
+    mutable GtkWidget* m_gtkVScrollbar;
+    mutable GtkWidget* m_gtkHScrollbar;
     bool m_themePartsHaveRGBAColormap;
     friend class WidgetRenderingContext;
 #endif
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk2.cpp b/Source/WebCore/platform/gtk/RenderThemeGtk2.cpp
index de4195d..534aa97 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk2.cpp
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk2.cpp
@@ -41,7 +41,6 @@
 #include "TextDirection.h"
 #include "UserAgentStyleSheets.h"
 #include "WidgetRenderingContext.h"
-#include "gtkdrawing.h"
 #include <gdk/gdk.h>
 #include <gtk/gtk.h>
 
@@ -50,7 +49,6 @@ namespace WebCore {
 // This is not a static method, because we want to avoid having GTK+ headers in RenderThemeGtk.h.
 extern GtkTextDirection gtkTextDirection(TextDirection);
 
-static int mozGtkRefCount = 0;
 void RenderThemeGtk::platformInit()
 {
     m_themePartsHaveRGBAColormap = true;
@@ -68,30 +66,18 @@ void RenderThemeGtk::platformInit()
     m_gtkComboBoxButton = 0;
     m_gtkComboBoxArrow = 0;
     m_gtkComboBoxSeparator = 0;
+    m_gtkVScrollbar = 0;
+    m_gtkHScrollbar = 0;
 
-    memset(&m_themeParts, 0, sizeof(GtkThemeParts));
-    GdkColormap* colormap = gdk_screen_get_rgba_colormap(gdk_screen_get_default());
-    if (!colormap) {
+    m_colormap = gdk_screen_get_rgba_colormap(gdk_screen_get_default());
+    if (!m_colormap) {
         m_themePartsHaveRGBAColormap = false;
-        colormap = gdk_screen_get_default_colormap(gdk_screen_get_default());
+        m_colormap = gdk_screen_get_default_colormap(gdk_screen_get_default());
     }
-    m_themeParts.colormap = colormap;
-
-    // Initialize the Mozilla theme drawing code.
-    if (!mozGtkRefCount) {
-        moz_gtk_init();
-        moz_gtk_use_theme_parts(&m_themeParts);
-    }
-    ++mozGtkRefCount;
 }
 
 RenderThemeGtk::~RenderThemeGtk()
 {
-    --mozGtkRefCount;
-
-    if (!mozGtkRefCount)
-        moz_gtk_shutdown();
-
     if (m_gtkWindow)
         gtk_widget_destroy(m_gtkWindow);
 }
@@ -147,34 +133,6 @@ static GtkStateType getGtkStateType(RenderThemeGtk* theme, RenderObject* object)
     return GTK_STATE_NORMAL;
 }
 
-bool RenderThemeGtk::paintRenderObject(GtkThemeWidgetType type, RenderObject* renderObject, GraphicsContext* context, const IntRect& rect, int flags)
-{
-    // Painting is disabled so just claim to have succeeded
-    if (context->paintingDisabled())
-        return false;
-
-    GtkWidgetState widgetState;
-    widgetState.active = isPressed(renderObject);
-    widgetState.focused = isFocused(renderObject);
-
-    // https://bugs.webkit.org/show_bug.cgi?id=18364
-    // The Mozilla theme drawing code, only paints a button as pressed when it's pressed 
-    // while hovered. Until we move away from the Mozila code, work-around the issue by
-    // forcing a pressed button into the hovered state. This ensures that buttons activated
-    // via the keyboard have the proper rendering.
-    widgetState.inHover = isHovered(renderObject) || (type == MOZ_GTK_BUTTON && isPressed(renderObject));
-
-    // FIXME: Disabled does not always give the correct appearance for ReadOnly
-    widgetState.disabled = !isEnabled(renderObject) || isReadOnlyControl(renderObject);
-    widgetState.isDefault = false;
-    widgetState.canDefault = false;
-    widgetState.depressed = false;
-
-    WidgetRenderingContext widgetContext(context, rect);
-    return !widgetContext.paintMozillaWidget(type, &widgetState, flags,
-                                             gtkTextDirection(renderObject->style()->direction()));
-}
-
 static void setToggleSize(const RenderThemeGtk* theme, RenderStyle* style, GtkWidget* widget)
 {
     // The width and height are both specified, so we shouldn't change them.
@@ -608,6 +566,15 @@ bool RenderThemeGtk::paintProgressBar(RenderObject* renderObject, const PaintInf
 }
 #endif
 
+void RenderThemeGtk::adjustInnerSpinButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const
+{
+}
+
+bool RenderThemeGtk::paintInnerSpinButton(RenderObject*, const PaintInfo&, const IntRect&)
+{
+    return true;
+}
+
 GRefPtr<GdkPixbuf> RenderThemeGtk::getStockIcon(GType widgetType, const char* iconName, gint direction, gint state, gint iconSize)
 {
     ASSERT(widgetType == GTK_TYPE_CONTAINER || widgetType == GTK_TYPE_ENTRY);
@@ -708,7 +675,7 @@ GtkWidget* RenderThemeGtk::gtkContainer() const
         return m_gtkContainer;
 
     m_gtkWindow = gtk_window_new(GTK_WINDOW_POPUP);
-    gtk_widget_set_colormap(m_gtkWindow, m_themeParts.colormap);
+    gtk_widget_set_colormap(m_gtkWindow, m_colormap);
     setupWidget(m_gtkWindow);
     gtk_widget_set_name(m_gtkWindow, "MozillaGtkWidget");
 
@@ -882,9 +849,22 @@ GtkWidget* RenderThemeGtk::gtkComboBoxSeparator() const
     return m_gtkComboBoxSeparator;
 }
 
-GtkWidget* RenderThemeGtk::gtkScrollbar()
+GtkWidget* RenderThemeGtk::gtkHScrollbar() const
+{
+    if (m_gtkHScrollbar)
+        return m_gtkHScrollbar;
+    m_gtkHScrollbar = gtk_hscrollbar_new(0);
+    setupWidgetAndAddToContainer(m_gtkHScrollbar, gtkContainer());
+    return m_gtkHScrollbar;
+}
+
+GtkWidget* RenderThemeGtk::gtkVScrollbar() const
 {
-    return moz_gtk_get_scrollbar_widget();
+    if (m_gtkVScrollbar)
+        return m_gtkVScrollbar;
+    m_gtkVScrollbar = gtk_vscrollbar_new(0);
+    setupWidgetAndAddToContainer(m_gtkVScrollbar, gtkContainer());
+    return m_gtkVScrollbar;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk3.cpp b/Source/WebCore/platform/gtk/RenderThemeGtk3.cpp
index 1a9f445..7fa0f04 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk3.cpp
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk3.cpp
@@ -45,6 +45,8 @@ namespace WebCore {
 
 // This is the default value defined by GTK+, where it was defined as MIN_ARROW_SIZE in gtkarrow.c.
 static const int minArrowSize = 15;
+// This is the default value defined by GTK+, where it was defined as MIN_ARROW_WIDTH in gtkspinbutton.c.
+static const int minSpinButtonArrowSize = 6;
 
 typedef HashMap<GType, GRefPtr<GtkStyleContext> > StyleContextMap;
 static StyleContextMap& styleContextMap();
@@ -543,7 +545,7 @@ bool RenderThemeGtk::paintMenuList(RenderObject* renderObject, const PaintInfo&
         cairo_clip(cairoContext);
         gtk_render_line(separatorStyleContext, cairoContext,
                         separatorPosition.x(), separatorPosition.y(),
-                        separatorPosition.x(), innerRect.bottom());
+                        separatorPosition.x(), innerRect.maxY());
         cairo_restore(cairoContext);
     }
 
@@ -720,6 +722,117 @@ bool RenderThemeGtk::paintProgressBar(RenderObject* renderObject, const PaintInf
 }
 #endif
 
+static gint spinButtonArrowSize(GtkStyleContext* context)
+{
+    const PangoFontDescription* fontDescription = gtk_style_context_get_font(context, static_cast<GtkStateFlags>(0));
+    gint fontSize = pango_font_description_get_size(fontDescription);
+    gint arrowSize = max(PANGO_PIXELS(fontSize), minSpinButtonArrowSize);
+
+    return arrowSize - arrowSize % 2; // Force even.
+}
+
+void RenderThemeGtk::adjustInnerSpinButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    GtkStyleContext* context = getStyleContext(GTK_TYPE_SPIN_BUTTON);
+
+    GtkBorder padding;
+    gtk_style_context_get_padding(context, static_cast<GtkStateFlags>(0), &padding);
+
+    int width = spinButtonArrowSize(context) + padding.left + padding.right;
+    style->setWidth(Length(width, Fixed));
+    style->setMinWidth(Length(width, Fixed));
+}
+
+static void paintSpinArrowButton(RenderTheme* theme, GtkStyleContext* context, RenderObject* renderObject, const PaintInfo& paintInfo, const IntRect& rect, GtkArrowType arrowType)
+{
+    ASSERT(arrowType == GTK_ARROW_UP || arrowType == GTK_ARROW_DOWN);
+
+    gtk_style_context_save(context);
+    gtk_style_context_add_class(context, GTK_STYLE_CLASS_BUTTON);
+
+    GtkTextDirection direction = gtk_style_context_get_direction(context);
+    guint state = static_cast<guint>(gtk_style_context_get_state(context));
+    if (!(state & GTK_STATE_FLAG_INSENSITIVE)) {
+        if (theme->isPressed(renderObject)) {
+            if ((arrowType == GTK_ARROW_UP && theme->isSpinUpButtonPartPressed(renderObject))
+                || (arrowType == GTK_ARROW_DOWN && !theme->isSpinUpButtonPartPressed(renderObject)))
+                state |= GTK_STATE_FLAG_ACTIVE;
+        } else if (theme->isHovered(renderObject)) {
+            if ((arrowType == GTK_ARROW_UP && theme->isSpinUpButtonPartHovered(renderObject))
+                || (arrowType == GTK_ARROW_DOWN && !theme->isSpinUpButtonPartHovered(renderObject)))
+                state |= GTK_STATE_FLAG_PRELIGHT;
+        }
+    }
+    gtk_style_context_set_state(context, static_cast<GtkStateFlags>(state));
+
+    // Paint button.
+    IntRect buttonRect(rect);
+    guint junction = gtk_style_context_get_junction_sides(context);
+    if (arrowType == GTK_ARROW_UP)
+        junction |= GTK_JUNCTION_BOTTOM;
+    else {
+        junction |= GTK_JUNCTION_TOP;
+        buttonRect.move(0, rect.height() / 2);
+    }
+    buttonRect.setHeight(rect.height() / 2);
+    gtk_style_context_set_junction_sides(context, static_cast<GtkJunctionSides>(junction));
+
+    gtk_render_background(context, paintInfo.context->platformContext(), buttonRect.x(), buttonRect.y(), buttonRect.width(), buttonRect.height());
+    gtk_render_frame(context, paintInfo.context->platformContext(), buttonRect.x(), buttonRect.y(), buttonRect.width(), buttonRect.height());
+
+    // Paint arrow centered inside button.
+    // This code is based on gtkspinbutton.c code.
+    IntRect arrowRect;
+    gdouble angle;
+    if (arrowType == GTK_ARROW_UP) {
+        angle = 0;
+        arrowRect.setY(rect.y());
+        arrowRect.setHeight(rect.height() / 2 - 2);
+    } else {
+        angle = G_PI;
+        arrowRect.setY(rect.y() + buttonRect.y());
+        arrowRect.setHeight(rect.height() - arrowRect.y() - 2);
+    }
+    arrowRect.setWidth(rect.width() - 3);
+    if (direction == GTK_TEXT_DIR_LTR)
+        arrowRect.setX(rect.x() + 1);
+    else
+        arrowRect.setX(rect.x() + 2);
+
+    gint width = arrowRect.width() / 2;
+    width -= width % 2 - 1; // Force odd.
+    gint height = (width + 1) / 2;
+
+    arrowRect.move((arrowRect.width() - width) / 2, (arrowRect.height() - height) / 2);
+    gtk_render_arrow(context, paintInfo.context->platformContext(), angle, arrowRect.x(), arrowRect.y(), width);
+
+    gtk_style_context_restore(context);
+}
+
+bool RenderThemeGtk::paintInnerSpinButton(RenderObject* renderObject, const PaintInfo& paintInfo, const IntRect& rect)
+{
+    GtkStyleContext* context = getStyleContext(GTK_TYPE_SPIN_BUTTON);
+    gtk_style_context_save(context);
+
+    GtkTextDirection direction = static_cast<GtkTextDirection>(gtkTextDirection(renderObject->style()->direction()));
+    gtk_style_context_set_direction(context, direction);
+
+    guint flags = 0;
+    if (!isEnabled(renderObject) || isReadOnlyControl(renderObject))
+        flags |= GTK_STATE_FLAG_INSENSITIVE;
+    else if (isFocused(renderObject))
+        flags |= GTK_STATE_FLAG_FOCUSED;
+    gtk_style_context_set_state(context, static_cast<GtkStateFlags>(flags));
+    gtk_style_context_remove_class(context, GTK_STYLE_CLASS_ENTRY);
+
+    paintSpinArrowButton(this, context, renderObject, paintInfo, rect, GTK_ARROW_UP);
+    paintSpinArrowButton(this, context, renderObject, paintInfo, rect, GTK_ARROW_DOWN);
+
+    gtk_style_context_restore(context);
+
+    return false;
+}
+
 GRefPtr<GdkPixbuf> RenderThemeGtk::getStockIcon(GType widgetType, const char* iconName, gint direction, gint state, gint iconSize)
 {
     GtkStyleContext* context = getStyleContext(widgetType);
diff --git a/Source/WebCore/platform/gtk/ScrollbarThemeGtk.cpp b/Source/WebCore/platform/gtk/ScrollbarThemeGtk.cpp
index cb9b0f8..7f7c269 100644
--- a/Source/WebCore/platform/gtk/ScrollbarThemeGtk.cpp
+++ b/Source/WebCore/platform/gtk/ScrollbarThemeGtk.cpp
@@ -228,9 +228,10 @@ bool ScrollbarThemeGtk::paint(Scrollbar* scrollbar, GraphicsContext* graphicsCon
             scrollMask |= ThumbPart;
     }
 
-    paintScrollbarBackground(graphicsContext, scrollbar);
-
-    if (scrollMask & TrackBGPart)
+    ScrollbarControlPartMask allButtons = BackButtonStartPart | BackButtonEndPart
+                                         | ForwardButtonStartPart | ForwardButtonEndPart;
+    if (scrollMask & TrackBGPart || scrollMask & ThumbPart || scrollMask & allButtons)
+        paintScrollbarBackground(graphicsContext, scrollbar);
         paintTrackBackground(graphicsContext, scrollbar, trackPaintRect);
 
     // Paint the back and forward buttons.
diff --git a/Source/WebCore/platform/gtk/ScrollbarThemeGtk2.cpp b/Source/WebCore/platform/gtk/ScrollbarThemeGtk2.cpp
index 79295c1..1ab8850 100644
--- a/Source/WebCore/platform/gtk/ScrollbarThemeGtk2.cpp
+++ b/Source/WebCore/platform/gtk/ScrollbarThemeGtk2.cpp
@@ -28,12 +28,12 @@
 
 #ifdef GTK_API_VERSION_2
 
+#include "GtkVersioning.h"
 #include "PlatformMouseEvent.h"
 #include "RenderThemeGtk.h"
 #include "ScrollView.h"
 #include "Scrollbar.h"
 #include "WidgetRenderingContext.h"
-#include "gtkdrawing.h"
 #include <gtk/gtk.h>
 
 namespace WebCore {
@@ -46,107 +46,169 @@ static void gtkStyleSetCallback(GtkWidget* widget, GtkStyle* previous, Scrollbar
 ScrollbarThemeGtk::ScrollbarThemeGtk()
 {
     updateThemeProperties();
-    g_signal_connect(static_cast<RenderThemeGtk*>(RenderTheme::defaultTheme().get())->gtkScrollbar(),
+    g_signal_connect(static_cast<RenderThemeGtk*>(RenderTheme::defaultTheme().get())->gtkHScrollbar(),
          "style-set", G_CALLBACK(gtkStyleSetCallback), this);
 }
 
 void ScrollbarThemeGtk::updateThemeProperties()
 {
-    MozGtkScrollbarMetrics metrics;
-    moz_gtk_get_scrollbar_metrics(&metrics);
-
-    m_thumbFatness = metrics.slider_width;
-    m_troughBorderWidth = metrics.trough_border;
-    m_stepperSize = metrics.stepper_size;
-    m_stepperSpacing = metrics.stepper_spacing;
-    m_minThumbLength = metrics.min_slider_size;
-    m_troughUnderSteppers = metrics.trough_under_steppers;
-    m_hasForwardButtonStartPart = metrics.has_secondary_forward_stepper;
-    m_hasBackButtonEndPart = metrics.has_secondary_backward_stepper;
-
+    GtkWidget* scrollbar = static_cast<RenderThemeGtk*>(RenderTheme::defaultTheme().get())->gtkHScrollbar();
+    gtk_widget_style_get(scrollbar,
+                         "slider_width", &m_thumbFatness,
+                         "trough_border", &m_troughBorderWidth,
+                         "stepper-size", &m_stepperSize,
+                         "trough-under-steppers", &m_troughUnderSteppers,
+                         "has-secondary-forward-stepper", &m_hasForwardButtonStartPart,
+                         "has-secondary-backward-stepper", &m_hasBackButtonEndPart, NULL);
+    m_minThumbLength = gtk_range_get_min_slider_size(GTK_RANGE(scrollbar));
     updateScrollbarsFrameThickness();
 }
 
-void ScrollbarThemeGtk::paintTrackBackground(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
+static GtkWidget* getWidgetForScrollbar(Scrollbar* scrollbar)
 {
-    GtkWidgetState state;
-    state.focused = FALSE;
-    state.isDefault = FALSE;
-    state.canDefault = FALSE;
-    state.disabled = FALSE;
-    state.active = FALSE;
-    state.inHover = FALSE;
+    RenderThemeGtk* theme = static_cast<RenderThemeGtk*>(RenderTheme::defaultTheme().get());
+    return scrollbar->orientation() == VerticalScrollbar ? theme->gtkVScrollbar() : theme->gtkHScrollbar();
+}
 
+void ScrollbarThemeGtk::paintTrackBackground(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
+{
     // Paint the track background. If the trough-under-steppers property is true, this
     // should be the full size of the scrollbar, but if is false, it should only be the
     // track rect.
-    IntRect fullScrollbarRect = rect;
+    IntRect fullScrollbarRect(rect);
     if (m_troughUnderSteppers)
         fullScrollbarRect = IntRect(scrollbar->x(), scrollbar->y(), scrollbar->width(), scrollbar->height());
 
-    GtkThemeWidgetType type = scrollbar->orientation() == VerticalScrollbar ? MOZ_GTK_SCROLLBAR_TRACK_VERTICAL : MOZ_GTK_SCROLLBAR_TRACK_HORIZONTAL;
     WidgetRenderingContext widgetContext(context, fullScrollbarRect);
-    widgetContext.paintMozillaWidget(type, &state, 0);
+    IntRect paintRect(IntPoint(), fullScrollbarRect.size());
+    widgetContext.gtkPaintBox(paintRect, getWidgetForScrollbar(scrollbar),
+                              GTK_STATE_ACTIVE, GTK_SHADOW_IN, "trough");
 }
 
 void ScrollbarThemeGtk::paintScrollbarBackground(GraphicsContext* context, Scrollbar* scrollbar)
 {
-    // This is unused by the moz_gtk_scrollecd_window_paint.
-    GtkWidgetState state;
     IntRect fullScrollbarRect = IntRect(scrollbar->x(), scrollbar->y(), scrollbar->width(), scrollbar->height());
+
     WidgetRenderingContext widgetContext(context, fullScrollbarRect);
-    widgetContext.paintMozillaWidget(MOZ_GTK_SCROLLED_WINDOW, &state, 0);
+    widgetContext.gtkPaintBox(fullScrollbarRect, getWidgetForScrollbar(scrollbar),
+                              GTK_STATE_NORMAL, GTK_SHADOW_IN, "scrolled_window");
 }
 
 void ScrollbarThemeGtk::paintThumb(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
 {
-    GtkWidgetState state;
-    state.focused = FALSE;
-    state.isDefault = FALSE;
-    state.canDefault = FALSE;
-    state.disabled = FALSE;
-    state.active = scrollbar->pressedPart() == ThumbPart;
-    state.inHover = scrollbar->hoveredPart() == ThumbPart;
-    state.maxpos = scrollbar->maximum();
-    state.curpos = scrollbar->currentPos();
-
-    GtkThemeWidgetType type = scrollbar->orientation() == VerticalScrollbar ? MOZ_GTK_SCROLLBAR_THUMB_VERTICAL : MOZ_GTK_SCROLLBAR_THUMB_HORIZONTAL;
+    GtkWidget* widget = getWidgetForScrollbar(scrollbar);
+    gboolean activateSlider;
+    gtk_widget_style_get(widget, "activate-slider", &activateSlider, NULL);
+
+    GtkStateType stateType = GTK_STATE_NORMAL;
+    GtkShadowType shadowType = GTK_SHADOW_OUT;
+    if (activateSlider && scrollbar->pressedPart() == ThumbPart) {
+        stateType = GTK_STATE_ACTIVE;
+        shadowType = GTK_SHADOW_IN;
+    } else if (scrollbar->pressedPart() == ThumbPart || scrollbar->hoveredPart() == ThumbPart)
+        stateType = GTK_STATE_PRELIGHT;
+
+    // The adjustment controls the rendering of the scrollbar thumb. If it's not set
+    // properly the theme may not draw the thumb borders properly.
+    GtkAdjustment* adjustment = gtk_range_get_adjustment(GTK_RANGE(widget));
+    gtk_adjustment_set_value(adjustment, scrollbar->currentPos());
+    gtk_adjustment_set_lower(adjustment, 0);
+    gtk_adjustment_set_upper(adjustment, scrollbar->maximum());
+
+    GtkOrientation orientation = GTK_ORIENTATION_HORIZONTAL;
+    if (scrollbar->orientation() == VerticalScrollbar) {
+        gtk_adjustment_set_page_size(adjustment, rect.height());
+        orientation = GTK_ORIENTATION_VERTICAL;
+    } else
+        gtk_adjustment_set_page_size(adjustment, rect.width());
+
     WidgetRenderingContext widgetContext(context, rect);
-    widgetContext.paintMozillaWidget(type, &state, 0);
+    IntRect sliderRect(IntPoint(), rect.size());
+    widgetContext.gtkPaintSlider(sliderRect, widget, stateType, shadowType, "slider", orientation);
 }
 
 void ScrollbarThemeGtk::paintButton(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
 {
-    int flags = 0;
-    if (scrollbar->orientation() == VerticalScrollbar)
-        flags |= MOZ_GTK_STEPPER_VERTICAL;
-
-    if (part == ForwardButtonEndPart)
-        flags |= (MOZ_GTK_STEPPER_DOWN | MOZ_GTK_STEPPER_BOTTOM);
-    if (part == ForwardButtonStartPart)
-        flags |= MOZ_GTK_STEPPER_DOWN;
-
-    GtkWidgetState state;
-    state.focused = TRUE;
-    state.isDefault = TRUE;
-    state.canDefault = TRUE;
-    state.depressed = FALSE;
+    // The buttons will be disabled if the thumb is as the appropriate extreme.
+    GtkShadowType shadowType = GTK_SHADOW_OUT;
+    GtkStateType stateType = GTK_STATE_INSENSITIVE;
+    bool pressed = (part == scrollbar->pressedPart());
 
     if ((BackButtonStartPart == part && scrollbar->currentPos())
         || (BackButtonEndPart == part && scrollbar->currentPos())
         || (ForwardButtonEndPart == part && scrollbar->currentPos() != scrollbar->maximum())
         || (ForwardButtonStartPart == part && scrollbar->currentPos() != scrollbar->maximum())) {
-        state.disabled = FALSE;
-        state.active = part == scrollbar->pressedPart();
-        state.inHover = part == scrollbar->hoveredPart();
+        stateType = GTK_STATE_NORMAL;
+        if (pressed) {
+            stateType = GTK_STATE_ACTIVE;
+            shadowType = GTK_SHADOW_IN;
+        } else if (part == scrollbar->hoveredPart())
+            stateType = GTK_STATE_PRELIGHT;
+    }
+
+    // Themes determine how to draw the button (which button to draw) based on the allocation
+    // of the widget. Where the target rect is in relation to the total widget allocation
+    // determines the button.
+    ScrollbarOrientation orientation = scrollbar->orientation();
+    int buttonSize = (orientation == VerticalScrollbar) ? rect.height() : rect.width();
+    int totalAllocation = buttonSize * 5; // One space for each button and one extra.
+    int buttonOffset = 0;
+    if (ForwardButtonStartPart == part)
+        buttonOffset = buttonSize;
+    else if (BackButtonEndPart == part)
+        buttonOffset = 3 * buttonSize;
+    else if (ForwardButtonEndPart == part)
+        buttonOffset = 4 * buttonSize;
+
+    // Now we want the allocation to be relative to the origin of the painted rect.
+    GtkWidget* widget = getWidgetForScrollbar(scrollbar);
+    GtkAllocation allocation;
+    gtk_widget_get_allocation(widget, &allocation);
+    allocation.x = allocation.y = 0;
+    allocation.width = rect.width();
+    allocation.height = rect.height();
+
+    if (orientation == VerticalScrollbar) {
+        allocation.height = totalAllocation;
+        allocation.y -= buttonOffset;
     } else {
-        state.disabled = TRUE;
-        state.active = FALSE;
-        state.inHover = FALSE;
+        allocation.width = totalAllocation;
+        allocation.x -= buttonOffset;
     }
+    gtk_widget_set_allocation(widget, &allocation);
 
+    const char* detail = orientation == VerticalScrollbar ? "vscrollbar" : "hscrollbar";
     WidgetRenderingContext widgetContext(context, rect);
-    widgetContext.paintMozillaWidget(MOZ_GTK_SCROLLBAR_BUTTON, &state, flags);
+
+    IntRect buttonRect(IntPoint(), rect.size());
+    widgetContext.gtkPaintBox(buttonRect, widget, stateType, shadowType, detail);
+
+    float arrowScaling;
+    gtk_widget_style_get(widget, "arrow-scaling", &arrowScaling, NULL);
+    IntSize arrowSize = rect.size();
+    arrowSize.scale(arrowScaling);
+    IntRect arrowRect(IntPoint(buttonRect.x() + (buttonRect.width() - arrowSize.width()) / 2,
+                               buttonRect.y() + (buttonRect.height() - arrowSize.height()) / 2),
+                      arrowSize);
+    if (pressed) {
+        int arrowDisplacementX, arrowDisplacementY;
+        gtk_widget_style_get(widget,
+                             "arrow-displacement-x", &arrowDisplacementX,
+                             "arrow-displacement-y", &arrowDisplacementY,
+                             NULL);
+        arrowRect.move(arrowDisplacementX, arrowDisplacementY);
+    }
+
+    GtkArrowType arrowType = GTK_ARROW_DOWN;
+    if (orientation == VerticalScrollbar) {
+        if (part == BackButtonEndPart || part == BackButtonStartPart)
+            arrowType = GTK_ARROW_UP;
+    } else if (orientation == HorizontalScrollbar) {
+        arrowType = GTK_ARROW_RIGHT;
+        if (part == BackButtonEndPart || part == BackButtonStartPart)
+            arrowType = GTK_ARROW_LEFT;
+    }
+    widgetContext.gtkPaintArrow(arrowRect, widget, stateType, shadowType, arrowType, detail);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/gtk/WidgetRenderingContext.cpp b/Source/WebCore/platform/gtk/WidgetRenderingContext.cpp
index 51b32ea..9e640f6 100644
--- a/Source/WebCore/platform/gtk/WidgetRenderingContext.cpp
+++ b/Source/WebCore/platform/gtk/WidgetRenderingContext.cpp
@@ -103,8 +103,8 @@ WidgetRenderingContext::WidgetRenderingContext(GraphicsContext* graphicsContext,
         width = (1 + (width >> 5)) << 5;
         height = (1 + (height >> 5)) << 5;
 
-        gScratchBuffer = gdk_pixmap_new(0, width, height, gdk_colormap_get_visual(theme->m_themeParts.colormap)->depth);
-        gdk_drawable_set_colormap(gScratchBuffer, theme->m_themeParts.colormap);
+        gScratchBuffer = gdk_pixmap_new(0, width, height, gdk_colormap_get_visual(theme->m_colormap)->depth);
+        gdk_drawable_set_colormap(gScratchBuffer, theme->m_colormap);
     }
     m_target = gScratchBuffer;
 
@@ -143,19 +143,19 @@ WidgetRenderingContext::~WidgetRenderingContext()
     scheduleScratchBufferPurge();
 }
 
-bool WidgetRenderingContext::paintMozillaWidget(GtkThemeWidgetType type, GtkWidgetState* state, int flags, GtkTextDirection textDirection)
-{
-    // Sometimes moz_gtk_widget_paint modifies the clipping rectangle, so we must use a copy.
-    GdkRectangle clipRect = m_paintRect;
-    m_hadError = moz_gtk_widget_paint(type, m_target, &clipRect, &m_paintRect,
-        state, flags, textDirection) != MOZ_GTK_SUCCESS;
-    return !m_hadError;
-}
-
 void WidgetRenderingContext::gtkPaintBox(const IntRect& rect, GtkWidget* widget, GtkStateType stateType, GtkShadowType shadowType, const gchar* detail)
 {
     GdkRectangle paintRect = { m_paintRect.x + rect.x(), m_paintRect.y + rect.y(), rect.width(), rect.height() };
-    gtk_paint_box(gtk_widget_get_style(widget), m_target, stateType, shadowType, &m_paintRect,
+
+    // Some widgets also need their allocation adjusted to account for extra space.
+    // Right now only scrollbar buttons have significant allocations.
+    GtkAllocation allocation;
+    gtk_widget_get_allocation(widget, &allocation);
+    allocation.x += m_paintRect.x;
+    allocation.y += m_paintRect.y;
+    gtk_widget_set_allocation(widget, &allocation);
+
+    gtk_paint_box(gtk_widget_get_style(widget), m_target, stateType, shadowType, &paintRect,
                   widget, detail, paintRect.x, paintRect.y, paintRect.width, paintRect.height);
 }
 
diff --git a/Source/WebCore/platform/gtk/WidgetRenderingContext.h b/Source/WebCore/platform/gtk/WidgetRenderingContext.h
index e248f04..8639a98 100644
--- a/Source/WebCore/platform/gtk/WidgetRenderingContext.h
+++ b/Source/WebCore/platform/gtk/WidgetRenderingContext.h
@@ -25,7 +25,11 @@
 #ifdef GTK_API_VERSION_2
 
 #include "IntRect.h"
-#include "gtkdrawing.h"
+
+// Usually this is too expensive to have in headers, but GtkStateType GtkShadowType are
+// enums and cannot be forward declared. WidgetRenderingContext.h is currently only
+// included in RenderThemeGtk2.cpp and ScrollbarThemeGtk2.cpp.
+#include <gtk/gtk.h>
 
 namespace WebCore {
 
@@ -37,7 +41,6 @@ public:
     WidgetRenderingContext(GraphicsContext*, const IntRect&);
     ~WidgetRenderingContext();
 
-    bool paintMozillaWidget(GtkThemeWidgetType, GtkWidgetState*, int flags, GtkTextDirection = GTK_TEXT_DIR_NONE);
     void gtkPaintBox(const IntRect&, GtkWidget*, GtkStateType, GtkShadowType, const gchar*);
     void gtkPaintFlatBox(const IntRect&, GtkWidget*, GtkStateType, GtkShadowType, const gchar*);
     void gtkPaintFocus(const IntRect&, GtkWidget*, GtkStateType, const gchar*);
diff --git a/Source/WebCore/platform/gtk/gtk2drawing.c b/Source/WebCore/platform/gtk/gtk2drawing.c
deleted file mode 100644
index 3979b7f..0000000
--- a/Source/WebCore/platform/gtk/gtk2drawing.c
+++ /dev/null
@@ -1,552 +0,0 @@
-/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 2002
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *  Brian Ryner <bryner@brianryner.com>  (Original Author)
- *  Pierre Chanial <p_ch@verizon.net>
- *  Michael Ventnor <m.ventnor@gmail.com>
- *  Alp Toker <alp@nuanti.com>
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-/*
- * This file contains painting functions for each of the gtk2 widgets.
- * Adapted from the gtkdrawing.c, and gtk+2.0 source.
- */
-
-#ifdef GTK_API_VERSION_2
-
-#undef GTK_DISABLE_DEPRECATED
-#undef GDK_DISABLE_DEPRECATED
-
-#include <gdk/gdkprivate.h>
-#include "gtkdrawing.h"
-#include "GtkVersioning.h"
-#include <math.h>
-#include <string.h>
-
-#define XTHICKNESS(style) (style->xthickness)
-#define YTHICKNESS(style) (style->ythickness)
-
-static GtkThemeParts *gParts = NULL;
-static style_prop_t style_prop_func;
-static gboolean is_initialized;
-
-void
-moz_gtk_use_theme_parts(GtkThemeParts* parts)
-{
-    gParts = parts;
-}
-
-/* Because we have such an unconventional way of drawing widgets, signal to the GTK theme engine
-   that they are drawing for Mozilla instead of a conventional GTK app so they can do any specific
-   things they may want to do. */
-static void
-moz_gtk_set_widget_name(GtkWidget* widget)
-{
-    gtk_widget_set_name(widget, "MozillaGtkWidget");
-}
-
-gint
-moz_gtk_enable_style_props(style_prop_t styleGetProp)
-{
-    style_prop_func = styleGetProp;
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-ensure_window_widget()
-{
-    if (!gParts->protoWindow) {
-        gParts->protoWindow = gtk_window_new(GTK_WINDOW_POPUP);
-
-        if (gParts->colormap)
-            gtk_widget_set_colormap(gParts->protoWindow, gParts->colormap);
-
-        gtk_widget_realize(gParts->protoWindow);
-        moz_gtk_set_widget_name(gParts->protoWindow);
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-setup_widget_prototype(GtkWidget* widget)
-{
-    ensure_window_widget();
-    if (!gParts->protoLayout) {
-        gParts->protoLayout = gtk_fixed_new();
-        gtk_container_add(GTK_CONTAINER(gParts->protoWindow), gParts->protoLayout);
-    }
-
-    gtk_container_add(GTK_CONTAINER(gParts->protoLayout), widget);
-    gtk_widget_realize(widget);
-    g_object_set_data(G_OBJECT(widget), "transparent-bg-hint", GINT_TO_POINTER(TRUE));
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-ensure_scrollbar_widget()
-{
-    if (!gParts->vertScrollbarWidget) {
-        gParts->vertScrollbarWidget = gtk_vscrollbar_new(NULL);
-        setup_widget_prototype(gParts->vertScrollbarWidget);
-    }
-    if (!gParts->horizScrollbarWidget) {
-        gParts->horizScrollbarWidget = gtk_hscrollbar_new(NULL);
-        setup_widget_prototype(gParts->horizScrollbarWidget);
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-ensure_scrolled_window_widget()
-{
-    if (!gParts->scrolledWindowWidget) {
-        gParts->scrolledWindowWidget = gtk_scrolled_window_new(NULL, NULL);
-        setup_widget_prototype(gParts->scrolledWindowWidget);
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
-static GtkStateType
-ConvertGtkState(GtkWidgetState* state)
-{
-    if (state->disabled)
-        return GTK_STATE_INSENSITIVE;
-    else if (state->depressed)
-        return (state->inHover ? GTK_STATE_PRELIGHT : GTK_STATE_ACTIVE);
-    else if (state->inHover)
-        return (state->active ? GTK_STATE_ACTIVE : GTK_STATE_PRELIGHT);
-    else
-        return GTK_STATE_NORMAL;
-}
-
-static gint
-TSOffsetStyleGCArray(GdkGC** gcs, gint xorigin, gint yorigin)
-{
-    int i;
-    /* there are 5 gc's in each array, for each of the widget states */
-    for (i = 0; i < 5; ++i)
-        gdk_gc_set_ts_origin(gcs[i], xorigin, yorigin);
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-TSOffsetStyleGCs(GtkStyle* style, gint xorigin, gint yorigin)
-{
-    TSOffsetStyleGCArray(style->fg_gc, xorigin, yorigin);
-    TSOffsetStyleGCArray(style->bg_gc, xorigin, yorigin);
-    TSOffsetStyleGCArray(style->light_gc, xorigin, yorigin);
-    TSOffsetStyleGCArray(style->dark_gc, xorigin, yorigin);
-    TSOffsetStyleGCArray(style->mid_gc, xorigin, yorigin);
-    TSOffsetStyleGCArray(style->text_gc, xorigin, yorigin);
-    TSOffsetStyleGCArray(style->base_gc, xorigin, yorigin);
-    gdk_gc_set_ts_origin(style->black_gc, xorigin, yorigin);
-    gdk_gc_set_ts_origin(style->white_gc, xorigin, yorigin);
-    return MOZ_GTK_SUCCESS;
-}
-
-gint
-moz_gtk_init()
-{
-    GtkWidgetClass *entry_class;
-
-    is_initialized = TRUE;
-
-    /* Add style property to GtkEntry.
-     * Adding the style property to the normal GtkEntry class means that it
-     * will work without issues inside GtkComboBox and for Spinbuttons. */
-    entry_class = g_type_class_ref(GTK_TYPE_ENTRY);
-    gtk_widget_class_install_style_property(entry_class,
-        g_param_spec_boolean("honors-transparent-bg-hint",
-                             "Transparent BG enabling flag",
-                             "If TRUE, the theme is able to draw the GtkEntry on non-prefilled background.",
-                             FALSE,
-                             G_PARAM_READWRITE));
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_scrolled_window_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                              GdkRectangle* cliprect, GtkWidgetState* state)
-{
-    GtkStyle* style;
-    GtkAllocation allocation;
-    GtkWidget* widget;
-
-    ensure_scrolled_window_widget();
-    widget = gParts->scrolledWindowWidget;
-
-    gtk_widget_get_allocation(widget, &allocation);
-    allocation.x = rect->x;
-    allocation.y = rect->y;
-    allocation.width = rect->width;
-    allocation.height = rect->height;
-    gtk_widget_set_allocation(widget, &allocation);
-
-    style = gtk_widget_get_style(widget);
-    TSOffsetStyleGCs(style, rect->x - 1, rect->y - 1);
-    gtk_paint_shadow(style, drawable, GTK_STATE_NORMAL, GTK_SHADOW_IN,
-                     cliprect, gParts->scrolledWindowWidget, "scrolled_window",
-                     rect->x, rect->y, rect->width, rect->height);
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_scrollbar_button_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                               GdkRectangle* cliprect, GtkWidgetState* state,
-                               GtkScrollbarButtonFlags flags,
-                               GtkTextDirection direction)
-{
-    GtkStateType state_type = ConvertGtkState(state);
-    GtkShadowType shadow_type = (state->active) ?
-        GTK_SHADOW_IN : GTK_SHADOW_OUT;
-    GdkRectangle arrow_rect;
-    GtkStyle* style;
-    GtkWidget *scrollbar;
-    GtkAllocation allocation;
-    GtkArrowType arrow_type;
-    gint arrow_displacement_x, arrow_displacement_y;
-    const char* detail = (flags & MOZ_GTK_STEPPER_VERTICAL) ?
-                           "vscrollbar" : "hscrollbar";
-
-    ensure_scrollbar_widget();
-
-    if (flags & MOZ_GTK_STEPPER_VERTICAL)
-        scrollbar = gParts->vertScrollbarWidget;
-    else
-        scrollbar = gParts->horizScrollbarWidget;
-
-    gtk_widget_set_direction(scrollbar, direction);
-
-    /* Some theme engines (i.e., ClearLooks) check the scrollbar's allocation
-       to determine where it should paint rounded corners on the buttons.
-       We need to trick them into drawing the buttons the way we want them. */
-
-    gtk_widget_get_allocation(scrollbar, &allocation);
-    allocation.x = rect->x;
-    allocation.y = rect->y;
-    allocation.width = rect->width;
-    allocation.height = rect->height;
-
-    if (flags & MOZ_GTK_STEPPER_VERTICAL) {
-        allocation.height *= 5;
-        if (flags & MOZ_GTK_STEPPER_DOWN) {
-            arrow_type = GTK_ARROW_DOWN;
-            if (flags & MOZ_GTK_STEPPER_BOTTOM)
-                allocation.y -= 4 * rect->height;
-            else
-                allocation.y -= rect->height;
-
-        } else {
-            arrow_type = GTK_ARROW_UP;
-            if (flags & MOZ_GTK_STEPPER_BOTTOM)
-                allocation.y -= 3 * rect->height;
-        }
-    } else {
-        allocation.width *= 5;
-        if (flags & MOZ_GTK_STEPPER_DOWN) {
-            arrow_type = GTK_ARROW_RIGHT;
-            if (flags & MOZ_GTK_STEPPER_BOTTOM)
-                allocation.x -= 4 * rect->width;
-            else
-                allocation.x -= rect->width;
-        } else {
-            arrow_type = GTK_ARROW_LEFT;
-            if (flags & MOZ_GTK_STEPPER_BOTTOM)
-                allocation.x -= 3 * rect->width;
-        }
-    }
-
-    gtk_widget_set_allocation(scrollbar, &allocation);
-    style = gtk_widget_get_style(scrollbar);
-
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-
-    gtk_paint_box(style, drawable, state_type, shadow_type, cliprect,
-                  scrollbar, detail, rect->x, rect->y,
-                  rect->width, rect->height);
-
-    arrow_rect.width = rect->width / 2;
-    arrow_rect.height = rect->height / 2;
-    arrow_rect.x = rect->x + (rect->width - arrow_rect.width) / 2;
-    arrow_rect.y = rect->y + (rect->height - arrow_rect.height) / 2;
-
-    if (state_type == GTK_STATE_ACTIVE) {
-        gtk_widget_style_get(scrollbar,
-                             "arrow-displacement-x", &arrow_displacement_x,
-                             "arrow-displacement-y", &arrow_displacement_y,
-                             NULL);
-
-        arrow_rect.x += arrow_displacement_x;
-        arrow_rect.y += arrow_displacement_y;
-    }
-
-    gtk_paint_arrow(style, drawable, state_type, shadow_type, cliprect,
-                    scrollbar, detail, arrow_type, TRUE, arrow_rect.x,
-                    arrow_rect.y, arrow_rect.width, arrow_rect.height);
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_scrollbar_trough_paint(GtkThemeWidgetType widget,
-                               GdkDrawable* drawable, GdkRectangle* rect,
-                               GdkRectangle* cliprect, GtkWidgetState* state,
-                               GtkTextDirection direction)
-{
-    GtkStyle* style;
-    GtkScrollbar *scrollbar;
-
-    ensure_scrollbar_widget();
-
-    if (widget ==  MOZ_GTK_SCROLLBAR_TRACK_HORIZONTAL)
-        scrollbar = GTK_SCROLLBAR(gParts->horizScrollbarWidget);
-    else
-        scrollbar = GTK_SCROLLBAR(gParts->vertScrollbarWidget);
-
-    gtk_widget_set_direction(GTK_WIDGET(scrollbar), direction);
-
-    style = gtk_widget_get_style(GTK_WIDGET(scrollbar));
-
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-    gtk_paint_box(style, drawable, GTK_STATE_ACTIVE, GTK_SHADOW_IN, cliprect,
-                  GTK_WIDGET(scrollbar), "trough", rect->x, rect->y,
-                  rect->width, rect->height);
-
-    if (state->focused) {
-        gtk_paint_focus(style, drawable, GTK_STATE_ACTIVE, cliprect,
-                        GTK_WIDGET(scrollbar), "trough",
-                        rect->x, rect->y, rect->width, rect->height);
-    }
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_scrollbar_thumb_paint(GtkThemeWidgetType widget,
-                              GdkDrawable* drawable, GdkRectangle* rect,
-                              GdkRectangle* cliprect, GtkWidgetState* state,
-                              GtkTextDirection direction)
-{
-    GtkStateType state_type = (state->inHover || state->active) ?
-        GTK_STATE_PRELIGHT : GTK_STATE_NORMAL;
-    GtkShadowType shadow_type = GTK_SHADOW_OUT;
-    GtkStyle* style;
-    GtkScrollbar *scrollbar;
-    GtkAdjustment *adj;
-    gboolean activate_slider;
-
-    ensure_scrollbar_widget();
-
-    if (widget == MOZ_GTK_SCROLLBAR_THUMB_HORIZONTAL)
-        scrollbar = GTK_SCROLLBAR(gParts->horizScrollbarWidget);
-    else
-        scrollbar = GTK_SCROLLBAR(gParts->vertScrollbarWidget);
-
-    gtk_widget_set_direction(GTK_WIDGET(scrollbar), direction);
-
-    /* Make sure to set the scrollbar range before painting so that
-       everything is drawn properly.  At least the bluecurve (and
-       maybe other) themes don't draw the top or bottom black line
-       surrounding the scrollbar if the theme thinks that it's butted
-       up against the scrollbar arrows.  Note the increases of the
-       clip rect below. */
-    /* Changing the cliprect is pretty bogus. This lets themes draw
-       outside the frame, which means we don't invalidate them
-       correctly. See bug 297508. But some themes do seem to need
-       it. So we modify the frame's overflow area to account for what
-       we're doing here; see nsNativeThemeGTK::GetWidgetOverflow. */
-    adj = gtk_range_get_adjustment(GTK_RANGE(scrollbar));
-
-    if (widget == MOZ_GTK_SCROLLBAR_THUMB_HORIZONTAL) {
-        cliprect->x -= 1;
-        cliprect->width += 2;
-        gtk_adjustment_set_page_size(adj, rect->width);
-    }
-    else {
-        cliprect->y -= 1;
-        cliprect->height += 2;
-        gtk_adjustment_set_page_size(adj, rect->height);
-    }
-
-#if GTK_CHECK_VERSION(2, 14, 0)
-    gtk_adjustment_configure(adj,
-                             state->curpos,
-                             0,
-                             state->maxpos,
-                             gtk_adjustment_get_step_increment(adj),
-                             gtk_adjustment_get_page_increment(adj),
-                             gtk_adjustment_get_page_size(adj));
-#else
-    adj->lower = 0;
-    adj->value = state->curpos;
-    adj->upper = state->maxpos;
-    gtk_adjustment_changed(adj);
-#endif
-
-    style = gtk_widget_get_style(GTK_WIDGET(scrollbar));
-    
-    gtk_widget_style_get(GTK_WIDGET(scrollbar), "activate-slider",
-                         &activate_slider, NULL);
-    
-    if (activate_slider && state->active) {
-        shadow_type = GTK_SHADOW_IN;
-        state_type = GTK_STATE_ACTIVE;
-    }
-
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-
-    gtk_paint_slider(style, drawable, state_type, shadow_type, cliprect,
-                     GTK_WIDGET(scrollbar), "slider", rect->x, rect->y,
-                     rect->width,  rect->height,
-                     (widget == MOZ_GTK_SCROLLBAR_THUMB_HORIZONTAL) ?
-                     GTK_ORIENTATION_HORIZONTAL : GTK_ORIENTATION_VERTICAL);
-
-    return MOZ_GTK_SUCCESS;
-}
-
-gint
-moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
-                          gint* right, gint* bottom, GtkTextDirection direction,
-                          gboolean inhtml)
-{
-    GtkWidget* w;
-    GtkStyle *style;
-
-    switch (widget) {
-    /* These widgets have no borders, since they are not containers. */
-    case MOZ_GTK_SCROLLBAR_BUTTON:
-    case MOZ_GTK_SCROLLBAR_TRACK_HORIZONTAL:
-    case MOZ_GTK_SCROLLBAR_TRACK_VERTICAL:
-    case MOZ_GTK_SCROLLBAR_THUMB_HORIZONTAL:
-    case MOZ_GTK_SCROLLBAR_THUMB_VERTICAL:
-        *left = *top = *right = *bottom = 0;
-        return MOZ_GTK_SUCCESS;
-    default:
-        g_warning("Unsupported widget type: %d", widget);
-        return MOZ_GTK_UNKNOWN_WIDGET;
-    }
-
-    style = gtk_widget_get_style(w);
-    *right = *left = XTHICKNESS(style);
-    *bottom = *top = YTHICKNESS(style);
-
-    return MOZ_GTK_SUCCESS;
-}
-
-gint
-moz_gtk_get_scrollbar_metrics(MozGtkScrollbarMetrics *metrics)
-{
-    ensure_scrollbar_widget();
-
-    gtk_widget_style_get (gParts->horizScrollbarWidget,
-                          "slider_width", &metrics->slider_width,
-                          "trough_border", &metrics->trough_border,
-                          "stepper_size", &metrics->stepper_size,
-                          "stepper_spacing", &metrics->stepper_spacing,
-                          "trough_under_steppers", &metrics->trough_under_steppers,
-                          "has_secondary_forward_stepper", &metrics->has_secondary_forward_stepper,
-                          "has_secondary_backward_stepper", &metrics->has_secondary_backward_stepper,
-                          NULL);
-
-    metrics->min_slider_size = gtk_range_get_min_slider_size(GTK_RANGE(gParts->horizScrollbarWidget));
-
-    return MOZ_GTK_SUCCESS;
-}
-
-gint
-moz_gtk_widget_paint(GtkThemeWidgetType widget, GdkDrawable* drawable,
-                     GdkRectangle* rect, GdkRectangle* cliprect,
-                     GtkWidgetState* state, gint flags,
-                     GtkTextDirection direction)
-{
-    switch (widget) {
-    case MOZ_GTK_SCROLLBAR_BUTTON:
-        return moz_gtk_scrollbar_button_paint(drawable, rect, cliprect, state,
-                                              (GtkScrollbarButtonFlags) flags,
-                                              direction);
-        break;
-    case MOZ_GTK_SCROLLBAR_TRACK_HORIZONTAL:
-    case MOZ_GTK_SCROLLBAR_TRACK_VERTICAL:
-        return moz_gtk_scrollbar_trough_paint(widget, drawable, rect,
-                                              cliprect, state, direction);
-        break;
-    case MOZ_GTK_SCROLLBAR_THUMB_HORIZONTAL:
-    case MOZ_GTK_SCROLLBAR_THUMB_VERTICAL:
-        return moz_gtk_scrollbar_thumb_paint(widget, drawable, rect,
-                                             cliprect, state, direction);
-        break;
-    case MOZ_GTK_SCROLLED_WINDOW:
-        return moz_gtk_scrolled_window_paint(drawable, rect, cliprect, state);
-        break;
-    default:
-        g_warning("Unknown widget type: %d", widget);
-    }
-
-    return MOZ_GTK_UNKNOWN_WIDGET;
-}
-
-GtkWidget* moz_gtk_get_scrollbar_widget(void)
-{
-    if (!is_initialized)
-        return NULL;
-    ensure_scrollbar_widget();
-    return gParts->horizScrollbarWidget;
-}
-
-gint
-moz_gtk_shutdown()
-{
-    GtkWidgetClass *entry_class;
-    entry_class = g_type_class_peek(GTK_TYPE_ENTRY);
-    g_type_class_unref(entry_class);
-
-    is_initialized = FALSE;
-
-    return MOZ_GTK_SUCCESS;
-}
-
-void moz_gtk_destroy_theme_parts_widgets(GtkThemeParts* parts)
-{
-    if (!parts)
-        return;
-
-    if (parts->protoWindow) {
-        gtk_widget_destroy(parts->protoWindow);
-        parts->protoWindow = NULL;
-    }
-}
-
-#endif // GTK_API_VERSION_2
diff --git a/Source/WebCore/platform/gtk/gtkdrawing.h b/Source/WebCore/platform/gtk/gtkdrawing.h
deleted file mode 100644
index cdb343c..0000000
--- a/Source/WebCore/platform/gtk/gtkdrawing.h
+++ /dev/null
@@ -1,217 +0,0 @@
-/* -*- Mode: C; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 2002
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *  Brian Ryner <bryner@brianryner.com>  (Original Author)
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-/**
- * gtkdrawing.h: GTK widget rendering utilities
- *
- * gtkdrawing provides an API for rendering GTK widgets in the
- * current theme to a pixmap or window, without requiring an actual
- * widget instantiation, similar to the Macintosh Appearance Manager
- * or Windows XP's DrawThemeBackground() API.
- */
-
-#ifndef _GTK_DRAWING_H_
-#define _GTK_DRAWING_H_
-
-#undef GTK_DISABLE_DEPRECATED
-
-#include <gtk/gtk.h>
-
-#ifdef __cplusplus
-extern "C" {
-#endif /* __cplusplus */
-
-/*** type definitions ***/
-typedef struct {
-  guint8 active;
-  guint8 focused;
-  guint8 inHover;
-  guint8 disabled;
-  guint8 isDefault;
-  guint8 canDefault;
-  /* The depressed state is for buttons which remain active for a longer period:
-   * activated toggle buttons or buttons showing a popup menu. */
-  guint8 depressed;
-  gint32 curpos; /* curpos and maxpos are used for scrollbars */
-  gint32 maxpos;
-} GtkWidgetState;
-
-typedef struct {
-  gint slider_width;
-  gint trough_border;
-  gint stepper_size;
-  gint stepper_spacing;
-  gint min_slider_size;
-  gboolean trough_under_steppers;
-  gboolean has_secondary_forward_stepper;
-  gboolean has_secondary_backward_stepper;
-} MozGtkScrollbarMetrics;
-
-typedef struct _GtkThemeParts {
-    GdkColormap* colormap;
-    GtkWidget* protoWindow;
-    GtkWidget* protoLayout;
-    GtkWidget* horizScrollbarWidget;
-    GtkWidget* vertScrollbarWidget;
-    GtkWidget* scrolledWindowWidget;
-} GtkThemeParts;
-
-typedef enum {
-  MOZ_GTK_STEPPER_DOWN        = 1 << 0,
-  MOZ_GTK_STEPPER_BOTTOM      = 1 << 1,
-  MOZ_GTK_STEPPER_VERTICAL    = 1 << 2
-} GtkScrollbarButtonFlags;
-
-/* function type for moz_gtk_enable_style_props */
-typedef gint (*style_prop_t)(GtkStyle*, const gchar*, gint);
-
-/*** result/error codes ***/
-#define MOZ_GTK_SUCCESS 0
-#define MOZ_GTK_UNKNOWN_WIDGET -1
-#define MOZ_GTK_UNSAFE_THEME -2
-
-/*** widget type constants ***/
-typedef enum {
-  /* Paints a GtkButton. flags is a GtkReliefStyle. */
-  MOZ_GTK_BUTTON,
-  /**
-   * Paints the button of a GtkScrollbar. flags is a GtkArrowType giving
-   * the arrow direction.
-   */
-  MOZ_GTK_SCROLLBAR_BUTTON,
-  /* Paints the trough (track) of a GtkScrollbar. */
-  MOZ_GTK_SCROLLBAR_TRACK_HORIZONTAL,
-  MOZ_GTK_SCROLLBAR_TRACK_VERTICAL,
-  /* Paints the slider (thumb) of a GtkScrollbar. */
-  MOZ_GTK_SCROLLBAR_THUMB_HORIZONTAL,
-  MOZ_GTK_SCROLLBAR_THUMB_VERTICAL,
-  /* Paints the background of a scrolled window */
-  MOZ_GTK_SCROLLED_WINDOW,
-} GtkThemeWidgetType;
-
-/*** General library functions ***/
-/**
- * Initializes the drawing library.  You must call this function
- * prior to using any other functionality.
- * returns: MOZ_GTK_SUCCESS if there were no errors
- *          MOZ_GTK_UNSAFE_THEME if the current theme engine is known
- *                               to crash with gtkdrawing.
- */
-gint moz_gtk_init();
-
-/**
- * Instruct the drawing library to do all rendering based on
- * the given collection of theme parts. If any members of the
- * GtkThemeParts struct are NULL, they will be created lazily.
- */
-void
-moz_gtk_use_theme_parts(GtkThemeParts* parts);
-
-/**
- * Enable GTK+ 1.2.9+ theme enhancements. You must provide a pointer
- * to the GTK+ 1.2.9+ function "gtk_style_get_prop_experimental".
- * styleGetProp:  pointer to gtk_style_get_prop_experimental
- * 
- * returns: MOZ_GTK_SUCCESS if there was no error, an error code otherwise
- */
-gint moz_gtk_enable_style_props(style_prop_t styleGetProp);
-
-/**
- * Perform cleanup of the drawing library. You should call this function
- * when your program exits, or you no longer need the library.
- *
- * returns: MOZ_GTK_SUCCESS if there was no error, an error code otherwise
- */
-gint moz_gtk_shutdown();
-
-/**
- * Destroy the widgets in the given GtkThemeParts, which should
- * be destroyed before the GtkThemeParts can be freed.
- */
-void moz_gtk_destroy_theme_parts_widgets(GtkThemeParts* parts);
-
-/*** Widget drawing ***/
-/**
- * Paint a widget in the current theme.
- * widget:    a constant giving the widget to paint
- * rect:      the bounding rectangle for the widget
- * cliprect:  a clipprect rectangle for this painting operation
- * state:     the state of the widget.  ignored for some widgets.
- * flags:     widget-dependant flags; see the GtkThemeWidgetType definition.
- * direction: the text direction, to draw the widget correctly LTR and RTL.
- */
-gint
-moz_gtk_widget_paint(GtkThemeWidgetType widget, GdkDrawable* drawable,
-                     GdkRectangle* rect, GdkRectangle* cliprect,
-                     GtkWidgetState* state, gint flags,
-                     GtkTextDirection direction);
-
-/*** Widget metrics ***/
-/**
- * Get the border size of a widget
- * left/right:  [OUT] the widget's left/right border
- * top/bottom:  [OUT] the widget's top/bottom border
- * direction:   the text direction for the widget
- * inhtml:      boolean indicating whether this widget will be drawn as a HTML form control,
- *              in order to workaround a size issue (MOZ_GTK_BUTTON only, ignored otherwise)
- *
- * returns:    MOZ_GTK_SUCCESS if there was no error, an error code otherwise
- */
-gint moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top, 
-                               gint* right, gint* bottom, GtkTextDirection direction,
-                               gboolean inhtml);
-/**
- * Get the desired metrics for a GtkScrollbar
- * metrics:          [IN]  struct which will contain the metrics
- *
- * returns:    MOZ_GTK_SUCCESS if there was no error, an error code otherwise
- */
-gint
-moz_gtk_get_scrollbar_metrics(MozGtkScrollbarMetrics* metrics);
-
-/**
- * Retrieve an actual GTK scrollbar widget for style analysis. It will not
- * be modified.
- */
-GtkWidget* moz_gtk_get_scrollbar_widget(void);
-
-#ifdef __cplusplus
-}
-#endif /* __cplusplus */
-
-#endif
diff --git a/Source/WebCore/platform/haiku/MIMETypeRegistryHaiku.cpp b/Source/WebCore/platform/haiku/MIMETypeRegistryHaiku.cpp
index 685827e..3cfddf9 100644
--- a/Source/WebCore/platform/haiku/MIMETypeRegistryHaiku.cpp
+++ b/Source/WebCore/platform/haiku/MIMETypeRegistryHaiku.cpp
@@ -31,6 +31,8 @@
 
 #include "PlatformString.h"
 #include <MimeType.h>
+#include <wtf/Assertions.h>
+#include <wtf/MainThread.h>
 #include <wtf/text/CString.h>
 
 namespace WebCore {
@@ -62,6 +64,8 @@ static const ExtensionMap extensionMap[] = {
 
 String MIMETypeRegistry::getMIMETypeForExtension(const String& ext)
 {
+    ASSERT(isMainThread());
+
     String str = ext.lower();
 
     // Try WebCore built-in types.
diff --git a/Source/WebCore/platform/image-decoders/ImageDecoder.cpp b/Source/WebCore/platform/image-decoders/ImageDecoder.cpp
index 17208b5..2aae205 100644
--- a/Source/WebCore/platform/image-decoders/ImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/ImageDecoder.cpp
@@ -38,7 +38,9 @@ using namespace std;
 
 namespace WebCore {
 
-static unsigned copyFromSharedBuffer(char* buffer, unsigned bufferLength, const SharedBuffer& sharedBuffer, unsigned offset)
+namespace {
+
+unsigned copyFromSharedBuffer(char* buffer, unsigned bufferLength, const SharedBuffer& sharedBuffer, unsigned offset)
 {
     unsigned bytesExtracted = 0;
     const char* moreData;
@@ -53,55 +55,80 @@ static unsigned copyFromSharedBuffer(char* buffer, unsigned bufferLength, const
     return bytesExtracted;
 }
 
+<<<<<<< HEAD
 #if !OS(ANDROID)
 // This method requires BMPImageDecoder, PNGImageDecoder, ICOImageDecoder and
 // JPEGDecoder, which aren't used on Android, and which don't all compile.
 // TODO: Find a better fix.
+=======
+bool matchesGIFSignature(char* contents)
+{
+    return !memcmp(contents, "GIF8", 4);
+}
+
+bool matchesPNGSignature(char* contents)
+{
+    return !memcmp(contents, "\x89\x50\x4E\x47", 4);
+}
+
+bool matchesJPEGSignature(char* contents)
+{
+    return !memcmp(contents, "\xFF\xD8\xFF", 3);
+}
+
+#if USE(WEBP)
+bool matchesWebPSignature(char* contents)
+{
+    return !memcmp(contents, "RIFF", 4) && !memcmp(contents + 8, "WEBPVP", 6);
+}
+#endif
+
+bool matchesBMPSignature(char* contents)
+{
+    return !memcmp(contents, "BM", 2);
+}
+
+bool matchesICOSignature(char* contents)
+{
+    return !memcmp(contents, "\x00\x00\x01\x00", 4);
+}
+
+bool matchesCURSignature(char* contents)
+{
+    return !memcmp(contents, "\x00\x00\x02\x00", 4);
+}
+
+}
+
+>>>>>>> webkit.org at r78450
 ImageDecoder* ImageDecoder::create(const SharedBuffer& data, ImageSource::AlphaOption alphaOption, ImageSource::GammaAndColorProfileOption gammaAndColorProfileOption)
 {
-    // We need at least 4 bytes to figure out what kind of image we're dealing
-    // with.
-    static const unsigned maxMarkerLength = 4;
-    char contents[maxMarkerLength];
-    unsigned length = copyFromSharedBuffer(contents, maxMarkerLength, data, 0);
-    if (length < maxMarkerLength)
+    static const unsigned lengthOfLongestSignature = 14; // To wit: "RIFF????WEBPVP"
+    char contents[lengthOfLongestSignature];
+    unsigned length = copyFromSharedBuffer(contents, lengthOfLongestSignature, data, 0);
+    if (length < lengthOfLongestSignature)
         return 0;
 
-    // GIFs begin with GIF8(7 or 9).
-    if (strncmp(contents, "GIF8", 4) == 0)
+    if (matchesGIFSignature(contents))
         return new GIFImageDecoder(alphaOption, gammaAndColorProfileOption);
 
-    // Test for PNG.
-    if (!memcmp(contents, "\x89\x50\x4E\x47", 4))
+    if (matchesPNGSignature(contents))
         return new PNGImageDecoder(alphaOption, gammaAndColorProfileOption);
 
-    // JPEG
-    if (!memcmp(contents, "\xFF\xD8\xFF", 3))
+    if (matchesJPEGSignature(contents))
         return new JPEGImageDecoder(alphaOption, gammaAndColorProfileOption);
 
 #if USE(WEBP)
-    if (!memcmp(contents, "RIFF", 4)) {
-        static const unsigned webpExtraMarker = 6;
-        static const unsigned webpExtraMarkeroffset = 8;
-        char header[webpExtraMarker];
-        unsigned length = copyFromSharedBuffer(header, webpExtraMarker, data, webpExtraMarkeroffset);
-        if (length >= webpExtraMarker) {
-            if (!memcmp(header, "WEBPVP", webpExtraMarker))
-                return new WEBPImageDecoder(alphaOption, gammaAndColorProfileOption);
-        }
-    }
+    if (matchesWebPSignature(contents))
+        return new WEBPImageDecoder(alphaOption, gammaAndColorProfileOption);
 #endif
 
-    // BMP
-    if (strncmp(contents, "BM", 2) == 0)
+    if (matchesBMPSignature(contents))
         return new BMPImageDecoder(alphaOption, gammaAndColorProfileOption);
 
-    // ICOs always begin with a 2-byte 0 followed by a 2-byte 1.
-    // CURs begin with 2-byte 0 followed by 2-byte 2.
-    if (!memcmp(contents, "\x00\x00\x01\x00", 4) || !memcmp(contents, "\x00\x00\x02\x00", 4))
+    if (matchesICOSignature(contents) || matchesCURSignature(contents))
         return new ICOImageDecoder(alphaOption, gammaAndColorProfileOption);
 
-    // Give up. We don't know what the heck this is.
     return 0;
 }
 #endif // !OS(ANDROID)
@@ -123,7 +150,7 @@ ImageFrame& ImageFrame::operator=(const ImageFrame& other)
         return *this;
 
     copyReferenceToBitmapData(other);
-    setRect(other.rect());
+    setOriginalFrameRect(other.originalFrameRect());
     setStatus(other.status());
     setDuration(other.duration());
     setDisposalMethod(other.disposalMethod());
@@ -131,7 +158,7 @@ ImageFrame& ImageFrame::operator=(const ImageFrame& other)
     return *this;
 }
 
-void ImageFrame::clear()
+void ImageFrame::clearPixelData()
 {
     m_backingStore.clear();
     m_bytes = 0;
@@ -142,7 +169,7 @@ void ImageFrame::clear()
     // later.
 }
 
-void ImageFrame::zeroFill()
+void ImageFrame::zeroFillPixelData()
 {
     memset(m_bytes, 0, m_size.width() * m_size.height() * sizeof(PixelData));
     m_hasAlpha = true;
@@ -176,8 +203,7 @@ bool ImageFrame::setSize(int newWidth, int newHeight)
     m_bytes = m_backingStore.data();
     m_size = IntSize(newWidth, newHeight);
 
-    // Zero the image.
-    zeroFill();
+    zeroFillPixelData();
 
     return true;
 }
diff --git a/Source/WebCore/platform/image-decoders/ImageDecoder.h b/Source/WebCore/platform/image-decoders/ImageDecoder.h
index c581ba1..7d0d0d4 100644
--- a/Source/WebCore/platform/image-decoders/ImageDecoder.h
+++ b/Source/WebCore/platform/image-decoders/ImageDecoder.h
@@ -50,9 +50,8 @@ namespace WebCore {
     // FIXME: Do we want better encapsulation?
     typedef Vector<char> ColorProfile;
 
-    // The ImageFrame object represents the decoded image data in RGBA32
-    // format.  This buffer is what all decoders write a single frame into.
-    // Frames are then instantiated for drawing by being handed this buffer.
+    // ImageFrame represents the decoded image data.  This buffer is what all
+    // decoders write a single frame into.
     class ImageFrame {
     public:
         enum FrameStatus { FrameEmpty, FramePartial, FrameComplete };
@@ -80,19 +79,17 @@ namespace WebCore {
         // create a new copy of the image data, only increase the ref count.
         ImageFrame& operator=(const ImageFrame& other);
 
-        // Deletes the pixel data entirely; used by ImageDecoder to save memory
-        // when we no longer need to display a frame and only need its metadata.
-        void clear();
+        // These do not touch other metadata, only the raw pixel data.
+        void clearPixelData();
+        void zeroFillPixelData();
 
-        // Zeroes the pixel data in the buffer, setting it to fully-transparent.
-        void zeroFill();
-
-        // Creates a new copy of the image data in |other|, so the two images
-        // can be modified independently.  Returns whether the copy succeeded.
+        // Makes this frame have an independent copy of the provided image's
+        // pixel data, so that modifications in one frame are not reflected in
+        // the other.  Returns whether the copy succeeded.
         bool copyBitmapData(const ImageFrame&);
 
-        // Creates a new reference to the image data in |other|.  The two images
-        // share a common backing store.
+        // Makes this frame reference the provided image's pixel data, so that
+        // modifications in one frame are reflected in the other.
         void copyReferenceToBitmapData(const ImageFrame&);
 
         // Copies the pixel data at [(startX, startY), (endX, startY)) to the
@@ -116,18 +113,17 @@ namespace WebCore {
 #endif
 
         // Allocates space for the pixel data.  Must be called before any pixels
-        // are written. Will return true on success, false if the memory
-        // allocation fails.  Calling this multiple times is undefined and may
-        // leak memory.
+        // are written.  Must only be called once.  Returns whether allocation
+        // succeeded.
         bool setSize(int newWidth, int newHeight);
 
-        // To be used by ImageSource::createFrameAtIndex().  Returns a pointer
-        // to the underlying native image data.  This pointer will be owned by
-        // the BitmapImage and freed in FrameData::clear().
+        // Returns a caller-owned pointer to the underlying native image data.
+        // (Actual use: This pointer will be owned by BitmapImage and freed in
+        // FrameData::clear()).
         NativeImagePtr asNewNativeImage() const;
 
         bool hasAlpha() const;
-        const IntRect& rect() const { return m_rect; }
+        const IntRect& originalFrameRect() const { return m_originalFrameRect; }
         FrameStatus status() const { return m_status; }
         unsigned duration() const { return m_duration; }
         FrameDisposalMethod disposalMethod() const { return m_disposalMethod; }
@@ -135,7 +131,7 @@ namespace WebCore {
 
         void setHasAlpha(bool alpha);
         void setColorProfile(const ColorProfile&);
-        void setRect(const IntRect& r) { m_rect = r; }
+        void setOriginalFrameRect(const IntRect& r) { m_originalFrameRect = r; }
         void setStatus(FrameStatus status);
         void setDuration(unsigned duration) { m_duration = duration; }
         void setDisposalMethod(FrameDisposalMethod method) { m_disposalMethod = method; }
@@ -184,7 +180,11 @@ namespace WebCore {
                     g = static_cast<unsigned>(g * alphaPercent);
                     b = static_cast<unsigned>(b * alphaPercent);
                 }
+<<<<<<< HEAD
 #if PLATFORM(ANDROID)
+=======
+#if PLATFORM(SKIA)
+>>>>>>> webkit.org at r78450
                 *dest = SkPackARGB32(a, r, g, b);
 #else
                 *dest = (a << 24 | r << 16 | g << 8 | b);
@@ -202,35 +202,26 @@ namespace WebCore {
 #else
         NativeBackingStore m_backingStore;
         PixelData* m_bytes; // The memory is backed by m_backingStore.
-        IntSize m_size; // The size of the buffer.  This should be the
-                        // same as ImageDecoder::m_size.
-        bool m_hasAlpha; // Whether or not any of the pixels in the buffer
-                         // have transparency.
+        IntSize m_size;
+        bool m_hasAlpha;
         ColorProfile m_colorProfile;
 #endif
-        IntRect m_rect; // The rect of the original specified frame within
-                        // the overall buffer.  This will always just be
-                        // the entire buffer except for GIF frames whose
-                        // original rect was smaller than the overall
-                        // image size.
-        FrameStatus m_status; // Whether or not this frame is completely
-                              // finished decoding.
-        unsigned m_duration; // The animation delay.
-        FrameDisposalMethod m_disposalMethod; // What to do with this frame's data when
-                                              // initializing the next frame.
-        bool m_premultiplyAlpha; // Whether to premultiply alpha into R, G, B
-                                 // channels; by default it's true.
+        IntRect m_originalFrameRect; // This will always just be the entire
+                                     // buffer except for GIF frames whose
+                                     // original rect was smaller than the
+                                     // overall image size.
+        FrameStatus m_status;
+        unsigned m_duration;
+        FrameDisposalMethod m_disposalMethod;
+        bool m_premultiplyAlpha;
     };
 
-    // The ImageDecoder class represents a base class for specific image format
-    // decoders (e.g., GIF, JPG, PNG, ICO) to derive from.  All decoders decode
-    // into RGBA32 format and the base class manages the RGBA32 frame cache.
+    // ImageDecoder is a base for all format-specific decoders
+    // (e.g. JPEGImageDecoder).  This base manages the ImageFrame cache.
     //
-    // ENABLE(IMAGE_DECODER_DOWN_SAMPLING) allows image decoders to write
-    // directly to scaled output buffers by down sampling. Call
-    // setMaxNumPixels() to specify the biggest size that decoded images can
-    // have. Image decoders will deflate those images that are bigger than
-    // m_maxNumPixels. (Not supported by all image decoders yet)
+    // ENABLE(IMAGE_DECODER_DOWN_SAMPLING) allows image decoders to downsample
+    // at decode time.  Image decoders will downsample any images larger than
+    // |m_maxNumPixels|.  FIXME: Not yet supported by all decoders.
     class ImageDecoder {
         WTF_MAKE_NONCOPYABLE(ImageDecoder); WTF_MAKE_FAST_ALLOCATED;
     public:
@@ -241,19 +232,15 @@ namespace WebCore {
             , m_sizeAvailable(false)
             , m_maxNumPixels(-1)
             , m_isAllDataReceived(false)
-            , m_failed(false)
-        {
-        }
+            , m_failed(false) { }
 
-        virtual ~ImageDecoder() {}
+        virtual ~ImageDecoder() { }
 
-        // Factory function to create an ImageDecoder.  Ports that subclass
-        // ImageDecoder can provide their own implementation of this to avoid
-        // needing to write a dedicated setData() implementation.
+        // Returns a caller-owned decoder of the appropriate type.  Returns 0 if
+        // we can't sniff a supported type from the provided data (possibly
+        // because there isn't enough data yet).
         static ImageDecoder* create(const SharedBuffer& data, ImageSource::AlphaOption, ImageSource::GammaAndColorProfileOption);
 
-        // The the filename extension usually associated with an undecoded image
-        // of this type.
         virtual String filenameExtension() const = 0;
 
         bool isAllDataReceived() const { return m_isAllDataReceived; }
@@ -266,41 +253,33 @@ namespace WebCore {
             m_isAllDataReceived = allDataReceived;
         }
 
-        // Whether or not the size information has been decoded yet. This
-        // default implementation just returns true if the size has been set and
-        // we have not seen a failure. Decoders may want to override this to
-        // lazily decode enough of the image to get the size.
+        // Lazily-decodes enough of the image to get the size (if possible).
+        // FIXME: Right now that has to be done by each subclass; factor the
+        // decode call out and use it here.
         virtual bool isSizeAvailable()
         {
-            return !m_failed && m_sizeAvailable; 
+            return !m_failed && m_sizeAvailable;
         }
 
-        // Returns the size of the image.
-        virtual IntSize size() const
-        {
-            return m_size;
-        }
+        virtual IntSize size() const { return m_size; }
 
         IntSize scaledSize() const
         {
             return m_scaled ? IntSize(m_scaledColumns.size(), m_scaledRows.size()) : size();
         }
 
-        // Returns the size of frame |index|.  This will only differ from size()
-        // for formats where different frames are different sizes (namely ICO,
-        // where each frame represents a different icon within the master file).
-        // Notably, this does not return different sizes for different GIF
-        // frames, since while these may be stored as smaller rectangles, during
-        // decoding they are composited to create a full-size frame.
+        // This will only differ from size() for ICO (where each frame is a
+        // different icon) or other formats where different frames are different
+        // sizes.  This does NOT differ from size() for GIF, since decoding GIFs
+        // composites any smaller frames against previous frames to create full-
+        // size frames.
         virtual IntSize frameSizeAtIndex(size_t) const
         {
             return size();
         }
 
-        // Called by the image decoders to set their decoded size, this also
-        // checks the size for validity. It will return true if the size was
-        // set, or false if there is an error. On error, the m_failed flag will
-        // be set and the caller should immediately stop decoding.
+        // Returns whether the size is legal (i.e. not going to result in
+        // overflow elsewhere).  If not, marks decoding as failed.
         virtual bool setSize(unsigned width, unsigned height)
         {
             if (isOverSize(width, height))
@@ -310,26 +289,19 @@ namespace WebCore {
             return true;
         }
 
-        // The total number of frames for the image.  Classes that support
-        // multiple frames will scan the image data for the answer if they need
-        // to (without necessarily decoding all of the individual frames).
+        // Lazily-decodes enough of the image to get the frame count (if
+        // possible), without decoding the individual frames.
+        // FIXME: Right now that has to be done by each subclass; factor the
+        // decode call out and use it here.
         virtual size_t frameCount() { return 1; }
 
-        // The number of repetitions to perform for an animation loop.
         virtual int repetitionCount() const { return cAnimationNone; }
 
-        // Called to obtain the ImageFrame full of decoded data for rendering.
-        // The decoder plugin will decode as much of the frame as it can before
-        // handing back the buffer.
+        // Decodes as much of the requested frame as possible, and returns an
+        // ImageDecoder-owned pointer.
         virtual ImageFrame* frameBufferAtIndex(size_t) = 0;
 
-        // Whether or not the underlying image format even supports alpha
-        // transparency.
-        virtual bool supportsAlpha() const { return true; }
-
         void setIgnoreGammaAndColorProfile(bool flag) { m_ignoreGammaAndColorProfile = flag; }
-
-        // Whether or not the gamma and color profile are applied.
         bool ignoresGammaAndColorProfile() const { return m_ignoreGammaAndColorProfile; }
 
         // Sets the "decode failure" flag.  For caller convenience (since so
@@ -344,13 +316,10 @@ namespace WebCore {
 
         bool failed() const { return m_failed; }
 
-        // Wipe out frames in the frame buffer cache before |clearBeforeFrame|,
-        // assuming this can be done without breaking decoding.  Different
-        // decoders place different restrictions on what frames are safe to
-        // destroy, so this is left to them to implement.
-        // For convenience's sake, we provide a default (empty) implementation,
-        // since in practice only GIFs will ever use this.
-        virtual void clearFrameBufferCache(size_t clearBeforeFrame) { }
+        // Clears decoded pixel data from before the provided frame unless that
+        // data may be needed to decode future frames (e.g. due to GIF frame
+        // compositing).
+        virtual void clearFrameBufferCache(size_t) { }
 
 #if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
         void setMaxNumPixels(int m) { m_maxNumPixels = m; }
@@ -378,8 +347,6 @@ namespace WebCore {
         // and return it as a (signed) int.  Avoid overflow.
         static bool isOverSize(unsigned width, unsigned height)
         {
-            // width * height must not exceed (2 ^ 29) - 1, so that we don't
-            // overflow when we multiply by 4.
             unsigned long long total_size = static_cast<unsigned long long>(width)
                                           * static_cast<unsigned long long>(height);
             return total_size > ((1 << 29) - 1);
diff --git a/Source/WebCore/platform/image-decoders/bmp/BMPImageReader.cpp b/Source/WebCore/platform/image-decoders/bmp/BMPImageReader.cpp
index 1805bc7..5c00553 100644
--- a/Source/WebCore/platform/image-decoders/bmp/BMPImageReader.cpp
+++ b/Source/WebCore/platform/image-decoders/bmp/BMPImageReader.cpp
@@ -87,7 +87,7 @@ bool BMPImageReader::decodeBMP(bool onlySize)
         m_buffer->setHasAlpha(false);
 
         // For BMPs, the frame always fills the entire image.
-        m_buffer->setRect(IntRect(IntPoint(), m_parent->size()));
+        m_buffer->setOriginalFrameRect(IntRect(IntPoint(), m_parent->size()));
 
         if (!m_isTopDown)
             m_coord.setY(m_parent->size().height() - 1);
@@ -707,7 +707,7 @@ BMPImageReader::ProcessingResult BMPImageReader::processNonRLEData(bool inRLE, i
                 } else {
                     m_seenNonZeroAlphaPixel = true;
                     if (m_seenZeroAlphaPixel) {
-                        m_buffer->zeroFill();
+                        m_buffer->zeroFillPixelData();
                         m_seenZeroAlphaPixel = false;
                     } else if (alpha != 255)
                         m_buffer->setHasAlpha(true);
diff --git a/Source/WebCore/platform/image-decoders/cg/ImageDecoderCG.cpp b/Source/WebCore/platform/image-decoders/cg/ImageDecoderCG.cpp
index 0b90107..43d6a52 100644
--- a/Source/WebCore/platform/image-decoders/cg/ImageDecoderCG.cpp
+++ b/Source/WebCore/platform/image-decoders/cg/ImageDecoderCG.cpp
@@ -72,7 +72,7 @@ bool ImageFrame::setSize(int newWidth, int newHeight)
     m_bytes = reinterpret_cast<PixelData*>(CFDataGetMutableBytePtr(m_backingStore.get()));
     m_size = IntSize(newWidth, newHeight);
 
-    zeroFill();
+    zeroFillPixelData();
     return true;
 }
 
diff --git a/Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp b/Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp
index e6de597..7e334a9 100644
--- a/Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp
@@ -174,14 +174,14 @@ void GIFImageDecoder::clearFrameBufferCache(size_t clearBeforeFrame)
     Vector<ImageFrame>::iterator i(end);
     for (; (i != m_frameBufferCache.begin()) && ((i->status() == ImageFrame::FrameEmpty) || (i->disposalMethod() == ImageFrame::DisposeOverwritePrevious)); --i) {
         if ((i->status() == ImageFrame::FrameComplete) && (i != end))
-            i->clear();
+            i->clearPixelData();
     }
 
     // Now |i| holds the last frame we need to preserve; clear prior frames.
     for (Vector<ImageFrame>::iterator j(m_frameBufferCache.begin()); j != i; ++j) {
         ASSERT(j->status() != ImageFrame::FramePartial);
         if (j->status() != ImageFrame::FrameEmpty)
-            j->clear();
+            j->clearPixelData();
     }
 }
 
@@ -266,7 +266,7 @@ bool GIFImageDecoder::frameComplete(unsigned frameIndex, unsigned frameDuration,
     if (!m_currentBufferSawAlpha) {
         // The whole frame was non-transparent, so it's possible that the entire
         // resulting buffer was non-transparent, and we can setHasAlpha(false).
-        if (buffer.rect().contains(IntRect(IntPoint(), scaledSize())))
+        if (buffer.originalFrameRect().contains(IntRect(IntPoint(), scaledSize())))
             buffer.setHasAlpha(false);
         else if (frameIndex) {
             // Tricky case.  This frame does not have alpha only if everywhere
@@ -289,7 +289,7 @@ bool GIFImageDecoder::frameComplete(unsigned frameIndex, unsigned frameDuration,
             // The only remaining case is a DisposeOverwriteBgcolor frame.  If
             // it had no alpha, and its rect is contained in the current frame's
             // rect, we know the current frame has no alpha.
-            if ((prevBuffer->disposalMethod() == ImageFrame::DisposeOverwriteBgcolor) && !prevBuffer->hasAlpha() && buffer.rect().contains(prevBuffer->rect()))
+            if ((prevBuffer->disposalMethod() == ImageFrame::DisposeOverwriteBgcolor) && !prevBuffer->hasAlpha() && buffer.originalFrameRect().contains(prevBuffer->originalFrameRect()))
                 buffer.setHasAlpha(false);
         }
     }
@@ -327,17 +327,17 @@ bool GIFImageDecoder::initFrameBuffer(unsigned frameIndex)
     IntRect frameRect(frameReader->x_offset, frameReader->y_offset, frameReader->width, frameReader->height);
 
     // Make sure the frameRect doesn't extend outside the buffer.
-    if (frameRect.right() > size().width())
+    if (frameRect.maxX() > size().width())
         frameRect.setWidth(size().width() - frameReader->x_offset);
-    if (frameRect.bottom() > size().height())
+    if (frameRect.maxY() > size().height())
         frameRect.setHeight(size().height() - frameReader->y_offset);
 
     ImageFrame* const buffer = &m_frameBufferCache[frameIndex];
     int left = upperBoundScaledX(frameRect.x());
-    int right = lowerBoundScaledX(frameRect.right(), left);
+    int right = lowerBoundScaledX(frameRect.maxX(), left);
     int top = upperBoundScaledY(frameRect.y());
-    int bottom = lowerBoundScaledY(frameRect.bottom(), top);
-    buffer->setRect(IntRect(left, top, right - left, bottom - top));
+    int bottom = lowerBoundScaledY(frameRect.maxY(), top);
+    buffer->setOriginalFrameRect(IntRect(left, top, right - left, bottom - top));
     
     if (!frameIndex) {
         // This is the first frame, so we're not relying on any previous data.
@@ -367,7 +367,7 @@ bool GIFImageDecoder::initFrameBuffer(unsigned frameIndex)
         } else {
             // We want to clear the previous frame to transparent, without
             // affecting pixels in the image outside of the frame.
-            const IntRect& prevRect = prevBuffer->rect();
+            const IntRect& prevRect = prevBuffer->originalFrameRect();
             const IntSize& bufferSize = scaledSize();
             if (!frameIndex || prevRect.contains(IntRect(IntPoint(), scaledSize()))) {
                 // Clearing the first frame, or a frame the size of the whole
@@ -378,8 +378,8 @@ bool GIFImageDecoder::initFrameBuffer(unsigned frameIndex)
               // Copy the whole previous buffer, then clear just its frame.
               if (!buffer->copyBitmapData(*prevBuffer))
                   return setFailed();
-              for (int y = prevRect.y(); y < prevRect.bottom(); ++y) {
-                  for (int x = prevRect.x(); x < prevRect.right(); ++x)
+              for (int y = prevRect.y(); y < prevRect.maxY(); ++y) {
+                  for (int x = prevRect.x(); x < prevRect.maxX(); ++x)
                       buffer->setRGBA(x, y, 0, 0, 0, 0);
               }
               if ((prevRect.width() > 0) && (prevRect.height() > 0))
diff --git a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
index a255c25..1434c65 100644
--- a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
@@ -222,6 +222,12 @@ public:
                 // jpeglib cannot convert these to rgb, but it can convert ycck
                 // to cmyk.
                 m_info.out_color_space = JCS_CMYK;
+
+                // Same as with grayscale images, we convert CMYK images to RGBA
+                // ones. When we keep the color profiles of these CMYK images,
+                // CoreGraphics will convert their colors again. So, we discard
+                // their color profiles to prevent color corruption.
+                m_decoder->setIgnoreGammaAndColorProfile(true);
                 break;
             default:
                 return m_decoder->setFailed();
@@ -462,7 +468,7 @@ bool JPEGImageDecoder::outputScanlines()
         buffer.setColorProfile(m_colorProfile);
 
         // For JPEGs, the frame always fills the entire image.
-        buffer.setRect(IntRect(IntPoint(), size()));
+        buffer.setOriginalFrameRect(IntRect(IntPoint(), size()));
     }
 
     jpeg_decompress_struct* info = m_reader->info();
diff --git a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h
index 801f1ab..d095cbb 100644
--- a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h
+++ b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h
@@ -45,7 +45,6 @@ namespace WebCore {
         virtual bool isSizeAvailable();
         virtual bool setSize(unsigned width, unsigned height);
         virtual ImageFrame* frameBufferAtIndex(size_t index);
-        virtual bool supportsAlpha() const { return false; }
         // CAUTION: setFailed() deletes |m_reader|.  Be careful to avoid
         // accessing deleted memory, especially when calling this from inside
         // JPEGImageReader!
diff --git a/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp b/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
index 755d704..8edfe36 100644
--- a/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
@@ -341,7 +341,7 @@ void PNGImageDecoder::rowAvailable(unsigned char* rowBuffer, unsigned rowIndex,
         buffer.setColorProfile(m_colorProfile);
 
         // For PNGs, the frame always fills the entire image.
-        buffer.setRect(IntRect(IntPoint(), size()));
+        buffer.setOriginalFrameRect(IntRect(IntPoint(), size()));
 
         if (m_reader->pngPtr()->interlaced)
             m_reader->createInterlaceBuffer((m_reader->hasAlpha() ? 4 : 3) * size().width() * size().height());
diff --git a/Source/WebCore/platform/image-decoders/qt/ImageFrameQt.cpp b/Source/WebCore/platform/image-decoders/qt/ImageFrameQt.cpp
index 81c22cf..a3cfbf6 100644
--- a/Source/WebCore/platform/image-decoders/qt/ImageFrameQt.cpp
+++ b/Source/WebCore/platform/image-decoders/qt/ImageFrameQt.cpp
@@ -50,14 +50,14 @@ ImageFrame& ImageFrame::operator=(const ImageFrame& other)
         return *this;
 
     copyBitmapData(other);
-    setRect(other.rect());
+    setOriginalFrameRect(other.originalFrameRect());
     setStatus(other.status());
     setDuration(other.duration());
     setDisposalMethod(other.disposalMethod());
     return *this;
 }
 
-void ImageFrame::clear()
+void ImageFrame::clearPixelData()
 {
     m_pixmap = QPixmap();
     m_image = QImage();
@@ -68,7 +68,7 @@ void ImageFrame::clear()
     // other metadata out of this frame later.
 }
 
-void ImageFrame::zeroFill()
+void ImageFrame::zeroFillPixelData()
 {
     if (m_pixmap.isNull() && !m_image.isNull()) {
         m_pixmap = QPixmap(m_image.width(), m_image.height());
@@ -101,8 +101,7 @@ bool ImageFrame::setSize(int newWidth, int newHeight)
     if (m_pixmap.isNull())
         return false;
 
-    // Zero the image.
-    zeroFill();
+    zeroFillPixelData();
 
     return true;
 }
diff --git a/Source/WebCore/platform/image-decoders/skia/ImageDecoderSkia.cpp b/Source/WebCore/platform/image-decoders/skia/ImageDecoderSkia.cpp
index a1c8261..c7dcc7a 100644
--- a/Source/WebCore/platform/image-decoders/skia/ImageDecoderSkia.cpp
+++ b/Source/WebCore/platform/image-decoders/skia/ImageDecoderSkia.cpp
@@ -51,7 +51,7 @@ ImageFrame& ImageFrame::operator=(const ImageFrame& other)
     // Keep the pixels locked since we will be writing directly into the
     // bitmap throughout this object's lifetime.
     m_bitmap.lockPixels();
-    setRect(other.rect());
+    setOriginalFrameRect(other.originalFrameRect());
     setStatus(other.status());
     setDuration(other.duration());
     setDisposalMethod(other.disposalMethod());
@@ -59,7 +59,7 @@ ImageFrame& ImageFrame::operator=(const ImageFrame& other)
     return *this;
 }
 
-void ImageFrame::clear()
+void ImageFrame::clearPixelData()
 {
     m_bitmap.reset();
     m_status = FrameEmpty;
@@ -69,7 +69,7 @@ void ImageFrame::clear()
     // other metadata out of this frame later.
 }
 
-void ImageFrame::zeroFill()
+void ImageFrame::zeroFillPixelData()
 {
     m_bitmap.eraseARGB(0, 0, 0, 0);
 }
@@ -93,8 +93,7 @@ bool ImageFrame::setSize(int newWidth, int newHeight)
     if (!m_bitmap.allocPixels())
         return false;
 
-    // Zero the image.
-    zeroFill();
+    zeroFillPixelData();
 
     return true;
 }
diff --git a/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp b/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp
index 8045ada..3db00f6 100644
--- a/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp
@@ -116,7 +116,7 @@ bool WEBPImageDecoder::decode(bool onlySize)
     }
     buffer.setStatus(ImageFrame::FrameComplete);
     buffer.setHasAlpha(false);
-    buffer.setRect(IntRect(IntPoint(), size()));
+    buffer.setOriginalFrameRect(IntRect(IntPoint(), size()));
     return true;
 }
 
diff --git a/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.h b/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.h
index cde1bbf..c32e047 100644
--- a/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.h
+++ b/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.h
@@ -42,7 +42,6 @@ public:
     virtual String filenameExtension() const { return "vp8"; }
     virtual bool isSizeAvailable();
     virtual ImageFrame* frameBufferAtIndex(size_t index);
-    virtual bool supportsAlpha() const { return false; }
 
 private:
     // Returns false in case of decoding failure.
diff --git a/Source/WebCore/platform/mac/DragImageMac.mm b/Source/WebCore/platform/mac/DragImageMac.mm
index f444b6e..fc58173 100644
--- a/Source/WebCore/platform/mac/DragImageMac.mm
+++ b/Source/WebCore/platform/mac/DragImageMac.mm
@@ -28,9 +28,16 @@
 
 #if ENABLE(DRAG_SUPPORT)
 #import "CachedImage.h"
+#import "Font.h"
+#import "FontDescription.h"
+#import "FontSelector.h"
+#import "GraphicsContext.h"
 #import "Image.h"
 #import "KURL.h"
 #import "ResourceResponse.h"
+#import "Settings.h"
+#import "StringTruncator.h"
+#import "TextRun.h"
 
 namespace WebCore {
 
@@ -98,7 +105,210 @@ RetainPtr<NSImage> createDragImageIconForCachedImage(CachedImage* image)
     
     return [[NSWorkspace sharedWorkspace] iconForFileType:extension];
 }
+
+
+const float DragLabelBorderX = 4;
+//Keep border_y in synch with DragController::LinkDragBorderInset
+const float DragLabelBorderY = 2;
+const float DragLabelRadius = 5;
+const float LabelBorderYOffset = 2;
+
+const float MinDragLabelWidthBeforeClip = 120;
+const float MaxDragLabelWidth = 320;
+
+const float DragLinkLabelFontsize = 11;
+const float DragLinkUrlFontSize = 10;
+
+// FIXME - we should move all the functionality of NSString extras to WebCore
+    
+static Font& fontFromNSFont(NSFont *font)
+{
+    static NSFont *currentFont;
+    DEFINE_STATIC_LOCAL(Font, currentRenderer, ());
+    
+    if ([font isEqual:currentFont])
+        return currentRenderer;
+    if (currentFont)
+        CFRelease(currentFont);
+    currentFont = font;
+    CFRetain(currentFont);
+    FontPlatformData f(font, [font pointSize]);
+    currentRenderer = Font(f, ![[NSGraphicsContext currentContext] isDrawingToScreen]);
+    return currentRenderer;
+}
+
+static bool canUseFastRenderer(const UniChar* buffer, unsigned length)
+{
+    unsigned i;
+    for (i = 0; i < length; i++) {
+        UCharDirection direction = u_charDirection(buffer[i]);
+        if (direction == U_RIGHT_TO_LEFT || direction > U_OTHER_NEUTRAL)
+            return false;
+    }
+    return true;
+}
+    
+static float widthWithFont(NSString *string, NSFont *font)
+{
+    unsigned length = [string length];
+    Vector<UniChar, 2048> buffer(length);
     
+    [string getCharacters:buffer.data()];
+    
+    if (canUseFastRenderer(buffer.data(), length)) {
+        Font webCoreFont(FontPlatformData(font, [font pointSize]), ![[NSGraphicsContext currentContext] isDrawingToScreen]);
+        TextRun run(buffer.data(), length);
+        run.disableRoundingHacks();
+        return webCoreFont.floatWidth(run);
+    }
+    
+    return [string sizeWithAttributes:[NSDictionary dictionaryWithObjectsAndKeys:font, NSFontAttributeName, nil]].width;
+}
+
+static inline CGFloat webkit_CGCeiling(CGFloat value)
+{
+    if (sizeof(value) == sizeof(float))
+        return ceilf(value);
+    return static_cast<CGFloat>(ceil(value));
+}
+    
+static void drawAtPoint(NSString *string, NSPoint point, NSFont *font, NSColor *textColor)
+{
+    unsigned length = [string length];
+    Vector<UniChar, 2048> buffer(length);
+    
+    [string getCharacters:buffer.data()];
+    
+    if (canUseFastRenderer(buffer.data(), length)) {
+        // The following is a half-assed attempt to match AppKit's rounding rules for drawAtPoint.
+        // It's probably incorrect for high DPI.
+        // If you change this, be sure to test all the text drawn this way in Safari, including
+        // the status bar, bookmarks bar, tab bar, and activity window.
+        point.y = webkit_CGCeiling(point.y);
+        
+        NSGraphicsContext *nsContext = [NSGraphicsContext currentContext];
+        CGContextRef cgContext = static_cast<CGContextRef>([nsContext graphicsPort]);
+        GraphicsContext graphicsContext(cgContext);    
+        
+        // Safari doesn't flip the NSGraphicsContext before calling WebKit, yet WebCore requires a flipped graphics context.
+        BOOL flipped = [nsContext isFlipped];
+        if (!flipped)
+            CGContextScaleCTM(cgContext, 1, -1);
+            
+        Font webCoreFont(FontPlatformData(font, [font pointSize]), ![nsContext isDrawingToScreen], Antialiased);
+        TextRun run(buffer.data(), length);
+        run.disableRoundingHacks();
+        
+        CGFloat red;
+        CGFloat green;
+        CGFloat blue;
+        CGFloat alpha;
+        [[textColor colorUsingColorSpaceName:NSDeviceRGBColorSpace] getRed:&red green:&green blue:&blue alpha:&alpha];
+        graphicsContext.setFillColor(makeRGBA(red * 255, green * 255, blue * 255, alpha * 255), ColorSpaceDeviceRGB);
+        
+        webCoreFont.drawText(&graphicsContext, run, FloatPoint(point.x, (flipped ? point.y : (-1 * point.y))));
+        
+        if (!flipped)
+            CGContextScaleCTM(cgContext, 1, -1);
+    } else {
+        // The given point is on the baseline.
+        if ([[NSView focusView] isFlipped])
+            point.y -= [font ascender];
+        else
+            point.y += [font descender];
+                
+        [string drawAtPoint:point withAttributes:[NSDictionary dictionaryWithObjectsAndKeys:font, NSFontAttributeName, textColor, NSForegroundColorAttributeName, nil]];
+    }
+}
+    
+static void drawDoubledAtPoint(NSString *string, NSPoint textPoint, NSColor *topColor, NSColor *bottomColor, NSFont *font)
+{
+        // turn off font smoothing so translucent text draws correctly (Radar 3118455)
+        drawAtPoint(string, textPoint, font, bottomColor);
+        
+        textPoint.y += 1;
+        drawAtPoint(string, textPoint, font, topColor);
+}
+
+DragImageRef createDragImageForLink(KURL& url, const String& title, Frame* frame)
+{
+    if (!frame)
+        return nil;
+    NSString *label = 0;
+    if (!title.isEmpty())
+        label = title;
+    NSURL *cocoaURL = url;
+    NSString *urlString = [cocoaURL absoluteString];
+
+    BOOL drawURLString = YES;
+    BOOL clipURLString = NO;
+    BOOL clipLabelString = NO;
+
+    if (!label) {
+        drawURLString = NO;
+        label = urlString;
+    }
+
+    NSFont *labelFont = [[NSFontManager sharedFontManager] convertFont:[NSFont systemFontOfSize:DragLinkLabelFontsize]
+                                                           toHaveTrait:NSBoldFontMask];
+    NSFont *urlFont = [NSFont systemFontOfSize:DragLinkUrlFontSize];
+    NSSize labelSize;
+    labelSize.width = widthWithFont(label, labelFont);
+    labelSize.height = [labelFont ascender] - [labelFont descender];
+    if (labelSize.width > MaxDragLabelWidth){
+        labelSize.width = MaxDragLabelWidth;
+        clipLabelString = YES;
+    }
+
+    NSSize imageSize;
+    imageSize.width = labelSize.width + DragLabelBorderX * 2;
+    imageSize.height = labelSize.height + DragLabelBorderY * 2;
+    if (drawURLString) {
+        NSSize urlStringSize;
+        urlStringSize.width = widthWithFont(urlString, urlFont);
+        urlStringSize.height = [urlFont ascender] - [urlFont descender];
+        imageSize.height += urlStringSize.height;
+        if (urlStringSize.width > MaxDragLabelWidth) {
+            imageSize.width = std::max(MaxDragLabelWidth + DragLabelBorderY * 2, MinDragLabelWidthBeforeClip);
+            clipURLString = YES;
+        } else
+            imageSize.width = std::max(labelSize.width + DragLabelBorderX * 2, urlStringSize.width + DragLabelBorderX * 2);
+    }
+    NSImage *dragImage = [[[NSImage alloc] initWithSize: imageSize] autorelease];
+    [dragImage lockFocus];
+
+    [[NSColor colorWithDeviceRed: 0.7f green: 0.7f blue: 0.7f alpha: 0.8f] set];
+
+    // Drag a rectangle with rounded corners
+    NSBezierPath *path = [NSBezierPath bezierPath];
+    [path appendBezierPathWithOvalInRect: NSMakeRect(0, 0, DragLabelRadius * 2, DragLabelRadius * 2)];
+    [path appendBezierPathWithOvalInRect: NSMakeRect(0, imageSize.height - DragLabelRadius * 2, DragLabelRadius * 2, DragLabelRadius * 2)];
+    [path appendBezierPathWithOvalInRect: NSMakeRect(imageSize.width - DragLabelRadius * 2, imageSize.height - DragLabelRadius * 2, DragLabelRadius * 2, DragLabelRadius * 2)];
+    [path appendBezierPathWithOvalInRect: NSMakeRect(imageSize.width - DragLabelRadius * 2, 0, DragLabelRadius * 2, DragLabelRadius * 2)];
+
+    [path appendBezierPathWithRect: NSMakeRect(DragLabelRadius, 0, imageSize.width - DragLabelRadius * 2, imageSize.height)];
+    [path appendBezierPathWithRect: NSMakeRect(0, DragLabelRadius, DragLabelRadius + 10, imageSize.height - 2 * DragLabelRadius)];
+    [path appendBezierPathWithRect: NSMakeRect(imageSize.width - DragLabelRadius - 20, DragLabelRadius, DragLabelRadius + 20, imageSize.height - 2 * DragLabelRadius)];
+    [path fill];
+
+    NSColor *topColor = [NSColor colorWithDeviceWhite:0.0f alpha:0.75f];
+    NSColor *bottomColor = [NSColor colorWithDeviceWhite:1.0f alpha:0.5f];
+    if (drawURLString) {
+        if (clipURLString)
+            urlString = StringTruncator::centerTruncate(urlString, imageSize.width - (DragLabelBorderX * 2), fontFromNSFont(urlFont));
+
+       drawDoubledAtPoint(urlString, NSMakePoint(DragLabelBorderX, DragLabelBorderY - [urlFont descender]), topColor, bottomColor, urlFont);
+    }
+
+    if (clipLabelString)
+        label = StringTruncator::rightTruncate(label, imageSize.width - (DragLabelBorderX * 2), fontFromNSFont(labelFont));
+    drawDoubledAtPoint(label, NSMakePoint(DragLabelBorderX, imageSize.height - LabelBorderYOffset - [labelFont pointSize]), topColor, bottomColor, labelFont);
+
+    [dragImage unlockFocus];
+
+    return dragImage;
+}
+   
 } // namespace WebCore
 
 #endif // ENABLE(DRAG_SUPPORT)
diff --git a/Source/WebCore/platform/mac/EmptyProtocolDefinitions.h b/Source/WebCore/platform/mac/EmptyProtocolDefinitions.h
index b73177b..04bf236 100644
--- a/Source/WebCore/platform/mac/EmptyProtocolDefinitions.h
+++ b/Source/WebCore/platform/mac/EmptyProtocolDefinitions.h
@@ -23,6 +23,9 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#ifndef EmptyProtocolDefinitions_h
+#define EmptyProtocolDefinitions_h
+
 #if defined(__OBJC__)
 
 #define EMPTY_PROTOCOL(NAME) \
@@ -47,3 +50,5 @@ EMPTY_PROTOCOL(NSURLDownloadDelegate)
 #undef EMPTY_PROTOCOL
 
 #endif /* defined(__OBJC__) */
+
+#endif /* EmptyProtocolDefinitions_h */
diff --git a/Source/WebCore/platform/mac/FileSystemMac.mm b/Source/WebCore/platform/mac/FileSystemMac.mm
index 0df3c89..bbeb76a 100644
--- a/Source/WebCore/platform/mac/FileSystemMac.mm
+++ b/Source/WebCore/platform/mac/FileSystemMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -25,10 +25,12 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
+
 #import "config.h"
 #import "FileSystem.h"
 
 #import "PlatformString.h"
+#import <wtf/RetainPtr.h>
 #import <wtf/text/CString.h>
 
 namespace WebCore {
@@ -62,4 +64,25 @@ CString openTemporaryFile(const char* prefix, PlatformFileHandle& platformFileHa
     return CString(temporaryFilePath.data());
 }
 
+bool canExcludeFromBackup()
+{
+#ifdef BUILDING_ON_TIGER
+    return false;
+#else
+    return true;
+#endif
+}
+
+bool excludeFromBackup(const String& path)
+{
+#ifdef BUILDING_ON_TIGER
+    UNUSED_PARAM(path);
+    return false;
+#else
+    // It is critical to pass FALSE for excludeByPath because excluding by path requires root privileges.
+    CSBackupSetItemExcluded(pathAsURL(path).get(), TRUE, FALSE); 
+    return true;
+#endif
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/mac/MIMETypeRegistryMac.mm b/Source/WebCore/platform/mac/MIMETypeRegistryMac.mm
index 82348e0..3792b5a 100644
--- a/Source/WebCore/platform/mac/MIMETypeRegistryMac.mm
+++ b/Source/WebCore/platform/mac/MIMETypeRegistryMac.mm
@@ -28,12 +28,15 @@
 #include "MIMETypeRegistry.h"
 
 #include "WebCoreSystemInterface.h"
+#include <wtf/Assertions.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore 
 {
 
 String MIMETypeRegistry::getMIMETypeForExtension(const String &ext)
 {
+    ASSERT(isMainThread());
     return wkGetMIMETypeForExtension(ext);
 }
 
diff --git a/Source/WebCore/platform/mac/PasteboardMac.mm b/Source/WebCore/platform/mac/PasteboardMac.mm
index 71e4046..65180a0 100644
--- a/Source/WebCore/platform/mac/PasteboardMac.mm
+++ b/Source/WebCore/platform/mac/PasteboardMac.mm
@@ -27,7 +27,6 @@
 #import "Pasteboard.h"
 
 #import "CachedResource.h"
-#import "CharacterNames.h"
 #import "DOMRangeInternal.h"
 #import "Document.h"
 #import "DocumentFragment.h"
@@ -49,10 +48,10 @@
 #import "Text.h"
 #import "WebCoreNSStringExtras.h"
 #import "markup.h"
-
 #import <wtf/StdLibExtras.h>
 #import <wtf/RetainPtr.h>
 #import <wtf/UnusedParam.h>
+#import <wtf/unicode/CharacterNames.h>
 
 @interface NSAttributedString (AppKitSecretsIKnowAbout)
 - (id)_initWithDOMRange:(DOMRange *)domRange;
diff --git a/Source/WebCore/platform/mac/PopupMenuMac.mm b/Source/WebCore/platform/mac/PopupMenuMac.mm
index 1bf500b..e69bcb2 100644
--- a/Source/WebCore/platform/mac/PopupMenuMac.mm
+++ b/Source/WebCore/platform/mac/PopupMenuMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
  *
  * This library is free software; you can redistribute it and/or
@@ -75,6 +75,11 @@ void PopupMenuMac::populate()
     if (!client()->shouldPopOver())
         [m_popup.get() addItemWithTitle:@""];
 
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    TextDirection menuTextDirection = client()->menuStyle().textDirection();
+    [m_popup.get() setUserInterfaceLayoutDirection:menuTextDirection == LTR ? NSUserInterfaceLayoutDirectionLeftToRight : NSUserInterfaceLayoutDirectionRightToLeft];
+#endif // !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+
     ASSERT(client());
     int size = client()->listSize();
 
@@ -92,13 +97,27 @@ void PopupMenuMac::populate()
                 }
                 [attributes setObject:font forKey:NSFontAttributeName];
             }
+
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+            RetainPtr<NSMutableParagraphStyle> paragraphStyle(AdoptNS, [[NSParagraphStyle defaultParagraphStyle] mutableCopy]);
+            [paragraphStyle.get() setAlignment:menuTextDirection == LTR ? NSLeftTextAlignment : NSRightTextAlignment];
+            NSWritingDirection writingDirection = style.textDirection() == LTR ? NSWritingDirectionLeftToRight : NSWritingDirectionRightToLeft;
+            [paragraphStyle.get() setBaseWritingDirection:writingDirection];
+            if (style.hasTextDirectionOverride()) {
+                RetainPtr<NSNumber> writingDirectionValue(AdoptNS, [[NSNumber alloc] initWithInteger:writingDirection + NSTextWritingDirectionOverride]);
+                RetainPtr<NSArray> writingDirectionArray(AdoptNS, [[NSArray alloc] initWithObjects:writingDirectionValue.get(), nil]);
+                [attributes setObject:writingDirectionArray.get() forKey:NSWritingDirectionAttributeName];
+            }
+            [attributes setObject:paragraphStyle.get() forKey:NSParagraphStyleAttributeName];
+#endif // !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+
             // FIXME: Add support for styling the foreground and background colors.
             // FIXME: Find a way to customize text color when an item is highlighted.
-            NSAttributedString* string = [[NSAttributedString alloc] initWithString:client()->itemText(i) attributes:attributes];
+            NSAttributedString *string = [[NSAttributedString alloc] initWithString:client()->itemText(i) attributes:attributes];
             [attributes release];
 
             [m_popup.get() addItemWithTitle:@""];
-            NSMenuItem* menuItem = [m_popup.get() lastItem];
+            NSMenuItem *menuItem = [m_popup.get() lastItem];
             [menuItem setAttributedTitle:string];
             [menuItem setEnabled:client()->itemIsEnabled(i)];
             [menuItem setToolTip:client()->itemToolTip(i)];
diff --git a/Source/WebCore/platform/mac/ScrollAnimatorMac.h b/Source/WebCore/platform/mac/ScrollAnimatorMac.h
index f05db40..3f7612a 100644
--- a/Source/WebCore/platform/mac/ScrollAnimatorMac.h
+++ b/Source/WebCore/platform/mac/ScrollAnimatorMac.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,17 +28,30 @@
 
 #if ENABLE(SMOOTH_SCROLLING)
 
+#include "FloatPoint.h"
+#include "FloatSize.h"
+#include "HeaderDetection.h"
 #include "ScrollAnimator.h"
+#include "Timer.h"
+#include "WebCoreSystemInterface.h"
 #include <wtf/RetainPtr.h>
 
 #ifdef __OBJC__
 @class ScrollAnimationHelperDelegate;
+@class ScrollbarPainterDelegate;
+@class ScrollbarPainterControllerDelegate;
+@class ScrollbarPainterDelegate;
 #else
 class ScrollAnimationHelperDelegate;
+class ScrollbarPainterDelegate;
+class ScrollbarPainterControllerDelegate;
+class ScrollbarPainterDelegate;
 #endif
 
 namespace WebCore {
 
+class Scrollbar;
+
 class ScrollAnimatorMac : public ScrollAnimator {
 public:
     ScrollAnimatorMac(ScrollableArea*);
@@ -47,12 +60,72 @@ public:
     virtual bool scroll(ScrollbarOrientation, ScrollGranularity, float step, float multiplier);
     virtual void scrollToOffsetWithoutAnimation(const FloatPoint&);
 
-    // Called by the ScrollAnimationHelperDelegate.
-    void immediateScrollToPoint(const FloatPoint& newPosition);
+#if ENABLE(RUBBER_BANDING)
+    virtual void handleWheelEvent(PlatformWheelEvent&);
+#if ENABLE(GESTURE_EVENTS)
+    virtual void handleGestureEvent(const PlatformGestureEvent&);
+#endif
+#endif
 
+    void immediateScrollToPoint(const FloatPoint& newPosition);
+    void immediateScrollByDeltaX(float deltaX);
+    void immediateScrollByDeltaY(float deltaY);
+    
 private:
     RetainPtr<id> m_scrollAnimationHelper;
     RetainPtr<ScrollAnimationHelperDelegate> m_scrollAnimationHelperDelegate;
+
+#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+    RetainPtr<WKScrollbarPainterControllerRef> m_scrollbarPainterController;
+    RetainPtr<ScrollbarPainterControllerDelegate> m_scrollbarPainterControllerDelegate;
+    RetainPtr<id> m_scrollbarPainterDelegate;
+#endif
+    
+    virtual void notityPositionChanged();
+    virtual void contentAreaWillPaint() const;
+    virtual void mouseEnteredContentArea() const;
+    virtual void mouseExitedContentArea() const;
+    virtual void mouseMovedInContentArea() const;
+    virtual void willStartLiveResize();
+    virtual void contentsResized() const;
+    virtual void willEndLiveResize();
+    virtual void contentAreaDidShow() const;
+    virtual void contentAreaDidHide() const;
+
+    virtual void didAddVerticalScrollbar(Scrollbar*);
+    virtual void willRemoveVerticalScrollbar(Scrollbar*);
+    virtual void didAddHorizontalScrollbar(Scrollbar*);
+    virtual void willRemoveHorizontalScrollbar(Scrollbar*);
+
+    float adjustScrollXPositionIfNecessary(float) const;
+    float adjustScrollYPositionIfNecessary(float) const;
+    FloatPoint adjustScrollPositionIfNecessary(const FloatPoint&) const;
+
+#if ENABLE(RUBBER_BANDING)
+    bool allowsVerticalStretching() const;
+    bool allowsHorizontalStretching() const;
+    bool pinnedInDirection(float deltaX, float deltaY);
+    void snapRubberBand();
+    void snapRubberBandTimerFired(Timer<ScrollAnimatorMac>*);
+    void smoothScrollWithEvent(PlatformWheelEvent&);
+    void beginScrollGesture();
+    void endScrollGesture();
+
+    bool m_inScrollGesture;
+    bool m_momentumScrollInProgress;
+    bool m_ignoreMomentumScrolls;
+    CFTimeInterval m_lastMomemtumScrollTimestamp;
+    FloatSize m_overflowScrollDelta;
+    FloatSize m_stretchScrollForce;
+    FloatSize m_momentumVelocity;
+
+    // Rubber band state.
+    CFTimeInterval m_startTime;
+    FloatSize m_startStretch;
+    FloatPoint m_origOrigin;
+    FloatSize m_origVelocity;
+    Timer<ScrollAnimatorMac> m_snapRubberBandTimer;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/mac/ScrollAnimatorMac.mm b/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
index 59b333b..c1154d5 100644
--- a/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
+++ b/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,10 +30,20 @@
 #include "ScrollAnimatorMac.h"
 
 #include "FloatPoint.h"
+#include "IntRect.h"
+#include "PlatformGestureEvent.h"
+#include "PlatformWheelEvent.h"
+#include "ScrollView.h"
 #include "ScrollableArea.h"
+#include "ScrollbarTheme.h"
+#include "ScrollbarThemeMac.h"
 #include <wtf/PassOwnPtr.h>
+#include <wtf/UnusedParam.h>
 
-@interface NSObject (NSScrollAnimationHelperDetails)
+using namespace WebCore;
+using namespace std;
+
+@interface NSObject (ScrollAnimationHelperDetails)
 - (id)initWithDelegate:(id)delegate;
 - (void)_stopRun;
 - (BOOL)_isAnimating;
@@ -44,18 +54,7 @@
 {
     WebCore::ScrollAnimatorMac* _animator;
 }
-
 - (id)initWithScrollAnimator:(WebCore::ScrollAnimatorMac*)scrollAnimator;
-
-- (NSRect)bounds;
-- (void)_immediateScrollToPoint:(NSPoint)newPosition;
-- (NSSize)convertSizeToBase:(NSSize)size;
-- (NSSize)convertSizeFromBase:(NSSize)size;
-
-- (id)superview; // Return nil.
-- (id)documentView; // Return nil.
-- (id)window; // Return nil.
-- (void)_recursiveRecomputeToolTips; // No-op.
 @end
 
 static NSSize abs(NSSize size)
@@ -80,14 +79,24 @@ static NSSize abs(NSSize size)
     return self;
 }
 
+- (void)scrollAnimatorDestroyed
+{
+    _animator = 0;
+}
+
 - (NSRect)bounds
 {
+    if (!_animator)
+        return NSZeroRect;
+
     WebCore::FloatPoint currentPosition = _animator->currentPosition();
     return NSMakeRect(currentPosition.x(), currentPosition.y(), 0, 0);
 }
 
 - (void)_immediateScrollToPoint:(NSPoint)newPosition
 {
+    if (!_animator)
+        return;
     _animator->immediateScrollToPoint(newPosition);
 }
 
@@ -101,6 +110,16 @@ static NSSize abs(NSSize size)
     return abs(size);
 }
 
+- (NSSize)convertSizeToBacking:(NSSize)size
+{
+    return abs(size);
+}
+
+- (NSSize)convertSizeFromBacking:(NSSize)size
+{
+    return abs(size);
+}
+
 - (id)superview
 {
     return nil;
@@ -122,6 +141,307 @@ static NSSize abs(NSSize size)
 
 @end
 
+#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+
+@interface ScrollbarPainterControllerDelegate : NSObject
+{
+    WebCore::ScrollAnimatorMac* _animator;
+}
+- (id)initWithScrollAnimator:(WebCore::ScrollAnimatorMac*)scrollAnimator;
+@end
+
+@implementation ScrollbarPainterControllerDelegate
+
+- (id)initWithScrollAnimator:(WebCore::ScrollAnimatorMac*)scrollAnimator
+{
+    self = [super init];
+    if (!self)
+        return nil;
+    
+    _animator = scrollAnimator;
+    return self;
+}
+
+- (void)scrollAnimatorDestroyed
+{
+    _animator = 0;
+}
+
+- (NSRect)contentAreaRectForScrollerImpPair:(id)scrollerImpPair
+{
+    UNUSED_PARAM(scrollerImpPair);
+    if (!_animator)
+        return NSZeroRect;
+
+    WebCore::IntSize contentsSize = _animator->scrollableArea()->contentsSize();
+    return NSMakeRect(0, 0, contentsSize.width(), contentsSize.height());
+}
+
+- (BOOL)inLiveResizeForScrollerImpPair:(id)scrollerImpPair
+{
+    UNUSED_PARAM(scrollerImpPair);
+    if (!_animator)
+        return NO;
+
+    return _animator->scrollableArea()->inLiveResize();
+}
+
+- (NSPoint)mouseLocationInContentAreaForScrollerImpPair:(id)scrollerImpPair
+{
+    UNUSED_PARAM(scrollerImpPair);
+    if (!_animator)
+        return NSZeroPoint;
+
+    return _animator->scrollableArea()->currentMousePosition();
+}
+
+- (NSPoint)scrollerImpPair:(id)scrollerImpPair convertContentPoint:(NSPoint)pointInContentArea toScrollerImp:(id)scrollerImp
+{
+    UNUSED_PARAM(scrollerImpPair);
+    if (!_animator)
+        return NSZeroPoint;
+
+    WebCore::Scrollbar* scrollbar = 0;
+    if (wkScrollbarPainterIsHorizontal((WKScrollbarPainterRef)scrollerImp))
+        scrollbar = _animator->scrollableArea()->horizontalScrollbar();
+    else 
+        scrollbar = _animator->scrollableArea()->verticalScrollbar();
+
+    // It is possible to have a null scrollbar here since it is possible for this delegate
+    // method to be called between the moment when a scrollbar has been set to 0 and the
+    // moment when its destructor has been called. We should probably de-couple some
+    // of the clean-up work in ScrollbarThemeMac::unregisterScrollbar() to avoid this
+    // issue.
+    if (!scrollbar)
+        return WebCore::IntPoint();
+    
+    return scrollbar->convertFromContainingView(WebCore::IntPoint(pointInContentArea));
+}
+
+- (void)scrollerImpPair:(id)scrollerImpPair setContentAreaNeedsDisplayInRect:(NSRect)rect
+{
+    UNUSED_PARAM(scrollerImpPair);
+    UNUSED_PARAM(rect);
+}
+
+- (void)scrollerImpPair:(id)scrollerImpPair updateScrollerStyleForNewRecommendedScrollerStyle:(NSScrollerStyle)newRecommendedScrollerStyle
+{
+    if (!_animator)
+        return;
+
+    WKScrollbarPainterControllerRef painterController = (WKScrollbarPainterControllerRef)scrollerImpPair;
+    WebCore::ScrollbarThemeMac* macTheme = (WebCore::ScrollbarThemeMac*)WebCore::ScrollbarTheme::nativeTheme();
+
+    WKScrollbarPainterRef oldVerticalPainter = wkVerticalScrollbarPainterForController(painterController);
+    if (oldVerticalPainter) {
+        WebCore::Scrollbar* verticalScrollbar = _animator->scrollableArea()->verticalScrollbar();
+        WKScrollbarPainterRef newVerticalPainter = wkMakeScrollbarReplacementPainter(oldVerticalPainter,
+                                                                                     newRecommendedScrollerStyle,
+                                                                                     verticalScrollbar->controlSize(),
+                                                                                     false);
+        macTheme->setNewPainterForScrollbar(verticalScrollbar, newVerticalPainter);
+    }
+
+    WKScrollbarPainterRef oldHorizontalPainter = wkHorizontalScrollbarPainterForController(painterController);
+    if (oldHorizontalPainter) {
+        WebCore::Scrollbar* horizontalScrollbar = _animator->scrollableArea()->horizontalScrollbar();
+        WKScrollbarPainterRef newHorizontalPainter = wkMakeScrollbarReplacementPainter(oldHorizontalPainter,
+                                                                                       newRecommendedScrollerStyle,
+                                                                                       horizontalScrollbar->controlSize(),
+                                                                                       true);
+        macTheme->setNewPainterForScrollbar(horizontalScrollbar, newHorizontalPainter);
+    }
+
+    wkSetScrollbarPainterControllerStyle(painterController, newRecommendedScrollerStyle);
+}
+
+@end
+
+@interface ScrollbarPartAnimation : NSAnimation
+{
+    RetainPtr<WKScrollbarPainterRef> _scrollerPainter;
+    WebCore::ScrollbarPart _part;
+    WebCore::ScrollAnimatorMac* _animator;
+    CGFloat _initialAlpha;
+    CGFloat _newAlpha;
+}
+- (id)initWithScrollbarPainter:(WKScrollbarPainterRef)scrollerPainter part:(WebCore::ScrollbarPart)part scrollAnimator:(WebCore::ScrollAnimatorMac*)scrollAnimator animateAlphaTo:(CGFloat)newAlpha duration:(NSTimeInterval)duration;
+@end
+
+@implementation ScrollbarPartAnimation
+
+- (id)initWithScrollbarPainter:(WKScrollbarPainterRef)scrollerPainter part:(WebCore::ScrollbarPart)part scrollAnimator:(WebCore::ScrollAnimatorMac*)scrollAnimator animateAlphaTo:(CGFloat)newAlpha duration:(NSTimeInterval)duration
+{
+    self = [super initWithDuration:duration animationCurve:NSAnimationEaseInOut];
+    if (!self)
+        return nil;
+    
+    _scrollerPainter = scrollerPainter;
+    _part = part;
+    _animator = scrollAnimator;
+    _initialAlpha = _part == WebCore::ThumbPart ? wkScrollbarPainterKnobAlpha(_scrollerPainter.get()) : wkScrollbarPainterTrackAlpha(_scrollerPainter.get());
+    _newAlpha = newAlpha;
+    
+    return self;    
+}
+
+- (void)setCurrentProgress:(NSAnimationProgress)progress
+{
+    [super setCurrentProgress:progress];
+
+    if (!_animator)
+        return;
+
+    CGFloat currentAlpha;
+    if (_initialAlpha > _newAlpha)
+        currentAlpha = 1 - progress;
+    else
+        currentAlpha = progress;
+    
+    if (_part == WebCore::ThumbPart)
+        wkSetScrollbarPainterKnobAlpha(_scrollerPainter.get(), currentAlpha);
+    else
+        wkSetScrollbarPainterTrackAlpha(_scrollerPainter.get(), currentAlpha);
+
+    // Invalidate the scrollbars so that they paint the animation
+    if (WebCore::Scrollbar* verticalScrollbar = _animator->scrollableArea()->verticalScrollbar())
+        _animator->scrollableArea()->invalidateScrollbarRect(verticalScrollbar, WebCore::IntRect(0, 0, verticalScrollbar->width(), verticalScrollbar->height()));
+    if (WebCore::Scrollbar* horizontalScrollbar = _animator->scrollableArea()->horizontalScrollbar())
+        _animator->scrollableArea()->invalidateScrollbarRect(horizontalScrollbar, WebCore::IntRect(0, 0, horizontalScrollbar->width(), horizontalScrollbar->height()));
+}
+
+- (void)scrollAnimatorDestroyed
+{
+    [self stopAnimation];
+    _animator = 0;
+}
+
+@end
+
+@interface ScrollbarPainterDelegate : NSObject<NSAnimationDelegate>
+{
+    WebCore::ScrollAnimatorMac* _animator;
+
+    RetainPtr<ScrollbarPartAnimation> _verticalKnobAnimation;
+    RetainPtr<ScrollbarPartAnimation> _horizontalKnobAnimation;
+
+    RetainPtr<ScrollbarPartAnimation> _verticalTrackAnimation;
+    RetainPtr<ScrollbarPartAnimation> _horizontalTrackAnimation;
+}
+- (id)initWithScrollAnimator:(WebCore::ScrollAnimatorMac*)scrollAnimator;
+@end
+
+@implementation ScrollbarPainterDelegate
+
+- (id)initWithScrollAnimator:(WebCore::ScrollAnimatorMac*)scrollAnimator
+{
+    self = [super init];
+    if (!self)
+        return nil;
+    
+    _animator = scrollAnimator;
+    return self;
+}
+
+- (NSRect)convertRectToBacking:(NSRect)aRect
+{
+    return aRect;
+}
+
+- (NSRect)convertRectFromBacking:(NSRect)aRect
+{
+    return aRect;
+}
+
+- (CALayer *)layer
+{
+    if (!_animator)
+        return nil;
+    if (!_animator->scrollableArea()->scrollbarWillRenderIntoCompositingLayer())
+        return nil;
+
+    // FIXME: This should attempt to return an actual layer.
+    static CALayer *dummyLayer = [[CALayer alloc] init];
+    return dummyLayer;
+}
+
+- (void)setUpAnimation:(RetainPtr<ScrollbarPartAnimation>&)scrollbarPartAnimation scrollerPainter:(WKScrollbarPainterRef)scrollerPainter part:(WebCore::ScrollbarPart)part animateAlphaTo:(CGFloat)newAlpha duration:(NSTimeInterval)duration
+{
+    // If we are currently animating, stop
+    if (scrollbarPartAnimation) {
+        [scrollbarPartAnimation.get() stopAnimation];
+        scrollbarPartAnimation = nil;
+    }
+    
+    scrollbarPartAnimation.adoptNS([[ScrollbarPartAnimation alloc] initWithScrollbarPainter:scrollerPainter 
+                                                                    part:part
+                                                                    scrollAnimator:_animator 
+                                                                    animateAlphaTo:newAlpha 
+                                                                    duration:duration]);
+    [scrollbarPartAnimation.get() setAnimationBlockingMode:NSAnimationNonblocking];
+    [scrollbarPartAnimation.get() startAnimation];
+}
+
+- (void)scrollerImp:(id)scrollerImp animateKnobAlphaTo:(CGFloat)newKnobAlpha duration:(NSTimeInterval)duration
+{
+    if (!_animator)
+        return;
+
+    WKScrollbarPainterRef scrollerPainter = (WKScrollbarPainterRef)scrollerImp;
+    if (newKnobAlpha == wkScrollbarPainterKnobAlpha(scrollerPainter))
+        return;
+
+    if (wkScrollbarPainterIsHorizontal(scrollerPainter))
+        [self setUpAnimation:_horizontalKnobAnimation scrollerPainter:scrollerPainter part:WebCore::ThumbPart animateAlphaTo:newKnobAlpha duration:duration];
+    else
+        [self setUpAnimation:_verticalKnobAnimation scrollerPainter:scrollerPainter part:WebCore::ThumbPart animateAlphaTo:newKnobAlpha duration:duration];
+}
+
+- (void)scrollerImp:(id)scrollerImp animateTrackAlphaTo:(CGFloat)newTrackAlpha duration:(NSTimeInterval)duration
+{
+    if (!_animator)
+        return;
+
+    WKScrollbarPainterRef scrollerPainter = (WKScrollbarPainterRef)scrollerImp;
+    if (newTrackAlpha == wkScrollbarPainterTrackAlpha(scrollerPainter))
+        return;
+
+    if (wkScrollbarPainterIsHorizontal(scrollerPainter))
+        [self setUpAnimation:_horizontalTrackAnimation scrollerPainter:scrollerPainter part:WebCore::BackTrackPart animateAlphaTo:newTrackAlpha duration:duration];
+    else
+        [self setUpAnimation:_verticalTrackAnimation scrollerPainter:scrollerPainter part:WebCore::BackTrackPart animateAlphaTo:newTrackAlpha duration:duration];
+}
+
+- (void)scrollerImp:(id)scrollerImp overlayScrollerStateChangedTo:(NSUInteger)newOverlayScrollerState
+{
+    if (!_animator)
+        return;
+
+    WKScrollbarPainterRef scrollbarPainter = (WKScrollbarPainterRef)scrollerImp;
+    wkScrollbarPainterSetOverlayState(scrollbarPainter, newOverlayScrollerState);
+
+    if (wkScrollbarPainterIsHorizontal(scrollbarPainter)) {
+        WebCore::Scrollbar* horizontalScrollbar = _animator->scrollableArea()->horizontalScrollbar();
+        _animator->scrollableArea()->invalidateScrollbarRect(horizontalScrollbar, WebCore::IntRect(0, 0, horizontalScrollbar->width(), horizontalScrollbar->height()));
+    } else {
+        WebCore::Scrollbar* verticalScrollbar = _animator->scrollableArea()->verticalScrollbar();
+        _animator->scrollableArea()->invalidateScrollbarRect(verticalScrollbar, WebCore::IntRect(0, 0, verticalScrollbar->width(), verticalScrollbar->height()));
+
+    }
+}
+
+- (void)scrollAnimatorDestroyed
+{
+    _animator = 0;
+    [_verticalKnobAnimation.get() scrollAnimatorDestroyed];
+    [_horizontalKnobAnimation.get() scrollAnimatorDestroyed];
+    [_verticalTrackAnimation.get() scrollAnimatorDestroyed];
+    [_horizontalTrackAnimation.get() scrollAnimatorDestroyed];
+}
+
+@end
+#endif // #if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+
 namespace WebCore {
 
 PassOwnPtr<ScrollAnimator> ScrollAnimator::create(ScrollableArea* scrollableArea)
@@ -131,13 +451,33 @@ PassOwnPtr<ScrollAnimator> ScrollAnimator::create(ScrollableArea* scrollableArea
 
 ScrollAnimatorMac::ScrollAnimatorMac(ScrollableArea* scrollableArea)
     : ScrollAnimator(scrollableArea)
+#if ENABLE(RUBBER_BANDING)
+    , m_inScrollGesture(false)
+    , m_momentumScrollInProgress(false)
+    , m_ignoreMomentumScrolls(false)
+    , m_lastMomemtumScrollTimestamp(0)
+    , m_startTime(0)
+    , m_snapRubberBandTimer(this, &ScrollAnimatorMac::snapRubberBandTimerFired)
+#endif
 {
     m_scrollAnimationHelperDelegate.adoptNS([[ScrollAnimationHelperDelegate alloc] initWithScrollAnimator:this]);
     m_scrollAnimationHelper.adoptNS([[NSClassFromString(@"NSScrollAnimationHelper") alloc] initWithDelegate:m_scrollAnimationHelperDelegate.get()]);
+
+#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+    m_scrollbarPainterControllerDelegate.adoptNS([[ScrollbarPainterControllerDelegate alloc] initWithScrollAnimator:this]);
+    m_scrollbarPainterController = wkMakeScrollbarPainterController(m_scrollbarPainterControllerDelegate.get());
+    m_scrollbarPainterDelegate.adoptNS([[ScrollbarPainterDelegate alloc] initWithScrollAnimator:this]);
+#endif
 }
 
 ScrollAnimatorMac::~ScrollAnimatorMac()
 {
+#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+    [m_scrollbarPainterControllerDelegate.get() scrollAnimatorDestroyed];
+    [(id)m_scrollbarPainterController.get() setDelegate:nil];
+    [m_scrollbarPainterDelegate.get() scrollAnimatorDestroyed];
+    [m_scrollAnimationHelperDelegate.get() scrollAnimatorDestroyed];
+#endif
 }
 
 bool ScrollAnimatorMac::scroll(ScrollbarOrientation orientation, ScrollGranularity granularity, float step, float multiplier)
@@ -167,16 +507,567 @@ bool ScrollAnimatorMac::scroll(ScrollbarOrientation orientation, ScrollGranulari
 void ScrollAnimatorMac::scrollToOffsetWithoutAnimation(const FloatPoint& offset)
 {
     [m_scrollAnimationHelper.get() _stopRun];
-    ScrollAnimator::scrollToOffsetWithoutAnimation(offset);
+    immediateScrollToPoint(offset);
+}
+
+float ScrollAnimatorMac::adjustScrollXPositionIfNecessary(float position) const
+{
+    if (!m_scrollableArea->constrainsScrollingToContentEdge())
+        return position;
+
+    return max<float>(min<float>(position, m_scrollableArea->contentsSize().width() - m_scrollableArea->visibleWidth()), 0);
+}
+
+float ScrollAnimatorMac::adjustScrollYPositionIfNecessary(float position) const
+{
+    if (!m_scrollableArea->constrainsScrollingToContentEdge())
+        return position;
+
+    return max<float>(min<float>(position, m_scrollableArea->contentsSize().height() - m_scrollableArea->visibleHeight()), 0);
+}
+
+FloatPoint ScrollAnimatorMac::adjustScrollPositionIfNecessary(const FloatPoint& position) const
+{
+    if (!m_scrollableArea->constrainsScrollingToContentEdge())
+        return position;
+
+    float newX = max<float>(min<float>(position.x(), m_scrollableArea->contentsSize().width() - m_scrollableArea->visibleWidth()), 0);
+    float newY = max<float>(min<float>(position.y(), m_scrollableArea->contentsSize().height() - m_scrollableArea->visibleHeight()), 0);
+
+    return FloatPoint(newX, newY);
 }
 
 void ScrollAnimatorMac::immediateScrollToPoint(const FloatPoint& newPosition)
 {
-    m_currentPosX = newPosition.x();
-    m_currentPosY = newPosition.y();
+    FloatPoint adjustedPosition = adjustScrollPositionIfNecessary(newPosition);
+ 
+    m_currentPosX = adjustedPosition.x();
+    m_currentPosY = adjustedPosition.y();
     notityPositionChanged();
 }
 
+void ScrollAnimatorMac::immediateScrollByDeltaX(float deltaX)
+{
+    m_currentPosX = adjustScrollXPositionIfNecessary(m_currentPosX + deltaX);
+    notityPositionChanged();
+}
+
+void ScrollAnimatorMac::immediateScrollByDeltaY(float deltaY)
+{
+    m_currentPosY = adjustScrollYPositionIfNecessary(m_currentPosY + deltaY);
+    notityPositionChanged();
+}
+
+void ScrollAnimatorMac::notityPositionChanged()
+{
+#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+    wkContentAreaScrolled(m_scrollbarPainterController.get());
+#endif
+    ScrollAnimator::notityPositionChanged();
+}
+
+void ScrollAnimatorMac::contentAreaWillPaint() const
+{
+#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+    wkContentAreaWillPaint(m_scrollbarPainterController.get());
+#endif
+}
+
+void ScrollAnimatorMac::mouseEnteredContentArea() const
+{
+#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+    wkMouseEnteredContentArea(m_scrollbarPainterController.get());
+#endif
+}
+
+void ScrollAnimatorMac::mouseExitedContentArea() const
+{
+#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+    wkMouseExitedContentArea(m_scrollbarPainterController.get());
+#endif
+}
+
+void ScrollAnimatorMac::mouseMovedInContentArea() const
+{
+#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+    wkMouseMovedInContentArea(m_scrollbarPainterController.get());
+#endif
+}
+
+void ScrollAnimatorMac::willStartLiveResize()
+{
+#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+    wkWillStartLiveResize(m_scrollbarPainterController.get());
+#endif
+}
+
+void ScrollAnimatorMac::contentsResized() const
+{
+#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+    wkContentAreaResized(m_scrollbarPainterController.get());
+#endif
+}
+
+void ScrollAnimatorMac::willEndLiveResize()
+{
+#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+    wkWillEndLiveResize(m_scrollbarPainterController.get());
+#endif
+}
+
+void ScrollAnimatorMac::contentAreaDidShow() const
+{
+#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+    wkContentAreaDidShow(m_scrollbarPainterController.get());
+#endif
+}
+
+void ScrollAnimatorMac::contentAreaDidHide() const
+{
+#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+    wkContentAreaDidHide(m_scrollbarPainterController.get());
+#endif
+}
+
+void ScrollAnimatorMac::didAddVerticalScrollbar(Scrollbar* scrollbar)
+{
+#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+    WKScrollbarPainterRef painter = static_cast<WebCore::ScrollbarThemeMac*>(WebCore::ScrollbarTheme::nativeTheme())->painterForScrollbar(scrollbar);
+    wkScrollbarPainterSetDelegate(painter, m_scrollbarPainterDelegate.get());
+    wkSetPainterForPainterController(m_scrollbarPainterController.get(), painter, false);
+    if (scrollableArea()->inLiveResize())
+        wkSetScrollbarPainterKnobAlpha(painter, 1);
+#else
+    UNUSED_PARAM(scrollbar);
+#endif
+}
+
+void ScrollAnimatorMac::willRemoveVerticalScrollbar(Scrollbar* scrollbar)
+{
+#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+    WKScrollbarPainterRef painter = static_cast<WebCore::ScrollbarThemeMac*>(WebCore::ScrollbarTheme::nativeTheme())->painterForScrollbar(scrollbar);
+    wkScrollbarPainterSetDelegate(painter, nil);
+    wkSetPainterForPainterController(m_scrollbarPainterController.get(), nil, false);
+#else
+    UNUSED_PARAM(scrollbar);
+#endif
+}
+
+void ScrollAnimatorMac::didAddHorizontalScrollbar(Scrollbar* scrollbar)
+{
+#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+    WKScrollbarPainterRef painter = static_cast<WebCore::ScrollbarThemeMac*>(WebCore::ScrollbarTheme::nativeTheme())->painterForScrollbar(scrollbar);
+    wkScrollbarPainterSetDelegate(painter, m_scrollbarPainterDelegate.get());
+    wkSetPainterForPainterController(m_scrollbarPainterController.get(), painter, true);
+    if (scrollableArea()->inLiveResize())
+        wkSetScrollbarPainterKnobAlpha(painter, 1);
+#else
+    UNUSED_PARAM(scrollbar);
+#endif
+}
+
+void ScrollAnimatorMac::willRemoveHorizontalScrollbar(Scrollbar* scrollbar)
+{
+#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+    WKScrollbarPainterRef painter = static_cast<WebCore::ScrollbarThemeMac*>(WebCore::ScrollbarTheme::nativeTheme())->painterForScrollbar(scrollbar);
+    wkScrollbarPainterSetDelegate(painter, nil);
+    wkSetPainterForPainterController(m_scrollbarPainterController.get(), nil, true);
+#else
+    UNUSED_PARAM(scrollbar);
+#endif
+}
+
+#if ENABLE(RUBBER_BANDING)
+
+static const float scrollVelocityZeroingTimeout = 0.10f;
+static const float rubberbandStiffness = 20;
+static const float rubberbandDirectionLockStretchRatio = 1;
+static const float rubberbandMinimumRequiredDeltaBeforeStretch = 10;
+static const float rubberbandAmplitude = 0.31f;
+static const float rubberbandPeriod = 1.6f;
+
+static float elasticDeltaForTimeDelta(float initialPosition, float initialVelocity, float elapsedTime)
+{
+    float amplitude = rubberbandAmplitude;
+    float period = rubberbandPeriod;
+    float criticalDampeningFactor = expf((-elapsedTime * rubberbandStiffness) / period);
+             
+    return (initialPosition + (-initialVelocity * elapsedTime * amplitude)) * criticalDampeningFactor;
+}
+
+static float elasticDeltaForReboundDelta(float delta)
+{
+    float stiffness = std::max(rubberbandStiffness, 1.0f);
+    return delta / stiffness;
+}
+
+static float reboundDeltaForElasticDelta(float delta)
+{
+    return delta * rubberbandStiffness;
+}
+
+static float scrollWheelMultiplier()
+{
+    static float multiplier = -1;
+    if (multiplier < 0) {
+        multiplier = [[NSUserDefaults standardUserDefaults] floatForKey:@"NSScrollWheelMultiplier"];
+        if (multiplier <= 0)
+            multiplier = 1;
+    }
+    return multiplier;
+}
+
+void ScrollAnimatorMac::handleWheelEvent(PlatformWheelEvent& wheelEvent)
+{
+    if (!wheelEvent.hasPreciseScrollingDeltas()) {
+        ScrollAnimator::handleWheelEvent(wheelEvent);
+        return;
+    }
+
+    wheelEvent.accept();
+
+    bool isMometumScrollEvent = (wheelEvent.phase() != PlatformWheelEventPhaseNone);
+    if (m_ignoreMomentumScrolls && (isMometumScrollEvent || m_snapRubberBandTimer.isActive())) {
+        if (wheelEvent.phase() == PlatformWheelEventPhaseEnded)
+            m_ignoreMomentumScrolls = false;
+        return;
+    }
+
+    smoothScrollWithEvent(wheelEvent);
+}
+
+void ScrollAnimatorMac::handleGestureEvent(const PlatformGestureEvent& gestureEvent)
+{
+    if (gestureEvent.type() == PlatformGestureEvent::ScrollBeginType)
+        beginScrollGesture();
+    else
+        endScrollGesture();
+}
+
+bool ScrollAnimatorMac::pinnedInDirection(float deltaX, float deltaY)
+{
+    FloatSize limitDelta;
+    if (fabsf(deltaY) >= fabsf(deltaX)) {
+        if (deltaY < 0) {
+            // We are trying to scroll up.  Make sure we are not pinned to the top
+            limitDelta.setHeight(m_scrollableArea->visibleContentRect().y());
+        } else {
+            // We are trying to scroll down.  Make sure we are not pinned to the bottom
+            limitDelta.setHeight(m_scrollableArea->contentsSize().height() - m_scrollableArea->visibleContentRect().maxY());
+        }
+    } else if (deltaX != 0) {
+        if (deltaX < 0) {
+            // We are trying to scroll left.  Make sure we are not pinned to the left
+            limitDelta.setWidth(m_scrollableArea->visibleContentRect().x());
+        } else {
+            // We are trying to scroll right.  Make sure we are not pinned to the right
+            limitDelta.setWidth(m_scrollableArea->contentsSize().width() - m_scrollableArea->visibleContentRect().maxX());
+        }
+    }
+    
+    if ((deltaX != 0 || deltaY != 0) && (limitDelta.width() < 1 && limitDelta.height() < 1))
+        return true;
+    return false;
+}
+
+bool ScrollAnimatorMac::allowsVerticalStretching() const
+{
+    Scrollbar* hScroller = m_scrollableArea->horizontalScrollbar();
+    Scrollbar* vScroller = m_scrollableArea->verticalScrollbar();
+    if (((vScroller && vScroller->enabled()) || (!hScroller || !hScroller->enabled())))
+        return true;
+
+    return false;
+}
+
+bool ScrollAnimatorMac::allowsHorizontalStretching() const
+{
+    Scrollbar* hScroller = m_scrollableArea->horizontalScrollbar();
+    Scrollbar* vScroller = m_scrollableArea->verticalScrollbar();
+    if (((hScroller && hScroller->enabled()) || (!vScroller || !vScroller->enabled())))
+        return true;
+
+    return false;
+}
+
+void ScrollAnimatorMac::smoothScrollWithEvent(PlatformWheelEvent& wheelEvent)
+{
+    float deltaX = m_overflowScrollDelta.width();
+    float deltaY = m_overflowScrollDelta.height();
+
+    // Reset overflow values because we may decide to remove delta at various points and put it into overflow.
+    m_overflowScrollDelta = FloatSize();
+
+    float eventCoallescedDeltaX = -wheelEvent.deltaX();
+    float eventCoallescedDeltaY = -wheelEvent.deltaY();
+
+    deltaX += eventCoallescedDeltaX;
+    deltaY += eventCoallescedDeltaY;
+
+    // Slightly prefer scrolling vertically by applying the = case to deltaY
+    if (fabsf(deltaY) >= fabsf(deltaX))
+        deltaX = 0;
+    else
+        deltaY = 0;
+    
+    bool isVerticallyStretched = false;
+    bool isHorizontallyStretched = false;
+    bool shouldStretch = false;
+    
+    IntSize stretchAmount = m_scrollableArea->overhangAmount();
+
+    isHorizontallyStretched = stretchAmount.width();
+    isVerticallyStretched = stretchAmount.height();
+
+    PlatformWheelEventPhase phase = wheelEvent.phase();
+
+    // If we are starting momentum scrolling then do some setup.
+    if (!m_momentumScrollInProgress && (phase == PlatformWheelEventPhaseBegan || phase == PlatformWheelEventPhaseChanged))
+        m_momentumScrollInProgress = true;
+
+    CFTimeInterval timeDelta = wheelEvent.timestamp() - m_lastMomemtumScrollTimestamp;
+    if (m_inScrollGesture || m_momentumScrollInProgress) {
+        if (m_lastMomemtumScrollTimestamp && timeDelta > 0 && timeDelta < scrollVelocityZeroingTimeout) {
+            m_momentumVelocity.setWidth(eventCoallescedDeltaX / (float)timeDelta);
+            m_momentumVelocity.setHeight(eventCoallescedDeltaY / (float)timeDelta);
+            m_lastMomemtumScrollTimestamp = wheelEvent.timestamp();
+        } else {
+            m_lastMomemtumScrollTimestamp = wheelEvent.timestamp();
+            m_momentumVelocity = FloatSize();
+        }
+
+        if (isVerticallyStretched) {
+            if (!isHorizontallyStretched && pinnedInDirection(deltaX, 0)) {                
+                // Stretching only in the vertical.
+                if (deltaY != 0 && (fabsf(deltaX / deltaY) < rubberbandDirectionLockStretchRatio))
+                    deltaX = 0;
+                else if (fabsf(deltaX) < rubberbandMinimumRequiredDeltaBeforeStretch) {
+                    m_overflowScrollDelta.setWidth(m_overflowScrollDelta.width() + deltaX);
+                    deltaX = 0;
+                } else
+                    m_overflowScrollDelta.setWidth(m_overflowScrollDelta.width() + deltaX);
+            }
+        } else if (isHorizontallyStretched) {
+            // Stretching only in the horizontal.
+            if (pinnedInDirection(0, deltaY)) {
+                if (deltaX != 0 && (fabsf(deltaY / deltaX) < rubberbandDirectionLockStretchRatio))
+                    deltaY = 0;
+                else if (fabsf(deltaY) < rubberbandMinimumRequiredDeltaBeforeStretch) {
+                    m_overflowScrollDelta.setHeight(m_overflowScrollDelta.height() + deltaY);
+                    deltaY = 0;
+                } else
+                    m_overflowScrollDelta.setHeight(m_overflowScrollDelta.height() + deltaY);
+            }
+        } else {
+            // Not stretching at all yet.
+            if (pinnedInDirection(deltaX, deltaY)) {
+                if (fabsf(deltaY) >= fabsf(deltaX)) {
+                    if (fabsf(deltaX) < rubberbandMinimumRequiredDeltaBeforeStretch) {
+                        m_overflowScrollDelta.setWidth(m_overflowScrollDelta.width() + deltaX);
+                        deltaX = 0;
+                    } else
+                        m_overflowScrollDelta.setWidth(m_overflowScrollDelta.width() + deltaX);
+                }
+                shouldStretch = true;
+            }
+        }
+    }
+
+    if (deltaX != 0 || deltaY != 0) {
+        if (!(shouldStretch || isVerticallyStretched || isHorizontallyStretched)) {
+            if (deltaY != 0) {
+                deltaY *= scrollWheelMultiplier();
+                immediateScrollByDeltaY(deltaY);
+            }
+            if (deltaX != 0) {
+                deltaX *= scrollWheelMultiplier();
+                immediateScrollByDeltaX(deltaX);
+            }
+        } else {
+            if (!allowsHorizontalStretching()) {
+                deltaX = 0;
+                eventCoallescedDeltaX = 0;
+            } else if ((deltaX != 0) && !isHorizontallyStretched && !pinnedInDirection(deltaX, 0)) {
+                deltaX *= scrollWheelMultiplier();
+
+                m_scrollableArea->setConstrainsScrollingToContentEdge(false);
+                immediateScrollByDeltaX(deltaX);
+                m_scrollableArea->setConstrainsScrollingToContentEdge(true);
+
+                deltaX = 0;
+            }
+            
+            if (!allowsVerticalStretching()) {
+                deltaY = 0;
+                eventCoallescedDeltaY = 0;
+            } else if ((deltaY != 0) && !isVerticallyStretched && !pinnedInDirection(0, deltaY)) {
+                deltaY *= scrollWheelMultiplier();
+
+                m_scrollableArea->setConstrainsScrollingToContentEdge(false);
+                immediateScrollByDeltaY(deltaY);
+                m_scrollableArea->setConstrainsScrollingToContentEdge(true);
+
+                deltaY = 0;
+            }
+            
+            IntSize stretchAmount = m_scrollableArea->overhangAmount();
+        
+            if (m_momentumScrollInProgress) {
+                if ((pinnedInDirection(eventCoallescedDeltaX, eventCoallescedDeltaY) || (fabsf(eventCoallescedDeltaX) + fabsf(eventCoallescedDeltaY) <= 0)) && m_lastMomemtumScrollTimestamp) {
+                    m_ignoreMomentumScrolls = true;
+                    m_momentumScrollInProgress = false;
+                    snapRubberBand();
+                }
+            }
+
+            m_stretchScrollForce.setWidth(m_stretchScrollForce.width() + deltaX);
+            m_stretchScrollForce.setHeight(m_stretchScrollForce.height() + deltaY);
+
+            FloatSize dampedDelta(ceilf(elasticDeltaForReboundDelta(m_stretchScrollForce.width())), ceilf(elasticDeltaForReboundDelta(m_stretchScrollForce.height())));
+            FloatPoint origOrigin = m_scrollableArea->visibleContentRect().location() - stretchAmount;
+            FloatPoint newOrigin = origOrigin + dampedDelta;
+
+            if (origOrigin != newOrigin) {
+                m_scrollableArea->setConstrainsScrollingToContentEdge(false);
+                immediateScrollToPoint(newOrigin);
+                m_scrollableArea->setConstrainsScrollingToContentEdge(true);
+            }
+        }
+    }
+
+    if (m_momentumScrollInProgress && phase == PlatformWheelEventPhaseEnded) {
+        m_momentumScrollInProgress = false;
+        m_ignoreMomentumScrolls = false;
+        m_lastMomemtumScrollTimestamp = 0;
+    }
+}
+
+void ScrollAnimatorMac::beginScrollGesture()
+{
+    m_inScrollGesture = true;
+    m_momentumScrollInProgress = false;
+    m_ignoreMomentumScrolls = false;
+    m_lastMomemtumScrollTimestamp = 0;
+    m_momentumVelocity = FloatSize();
+
+    IntSize stretchAmount = m_scrollableArea->overhangAmount();
+    m_stretchScrollForce.setWidth(reboundDeltaForElasticDelta(stretchAmount.width()));
+    m_stretchScrollForce.setHeight(reboundDeltaForElasticDelta(stretchAmount.height()));
+
+    m_overflowScrollDelta = FloatSize();
+    
+    if (m_snapRubberBandTimer.isActive())
+        m_snapRubberBandTimer.stop();
+}
+
+void ScrollAnimatorMac::endScrollGesture()
+{
+    snapRubberBand();
+}
+
+void ScrollAnimatorMac::snapRubberBand()
+{
+    CFTimeInterval timeDelta = [[NSProcessInfo processInfo] systemUptime] - m_lastMomemtumScrollTimestamp;
+    if (m_lastMomemtumScrollTimestamp && timeDelta >= scrollVelocityZeroingTimeout)
+        m_momentumVelocity = FloatSize();
+
+    m_inScrollGesture = false;
+
+    if (m_snapRubberBandTimer.isActive())
+        return;
+
+    m_startTime = [NSDate timeIntervalSinceReferenceDate];
+    m_startStretch = FloatSize();
+    m_origOrigin = FloatPoint();
+    m_origVelocity = FloatSize();
+
+    m_snapRubberBandTimer.startRepeating(1.0/60.0);
+}
+
+static inline float roundTowardZero(float num)
+{
+    return num > 0 ? ceilf(num - 0.5f) : floorf(num + 0.5f);
+}
+
+static inline float roundToDevicePixelTowardZero(float num)
+{
+    float roundedNum = roundf(num);
+    if (fabs(num - roundedNum) < 0.125)
+        num = roundedNum;
+
+    return roundTowardZero(num);
+}
+
+void ScrollAnimatorMac::snapRubberBandTimerFired(Timer<ScrollAnimatorMac>*)
+{
+    if (!m_momentumScrollInProgress || m_ignoreMomentumScrolls) {
+        CFTimeInterval timeDelta = [NSDate timeIntervalSinceReferenceDate] - m_startTime;
+
+        if (m_startStretch == FloatSize()) {
+            m_startStretch = m_scrollableArea->overhangAmount();
+            if (m_startStretch == FloatSize()) {    
+                m_snapRubberBandTimer.stop();
+                m_stretchScrollForce = FloatSize();
+                m_startTime = 0;
+                m_startStretch = FloatSize();
+                m_origOrigin = FloatPoint();
+                m_origVelocity = FloatSize();
+
+                return;
+            }
+
+            m_origOrigin = m_scrollableArea->visibleContentRect().location() - m_startStretch;
+            m_origVelocity = m_momentumVelocity;
+
+            // Just like normal scrolling, prefer vertical rubberbanding
+            if (fabsf(m_origVelocity.height()) >= fabsf(m_origVelocity.width()))
+                m_origVelocity.setWidth(0);
+            
+            // Don't rubber-band horizontally if it's not possible to scroll horizontally
+            Scrollbar* hScroller = m_scrollableArea->horizontalScrollbar();
+            if (!hScroller || !hScroller->enabled())
+                m_origVelocity.setWidth(0);
+            
+            // Don't rubber-band vertically if it's not possible to scroll horizontally
+            Scrollbar* vScroller = m_scrollableArea->verticalScrollbar();
+            if (!vScroller || !vScroller->enabled())
+                m_origVelocity.setHeight(0);
+        }
+
+        FloatPoint delta(roundToDevicePixelTowardZero(elasticDeltaForTimeDelta(m_startStretch.width(), -m_origVelocity.width(), (float)timeDelta)),
+                         roundToDevicePixelTowardZero(elasticDeltaForTimeDelta(m_startStretch.height(), -m_origVelocity.height(), (float)timeDelta)));
+
+        if (fabs(delta.x()) >= 1 || fabs(delta.y()) >= 1) {
+            FloatPoint newOrigin = m_origOrigin + delta;
+
+            m_scrollableArea->setConstrainsScrollingToContentEdge(false);
+            immediateScrollToPoint(newOrigin);
+            m_scrollableArea->setConstrainsScrollingToContentEdge(true);
+
+            FloatSize newStretch = m_scrollableArea->overhangAmount();
+            
+            m_stretchScrollForce.setWidth(reboundDeltaForElasticDelta(newStretch.width()));
+            m_stretchScrollForce.setHeight(reboundDeltaForElasticDelta(newStretch.height()));
+        } else {
+            immediateScrollToPoint(m_origOrigin);
+
+            m_scrollableArea->didCompleteRubberBand(roundedIntSize(m_startStretch));
+
+            m_snapRubberBandTimer.stop();
+            m_stretchScrollForce = FloatSize();
+            
+            m_startTime = 0;
+            m_startStretch = FloatSize();
+            m_origOrigin = FloatPoint();
+            m_origVelocity = FloatSize();
+        }
+    } else {
+        m_startTime = [NSDate timeIntervalSinceReferenceDate];
+        m_startStretch = FloatSize();
+    }
+}
+#endif
+
 } // namespace WebCore
 
 #endif // ENABLE(SMOOTH_SCROLLING)
diff --git a/Source/WebCore/platform/mac/ScrollViewMac.mm b/Source/WebCore/platform/mac/ScrollViewMac.mm
index 93ec971..ff2e14e 100644
--- a/Source/WebCore/platform/mac/ScrollViewMac.mm
+++ b/Source/WebCore/platform/mac/ScrollViewMac.mm
@@ -203,10 +203,10 @@ bool ScrollView::platformIsOffscreen() const
     return ![platformWidget() window] || ![[platformWidget() window] isVisible];
 }
 
-void ScrollView::platformSetScrollOrigin(const IntPoint& origin, bool updatePosition)
+void ScrollView::platformSetScrollOrigin(const IntPoint& origin, bool updatePositionAtAll, bool updatePositionSynchronously)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
-    [scrollView() setScrollOrigin:origin updatePosition:updatePosition];
+    [scrollView() setScrollOrigin:origin updatePositionAtAll:updatePositionAtAll immediately:updatePositionSynchronously];
     END_BLOCK_OBJC_EXCEPTIONS;
 }
 
diff --git a/Source/WebCore/platform/mac/ScrollbarThemeMac.h b/Source/WebCore/platform/mac/ScrollbarThemeMac.h
index 8b5412d..844a088 100644
--- a/Source/WebCore/platform/mac/ScrollbarThemeMac.h
+++ b/Source/WebCore/platform/mac/ScrollbarThemeMac.h
@@ -26,7 +26,9 @@
 #ifndef ScrollbarThemeMac_h
 #define ScrollbarThemeMac_h
 
+#include "HeaderDetection.h"
 #include "ScrollbarThemeComposite.h"
+#include "WebCoreSystemInterface.h"
 
 namespace WebCore {
 
@@ -50,6 +52,11 @@ public:
     virtual void registerScrollbar(Scrollbar*);
     virtual void unregisterScrollbar(Scrollbar*);
 
+#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+    void setNewPainterForScrollbar(Scrollbar*, WKScrollbarPainterRef);
+    WKScrollbarPainterRef painterForScrollbar(Scrollbar*);
+#endif
+
 protected:
     virtual bool hasButtons(Scrollbar*);
     virtual bool hasThumb(Scrollbar*);
diff --git a/Source/WebCore/platform/mac/ScrollbarThemeMac.mm b/Source/WebCore/platform/mac/ScrollbarThemeMac.mm
index 032d9f3..c35dfa0 100644
--- a/Source/WebCore/platform/mac/ScrollbarThemeMac.mm
+++ b/Source/WebCore/platform/mac/ScrollbarThemeMac.mm
@@ -29,17 +29,13 @@
 #include "ImageBuffer.h"
 #include "LocalCurrentGraphicsContext.h"
 #include "PlatformMouseEvent.h"
+#include "ScrollAnimatorMac.h"
 #include "ScrollView.h"
-#include "WebCoreSystemInterface.h"
 #include <Carbon/Carbon.h>
 #include <wtf/HashMap.h>
 #include <wtf/StdLibExtras.h>
 #include <wtf/UnusedParam.h>
 
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-#define USE_WK_SCROLLBAR_PAINTER
-#endif
-
 // FIXME: There are repainting problems due to Aqua scroll bar buttons' visual overflow.
 
 using namespace std;
@@ -47,7 +43,7 @@ using namespace WebCore;
 
 namespace WebCore {
 
-#if defined(USE_WK_SCROLLBAR_PAINTER)
+#if USE(WK_SCROLLBAR_PAINTER)
 typedef HashMap<Scrollbar*, RetainPtr<WKScrollbarPainterRef> > ScrollbarPainterMap;
 #else
 typedef HashSet<Scrollbar*> ScrollbarPainterMap;
@@ -83,7 +79,7 @@ static ScrollbarPainterMap* scrollbarMap()
         return;
     ScrollbarPainterMap::iterator end = scrollbarMap()->end();
     for (ScrollbarPainterMap::iterator it = scrollbarMap()->begin(); it != end; ++it) {
-#if defined(USE_WK_SCROLLBAR_PAINTER)
+#if USE(WK_SCROLLBAR_PAINTER)
         it->first->styleChanged();
         it->first->invalidate();
 #else
@@ -117,13 +113,15 @@ ScrollbarTheme* ScrollbarTheme::nativeTheme()
 }
 
 // FIXME: Get these numbers from CoreUI.
-static int cScrollbarThickness[] = { 15, 11 };
 static int cRealButtonLength[] = { 28, 21 };
-static int cButtonInset[] = { 14, 11 };
 static int cButtonHitInset[] = { 3, 2 };
 // cRealButtonLength - cButtonInset
 static int cButtonLength[] = { 14, 10 };
+#if !USE(WK_SCROLLBAR_PAINTER)
+static int cScrollbarThickness[] = { 15, 11 };
+static int cButtonInset[] = { 14, 11 };
 static int cThumbMinLength[] = { 26, 20 };
+#endif
 
 static int cOuterButtonLength[] = { 16, 14 }; // The outer button in a double button pair is a bit bigger.
 static int cOuterButtonOverlap = 2;
@@ -131,13 +129,15 @@ static int cOuterButtonOverlap = 2;
 static float gInitialButtonDelay = 0.5f;
 static float gAutoscrollButtonDelay = 0.05f;
 static bool gJumpOnTrackClick = false;
+
+#if USE(WK_SCROLLBAR_PAINTER)
+static ScrollbarButtonsPlacement gButtonPlacement = ScrollbarButtonsNone;
+#else
 static ScrollbarButtonsPlacement gButtonPlacement = ScrollbarButtonsDoubleEnd;
+#endif
 
 static void updateArrowPlacement()
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER)
-    gButtonPlacement = ScrollbarButtonsNone;
-#else
     NSString *buttonPlacement = [[NSUserDefaults standardUserDefaults] objectForKey:@"AppleScrollBarVariant"];
     if ([buttonPlacement isEqualToString:@"Single"])
         gButtonPlacement = ScrollbarButtonsSingle;
@@ -145,16 +145,20 @@ static void updateArrowPlacement()
         gButtonPlacement = ScrollbarButtonsDoubleStart;
     else if ([buttonPlacement isEqualToString:@"DoubleBoth"])
         gButtonPlacement = ScrollbarButtonsDoubleBoth;
-    else
-        gButtonPlacement = ScrollbarButtonsDoubleEnd; // The default is ScrollbarButtonsDoubleEnd.
+    else {
+#if USE(WK_SCROLLBAR_PAINTER)
+        gButtonPlacement = ScrollbarButtonsNone;
+#else
+        gButtonPlacement = ScrollbarButtonsDoubleEnd;
 #endif
+    }
 }
 
 void ScrollbarThemeMac::registerScrollbar(Scrollbar* scrollbar)
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER)
-    WKScrollbarPainterRef scrollbarPainter = wkMakeScrollbarPainter(scrollbar->controlSize(),
-        scrollbar->orientation() == HorizontalScrollbar);
+#if USE(WK_SCROLLBAR_PAINTER)
+    bool isHorizontal = scrollbar->orientation() == HorizontalScrollbar;
+    WKScrollbarPainterRef scrollbarPainter = wkMakeScrollbarPainter(scrollbar->controlSize(), isHorizontal);
     scrollbarMap()->add(scrollbar, scrollbarPainter);
 #else
     scrollbarMap()->add(scrollbar);
@@ -163,9 +167,22 @@ void ScrollbarThemeMac::registerScrollbar(Scrollbar* scrollbar)
 
 void ScrollbarThemeMac::unregisterScrollbar(Scrollbar* scrollbar)
 {
+
     scrollbarMap()->remove(scrollbar);
 }
 
+#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+void ScrollbarThemeMac::setNewPainterForScrollbar(Scrollbar* scrollbar, WKScrollbarPainterRef newPainter)
+{
+    scrollbarMap()->set(scrollbar, newPainter);
+}
+
+WKScrollbarPainterRef ScrollbarThemeMac::painterForScrollbar(Scrollbar* scrollbar)
+{
+    return scrollbarMap()->get(scrollbar).get();
+}
+#endif
+
 ScrollbarThemeMac::ScrollbarThemeMac()
 {
     static bool initialized;
@@ -192,13 +209,20 @@ void ScrollbarThemeMac::preferencesChanged()
 
 int ScrollbarThemeMac::scrollbarThickness(ScrollbarControlSize controlSize)
 {
+#if USE(WK_SCROLLBAR_PAINTER)
+    return wkScrollbarThickness(controlSize);
+#else
     return cScrollbarThickness[controlSize];
+#endif
 }
 
 bool ScrollbarThemeMac::usesOverlayScrollbars() const
 {
-    // FIXME: This should be enabled when <rdar://problem/8492788> is resolved.
+#if USE(WK_SCROLLBAR_PAINTER)
+    return wkScrollbarPainterUsesOverlayScrollers();
+#else
     return false;
+#endif
 }
 
 double ScrollbarThemeMac::initialAutoscrollTimerDelay()
@@ -218,20 +242,29 @@ ScrollbarButtonsPlacement ScrollbarThemeMac::buttonsPlacement() const
 
 bool ScrollbarThemeMac::hasButtons(Scrollbar* scrollbar)
 {
-    return scrollbar->enabled() && (scrollbar->orientation() == HorizontalScrollbar ? 
-             scrollbar->width() : 
-             scrollbar->height()) >= 2 * (cRealButtonLength[scrollbar->controlSize()] - cButtonHitInset[scrollbar->controlSize()]);
+    return scrollbar->enabled() && gButtonPlacement != ScrollbarButtonsNone
+             && (scrollbar->orientation() == HorizontalScrollbar
+             ? scrollbar->width()
+             : scrollbar->height()) >= 2 * (cRealButtonLength[scrollbar->controlSize()] - cButtonHitInset[scrollbar->controlSize()]);
 }
 
 bool ScrollbarThemeMac::hasThumb(Scrollbar* scrollbar)
 {
+    int minLengthForThumb;
+#if USE(WK_SCROLLBAR_PAINTER)
+    minLengthForThumb = wkScrollbarMinimumTotalLengthNeededForThumb(scrollbarMap()->get(scrollbar).get());
+#else
+    minLengthForThumb = 2 * cButtonInset[scrollbar->controlSize()] + cThumbMinLength[scrollbar->controlSize()] + 1;
+#endif
     return scrollbar->enabled() && (scrollbar->orientation() == HorizontalScrollbar ? 
              scrollbar->width() : 
-             scrollbar->height()) >= 2 * cButtonInset[scrollbar->controlSize()] + cThumbMinLength[scrollbar->controlSize()] + 1;
+             scrollbar->height()) >= minLengthForThumb;
 }
 
 static IntRect buttonRepaintRect(const IntRect& buttonRect, ScrollbarOrientation orientation, ScrollbarControlSize controlSize, bool start)
 {
+    ASSERT(gButtonPlacement != ScrollbarButtonsNone);
+
     IntRect paintRect(buttonRect);
     if (orientation == HorizontalScrollbar) {
         paintRect.setWidth(cRealButtonLength[controlSize]);
@@ -359,7 +392,11 @@ IntRect ScrollbarThemeMac::trackRect(Scrollbar* scrollbar, bool painting)
 
 int ScrollbarThemeMac::minimumThumbLength(Scrollbar* scrollbar)
 {
+#if USE(WK_SCROLLBAR_PAINTER)
+    return wkScrollbarMinimumThumbLength(scrollbarMap()->get(scrollbar).get());
+#else
     return cThumbMinLength[scrollbar->controlSize()];
+#endif
 }
 
 bool ScrollbarThemeMac::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent& evt)
@@ -391,15 +428,32 @@ static int scrollbarPartToHIPressedState(ScrollbarPart part)
 
 bool ScrollbarThemeMac::paint(Scrollbar* scrollbar, GraphicsContext* context, const IntRect& damageRect)
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER)
+#if USE(WK_SCROLLBAR_PAINTER)
+    float value = 0.0f;
+    float totalSize = 0.0f;
+
+    if (scrollbar->currentPos() < 0) {
+        // Scrolled past the top.
+        value = 0.0f;
+        totalSize = scrollbar->totalSize() - scrollbar->currentPos();
+    } else if (scrollbar->visibleSize() + scrollbar->currentPos() > scrollbar->totalSize()) {
+        // Scrolled past the bottom.
+        value = 1.0f;
+        totalSize = scrollbar->visibleSize() + scrollbar->currentPos();
+    } else {
+        // Within the bounds of the scrollable area.
+        value = scrollbar->currentPos() / scrollbar->maximum();
+        totalSize = scrollbar->totalSize();
+    }
+
     context->save();
     context->clip(damageRect);
     context->translate(scrollbar->frameRect().x(), scrollbar->frameRect().y());
     LocalCurrentGraphicsContext localContext(context);
     wkScrollbarPainterPaint(scrollbarMap()->get(scrollbar).get(),
                             scrollbar->enabled(),
-                            scrollbar->currentPos() / scrollbar->maximum(),
-                            static_cast<CGFloat>(scrollbar->visibleSize()) / scrollbar->totalSize(),
+                            value,
+                            static_cast<CGFloat>(scrollbar->visibleSize()) / totalSize,
                             scrollbar->frameRect());
     context->restore();
     return true;
@@ -409,9 +463,27 @@ bool ScrollbarThemeMac::paint(Scrollbar* scrollbar, GraphicsContext* context, co
     trackInfo.version = 0;
     trackInfo.kind = scrollbar->controlSize() == RegularScrollbar ? kThemeMediumScrollBar : kThemeSmallScrollBar;
     trackInfo.bounds = scrollbar->frameRect();
+
+    float maximum = 0.0f;
+    float position = 0.0f;
+    if (scrollbar->currentPos() < 0) {
+        // Scrolled past the top.
+        maximum = (scrollbar->totalSize() - scrollbar->currentPos()) - scrollbar->visibleSize();
+        position = 0;
+    } else if (scrollbar->visibleSize() + scrollbar->currentPos() > scrollbar->totalSize()) {
+        // Scrolled past the bottom.
+        maximum = scrollbar->currentPos();
+        position = maximum;
+    } else {
+        // Within the bounds of the scrollable area.
+        maximum = scrollbar->maximum();
+        position = scrollbar->currentPos();
+    }
+
     trackInfo.min = 0;
-    trackInfo.max = scrollbar->maximum();
-    trackInfo.value = scrollbar->currentPos();
+    trackInfo.max = static_cast<int>(maximum);
+    trackInfo.value = static_cast<int>(position);
+
     trackInfo.trackInfo.scrollbar.viewsize = scrollbar->visibleSize();
     trackInfo.attributes = 0;
     if (scrollbar->orientation() == HorizontalScrollbar)
diff --git a/Source/WebCore/platform/mac/WebCoreSystemInterface.h b/Source/WebCore/platform/mac/WebCoreSystemInterface.h
index 045864a..e6d6cf6 100644
--- a/Source/WebCore/platform/mac/WebCoreSystemInterface.h
+++ b/Source/WebCore/platform/mac/WebCoreSystemInterface.h
@@ -147,6 +147,8 @@ extern void (*wkSignalCFReadStreamEnd)(CFReadStreamRef stream);
 extern void (*wkSignalCFReadStreamError)(CFReadStreamRef stream, CFStreamError *error);
 extern void (*wkSignalCFReadStreamHasBytes)(CFReadStreamRef stream);
 extern unsigned (*wkInitializeMaximumHTTPConnectionCountPerHost)(unsigned preferredConnectionCount);
+extern int (*wkGetHTTPPipeliningPriority)(NSURLRequest *);
+extern void (*wkSetHTTPPipeliningPriority)(NSMutableURLRequest *, int priority);
 extern void (*wkSetCONNECTProxyForStream)(CFReadStreamRef, CFStringRef proxyHost, CFNumberRef proxyPort);
 extern void (*wkSetCONNECTProxyAuthorizationForStream)(CFReadStreamRef, CFStringRef proxyAuthorizationString);
 extern CFHTTPMessageRef (*wkCopyCONNECTProxyResponse)(CFReadStreamRef, CFURLRef responseURL);
@@ -189,9 +191,50 @@ extern CGImageRef (*wkIOSurfaceContextCreateImage)(CGContextRef context);
 
 typedef struct __WKScrollbarPainter *WKScrollbarPainterRef;
 extern WKScrollbarPainterRef (*wkMakeScrollbarPainter)(int controlSize, bool isHorizontal);
+extern WKScrollbarPainterRef (*wkMakeScrollbarReplacementPainter)(WKScrollbarPainterRef oldPainter, int newStyle, int controlSize, bool isHorizontal);
+extern void (*wkScrollbarPainterSetDelegate)(WKScrollbarPainterRef, id scrollbarPainterDelegate);
 extern void (*wkScrollbarPainterPaint)(WKScrollbarPainterRef, bool enabled, double value, CGFloat proportion, CGRect frameRect);
+extern int (*wkScrollbarThickness)(int controlSize);
+extern int (*wkScrollbarMinimumThumbLength)(WKScrollbarPainterRef);
+extern int (*wkScrollbarMinimumTotalLengthNeededForThumb)(WKScrollbarPainterRef);
+extern CGFloat (*wkScrollbarPainterKnobAlpha)(WKScrollbarPainterRef);
+extern void (*wkSetScrollbarPainterKnobAlpha)(WKScrollbarPainterRef, CGFloat);
+extern CGFloat (*wkScrollbarPainterTrackAlpha)(WKScrollbarPainterRef);
+extern void (*wkSetScrollbarPainterTrackAlpha)(WKScrollbarPainterRef, CGFloat);
+extern bool (*wkScrollbarPainterIsHorizontal)(WKScrollbarPainterRef);
+extern void (*wkScrollbarPainterSetOverlayState)(WKScrollbarPainterRef, int overlayScrollerState);
+
+typedef struct __WKScrollbarPainterController *WKScrollbarPainterControllerRef;
+extern WKScrollbarPainterControllerRef (*wkMakeScrollbarPainterController)(id painterControllerDelegate);
+extern void (*wkSetPainterForPainterController)(WKScrollbarPainterControllerRef, WKScrollbarPainterRef, bool isHorizontal);
+extern WKScrollbarPainterRef (*wkVerticalScrollbarPainterForController)(WKScrollbarPainterControllerRef);
+extern WKScrollbarPainterRef (*wkHorizontalScrollbarPainterForController)(WKScrollbarPainterControllerRef);
+extern void (*wkSetScrollbarPainterControllerStyle)(WKScrollbarPainterControllerRef, int newStyle);
+extern void (*wkContentAreaScrolled)(WKScrollbarPainterControllerRef);
+extern void (*wkContentAreaWillPaint)(WKScrollbarPainterControllerRef);
+extern void (*wkMouseEnteredContentArea)(WKScrollbarPainterControllerRef);
+extern void (*wkMouseExitedContentArea)(WKScrollbarPainterControllerRef);
+extern void (*wkMouseMovedInContentArea)(WKScrollbarPainterControllerRef);
+extern void (*wkWillStartLiveResize)(WKScrollbarPainterControllerRef);
+extern void (*wkContentAreaResized)(WKScrollbarPainterControllerRef);
+extern void (*wkWillEndLiveResize)(WKScrollbarPainterControllerRef);
+extern void (*wkContentAreaDidShow)(WKScrollbarPainterControllerRef);
+extern void (*wkContentAreaDidHide)(WKScrollbarPainterControllerRef);
+
+extern bool (*wkScrollbarPainterUsesOverlayScrollers)(void);
 #endif
 
+extern void (*wkUnregisterUniqueIdForElement)(id element);
+extern void (*wkAccessibilityHandleFocusChanged)(void);    
+extern CFTypeID (*wkGetAXTextMarkerTypeID)(void);
+extern CFTypeID (*wkGetAXTextMarkerRangeTypeID)(void);
+extern CFTypeRef (*wkCreateAXTextMarkerRange)(CFTypeRef start, CFTypeRef end);
+extern CFTypeRef (*wkCopyAXTextMarkerRangeStart)(CFTypeRef range);
+extern CFTypeRef (*wkCopyAXTextMarkerRangeEnd)(CFTypeRef range);
+extern CFTypeRef (*wkCreateAXTextMarker)(const void *bytes, size_t len);
+extern BOOL (*wkGetBytesFromAXTextMarker)(CFTypeRef textMarker, void *bytes, size_t length);
+extern AXUIElementRef (*wkCreateAXUIElementRef)(id element);
+
 }
 
 #endif
diff --git a/Source/WebCore/platform/mac/WebCoreSystemInterface.mm b/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
index 047827f..24bdcb1 100644
--- a/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
+++ b/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
@@ -89,6 +89,8 @@ void (*wkSetNSURLConnectionDefersCallbacks)(NSURLConnection *, BOOL);
 void (*wkSetNSURLRequestShouldContentSniff)(NSMutableURLRequest *, BOOL);
 id (*wkCreateNSURLConnectionDelegateProxy)(void);
 unsigned (*wkInitializeMaximumHTTPConnectionCountPerHost)(unsigned preferredConnectionCount);
+int (*wkGetHTTPPipeliningPriority)(NSURLRequest *);
+void (*wkSetHTTPPipeliningPriority)(NSMutableURLRequest *, int priority);
 void (*wkSetCONNECTProxyForStream)(CFReadStreamRef, CFStringRef proxyHost, CFNumberRef proxyPort);
 void (*wkSetCONNECTProxyAuthorizationForStream)(CFReadStreamRef, CFStringRef proxyAuthorizationString);
 CFHTTPMessageRef (*wkCopyCONNECTProxyResponse)(CFReadStreamRef, CFURLRef responseURL);
@@ -127,5 +129,46 @@ CGContextRef (*wkIOSurfaceContextCreate)(IOSurfaceRef surface, unsigned width, u
 CGImageRef (*wkIOSurfaceContextCreateImage)(CGContextRef context);
 
 WKScrollbarPainterRef (*wkMakeScrollbarPainter)(int controlSize, bool isHorizontal);
+WKScrollbarPainterRef (*wkMakeScrollbarReplacementPainter)(WKScrollbarPainterRef oldPainter, int newStyle, int controlSize, bool isHorizontal);
+void (*wkScrollbarPainterSetDelegate)(WKScrollbarPainterRef, id scrollbarPainterDelegate);
 void (*wkScrollbarPainterPaint)(WKScrollbarPainterRef, bool enabled, double value, CGFloat proportion, CGRect frameRect);
+int (*wkScrollbarThickness)(int controlSize);
+int (*wkScrollbarMinimumThumbLength)(WKScrollbarPainterRef);
+int (*wkScrollbarMinimumTotalLengthNeededForThumb)(WKScrollbarPainterRef);
+CGFloat (*wkScrollbarPainterKnobAlpha)(WKScrollbarPainterRef);
+void (*wkSetScrollbarPainterKnobAlpha)(WKScrollbarPainterRef, CGFloat);
+CGFloat (*wkScrollbarPainterTrackAlpha)(WKScrollbarPainterRef);
+void (*wkSetScrollbarPainterTrackAlpha)(WKScrollbarPainterRef, CGFloat);
+bool (*wkScrollbarPainterIsHorizontal)(WKScrollbarPainterRef);
+void (*wkScrollbarPainterSetOverlayState)(WKScrollbarPainterRef, int overlayScrollerState);
+
+WKScrollbarPainterControllerRef (*wkMakeScrollbarPainterController)(id painterControllerDelegate);
+void (*wkSetPainterForPainterController)(WKScrollbarPainterControllerRef, WKScrollbarPainterRef, bool isHorizontal);
+WKScrollbarPainterRef (*wkVerticalScrollbarPainterForController)(WKScrollbarPainterControllerRef);
+WKScrollbarPainterRef (*wkHorizontalScrollbarPainterForController)(WKScrollbarPainterControllerRef);
+void (*wkSetScrollbarPainterControllerStyle)(WKScrollbarPainterControllerRef, int newStyle);
+void (*wkContentAreaScrolled)(WKScrollbarPainterControllerRef);
+void (*wkContentAreaWillPaint)(WKScrollbarPainterControllerRef);
+void (*wkMouseEnteredContentArea)(WKScrollbarPainterControllerRef);
+void (*wkMouseExitedContentArea)(WKScrollbarPainterControllerRef);
+void (*wkMouseMovedInContentArea)(WKScrollbarPainterControllerRef);
+void (*wkWillStartLiveResize)(WKScrollbarPainterControllerRef);
+void (*wkContentAreaResized)(WKScrollbarPainterControllerRef);
+void (*wkWillEndLiveResize)(WKScrollbarPainterControllerRef);
+void (*wkContentAreaDidShow)(WKScrollbarPainterControllerRef);
+void (*wkContentAreaDidHide)(WKScrollbarPainterControllerRef);
+
+bool (*wkScrollbarPainterUsesOverlayScrollers)(void);
 #endif
+
+void (*wkUnregisterUniqueIdForElement)(id element);
+void (*wkAccessibilityHandleFocusChanged)(void);
+CFTypeID (*wkGetAXTextMarkerTypeID)(void);
+CFTypeID (*wkGetAXTextMarkerRangeTypeID)(void);
+CFTypeRef (*wkCreateAXTextMarkerRange)(CFTypeRef start, CFTypeRef end);
+CFTypeRef (*wkCopyAXTextMarkerRangeStart)(CFTypeRef range);
+CFTypeRef (*wkCopyAXTextMarkerRangeEnd)(CFTypeRef range);
+CFTypeRef (*wkCreateAXTextMarker)(const void *bytes, size_t len);
+BOOL (*wkGetBytesFromAXTextMarker)(CFTypeRef textMarker, void *bytes, size_t length);
+AXUIElementRef (*wkCreateAXUIElementRef)(id element);
+
diff --git a/Source/WebCore/platform/mac/WheelEventMac.mm b/Source/WebCore/platform/mac/WheelEventMac.mm
index d4fc698..74265d1 100644
--- a/Source/WebCore/platform/mac/WheelEventMac.mm
+++ b/Source/WebCore/platform/mac/WheelEventMac.mm
@@ -64,6 +64,7 @@ PlatformWheelEvent::PlatformWheelEvent(NSEvent* event, NSView *windowView)
     , m_altKey([event modifierFlags] & NSAlternateKeyMask)
     , m_metaKey([event modifierFlags] & NSCommandKeyMask)
     , m_phase(phaseForEvent(event))
+    , m_timestamp([event timestamp])
 {
     BOOL continuous;
 
@@ -71,11 +72,13 @@ PlatformWheelEvent::PlatformWheelEvent(NSEvent* event, NSView *windowView)
     if (continuous) {
         m_wheelTicksX = m_deltaX / static_cast<float>(Scrollbar::pixelsPerLineStep());
         m_wheelTicksY = m_deltaY / static_cast<float>(Scrollbar::pixelsPerLineStep());
+        m_hasPreciseScrollingDeltas = true;
     } else {
         m_wheelTicksX = m_deltaX;
         m_wheelTicksY = m_deltaY;
         m_deltaX *= static_cast<float>(Scrollbar::pixelsPerLineStep());
         m_deltaY *= static_cast<float>(Scrollbar::pixelsPerLineStep());
+        m_hasPreciseScrollingDeltas = false;
     }
 }
 
diff --git a/Source/WebCore/platform/mac/WidgetMac.mm b/Source/WebCore/platform/mac/WidgetMac.mm
index f3c951a..96bcde2 100644
--- a/Source/WebCore/platform/mac/WidgetMac.mm
+++ b/Source/WebCore/platform/mac/WidgetMac.mm
@@ -252,7 +252,7 @@ void Widget::paint(GraphicsContext* p, const IntRect& r)
         IntRect dirtyRect = r;
         dirtyRect.move(-transformOrigin.x(), -transformOrigin.y());
         if (![view isFlipped])
-            dirtyRect.setY([view bounds].size.height - dirtyRect.bottom());
+            dirtyRect.setY([view bounds].size.height - dirtyRect.maxY());
 
         [view displayRectIgnoringOpacity:dirtyRect];
 
@@ -296,7 +296,7 @@ void Widget::paint(GraphicsContext* p, const IntRect& r)
         IntRect dirtyRect = r;
         dirtyRect.move(-transformOrigin.x(), -transformOrigin.y());
         if (![view isFlipped])
-            dirtyRect.setY([view bounds].size.height - dirtyRect.bottom());
+            dirtyRect.setY([view bounds].size.height - dirtyRect.maxY());
 
         BEGIN_BLOCK_OBJC_EXCEPTIONS;
         {
diff --git a/Source/WebCore/platform/network/BlobRegistryImpl.cpp b/Source/WebCore/platform/network/BlobRegistryImpl.cpp
index 2c4e8fa..83517f1 100644
--- a/Source/WebCore/platform/network/BlobRegistryImpl.cpp
+++ b/Source/WebCore/platform/network/BlobRegistryImpl.cpp
@@ -68,7 +68,9 @@ PassRefPtr<ResourceHandle> BlobRegistryImpl::createResourceHandle(const Resource
     if (!shouldLoadResource(request))
         return 0;
 
-    return BlobResourceHandle::create(m_blobs.get(request.url().string()), request, client);
+    RefPtr<BlobResourceHandle> handle = BlobResourceHandle::create(m_blobs.get(request.url().string()), request, client);
+    handle->start();
+    return handle.release();
 }
 
 bool BlobRegistryImpl::loadResourceSynchronously(const ResourceRequest& request, ResourceError& error, ResourceResponse& response, Vector<char>& data)
diff --git a/Source/WebCore/platform/network/BlobResourceHandle.cpp b/Source/WebCore/platform/network/BlobResourceHandle.cpp
index 753052a..24c9088 100644
--- a/Source/WebCore/platform/network/BlobResourceHandle.cpp
+++ b/Source/WebCore/platform/network/BlobResourceHandle.cpp
@@ -138,11 +138,6 @@ void BlobResourceHandle::loadResourceSynchronously(PassRefPtr<BlobStorageData> b
     handle->start();
 }
 
-static void delayedStart(void* context)
-{
-    static_cast<BlobResourceHandle*>(context)->start();
-}
-
 BlobResourceHandle::BlobResourceHandle(PassRefPtr<BlobStorageData> blobData, const ResourceRequest& request, ResourceHandleClient* client, bool async)
     : ResourceHandle(request, client, false, false)
     , m_blobData(blobData)
@@ -158,11 +153,9 @@ BlobResourceHandle::BlobResourceHandle(PassRefPtr<BlobStorageData> blobData, con
     , m_readItemCount(0)
     , m_fileOpened(false)
 {    
-    if (m_async) {
-        // We need to take a ref.
+    if (m_async)
         m_asyncStream = client->createAsyncFileStream(this);
-        callOnMainThread(delayedStart, this);
-    } else
+    else
         m_stream = FileStream::create();
 }
 
@@ -187,10 +180,32 @@ void BlobResourceHandle::cancel()
     }
 
     m_aborted = true;
+
+    ResourceHandle::cancel();
+}
+
+void delayedStartBlobResourceHandle(void* context)
+{
+    RefPtr<BlobResourceHandle> handle = adoptRef(static_cast<BlobResourceHandle*>(context));
+    handle->doStart();
 }
 
 void BlobResourceHandle::start()
 {
+    if (m_async) {
+        // Keep BlobResourceHandle alive until delayedStartBlobResourceHandle runs.
+        ref();
+
+        // Finish this async call quickly and return.
+        callOnMainThread(delayedStartBlobResourceHandle, this);
+        return;
+    }
+
+    doStart();
+}
+
+void BlobResourceHandle::doStart()
+{
     // Do not continue if the request is aborted or an error occurs.
     if (m_aborted || m_errorCode)
         return;
@@ -578,10 +593,23 @@ void BlobResourceHandle::notifyFail(int errorCode)
         client()->didFail(this, ResourceError(String(), errorCode, firstRequest().url(), String()));
 }
 
+static void doNotifyFinish(void* context)
+{
+    BlobResourceHandle* handle = static_cast<BlobResourceHandle*>(context);
+    if (handle->client())
+        handle->client()->didFinishLoading(handle, 0);
+}
+
 void BlobResourceHandle::notifyFinish()
 {
-    if (client())
-        client()->didFinishLoading(this, 0);
+    if (m_async) {
+        // Schedule to notify the client from a standalone function because the client might dispose the handle immediately from the callback function
+        // while we still have BlobResourceHandle calls in the stack.
+        callOnMainThread(doNotifyFinish, this);
+        return;
+    }
+
+    doNotifyFinish(this);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/network/BlobResourceHandle.h b/Source/WebCore/platform/network/BlobResourceHandle.h
index 63e8578..1e9e94a 100644
--- a/Source/WebCore/platform/network/BlobResourceHandle.h
+++ b/Source/WebCore/platform/network/BlobResourceHandle.h
@@ -69,9 +69,12 @@ public:
     int readSync(char*, int);
 
 private:
+    friend void delayedStartBlobResourceHandle(void*);
+
     BlobResourceHandle(PassRefPtr<BlobStorageData>, const ResourceRequest&, ResourceHandleClient*, bool async);
     virtual ~BlobResourceHandle();
 
+    void doStart();
     void getSizeForNext();
     void seek();
     void consumeData(const char* data, int bytesRead);
diff --git a/Source/WebCore/platform/network/FormData.cpp b/Source/WebCore/platform/network/FormData.cpp
index 16f98ad..9784b7f 100644
--- a/Source/WebCore/platform/network/FormData.cpp
+++ b/Source/WebCore/platform/network/FormData.cpp
@@ -209,14 +209,16 @@ void FormData::appendKeyValuePairItems(const FormDataList& list, const TextEncod
                     name = file->webkitRelativePath().isEmpty() ? file->name() : file->webkitRelativePath();
 #else
                     name = file->name();
-#endif                    
-
+#endif
                     // Let the application specify a filename if it's going to generate a replacement file for the upload.
-                    if (Page* page = document->page()) {
-                        String generatedFileName;
-                        shouldGenerateFile = page->chrome()->client()->shouldReplaceWithGeneratedFileForUpload(file->path(), generatedFileName);
-                        if (shouldGenerateFile)
-                            name = generatedFileName;
+                    const String& path = file->path();
+                    if (!path.isEmpty()) {
+                        if (Page* page = document->page()) {
+                            String generatedFileName;
+                            shouldGenerateFile = page->chrome()->client()->shouldReplaceWithGeneratedFileForUpload(path, generatedFileName);
+                            if (shouldGenerateFile)
+                                name = generatedFileName;
+                        }
                     }
                 } else {
                     // For non-file blob, use the identifier part of the URL as the name.
@@ -364,7 +366,9 @@ static void encode(Encoder& encoder, const FormDataElement& element)
 
 static bool decode(Decoder& decoder, FormDataElement& element)
 {
-    uint32_t type = element.m_type;
+    uint32_t type;
+    if (!decoder.decodeUInt32(type))
+        return false;
 
     switch (type) {
     case FormDataElement::data: {
@@ -432,7 +436,7 @@ void FormData::encodeForBackForward(Encoder& encoder) const
 
     encoder.encodeBool(m_hasGeneratedFiles);
 
-    encoder.encodeBool(m_identifier);
+    encoder.encodeInt64(m_identifier);
 }
 
 PassRefPtr<FormData> FormData::decodeForBackForward(Decoder& decoder)
diff --git a/Source/WebCore/platform/network/FormDataBuilder.cpp b/Source/WebCore/platform/network/FormDataBuilder.cpp
index da28fc2..e973f99 100644
--- a/Source/WebCore/platform/network/FormDataBuilder.cpp
+++ b/Source/WebCore/platform/network/FormDataBuilder.cpp
@@ -94,10 +94,7 @@ TextEncoding FormDataBuilder::encodingFromAcceptCharset(const String& acceptChar
             return encoding;
     }
 
-    if (Frame* frame = document->frame())
-        return frame->loader()->writer()->encoding();
-
-    return Latin1Encoding();
+    return document->inputEncoding();
 }
 
 Vector<char> FormDataBuilder::generateUniqueBoundaryString()
diff --git a/Source/WebCore/platform/network/ProtectionSpaceHash.h b/Source/WebCore/platform/network/ProtectionSpaceHash.h
index 08716b5..9934321 100644
--- a/Source/WebCore/platform/network/ProtectionSpaceHash.h
+++ b/Source/WebCore/platform/network/ProtectionSpaceHash.h
@@ -42,11 +42,11 @@ struct ProtectionSpaceHash {
             protectionSpace.realm().impl() ? protectionSpace.realm().impl()->hash() : 0
         };
 
-        unsigned codeCount = sizeof(hashCodes) / sizeof(UChar);
+        unsigned codeCount = sizeof(hashCodes);
         // Ignore realm for proxies.
         if (protectionSpace.isProxy())
-            codeCount -= sizeof(hashCodes[0]) / sizeof(UChar);
-        return StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), codeCount);
+            codeCount -= sizeof(hashCodes[0]);
+        return WTF::StringHasher::createBlobHash(hashCodes, codeCount);
     }
     
     static bool equal(const ProtectionSpace& a, const ProtectionSpace& b) { return a == b; }
diff --git a/Source/WebCore/platform/network/ResourceHandle.h b/Source/WebCore/platform/network/ResourceHandle.h
index bb94b59..c2a0b8e 100644
--- a/Source/WebCore/platform/network/ResourceHandle.h
+++ b/Source/WebCore/platform/network/ResourceHandle.h
@@ -41,7 +41,7 @@ typedef struct _SoupSession SoupSession;
 typedef const struct __CFData * CFDataRef;
 #endif
 
-#if PLATFORM(WIN)
+#if USE(WININET)
 typedef unsigned long DWORD;
 typedef unsigned long DWORD_PTR;
 typedef void* LPVOID;
@@ -173,7 +173,7 @@ public:
 
     bool hasAuthenticationChallenge() const;
     void clearAuthentication();
-    void cancel();
+    virtual void cancel();
 
     // The client may be 0, in which case no callbacks will be made.
     ResourceHandleClient* client() const;
diff --git a/Source/WebCore/platform/network/ResourceHandleInternal.h b/Source/WebCore/platform/network/ResourceHandleInternal.h
index ed66944..5512062 100644
--- a/Source/WebCore/platform/network/ResourceHandleInternal.h
+++ b/Source/WebCore/platform/network/ResourceHandleInternal.h
@@ -46,8 +46,9 @@
 #endif
 
 #if USE(SOUP)
-#include "soup-requester.h"
 #include <GRefPtr.h>
+#define LIBSOUP_USE_UNSTABLE_REQUEST_API
+#include <libsoup/soup-request.h>
 #include <libsoup/soup.h>
 class Frame;
 #endif
@@ -114,6 +115,8 @@ namespace WebCore {
             , m_cancelled(false)
             , m_buffer(0)
             , m_total(0)
+            , m_bodySize(0)
+            , m_bodyDataSent(0)
             , m_idleHandler(0)
             , m_gotChunkHandler(0)
 #endif
@@ -132,9 +135,6 @@ namespace WebCore {
             m_user = url.user();
             m_pass = url.pass();
             m_firstRequest.removeCredentials();
-#if USE(SOUP)
-            m_requester = adoptGRef(webkit_soup_requester_new());
-#endif
         }
         
         ~ResourceHandleInternal();
@@ -190,12 +190,13 @@ namespace WebCore {
         GRefPtr<SoupMessage> m_soupMessage;
         ResourceResponse m_response;
         bool m_cancelled;
-        GRefPtr<WebKitSoupRequest> m_soupRequest;
-        GRefPtr<WebKitSoupRequester> m_requester;
+        GRefPtr<SoupRequest> m_soupRequest;
         GRefPtr<GInputStream> m_inputStream;
         GRefPtr<GCancellable> m_cancellable;
         char* m_buffer;
         gsize m_total;
+        unsigned long m_bodySize;
+        unsigned long m_bodyDataSent;
         guint m_idleHandler;
         RefPtr<NetworkingContext> m_context;
         gulong m_gotChunkHandler;
diff --git a/Source/WebCore/platform/network/ResourceRequestBase.cpp b/Source/WebCore/platform/network/ResourceRequestBase.cpp
index ae8316a..ba58461 100644
--- a/Source/WebCore/platform/network/ResourceRequestBase.cpp
+++ b/Source/WebCore/platform/network/ResourceRequestBase.cpp
@@ -45,6 +45,7 @@ PassOwnPtr<ResourceRequest> ResourceRequestBase::adopt(PassOwnPtr<CrossThreadRes
     request->setTimeoutInterval(data->m_timeoutInterval);
     request->setFirstPartyForCookies(data->m_firstPartyForCookies);
     request->setHTTPMethod(data->m_httpMethod);
+    request->setPriority(data->m_priority);
     request->setTargetType(data->m_targetType);
 
     request->updateResourceRequest();
@@ -78,6 +79,7 @@ PassOwnPtr<CrossThreadResourceRequestData> ResourceRequestBase::copyData() const
     data->m_firstPartyForCookies = firstPartyForCookies().copy();
     data->m_httpMethod = httpMethod().crossThreadString();
     data->m_httpHeaders = httpHeaderFields().copyData();
+    data->m_priority = priority();
     data->m_targetType = m_targetType;
 
     data->m_responseContentDispositionEncodingFallbackArray.reserveInitialCapacity(m_responseContentDispositionEncodingFallbackArray.size());
@@ -314,6 +316,23 @@ void ResourceRequestBase::setAllowCookies(bool allowCookies)
         m_platformRequestUpdated = false;
 }
 
+ResourceLoadPriority ResourceRequestBase::priority() const
+{
+    updateResourceRequest();
+
+    return m_priority;
+}
+
+void ResourceRequestBase::setPriority(ResourceLoadPriority priority)
+{
+    updateResourceRequest();
+
+    m_priority = priority;
+
+    if (url().protocolInHTTPFamily())
+        m_platformRequestUpdated = false;
+}
+
 void ResourceRequestBase::addHTTPHeaderField(const AtomicString& name, const String& value) 
 {
     updateResourceRequest();
@@ -352,6 +371,9 @@ bool equalIgnoringHeaderFields(const ResourceRequestBase& a, const ResourceReque
     if (a.allowCookies() != b.allowCookies())
         return false;
     
+    if (a.priority() != b.priority())
+        return false;
+
     FormData* formDataA = a.httpBody();
     FormData* formDataB = b.httpBody();
     
diff --git a/Source/WebCore/platform/network/ResourceRequestBase.h b/Source/WebCore/platform/network/ResourceRequestBase.h
index dce33db..9cc9148 100644
--- a/Source/WebCore/platform/network/ResourceRequestBase.h
+++ b/Source/WebCore/platform/network/ResourceRequestBase.h
@@ -29,8 +29,9 @@
 #define ResourceRequestBase_h
 
 #include "FormData.h"
-#include "KURL.h"
 #include "HTTPHeaderMap.h"
+#include "KURL.h"
+#include "ResourceLoadPriority.h"
 
 #include <wtf/OwnPtr.h>
 
@@ -128,6 +129,9 @@ namespace WebCore {
         bool allowCookies() const;
         void setAllowCookies(bool allowCookies);
 
+        ResourceLoadPriority priority() const;
+        void setPriority(ResourceLoadPriority);
+
         bool isConditional() const;
 
         // Whether the associated ResourceHandleClient needs to be notified of
@@ -157,6 +161,7 @@ namespace WebCore {
             , m_reportUploadProgress(false)
             , m_reportLoadTiming(false)
             , m_reportRawHeaders(false)
+            , m_priority(ResourceLoadPriorityLow)
             , m_targetType(TargetIsSubresource)
         {
         }
@@ -172,6 +177,7 @@ namespace WebCore {
             , m_reportUploadProgress(false)
             , m_reportLoadTiming(false)
             , m_reportRawHeaders(false)
+            , m_priority(ResourceLoadPriorityLow)
             , m_targetType(TargetIsSubresource)
         {
         }
@@ -197,6 +203,7 @@ namespace WebCore {
         bool m_reportUploadProgress;
         bool m_reportLoadTiming;
         bool m_reportRawHeaders;
+        ResourceLoadPriority m_priority;
         TargetType m_targetType;
 
     private:
@@ -223,11 +230,20 @@ namespace WebCore {
         Vector<String> m_responseContentDispositionEncodingFallbackArray;
         RefPtr<FormData> m_httpBody;
         bool m_allowCookies;
+        ResourceLoadPriority m_priority;
         ResourceRequestBase::TargetType m_targetType;
     };
     
     unsigned initializeMaximumHTTPConnectionCountPerHost();
 
+#if PLATFORM(CF)
+    bool isHTTPPipeliningEnabled();
+    bool shouldForceHTTPPipeliningPriorityHigh();
+#else
+    inline bool isHTTPPipeliningEnabled() { return false; }
+    inline bool shouldForceHTTPPipeliningPriorityHigh() { return false; }
+#endif
+
 } // namespace WebCore
 
 #endif // ResourceRequestBase_h
diff --git a/Source/WebCore/platform/network/cf/DNSCFNet.cpp b/Source/WebCore/platform/network/cf/DNSCFNet.cpp
index 166abbf..b6f9922 100644
--- a/Source/WebCore/platform/network/cf/DNSCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/DNSCFNet.cpp
@@ -36,6 +36,7 @@
 
 #if PLATFORM(WIN)
 #include "LoaderRunLoopCF.h"
+#include <CFNetwork/CFNetwork.h>
 #endif
 
 #if defined(BUILDING_ON_LEOPARD)
diff --git a/Source/WebCore/platform/network/cf/DownloadBundle.h b/Source/WebCore/platform/network/cf/DownloadBundle.h
new file mode 100644
index 0000000..cf90908
--- /dev/null
+++ b/Source/WebCore/platform/network/cf/DownloadBundle.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2011 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DownloadBundle_h
+#define DownloadBundle_h
+
+#include <wtf/Forward.h>
+
+typedef const struct __CFData* CFDataRef;
+
+namespace WebCore {
+namespace DownloadBundle {
+
+bool appendResumeData(CFDataRef resumeData, const String& bundlePath);
+CFDataRef extractResumeData(const String& bundlePath);
+const String& fileExtension();
+
+} // namespace DownloadBundle
+} // namespace WebCore
+
+#endif // DownloadBundle_h
diff --git a/Source/WebCore/platform/network/cf/FormDataStreamCFNet.cpp b/Source/WebCore/platform/network/cf/FormDataStreamCFNet.cpp
index eb0ec3a..8bc8f08 100644
--- a/Source/WebCore/platform/network/cf/FormDataStreamCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/FormDataStreamCFNet.cpp
@@ -145,17 +145,8 @@ static void advanceCurrentStream(FormStreamFields *form)
         char* data = nextInput.m_data.releaseBuffer();
         form->currentStream = CFReadStreamCreateWithBytesNoCopy(0, reinterpret_cast<const UInt8*>(data), size, kCFAllocatorNull);
         form->currentData = data;
-    } else {
-        CFStringRef filename = nextInput.m_filename.createCFString();
-#if PLATFORM(WIN)
-        CFURLRef fileURL = CFURLCreateWithFileSystemPath(0, filename, kCFURLWindowsPathStyle, FALSE);
-#else
-        CFURLRef fileURL = CFURLCreateWithFileSystemPath(0, filename, kCFURLPOSIXPathStyle, FALSE);
-#endif
-        CFRelease(filename);
-        form->currentStream = CFReadStreamCreateWithFile(0, fileURL);
-        CFRelease(fileURL);
-    }
+    } else
+        form->currentStream = CFReadStreamCreateWithFile(0, pathAsURL(nextInput.m_filename).get());
     form->remainingElements.removeLast();
 
     // Set up the callback.
diff --git a/Source/WebCore/platform/network/cf/LoaderRunLoopCF.cpp b/Source/WebCore/platform/network/cf/LoaderRunLoopCF.cpp
index 249fe43..a7cc639 100644
--- a/Source/WebCore/platform/network/cf/LoaderRunLoopCF.cpp
+++ b/Source/WebCore/platform/network/cf/LoaderRunLoopCF.cpp
@@ -28,6 +28,7 @@
 
 #if USE(CFNETWORK)
 
+#include <CoreFoundation/CoreFoundation.h>
 #include <wtf/Threading.h>
 
 namespace WebCore {
diff --git a/Source/WebCore/platform/network/cf/LoaderRunLoopCF.h b/Source/WebCore/platform/network/cf/LoaderRunLoopCF.h
index f66128c..e0d3ba4 100644
--- a/Source/WebCore/platform/network/cf/LoaderRunLoopCF.h
+++ b/Source/WebCore/platform/network/cf/LoaderRunLoopCF.h
@@ -32,6 +32,8 @@
 #error This code is not needed on platforms other than Windows, because main thread's CFRunLoop can be used.
 #endif
 
+typedef struct __CFRunLoop* CFRunLoopRef;
+
 namespace WebCore {
 
 CFRunLoopRef loaderRunLoop();
diff --git a/Source/WebCore/platform/network/cf/ProxyServerCFNet.cpp b/Source/WebCore/platform/network/cf/ProxyServerCFNet.cpp
index 3bef808..57d714b 100644
--- a/Source/WebCore/platform/network/cf/ProxyServerCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/ProxyServerCFNet.cpp
@@ -29,6 +29,10 @@
 #include "KURL.h"
 #include <wtf/RetainPtr.h>
 
+#if PLATFORM(WIN)
+#include <CFNetwork/CFNetwork.h>
+#endif
+
 namespace WebCore {
 
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
diff --git a/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp b/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
index 66ae5a0..52b100f 100644
--- a/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
@@ -126,12 +126,7 @@ static void setDefaultMIMEType(CFURLResponseRef response)
 
 static String encodeBasicAuthorization(const String& user, const String& password)
 {
-    CString unencodedString = (user + ":" + password).utf8();
-    Vector<char> unencoded(unencodedString.length());
-    std::copy(unencodedString.data(), unencodedString.data() + unencodedString.length(), unencoded.begin());
-    Vector<char> encoded;
-    base64Encode(unencoded, encoded);
-    return String(encoded.data(), encoded.size());
+    return base64Encode((user + ":" + password).utf8());
 }
 
 CFURLRequestRef willSendRequest(CFURLConnectionRef conn, CFURLRequestRef cfRequest, CFURLResponseRef cfRedirectResponse, const void* clientInfo)
diff --git a/Source/WebCore/platform/network/cf/ResourceRequestCFNet.cpp b/Source/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
index 410a649..7a1dfd5 100644
--- a/Source/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
@@ -26,16 +26,22 @@
 #include "config.h"
 #include "ResourceRequestCFNet.h"
 
-#if USE(CFNETWORK)
-
-#include "FormDataStreamCFNet.h"
 #include "ResourceRequest.h"
 
+#if PLATFORM(MAC)
+#include "WebCoreSystemInterface.h"
+#endif
+
+#if USE(CFNETWORK)
+#include "FormDataStreamCFNet.h"
 #include <CFNetwork/CFURLRequestPriv.h>
 #include <WebKitSystemInterface/WebKitSystemInterface.h>
+#endif
 
 namespace WebCore {
 
+#if USE(CFNETWORK)
+
 typedef void (*CFURLRequestSetContentDispositionEncodingFallbackArrayFunction)(CFMutableURLRequestRef, CFArrayRef);
 typedef CFArrayRef (*CFURLRequestCopyContentDispositionEncodingFallbackArrayFunction)(CFURLRequestRef);
 
@@ -189,12 +195,43 @@ void ResourceRequest::doUpdateResourceRequest()
     m_httpBody = httpBodyFromRequest(m_cfRequest.get());
 }
 
+#endif // USE(CFNETWORK)
+
 unsigned initializeMaximumHTTPConnectionCountPerHost()
 {
     static const unsigned preferredConnectionCount = 6;
-    return wkInitializeMaximumHTTPConnectionCountPerHost(preferredConnectionCount);
+    static const unsigned unlimitedConnectionCount = 10000;
+
+    // Always set the connection count per host, even when pipelining.
+    unsigned maximumHTTPConnectionCountPerHost = wkInitializeMaximumHTTPConnectionCountPerHost(preferredConnectionCount);
+
+#if PLATFORM(MAC)
+    if (isHTTPPipeliningEnabled()) {
+        // When pipelining do not rate-limit requests sent from WebCore since CFNetwork handles that.
+        return unlimitedConnectionCount;
+    }
+#endif
+
+    return maximumHTTPConnectionCountPerHost;
 }
 
-} // namespace WebCore
+static inline bool readBooleanPreference(CFStringRef key)
+{
+    Boolean keyExistsAndHasValidFormat;
+    Boolean result = CFPreferencesGetAppBooleanValue(key, kCFPreferencesCurrentApplication, &keyExistsAndHasValidFormat);
+    return keyExistsAndHasValidFormat ? result : false;
+}
 
-#endif // USE(CFNETWORK)
+bool isHTTPPipeliningEnabled()
+{
+    static bool isEnabled = readBooleanPreference(CFSTR("WebKitEnableHTTPPipelining"));
+    return isEnabled;
+}
+
+bool shouldForceHTTPPipeliningPriorityHigh()
+{
+    static bool shouldForcePriorityHigh = readBooleanPreference(CFSTR("WebKitForceHTTPPipeliningPriorityHigh"));
+    return shouldForcePriorityHigh;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/network/cf/ResourceRequestCFNet.h b/Source/WebCore/platform/network/cf/ResourceRequestCFNet.h
index 39587a4..09f4cea 100644
--- a/Source/WebCore/platform/network/cf/ResourceRequestCFNet.h
+++ b/Source/WebCore/platform/network/cf/ResourceRequestCFNet.h
@@ -26,18 +26,55 @@
 #ifndef ResourceRequestCFNet_h
 #define ResourceRequestCFNet_h
 
-#if USE(CFNETWORK)
+#include "ResourceLoadPriority.h"
 
+#if USE(CFNETWORK)
 typedef const struct _CFURLRequest* CFURLRequestRef;
+#endif
 
 namespace WebCore {
 
-    class ResourceRequest;
+class ResourceRequest;
+
+#if USE(CFNETWORK)
+void getResourceRequest(ResourceRequest&, CFURLRequestRef);
+CFURLRequestRef cfURLRequest(const ResourceRequest&);
+#endif
+
+inline ResourceLoadPriority mapHTTPPipeliningPriorityToResourceLoadPriority(int priority)
+{
+    switch (priority) {
+    case 0:
+        return ResourceLoadPriorityLow;
+    case 1:
+        return ResourceLoadPriorityMedium;
+    case 2:
+        return ResourceLoadPriorityHigh;
+    default:
+        ASSERT_NOT_REACHED();
+        return ResourceLoadPriorityLowest;
+    }
+}
+
+inline int mapResourceLoadPriorityToHTTPPipeliningPriority(ResourceLoadPriority priority)
+{
+    switch (priority) {
+    case ResourceLoadPriorityVeryLow:
+    case ResourceLoadPriorityLow:
+        return 0;
+    case ResourceLoadPriorityMedium:
+        return 1;
+    case ResourceLoadPriorityHigh:
+        return 2;
+    case ResourceLoadPriorityUnresolved:
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
 
-    void getResourceRequest(ResourceRequest&, CFURLRequestRef);
-    CFURLRequestRef cfURLRequest(const ResourceRequest&);
+    ASSERT_NOT_REACHED();
+    return 0;
 }
 
-#endif // USE(CFNETWORK)
+} // namespace WebCore
 
 #endif // ResourceRequestCFNet_h
diff --git a/Source/WebCore/platform/network/cf/SocketStreamHandle.h b/Source/WebCore/platform/network/cf/SocketStreamHandle.h
index df1d4a3..fbda3bc 100644
--- a/Source/WebCore/platform/network/cf/SocketStreamHandle.h
+++ b/Source/WebCore/platform/network/cf/SocketStreamHandle.h
@@ -36,6 +36,7 @@
 #include "SocketStreamHandleBase.h"
 #include <wtf/RetainPtr.h>
 
+typedef struct __CFHTTPMessage* CFHTTPMessageRef;
 
 namespace WebCore {
 
diff --git a/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp b/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
index 821b1ca..06454a7 100644
--- a/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
@@ -47,6 +47,7 @@
 
 #if PLATFORM(WIN)
 #include "LoaderRunLoopCF.h"
+#include <CFNetwork/CFNetwork.h>
 #include <WebKitSystemInterface/WebKitSystemInterface.h>
 #else
 #include "WebCoreSystemInterface.h"
diff --git a/Source/WebCore/platform/network/chromium/ResourceRequest.cpp b/Source/WebCore/platform/network/chromium/ResourceRequest.cpp
index 69591c1..519c63f 100644
--- a/Source/WebCore/platform/network/chromium/ResourceRequest.cpp
+++ b/Source/WebCore/platform/network/chromium/ResourceRequest.cpp
@@ -43,6 +43,7 @@ PassOwnPtr<CrossThreadResourceRequestData> ResourceRequest::doPlatformCopyData(P
     data->m_requestorProcessID = m_requestorProcessID;
     data->m_appCacheHostID = m_appCacheHostID;
     data->m_hasUserGesture = m_hasUserGesture;
+    data->m_downloadToFile = m_downloadToFile;
     return data;
 }
 
@@ -52,6 +53,7 @@ void ResourceRequest::doPlatformAdopt(PassOwnPtr<CrossThreadResourceRequestData>
     m_requestorProcessID = data->m_requestorProcessID;
     m_appCacheHostID = data->m_appCacheHostID;
     m_hasUserGesture = data->m_hasUserGesture;
+    m_downloadToFile = data->m_downloadToFile;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/network/chromium/ResourceRequest.h b/Source/WebCore/platform/network/chromium/ResourceRequest.h
index 41ad6e0..07b31eb 100644
--- a/Source/WebCore/platform/network/chromium/ResourceRequest.h
+++ b/Source/WebCore/platform/network/chromium/ResourceRequest.h
@@ -42,6 +42,7 @@ namespace WebCore {
             , m_requestorProcessID(0)
             , m_appCacheHostID(0)
             , m_hasUserGesture(false)
+            , m_downloadToFile(false)
         {
         }
 
@@ -51,6 +52,7 @@ namespace WebCore {
             , m_requestorProcessID(0)
             , m_appCacheHostID(0)
             , m_hasUserGesture(false)
+            , m_downloadToFile(false)
         {
         }
 
@@ -60,6 +62,7 @@ namespace WebCore {
             , m_requestorProcessID(0)
             , m_appCacheHostID(0)
             , m_hasUserGesture(false)
+            , m_downloadToFile(false)
         {
             setHTTPReferrer(referrer);
         }
@@ -70,6 +73,7 @@ namespace WebCore {
             , m_requestorProcessID(0)
             , m_appCacheHostID(0)
             , m_hasUserGesture(false)
+            , m_downloadToFile(false)
         {
         }
 
@@ -92,6 +96,10 @@ namespace WebCore {
         bool hasUserGesture() const { return m_hasUserGesture; }
         void setHasUserGesture(bool hasUserGesture) { m_hasUserGesture = hasUserGesture; }
 
+        // True if request should be downloaded to file.
+        bool downloadToFile() const { return m_downloadToFile; }
+        void setDownloadToFile(bool downloadToFile) { m_downloadToFile = downloadToFile; }
+
     private:
         friend class ResourceRequestBase;
 
@@ -105,6 +113,7 @@ namespace WebCore {
         int m_requestorProcessID;
         int m_appCacheHostID;
         bool m_hasUserGesture;
+        bool m_downloadToFile;
     };
 
     struct CrossThreadResourceRequestData : public CrossThreadResourceRequestDataBase {
@@ -112,6 +121,7 @@ namespace WebCore {
         int m_requestorProcessID;
         int m_appCacheHostID;
         bool m_hasUserGesture;
+        bool m_downloadToFile;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/network/chromium/ResourceResponse.cpp b/Source/WebCore/platform/network/chromium/ResourceResponse.cpp
index acd44d3..fc8ac62 100644
--- a/Source/WebCore/platform/network/chromium/ResourceResponse.cpp
+++ b/Source/WebCore/platform/network/chromium/ResourceResponse.cpp
@@ -39,6 +39,8 @@ PassOwnPtr<CrossThreadResourceResponseData> ResourceResponse::doPlatformCopyData
     data->m_wasAlternateProtocolAvailable = m_wasAlternateProtocolAvailable;
     data->m_wasFetchedViaProxy = m_wasFetchedViaProxy;
     data->m_responseTime = m_responseTime;
+    data->m_socketAddress = m_socketAddress;
+    data->m_downloadFilePath = m_downloadFilePath;
     return data;
 }
 
@@ -53,6 +55,8 @@ void ResourceResponse::doPlatformAdopt(PassOwnPtr<CrossThreadResourceResponseDat
     m_wasAlternateProtocolAvailable = data->m_wasAlternateProtocolAvailable;
     m_wasFetchedViaProxy = data->m_wasFetchedViaProxy;
     m_responseTime = data->m_responseTime;
+    m_socketAddress = data->m_socketAddress;
+    m_downloadFilePath = data->m_downloadFilePath;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/network/chromium/ResourceResponse.h b/Source/WebCore/platform/network/chromium/ResourceResponse.h
index 5e99994..35f13d1 100644
--- a/Source/WebCore/platform/network/chromium/ResourceResponse.h
+++ b/Source/WebCore/platform/network/chromium/ResourceResponse.h
@@ -96,6 +96,12 @@ namespace WebCore {
         double responseTime() const { return m_responseTime; }
         void setResponseTime(double responseTime) { m_responseTime = responseTime; }
 
+        const String& socketAddress() const { return m_socketAddress; }
+        void setSocketAddress(const String& value) { m_socketAddress = value; }
+
+        const String& downloadFilePath() const { return m_downloadFilePath; }
+        void setDownloadFilePath(const String& downloadFilePath) { m_downloadFilePath = downloadFilePath; }
+
     private:
         friend class ResourceResponseBase;
 
@@ -143,6 +149,13 @@ namespace WebCore {
         // The time at which the response headers were received.  For cached
         // responses, this time could be "far" in the past.
         double m_responseTime;
+
+        // Remote address of the socket which fetched this resource, for presenting
+        // to inquisitive users.  Can be "ipv4:port", "[ipv6]:port", or empty.
+        String m_socketAddress;
+
+        // The path to the downloaded file.
+        String m_downloadFilePath;
     };
 
     struct CrossThreadResourceResponseData : public CrossThreadResourceResponseDataBase {
@@ -155,6 +168,8 @@ namespace WebCore {
         bool m_wasAlternateProtocolAvailable;
         bool m_wasFetchedViaProxy;
         double m_responseTime;
+        String m_socketAddress;
+        String m_downloadFilePath;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/network/mac/AuthenticationMac.mm b/Source/WebCore/platform/network/mac/AuthenticationMac.mm
index efa42d9..a187187 100644
--- a/Source/WebCore/platform/network/mac/AuthenticationMac.mm
+++ b/Source/WebCore/platform/network/mac/AuthenticationMac.mm
@@ -31,6 +31,7 @@
 #import "AuthenticationClient.h"
 #import "Credential.h"
 #import "ProtectionSpace.h"
+#import <wtf/UnusedParam.h>
 
 #import <Foundation/NSURLAuthenticationChallenge.h>
 #import <Foundation/NSURLCredential.h>
@@ -86,6 +87,20 @@ using namespace WebCore;
         m_client->receivedCancellation(core(challenge));
 }
 
+- (void)performDefaultHandlingForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
+{
+    // FIXME: <rdar://problem/8995483> Determine what, if anything, we should do here.
+    ASSERT_NOT_REACHED();
+    UNUSED_PARAM(challenge);
+}
+
+- (void)rejectProtectionSpaceAndContinueWithChallenge:(NSURLAuthenticationChallenge *)challenge
+{
+    // FIXME: <rdar://problem/8995483> Determine what, if anything, we should do here.
+    ASSERT_NOT_REACHED();
+    UNUSED_PARAM(challenge);
+}
+
 @end
 
 namespace WebCore {
diff --git a/Source/WebCore/platform/network/mac/FormDataStreamMac.mm b/Source/WebCore/platform/network/mac/FormDataStreamMac.mm
index 03f4579..eb6f601 100644
--- a/Source/WebCore/platform/network/mac/FormDataStreamMac.mm
+++ b/Source/WebCore/platform/network/mac/FormDataStreamMac.mm
@@ -185,9 +185,7 @@ static bool advanceCurrentStream(FormStreamFields* form)
         }
 #endif
         const String& path = nextInput.m_shouldGenerateFile ? nextInput.m_generatedFilename : nextInput.m_filename;
-        RetainPtr<CFStringRef> filename(AdoptCF, path.createCFString());
-        RetainPtr<CFURLRef> fileURL(AdoptCF, CFURLCreateWithFileSystemPath(0, filename.get(), kCFURLPOSIXPathStyle, FALSE));
-        form->currentStream = CFReadStreamCreateWithFile(0, fileURL.get());
+        form->currentStream = CFReadStreamCreateWithFile(0, pathAsURL(path).get());
         if (!form->currentStream) {
             // The file must have been removed or become unreadable.
             return false;
diff --git a/Source/WebCore/platform/network/mac/ResourceHandleMac.mm b/Source/WebCore/platform/network/mac/ResourceHandleMac.mm
index 84b656c..2d687c0 100644
--- a/Source/WebCore/platform/network/mac/ResourceHandleMac.mm
+++ b/Source/WebCore/platform/network/mac/ResourceHandleMac.mm
@@ -164,12 +164,7 @@ public:
 #ifndef BUILDING_ON_TIGER
 static String encodeBasicAuthorization(const String& user, const String& password)
 {
-    CString unencodedString = (user + ":" + password).utf8();
-    Vector<char> unencoded(unencodedString.length());
-    std::copy(unencodedString.data(), unencodedString.data() + unencodedString.length(), unencoded.begin());
-    Vector<char> encoded;
-    base64Encode(unencoded, encoded);
-    return String(encoded.data(), encoded.size());
+    return base64Encode((user + ":" + password).utf8());
 }
 #endif
 
diff --git a/Source/WebCore/platform/network/mac/ResourceRequestMac.mm b/Source/WebCore/platform/network/mac/ResourceRequestMac.mm
index f0357e5..640d237 100644
--- a/Source/WebCore/platform/network/mac/ResourceRequestMac.mm
+++ b/Source/WebCore/platform/network/mac/ResourceRequestMac.mm
@@ -31,6 +31,8 @@
 #import "WebCoreSystemInterface.h"
 
 #import "FormDataStreamMac.h"
+#import "ResourceRequestCFNet.h"
+#import "WebCoreSystemInterface.h"
 
 #import <Foundation/Foundation.h>
 
@@ -65,7 +67,12 @@ void ResourceRequest::doUpdateResourceRequest()
     if (NSString* method = [m_nsRequest.get() HTTPMethod])
         m_httpMethod = method;
     m_allowCookies = [m_nsRequest.get() HTTPShouldHandleCookies];
-    
+
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    if (isHTTPPipeliningEnabled() && !shouldForceHTTPPipeliningPriorityHigh())
+        m_priority = mapHTTPPipeliningPriorityToResourceLoadPriority(wkGetHTTPPipeliningPriority(m_nsRequest.get()));
+#endif
+
     NSDictionary *headers = [m_nsRequest.get() allHTTPHeaderFields];
     NSEnumerator *e = [headers keyEnumerator];
     NSString *name;
@@ -111,6 +118,13 @@ void ResourceRequest::doUpdatePlatformRequest()
     wkSupportsMultipartXMixedReplace(nsRequest);
 #endif
 
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    if (isHTTPPipeliningEnabled()) {
+        int priority = mapResourceLoadPriorityToHTTPPipeliningPriority(m_priority);
+        wkSetHTTPPipeliningPriority(nsRequest, shouldForceHTTPPipeliningPriorityHigh() ? 2 : priority);
+    }
+#endif
+
     [nsRequest setCachePolicy:(NSURLRequestCachePolicy)cachePolicy()];
     if (timeoutInterval() != unspecifiedTimeoutInterval)
         [nsRequest setTimeoutInterval:timeoutInterval()];
@@ -154,12 +168,6 @@ void ResourceRequest::applyWebArchiveHackForMail()
     // Hack because Mail checks for this property to detect data / archive loads
     [NSURLProtocol setProperty:@"" forKey:@"WebDataRequest" inRequest:(NSMutableURLRequest *)nsURLRequest()];
 }
-    
-unsigned initializeMaximumHTTPConnectionCountPerHost()
-{
-    static const unsigned preferredConnectionCount = 6;
-    return wkInitializeMaximumHTTPConnectionCountPerHost(preferredConnectionCount);
-}
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/network/qt/QtNAMThreadSafeProxy.cpp b/Source/WebCore/platform/network/qt/QtNAMThreadSafeProxy.cpp
index e0d6e69..a98b4f4 100644
--- a/Source/WebCore/platform/network/qt/QtNAMThreadSafeProxy.cpp
+++ b/Source/WebCore/platform/network/qt/QtNAMThreadSafeProxy.cpp
@@ -35,6 +35,18 @@ QtNAMThreadSafeProxy::QtNAMThreadSafeProxy(QNetworkAccessManager *manager)
     connect(this, SIGNAL(localSetCookiesRequested(const QUrl&, const QString&)), SLOT(localSetCookies(const QUrl&, const QString&)));
     connect(this, SIGNAL(localCookiesForUrlRequested(const QUrl&, bool*, QList<QNetworkCookie>*)), SLOT(localCookiesForUrl(const QUrl&, bool*, QList<QNetworkCookie>*)));
     connect(this, SIGNAL(localWillLoadFromCacheRequested(const QUrl&, bool*, bool*)), SLOT(localWillLoadFromCache(const QUrl&, bool*, bool*)));
+    connect(this, SIGNAL(hasCookieJarRequested(bool*, bool*)), SLOT(hasCookieJar(bool*, bool*)));
+}
+
+bool QtNAMThreadSafeProxy::hasCookieJar()
+{
+    bool result;
+    bool done = false;
+    emit hasCookieJarRequested(&done, &result);
+    QMutexLocker lock(&m_resultMutex);
+    while (!done)
+        m_resultWaitCondition.wait(&m_resultMutex);
+    return result;
 }
 
 void QtNAMThreadSafeProxy::localSetCookies(const QUrl& url, const QString& cookies)
@@ -69,6 +81,14 @@ void QtNAMThreadSafeProxy::localWillLoadFromCache(const QUrl& url, bool* done, b
     m_resultWaitCondition.wakeAll();
 }
 
+void QtNAMThreadSafeProxy::hasCookieJar(bool* done, bool* result)
+{
+    QMutexLocker lock(&m_resultMutex);
+    *result = !!m_manager->cookieJar();
+    *done = true;
+    m_resultWaitCondition.wakeAll();
+}
+
 QtNetworkReplyThreadSafeProxy::QtNetworkReplyThreadSafeProxy(QNetworkAccessManager *manager)
     : m_manager(manager)
     , m_reply(0)
diff --git a/Source/WebCore/platform/network/qt/QtNAMThreadSafeProxy.h b/Source/WebCore/platform/network/qt/QtNAMThreadSafeProxy.h
index ae963cf..4906fe2 100644
--- a/Source/WebCore/platform/network/qt/QtNAMThreadSafeProxy.h
+++ b/Source/WebCore/platform/network/qt/QtNAMThreadSafeProxy.h
@@ -67,15 +67,19 @@ public:
         return result;
     }
 
+    bool hasCookieJar();
+
 signals:
     void localSetCookiesRequested(const QUrl&, const QString& cookies);
     void localCookiesForUrlRequested(const QUrl&, bool* done, QList<QNetworkCookie>* result);
     void localWillLoadFromCacheRequested(const QUrl&, bool* done, bool* result);
+    void hasCookieJarRequested(bool* done, bool* result);
 
 private slots:
     void localSetCookies(const QUrl&, const QString& cookies);
     void localCookiesForUrl(const QUrl&, bool* done, QList<QNetworkCookie>* result);
     void localWillLoadFromCache(const QUrl&, bool* done, bool* result);
+    void hasCookieJar(bool* done, bool* result);
 
 private:
     QNetworkAccessManager* m_manager;
diff --git a/Source/WebCore/platform/network/soup/CookieJarSoup.cpp b/Source/WebCore/platform/network/soup/CookieJarSoup.cpp
index ba29622..e2c2f05 100644
--- a/Source/WebCore/platform/network/soup/CookieJarSoup.cpp
+++ b/Source/WebCore/platform/network/soup/CookieJarSoup.cpp
@@ -38,9 +38,7 @@ SoupCookieJar* defaultCookieJar()
         cookiesInitialized = true;
 
         cookieJar = soup_cookie_jar_new();
-#ifdef HAVE_LIBSOUP_2_29_90
         soup_cookie_jar_set_accept_policy(cookieJar, SOUP_COOKIE_JAR_ACCEPT_NO_THIRD_PARTY);
-#endif
     }
 
     return cookieJar;
@@ -67,18 +65,12 @@ void setCookies(Document* document, const KURL& url, const String& value)
 
     GOwnPtr<SoupURI> origin(soup_uri_new(url.string().utf8().data()));
 
-#ifdef HAVE_LIBSOUP_2_29_90
     GOwnPtr<SoupURI> firstParty(soup_uri_new(document->firstPartyForCookies().string().utf8().data()));
 
     soup_cookie_jar_set_cookie_with_first_party(jar,
                                                 origin.get(),
                                                 firstParty.get(),
                                                 value.utf8().data());
-#else
-    soup_cookie_jar_set_cookie(jar,
-                               origin.get(),
-                               value.utf8().data());
-#endif
 }
 
 String cookies(const Document* /*document*/, const KURL& url)
diff --git a/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp b/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
index a7170fe..3b1f157 100644
--- a/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
+++ b/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
@@ -45,12 +45,14 @@
 #include "ResourceHandleInternal.h"
 #include "ResourceResponse.h"
 #include "SharedBuffer.h"
-#include "soup-request-http.h"
 #include "TextEncoding.h"
 #include <errno.h>
 #include <fcntl.h>
 #include <gio/gio.h>
 #include <glib.h>
+#define LIBSOUP_USE_UNSTABLE_REQUEST_API
+#include <libsoup/soup-request-http.h>
+#include <libsoup/soup-requester.h>
 #include <libsoup/soup.h>
 #include <sys/stat.h>
 #include <sys/types.h>
@@ -127,7 +129,7 @@ static void cleanupSoupRequestOperation(ResourceHandle*, bool isDestroying);
 static void sendRequestCallback(GObject*, GAsyncResult*, gpointer);
 static void readCallback(GObject*, GAsyncResult*, gpointer);
 static void closeCallback(GObject*, GAsyncResult*, gpointer);
-static bool startGio(ResourceHandle*, KURL);
+static bool startNonHTTPRequest(ResourceHandle*, KURL);
 
 ResourceHandleInternal::~ResourceHandleInternal()
 {
@@ -145,14 +147,48 @@ ResourceHandle::~ResourceHandle()
     cleanupSoupRequestOperation(this, true);
 }
 
+static void ensureSessionIsInitialized(SoupSession* session)
+{
+    // Values taken from http://stevesouders.com/ua/index.php following
+    // the rule "Do What Every Other Modern Browser Is Doing". They seem
+    // to significantly improve page loading time compared to soup's
+    // default values.
+    static const int maxConnections = 60;
+    static const int maxConnectionsPerHost = 6;
+
+    if (g_object_get_data(G_OBJECT(session), "webkit-init"))
+        return;
+
+    SoupCookieJar* jar = SOUP_COOKIE_JAR(soup_session_get_feature(session, SOUP_TYPE_COOKIE_JAR));
+    if (!jar)
+        soup_session_add_feature(session, SOUP_SESSION_FEATURE(defaultCookieJar()));
+    else
+        setDefaultCookieJar(jar);
+
+    if (!soup_session_get_feature(session, SOUP_TYPE_LOGGER) && LogNetwork.state == WTFLogChannelOn) {
+        SoupLogger* logger = soup_logger_new(static_cast<SoupLoggerLogLevel>(SOUP_LOGGER_LOG_BODY), -1);
+        soup_session_add_feature(session, SOUP_SESSION_FEATURE(logger));
+        g_object_unref(logger);
+    }
+
+    SoupRequester* requester = soup_requester_new();
+    soup_session_add_feature(session, SOUP_SESSION_FEATURE(requester));
+    g_object_unref(requester);
+
+    g_object_set(session,
+                 SOUP_SESSION_MAX_CONNS, maxConnections,
+                 SOUP_SESSION_MAX_CONNS_PER_HOST, maxConnectionsPerHost,
+                 NULL);
+
+    g_object_set_data(G_OBJECT(session), "webkit-init", reinterpret_cast<void*>(0xdeadbeef));
+}
+
 void ResourceHandle::prepareForURL(const KURL &url)
 {
-#ifdef HAVE_LIBSOUP_2_29_90
     GOwnPtr<SoupURI> soupURI(soup_uri_new(url.prettyURL().utf8().data()));
     if (!soupURI)
         return;
     soup_session_prepare_for_uri(ResourceHandle::defaultSession(), soupURI.get());
-#endif
 }
 
 // All other kinds of redirections, except for the *304* status code
@@ -206,14 +242,12 @@ static void restartedCallback(SoupMessage* msg, gpointer data)
     if (d->m_cancelled)
         return;
 
-#ifdef HAVE_LIBSOUP_2_29_90
     // Update the first party in case the base URL changed with the redirect
     String firstPartyString = request.firstPartyForCookies().string();
     if (!firstPartyString.isEmpty()) {
         GOwnPtr<SoupURI> firstParty(soup_uri_new(firstPartyString.utf8().data()));
         soup_message_set_first_party(d->m_soupMessage.get(), firstParty.get());
     }
-#endif
 }
 
 static void contentSniffedCallback(SoupMessage*, const char*, GHashTable*, gpointer);
@@ -263,7 +297,26 @@ static void gotHeadersCallback(SoupMessage* msg, gpointer data)
     client->didReceiveResponse(handle.get(), d->m_response);
 }
 
-// This callback will not be called if the content sniffer is disabled in startHttp.
+static void wroteBodyDataCallback(SoupMessage*, SoupBuffer* buffer, gpointer data)
+{
+    RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(data);
+    if (!handle)
+        return;
+
+    ASSERT(buffer);
+    ResourceHandleInternal* internal = handle->getInternal();
+    internal->m_bodyDataSent += buffer->length;
+
+    if (internal->m_cancelled)
+        return;
+    ResourceHandleClient* client = handle->client();
+    if (!client)
+        return;
+
+    client->didSendData(handle.get(), internal->m_bodyDataSent, internal->m_bodySize);
+}
+
+// This callback will not be called if the content sniffer is disabled in startHTTPRequest.
 static void contentSniffedCallback(SoupMessage* msg, const char* sniffedType, GHashTable *params, gpointer data)
 {
     if (sniffedType) {
@@ -312,136 +365,11 @@ static void gotChunkCallback(SoupMessage* msg, SoupBuffer* chunk, gpointer data)
     client->didReceiveData(handle.get(), chunk->data, chunk->length, false);
 }
 
-static gboolean parseDataUrl(gpointer callbackData)
-{
-    ResourceHandle* handle = static_cast<ResourceHandle*>(callbackData);
-    ResourceHandleClient* client = handle->client();
-    ResourceHandleInternal* d = handle->getInternal();
-    if (d->m_cancelled)
-        return false;
-
-    d->m_idleHandler = 0;
-
-    ASSERT(client);
-    if (!client)
-        return false;
-
-    String url = handle->firstRequest().url().string();
-    ASSERT(url.startsWith("data:", false));
-
-    int index = url.find(',');
-    if (index == -1) {
-        client->cannotShowURL(handle);
-        return false;
-    }
-
-    String mediaType = url.substring(5, index - 5);
-
-    bool isBase64 = mediaType.endsWith(";base64", false);
-    if (isBase64)
-        mediaType = mediaType.left(mediaType.length() - 7);
-
-    if (mediaType.isEmpty())
-        mediaType = "text/plain;charset=US-ASCII";
-
-    String mimeType = extractMIMETypeFromMediaType(mediaType);
-    String charset = extractCharsetFromMediaType(mediaType);
-
-    ASSERT(d->m_response.isNull());
-
-    d->m_response.setURL(handle->firstRequest().url());
-    d->m_response.setMimeType(mimeType);
-
-    // For non base64 encoded data we have to convert to UTF-16 early
-    // due to limitations in KURL
-    d->m_response.setTextEncodingName(isBase64 ? charset : "UTF-16");
-    client->didReceiveResponse(handle, d->m_response);
-
-    // The load may be cancelled, and the client may be destroyed
-    // by any of the client reporting calls, so we check, and bail
-    // out in either of those cases.
-    if (d->m_cancelled || !handle->client())
-        return false;
-
-    SoupSession* session = handle->defaultSession();
-    GOwnPtr<GError> error;
-    d->m_soupRequest = adoptGRef(webkit_soup_requester_request(d->m_requester.get(), handle->firstRequest().url().string().utf8().data(), session, &error.outPtr()));
-    if (error) {
-        d->m_soupRequest = 0;
-        client->didFinishLoading(handle, 0);
-        return false;
-    }
-
-    d->m_inputStream = adoptGRef(webkit_soup_request_send(d->m_soupRequest.get(), 0, &error.outPtr()));
-    if (error) {
-        d->m_inputStream = 0;
-        client->didFinishLoading(handle, 0);
-        return false;
-    }
-
-    d->m_buffer = static_cast<char*>(g_slice_alloc0(READ_BUFFER_SIZE));
-    d->m_total = 0;
-
-    g_object_set_data(G_OBJECT(d->m_inputStream.get()), "webkit-resource", handle);
-    // balanced by a deref() in cleanupSoupRequestOperation, which should always run
-    handle->ref();
-
-    d->m_cancellable = adoptGRef(g_cancellable_new());
-    g_input_stream_read_async(d->m_inputStream.get(), d->m_buffer, READ_BUFFER_SIZE, G_PRIORITY_DEFAULT,
-                              d->m_cancellable.get(), readCallback, GINT_TO_POINTER(!isBase64));
-
-    return false;
-}
-
-static bool startData(ResourceHandle* handle, String urlString)
-{
-    ASSERT(handle);
-
-    ResourceHandleInternal* d = handle->getInternal();
-
-    // If parseDataUrl is called synchronously the job is not yet effectively started
-    // and webkit won't never know that the data has been parsed even didFinishLoading is called.
-    d->m_idleHandler = g_timeout_add(0, parseDataUrl, handle);
-    return true;
-}
-
 static SoupSession* createSoupSession()
 {
     return soup_session_async_new();
 }
 
-// Values taken from http://stevesouders.com/ua/index.php following
-// the rule "Do What Every Other Modern Browser Is Doing". They seem
-// to significantly improve page loading time compared to soup's
-// default values.
-#define MAX_CONNECTIONS          60
-#define MAX_CONNECTIONS_PER_HOST 6
-
-static void ensureSessionIsInitialized(SoupSession* session)
-{
-    if (g_object_get_data(G_OBJECT(session), "webkit-init"))
-        return;
-
-    SoupCookieJar* jar = reinterpret_cast<SoupCookieJar*>(soup_session_get_feature(session, SOUP_TYPE_COOKIE_JAR));
-    if (!jar)
-        soup_session_add_feature(session, SOUP_SESSION_FEATURE(defaultCookieJar()));
-    else
-        setDefaultCookieJar(jar);
-
-    if (!soup_session_get_feature(session, SOUP_TYPE_LOGGER) && LogNetwork.state == WTFLogChannelOn) {
-        SoupLogger* logger = soup_logger_new(static_cast<SoupLoggerLogLevel>(SOUP_LOGGER_LOG_BODY), -1);
-        soup_logger_attach(logger, session);
-        g_object_unref(logger);
-    }
-
-    g_object_set(session,
-                 SOUP_SESSION_MAX_CONNS, MAX_CONNECTIONS,
-                 SOUP_SESSION_MAX_CONNS_PER_HOST, MAX_CONNECTIONS_PER_HOST,
-                 NULL);
-
-    g_object_set_data(G_OBJECT(session), "webkit-init", reinterpret_cast<void*>(0xdeadbeef));
-}
-
 static void cleanupSoupRequestOperation(ResourceHandle* handle, bool isDestroying = false)
 {
     ResourceHandleInternal* d = handle->getInternal();
@@ -495,14 +423,14 @@ static void sendRequestCallback(GObject* source, GAsyncResult* res, gpointer use
     }
 
     GOwnPtr<GError> error;
-    GInputStream* in = webkit_soup_request_send_finish(d->m_soupRequest.get(), res, &error.outPtr());
+    GInputStream* in = soup_request_send_finish(d->m_soupRequest.get(), res, &error.outPtr());
 
     if (error) {
         SoupMessage* soupMsg = d->m_soupMessage.get();
         gboolean isTransportError = d->m_soupMessage && SOUP_STATUS_IS_TRANSPORT_ERROR(soupMsg->status_code);
 
         if (isTransportError || (error->domain == G_IO_ERROR)) {
-            SoupURI* uri = webkit_soup_request_get_uri(d->m_soupRequest.get());
+            SoupURI* uri = soup_request_get_uri(d->m_soupRequest.get());
             GOwnPtr<char> uriStr(soup_uri_to_string(uri, false));
             gint errorCode = isTransportError ? static_cast<gint>(soupMsg->status_code) : error->code;
             const gchar* errorMsg = isTransportError ? soupMsg->reason_phrase : error->message;
@@ -550,13 +478,14 @@ static void sendRequestCallback(GObject* source, GAsyncResult* res, gpointer use
     // readCallback needs it
     g_object_set_data(G_OBJECT(d->m_inputStream.get()), "webkit-resource", handle.get());
 
-    // Ensure a response is sent for any protocols that don't explicitly support responses
-    // through got-headers signal or content sniffing.
-    // (e.g. file and GIO based protocol).
-    if (!handle->shouldContentSniff() && d->m_response.isNull()) {
+    // If not using SoupMessage we need to call didReceiveResponse now.
+    // (This will change later when SoupRequest supports content sniffing.)
+    if (!d->m_soupMessage) {
         d->m_response.setURL(handle->firstRequest().url());
-        d->m_response.setMimeType(webkit_soup_request_get_content_type(d->m_soupRequest.get()));
-        d->m_response.setExpectedContentLength(webkit_soup_request_get_content_length(d->m_soupRequest.get()));
+        const gchar* contentType = soup_request_get_content_type(d->m_soupRequest.get());
+        d->m_response.setMimeType(extractMIMETypeFromMediaType(contentType));
+        d->m_response.setTextEncodingName(extractCharsetFromMediaType(contentType));
+        d->m_response.setExpectedContentLength(soup_request_get_content_length(d->m_soupRequest.get()));
         client->didReceiveResponse(handle.get(), d->m_response);
 
         if (d->m_cancelled) {
@@ -572,12 +501,56 @@ static void sendRequestCallback(GObject* source, GAsyncResult* res, gpointer use
                               G_PRIORITY_DEFAULT, d->m_cancellable.get(), readCallback, 0);
 }
 
-static bool startHttp(ResourceHandle* handle)
+static bool addFormElementsToSoupMessage(SoupMessage* message, const char* contentType, FormData* httpBody, unsigned long& totalBodySize)
+{
+    size_t numElements = httpBody->elements().size();
+    if (numElements < 2) { // No file upload is the most common case.
+        Vector<char> body;
+        httpBody->flatten(body);
+        totalBodySize = body.size();
+        soup_message_set_request(message, contentType, SOUP_MEMORY_COPY, body.data(), body.size());
+        return true;
+    }
+
+    // We have more than one element to upload, and some may be large files,
+    // which we will want to mmap instead of copying into memory
+    soup_message_body_set_accumulate(message->request_body, FALSE);
+    for (size_t i = 0; i < numElements; i++) {
+        const FormDataElement& element = httpBody->elements()[i];
+
+        if (element.m_type == FormDataElement::data) {
+            totalBodySize += element.m_data.size();
+            soup_message_body_append(message->request_body, SOUP_MEMORY_TEMPORARY,
+                                     element.m_data.data(), element.m_data.size());
+            continue;
+        }
+
+        // This technique is inspired by libsoup's simple-httpd test.
+        GOwnPtr<GError> error;
+        CString fileName = fileSystemRepresentation(element.m_filename);
+        GMappedFile* fileMapping = g_mapped_file_new(fileName.data(), false, &error.outPtr());
+        if (error)
+            return false;
+
+        gsize mappedFileSize = g_mapped_file_get_length(fileMapping);
+        totalBodySize += mappedFileSize;
+        SoupBuffer* soupBuffer = soup_buffer_new_with_owner(g_mapped_file_get_contents(fileMapping),
+                                                            mappedFileSize, fileMapping,
+                                                            reinterpret_cast<GDestroyNotify>(g_mapped_file_unref));
+        soup_message_body_append_buffer(message->request_body, soupBuffer);
+        soup_buffer_free(soupBuffer);
+    }
+
+    return true;
+}
+
+static bool startHTTPRequest(ResourceHandle* handle)
 {
     ASSERT(handle);
 
     SoupSession* session = handle->defaultSession();
     ensureSessionIsInitialized(session);
+    SoupRequester* requester = SOUP_REQUESTER(soup_session_get_feature(session, SOUP_TYPE_REQUESTER));
 
     ResourceHandleInternal* d = handle->getInternal();
 
@@ -587,7 +560,7 @@ static bool startHttp(ResourceHandle* handle)
     request.setURL(url);
 
     GOwnPtr<GError> error;
-    d->m_soupRequest = adoptGRef(webkit_soup_requester_request(d->m_requester.get(), url.string().utf8().data(), session, &error.outPtr()));
+    d->m_soupRequest = adoptGRef(soup_requester_request(requester, url.string().utf8().data(), &error.outPtr()));
     if (error) {
         d->m_soupRequest = 0;
         return false;
@@ -595,7 +568,7 @@ static bool startHttp(ResourceHandle* handle)
 
     g_object_set_data(G_OBJECT(d->m_soupRequest.get()), "webkit-resource", handle);
 
-    d->m_soupMessage = adoptGRef(webkit_soup_request_http_get_message(WEBKIT_SOUP_REQUEST_HTTP(d->m_soupRequest.get())));
+    d->m_soupMessage = adoptGRef(soup_request_http_get_message(SOUP_REQUEST_HTTP(d->m_soupRequest.get())));
     if (!d->m_soupMessage)
         return false;
 
@@ -609,65 +582,23 @@ static bool startHttp(ResourceHandle* handle)
 
     g_signal_connect(soupMessage, "restarted", G_CALLBACK(restartedCallback), handle);
     g_signal_connect(soupMessage, "got-headers", G_CALLBACK(gotHeadersCallback), handle);
+    g_signal_connect(soupMessage, "wrote-body-data", G_CALLBACK(wroteBodyDataCallback), handle);
     d->m_gotChunkHandler = g_signal_connect(soupMessage, "got-chunk", G_CALLBACK(gotChunkCallback), handle);
 
-#ifdef HAVE_LIBSOUP_2_29_90
     String firstPartyString = request.firstPartyForCookies().string();
     if (!firstPartyString.isEmpty()) {
         GOwnPtr<SoupURI> firstParty(soup_uri_new(firstPartyString.utf8().data()));
         soup_message_set_first_party(soupMessage, firstParty.get());
     }
-#endif
 
     FormData* httpBody = d->m_firstRequest.httpBody();
-    if (httpBody && !httpBody->isEmpty()) {
-        size_t numElements = httpBody->elements().size();
-
-        // handle the most common case (i.e. no file upload)
-        if (numElements < 2) {
-            Vector<char> body;
-            httpBody->flatten(body);
-            soup_message_set_request(soupMessage, d->m_firstRequest.httpContentType().utf8().data(),
-                                     SOUP_MEMORY_COPY, body.data(), body.size());
-        } else {
-            /*
-             * we have more than one element to upload, and some may
-             * be (big) files, which we will want to mmap instead of
-             * copying into memory; TODO: support upload of non-local
-             * (think sftp://) files by using GIO?
-             */
-            soup_message_body_set_accumulate(soupMessage->request_body, FALSE);
-            for (size_t i = 0; i < numElements; i++) {
-                const FormDataElement& element = httpBody->elements()[i];
-
-                if (element.m_type == FormDataElement::data)
-                    soup_message_body_append(soupMessage->request_body, SOUP_MEMORY_TEMPORARY, element.m_data.data(), element.m_data.size());
-                else {
-                    /*
-                     * mapping for uploaded files code inspired by technique used in
-                     * libsoup's simple-httpd test
-                     */
-                    GOwnPtr<GError> error;
-                    CString fileName = fileSystemRepresentation(element.m_filename);
-                    GMappedFile* fileMapping = g_mapped_file_new(fileName.data(), false, &error.outPtr());
-
-                    if (error) {
-                        g_signal_handlers_disconnect_matched(soupMessage, G_SIGNAL_MATCH_DATA,
-                                                             0, 0, 0, 0, handle);
-                        d->m_soupMessage.clear();
-
-                        return false;
-                    }
-
-                    SoupBuffer* soupBuffer = soup_buffer_new_with_owner(g_mapped_file_get_contents(fileMapping),
-                                                                        g_mapped_file_get_length(fileMapping),
-                                                                        fileMapping,
-                                                                        reinterpret_cast<GDestroyNotify>(g_mapped_file_unref));
-                    soup_message_body_append_buffer(soupMessage->request_body, soupBuffer);
-                    soup_buffer_free(soupBuffer);
-                }
-            }
-        }
+    CString contentType = d->m_firstRequest.httpContentType().utf8().data();
+    if (httpBody && !httpBody->isEmpty()
+        && !addFormElementsToSoupMessage(soupMessage, contentType.data(), httpBody, d->m_bodySize)) {
+        // We failed to prepare the body data, so just fail this load.
+        g_signal_handlers_disconnect_matched(soupMessage, G_SIGNAL_MATCH_DATA, 0, 0, 0, 0, handle);
+        d->m_soupMessage.clear();
+        return false;
     }
 
     // balanced by a deref() in cleanupSoupRequestOperation, which should always run
@@ -681,7 +612,7 @@ static bool startHttp(ResourceHandle* handle)
     // Send the request only if it's not been explicitely deferred.
     if (!d->m_defersLoading) {
         d->m_cancellable = adoptGRef(g_cancellable_new());
-        webkit_soup_request_send_async(d->m_soupRequest.get(), d->m_cancellable.get(), sendRequestCallback, 0);
+        soup_request_send_async(d->m_soupRequest.get(), d->m_cancellable.get(), sendRequestCallback, 0);
     }
 
     return true;
@@ -715,19 +646,13 @@ bool ResourceHandle::start(NetworkingContext* context)
     // Used to set the authentication dialog toplevel; may be NULL
     d->m_context = context;
 
-    if (equalIgnoringCase(protocol, "data"))
-        return startData(this, urlString);
-
     if (equalIgnoringCase(protocol, "http") || equalIgnoringCase(protocol, "https")) {
-        if (startHttp(this))
+        if (startHTTPRequest(this))
             return true;
     }
 
-    if (equalIgnoringCase(protocol, "file") || equalIgnoringCase(protocol, "ftp") || equalIgnoringCase(protocol, "ftps")) {
-        // FIXME: should we be doing any other protocols here?
-        if (startGio(this, url))
-            return true;
-    }
+    if (startNonHTTPRequest(this, url))
+        return true;
 
     // Error must not be reported immediately
     this->scheduleFailure(InvalidURLFailure);
@@ -764,7 +689,7 @@ void ResourceHandle::platformSetDefersLoading(bool defersLoading)
 
     if (!defersLoading && !d->m_cancellable && d->m_soupRequest.get()) {
         d->m_cancellable = adoptGRef(g_cancellable_new());
-        webkit_soup_request_send_async(d->m_soupRequest.get(), d->m_cancellable.get(), sendRequestCallback, 0);
+        soup_request_send_async(d->m_soupRequest.get(), d->m_cancellable.get(), sendRequestCallback, 0);
         return;
     }
 
@@ -795,11 +720,13 @@ bool ResourceHandle::willLoadFromCache(ResourceRequest&, Frame*)
 void ResourceHandle::loadResourceSynchronously(NetworkingContext* context, const ResourceRequest& request, StoredCredentials /*storedCredentials*/, ResourceError& error, ResourceResponse& response, Vector<char>& data)
 {
     WebCoreSynchronousLoader syncLoader(error, response, data);
-    // FIXME: we should use the ResourceHandle::create method here,
-    // but it makes us timeout in a couple of tests. See
-    // https://bugs.webkit.org/show_bug.cgi?id=41823
-    RefPtr<ResourceHandle> handle = adoptRef(new ResourceHandle(request, &syncLoader, false /*defersLoading*/, false /*shouldContentSniff*/));
-    handle->start(context);
+    RefPtr<ResourceHandle> handle = create(context, request, &syncLoader, false /*defersLoading*/, false /*shouldContentSniff*/);
+    if (!handle)
+        return;
+
+    // If the request has already failed, do not run the main loop, or else we'll block indefinitely.
+    if (handle->d->m_scheduledFailureType != NoFailure)
+        return;
 
     syncLoader.run();
 }
@@ -811,18 +738,8 @@ static void closeCallback(GObject* source, GAsyncResult* res, gpointer)
         return;
 
     ResourceHandleInternal* d = handle->getInternal();
-    ResourceHandleClient* client = handle->client();
-
     g_input_stream_close_finish(d->m_inputStream.get(), res, 0);
     cleanupSoupRequestOperation(handle.get());
-
-    // The load may have been cancelled, the client may have been
-    // destroyed already. In such cases calling didFinishLoading is a
-    // bad idea.
-    if (d->m_cancelled || !client)
-        return;
-
-    client->didFinishLoading(handle.get(), 0);
 }
 
 static void readCallback(GObject* source, GAsyncResult* asyncResult, gpointer data)
@@ -844,7 +761,7 @@ static void readCallback(GObject* source, GAsyncResult* asyncResult, gpointer da
 
     gssize bytesRead = g_input_stream_read_finish(d->m_inputStream.get(), asyncResult, &error.outPtr());
     if (error) {
-        SoupURI* uri = webkit_soup_request_get_uri(d->m_soupRequest.get());
+        SoupURI* uri = soup_request_get_uri(d->m_soupRequest.get());
         GOwnPtr<char> uriStr(soup_uri_to_string(uri, false));
         ResourceError resourceError(g_quark_to_string(G_IO_ERROR), error->code, uriStr.get(),
                                     error ? String::fromUTF8(error->message) : String());
@@ -854,6 +771,10 @@ static void readCallback(GObject* source, GAsyncResult* asyncResult, gpointer da
     }
 
     if (!bytesRead) {
+        // Finish the load. We do not wait for the stream to
+        // close. Instead we better notify WebCore as soon as possible
+        client->didFinishLoading(handle.get(), 0);
+
         g_input_stream_close_async(d->m_inputStream.get(), G_PRIORITY_DEFAULT,
                                    0, closeCallback, 0);
         return;
@@ -881,7 +802,7 @@ static void readCallback(GObject* source, GAsyncResult* asyncResult, gpointer da
                               d->m_cancellable.get(), readCallback, data);
 }
 
-static bool startGio(ResourceHandle* handle, KURL url)
+static bool startNonHTTPRequest(ResourceHandle* handle, KURL url)
 {
     ASSERT(handle);
 
@@ -889,18 +810,14 @@ static bool startGio(ResourceHandle* handle, KURL url)
         return false;
 
     SoupSession* session = handle->defaultSession();
+    ensureSessionIsInitialized(session);
+    SoupRequester* requester = SOUP_REQUESTER(soup_session_get_feature(session, SOUP_TYPE_REQUESTER));
     ResourceHandleInternal* d = handle->getInternal();
 
-    // GIO doesn't know how to handle refs and queries, so remove them
-    // TODO: use KURL.fileSystemPath after KURLGtk and FileSystemGtk are
-    // using GIO internally, and providing URIs instead of file paths
-    url.removeFragmentIdentifier();
-    url.setQuery(String());
-    url.removePort();
     CString urlStr = url.string().utf8();
 
     GOwnPtr<GError> error;
-    d->m_soupRequest = adoptGRef(webkit_soup_requester_request(d->m_requester.get(), urlStr.data(), session, &error.outPtr()));
+    d->m_soupRequest = adoptGRef(soup_requester_request(requester, urlStr.data(), &error.outPtr()));
     if (error) {
         d->m_soupRequest = 0;
         return false;
@@ -912,7 +829,7 @@ static bool startGio(ResourceHandle* handle, KURL url)
     handle->ref();
 
     d->m_cancellable = adoptGRef(g_cancellable_new());
-    webkit_soup_request_send_async(d->m_soupRequest.get(), d->m_cancellable.get(), sendRequestCallback, 0);
+    soup_request_send_async(d->m_soupRequest.get(), d->m_cancellable.get(), sendRequestCallback, 0);
 
     return true;
 }
diff --git a/Source/WebCore/platform/network/soup/ResourceRequestSoup.cpp b/Source/WebCore/platform/network/soup/ResourceRequestSoup.cpp
index d46e47b..5016bf1 100644
--- a/Source/WebCore/platform/network/soup/ResourceRequestSoup.cpp
+++ b/Source/WebCore/platform/network/soup/ResourceRequestSoup.cpp
@@ -46,13 +46,11 @@ void ResourceRequest::updateSoupMessage(SoupMessage* soupMessage) const
             soup_message_headers_append(soupHeaders, it->first.string().utf8().data(), it->second.utf8().data());
     }
 
-#ifdef HAVE_LIBSOUP_2_29_90
     String firstPartyString = firstPartyForCookies().string();
     if (!firstPartyString.isEmpty()) {
         GOwnPtr<SoupURI> firstParty(soup_uri_new(firstPartyString.utf8().data()));
         soup_message_set_first_party(soupMessage, firstParty.get());
     }
-#endif
 
     soup_message_set_flags(soupMessage, m_soupFlags);
 }
@@ -71,13 +69,11 @@ SoupMessage* ResourceRequest::toSoupMessage() const
             soup_message_headers_append(soupHeaders, it->first.string().utf8().data(), it->second.utf8().data());
     }
 
-#ifdef HAVE_LIBSOUP_2_29_90
     String firstPartyString = firstPartyForCookies().string();
     if (!firstPartyString.isEmpty()) {
         GOwnPtr<SoupURI> firstParty(soup_uri_new(firstPartyString.utf8().data()));
         soup_message_set_first_party(soupMessage, firstParty.get());
     }
-#endif
 
     soup_message_set_flags(soupMessage, m_soupFlags);
 
@@ -104,11 +100,9 @@ void ResourceRequest::updateFromSoupMessage(SoupMessage* soupMessage)
     if (soupMessage->request_body->data)
         m_httpBody = FormData::create(soupMessage->request_body->data, soupMessage->request_body->length);
 
-#ifdef HAVE_LIBSOUP_2_29_90
     SoupURI* firstParty = soup_message_get_first_party(soupMessage);
     if (firstParty)
         m_firstPartyForCookies = soupURIToKURL(firstParty);
-#endif
 
     m_soupFlags = soup_message_get_flags(soupMessage);
 
diff --git a/Source/WebCore/platform/network/soup/SocketStreamHandle.h b/Source/WebCore/platform/network/soup/SocketStreamHandle.h
index 3168fae..c8fe3b3 100644
--- a/Source/WebCore/platform/network/soup/SocketStreamHandle.h
+++ b/Source/WebCore/platform/network/soup/SocketStreamHandle.h
@@ -60,7 +60,7 @@ namespace WebCore {
     private:
         GRefPtr<GSocketConnection> m_socketConnection;
         GRefPtr<GInputStream> m_inputStream;
-        GRefPtr<GOutputStream> m_outputStream;
+        GRefPtr<GPollableOutputStream> m_outputStream;
         GRefPtr<GSource> m_writeReadySource;
         char* m_readBuffer;
         void* m_id;
diff --git a/Source/WebCore/platform/network/soup/SocketStreamHandleSoup.cpp b/Source/WebCore/platform/network/soup/SocketStreamHandleSoup.cpp
index 841e209..34382dd 100644
--- a/Source/WebCore/platform/network/soup/SocketStreamHandleSoup.cpp
+++ b/Source/WebCore/platform/network/soup/SocketStreamHandleSoup.cpp
@@ -50,7 +50,7 @@ namespace WebCore {
 // These functions immediately call the similarly named SocketStreamHandle methods.
 static void connectedCallback(GSocketClient*, GAsyncResult*, void*);
 static void readReadyCallback(GInputStream*, GAsyncResult*, void*);
-static gboolean writeReadyCallback(GSocket*, GIOCondition, void*);
+static gboolean writeReadyCallback(GPollableOutputStream*, void*);
 
 // Having a list of active handles means that we do not have to worry about WebCore
 // reference counting in GLib callbacks. Once the handle is off the active handles list
@@ -82,13 +82,12 @@ SocketStreamHandle::SocketStreamHandle(const KURL& url, SocketStreamHandleClient
     : SocketStreamHandleBase(url, client)
     , m_readBuffer(0)
 {
-    // No support for SSL sockets yet.
-    if (url.protocolIs("wss"))
-        return;
-    unsigned int port = url.hasPort() ? url.port() : 80;
+    unsigned int port = url.hasPort() ? url.port() : (url.protocolIs("wss") ? 443 : 80);
 
     m_id = activateHandle(this);
     GRefPtr<GSocketClient> socketClient = adoptGRef(g_socket_client_new());
+    if (url.protocolIs("wss"))
+        g_socket_client_set_tls(socketClient.get(), TRUE);
     g_socket_client_connect_to_host_async(socketClient.get(), url.host().utf8().data(), port, 0,
         reinterpret_cast<GAsyncReadyCallback>(connectedCallback), m_id);
 }
@@ -108,7 +107,7 @@ void SocketStreamHandle::connected(GSocketConnection* socketConnection, GError*
     }
 
     m_socketConnection = adoptGRef(socketConnection);
-    m_outputStream = g_io_stream_get_output_stream(G_IO_STREAM(m_socketConnection.get()));
+    m_outputStream = G_POLLABLE_OUTPUT_STREAM(g_io_stream_get_output_stream(G_IO_STREAM(m_socketConnection.get())));
     m_inputStream = g_io_stream_get_input_stream(G_IO_STREAM(m_socketConnection.get()));
 
     m_readBuffer = new char[READ_BUFFER_SIZE];
@@ -156,14 +155,14 @@ void SocketStreamHandle::writeReady()
 
 int SocketStreamHandle::platformSend(const char* data, int length)
 {
-    if (!g_socket_condition_check(g_socket_connection_get_socket(m_socketConnection.get()), G_IO_OUT)) {
+    if (!g_pollable_output_stream_is_writable(m_outputStream.get())) {
         beginWaitingForSocketWritability();
         return 0;
     }
 
     GOwnPtr<GError> error;
-    gssize written = g_output_stream_write(m_outputStream.get(), data, length, 0, &error.outPtr());
-    if (error) {
+    gssize written = g_pollable_output_stream_write_nonblocking(m_outputStream.get(), data, length, 0, &error.outPtr());
+    if (error && !g_error_matches(error.get(), G_IO_ERROR, G_IO_ERROR_WOULD_BLOCK)) {
         m_client->didFail(this, SocketStreamError(error->code)); // FIXME: Provide a sensible error.
         return 0;
     }
@@ -222,8 +221,7 @@ void SocketStreamHandle::beginWaitingForSocketWritability()
     if (m_writeReadySource) // Already waiting.
         return;
 
-    m_writeReadySource = adoptGRef(g_socket_create_source(
-        g_socket_connection_get_socket(m_socketConnection.get()), static_cast<GIOCondition>(G_IO_OUT), 0));
+    m_writeReadySource = adoptGRef(g_pollable_output_stream_create_source(m_outputStream.get(), 0));
     g_source_set_callback(m_writeReadySource.get(), reinterpret_cast<GSourceFunc>(writeReadyCallback), m_id, 0);
     g_source_attach(m_writeReadySource.get(), 0);
 }
@@ -266,24 +264,13 @@ static void readReadyCallback(GInputStream* stream, GAsyncResult* result, void*
     handle->readBytes(bytesRead, error.get());
 }
 
-static gboolean writeReadyCallback(GSocket*, GIOCondition condition, void* id)
+static gboolean writeReadyCallback(GPollableOutputStream*, void* id)
 {
     SocketStreamHandle* handle = getHandleFromId(id);
     if (!handle)
         return FALSE;
 
-    // G_IO_HUP and G_IO_ERR are are always active. See:
-    // http://library.gnome.org/devel/gio/stable/GSocket.html#g-socket-create-source
-    if (condition & G_IO_HUP) {
-        handle->close();
-        return FALSE;
-    }
-    if (condition & G_IO_ERR) {
-        handle->client()->didFail(handle, SocketStreamError(0)); // FIXME: Provide a sensible error.
-        return FALSE;
-    }
-    if (condition & G_IO_OUT)
-        handle->writeReady();
+    handle->writeReady();
     return TRUE;
 }
 
diff --git a/Source/WebCore/platform/network/soup/cache/soup-directory-input-stream.c b/Source/WebCore/platform/network/soup/cache/soup-directory-input-stream.c
deleted file mode 100644
index c14863b..0000000
--- a/Source/WebCore/platform/network/soup/cache/soup-directory-input-stream.c
+++ /dev/null
@@ -1,200 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
-/*
- * Copyright (C) 2008 Red Hat, Inc.
- * Copyright (C) 2010 Igalia, S.L.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifdef HAVE_CONFIG_H
-#include <config.h>
-#endif
-
-#include "soup-directory-input-stream.h"
-
-#include <libsoup/soup.h>
-#include <stdio.h>
-#include <string.h>
-
-#define INIT_STRING "<html><head><title>OMG!</title></head><body><table>"
-#define EXIT_STRING "</table></html>"
-
-G_DEFINE_TYPE (WebKitSoupDirectoryInputStream, webkit_soup_directory_input_stream, G_TYPE_INPUT_STREAM)
-
-static SoupBuffer *
-webkit_soup_directory_input_stream_parse_info (WebKitSoupDirectoryInputStream * stream,
-					       GFileInfo * info)
-{
-	SoupBuffer *buffer;
-	GString *string;
-	const char *s;
-	char *escaped, *path, *xml_string;
-
-	if (!g_file_info_get_name (info))
-		return NULL;
-
-	s = g_file_info_get_display_name (info);
-	if (!s) {
-		s = g_file_info_get_name (info);
-		/* FIXME: convert somehow? */
-		if (!g_utf8_validate (s, -1, NULL))
-			return NULL;
-	}
-	string = g_string_new ("<tr>");
-
-	xml_string = g_markup_escape_text (s, -1);
-	escaped = g_uri_escape_string (g_file_info_get_name (info), NULL, FALSE);
-	path = g_strconcat (stream->uri, "/", escaped, NULL);
-	g_free (escaped);
-	g_string_append_printf (string, "<td><a href=\"%s\">%s</a></td>", path, xml_string);
-	g_free (path);
-	g_free (xml_string);
-	g_string_append (string, "</tr>");
-
-	buffer = soup_buffer_new (SOUP_MEMORY_TAKE, string->str, string->len);
-	g_string_free (string, FALSE);
-
-	return buffer;
-}
-
-static SoupBuffer *
-webkit_soup_directory_input_stream_read_next_file (WebKitSoupDirectoryInputStream  *stream,
-						   GCancellable              *cancellable,
-						   GError                   **error)
-{
-	GFileInfo *info;
-	SoupBuffer *buffer;
-	GError *err = NULL;
-
-	do {
-		info = g_file_enumerator_next_file (stream->enumerator, cancellable, &err);
-		if (info == NULL) {
-			if (err) {
-				g_propagate_error (error, err);
-				return NULL;
-			} else if (!stream->done) {
-				stream->done = TRUE;
-				return soup_buffer_new (SOUP_MEMORY_STATIC,
-							EXIT_STRING,
-							sizeof (EXIT_STRING));
-			} else {
-				return NULL;
-			}
-		}
-
-		buffer = webkit_soup_directory_input_stream_parse_info (stream, info);
-	} while (buffer == NULL);
-
-	return buffer;
-}
-
-static gssize
-webkit_soup_directory_input_stream_read (GInputStream  *input,
-					 void          *buffer,
-					 gsize count,
-					 GCancellable  *cancellable,
-					 GError       **error)
-{
-	WebKitSoupDirectoryInputStream *stream = WEBKIT_SOUP_DIRECTORY_INPUT_STREAM (input);
-	gsize total, size;
-
-	for (total = 0; total < count; total += size) {
-		if (stream->buffer == NULL) {
-			stream->buffer = webkit_soup_directory_input_stream_read_next_file (stream, cancellable, error);
-			if (stream->buffer == NULL) {
-				/* FIXME: Is this correct or should we forward the error? */
-				if (total)
-					g_clear_error (error);
-				return total;
-			}
-		}
-
-		size = MIN (stream->buffer->length, count - total);
-		memcpy ((char *)buffer + total, stream->buffer->data, size);
-		if (size == stream->buffer->length) {
-			soup_buffer_free (stream->buffer);
-			stream->buffer = NULL;
-		} else {
-			SoupBuffer *sub = soup_buffer_new_subbuffer (stream->buffer,
-								     size,
-								     stream->buffer->length - size);
-			soup_buffer_free (stream->buffer);
-			stream->buffer = sub;
-		}
-	}
-
-	return total;
-}
-
-static gboolean
-webkit_soup_directory_input_stream_close (GInputStream  *input,
-					  GCancellable  *cancellable,
-					  GError       **error)
-{
-	WebKitSoupDirectoryInputStream *stream = WEBKIT_SOUP_DIRECTORY_INPUT_STREAM (input);
-	gboolean result;
-
-	if (stream->buffer) {
-		soup_buffer_free (stream->buffer);
-		stream->buffer = NULL;
-	}
-
-	result = g_file_enumerator_close (stream->enumerator,
-					  cancellable,
-					  error);
-	g_object_unref (stream->enumerator);
-	stream->enumerator = NULL;
-
-	g_free (stream->uri);
-	stream->uri = NULL;
-
-	return result;
-}
-
-static void
-webkit_soup_directory_input_stream_class_init (WebKitSoupDirectoryInputStreamClass *stream_class)
-{
-	GInputStreamClass *inputstream_class = G_INPUT_STREAM_CLASS (stream_class);
-
-	inputstream_class->read_fn = webkit_soup_directory_input_stream_read;
-	inputstream_class->close_fn = webkit_soup_directory_input_stream_close;
-}
-
-static void
-webkit_soup_directory_input_stream_init (WebKitSoupDirectoryInputStream *stream)
-{
-	stream->buffer = soup_buffer_new (SOUP_MEMORY_STATIC,
-					  INIT_STRING,
-					  sizeof (INIT_STRING));
-}
-
-GInputStream *
-webkit_soup_directory_input_stream_new (GFileEnumerator *enumerator,
-					SoupURI         *uri)
-{
-	GInputStream *stream;
-
-	g_return_val_if_fail (G_IS_FILE_ENUMERATOR (enumerator), NULL);
-	g_return_val_if_fail (uri != NULL, NULL);
-
-	stream = g_object_new (WEBKIT_TYPE_SOUP_DIRECTORY_INPUT_STREAM, NULL);
-
-	WEBKIT_SOUP_DIRECTORY_INPUT_STREAM (stream)->enumerator = g_object_ref (enumerator);
-	WEBKIT_SOUP_DIRECTORY_INPUT_STREAM (stream)->uri = soup_uri_to_string (uri, FALSE);
-
-	return stream;
-}
-
diff --git a/Source/WebCore/platform/network/soup/cache/soup-directory-input-stream.h b/Source/WebCore/platform/network/soup/cache/soup-directory-input-stream.h
deleted file mode 100644
index 0c5b0be..0000000
--- a/Source/WebCore/platform/network/soup/cache/soup-directory-input-stream.h
+++ /dev/null
@@ -1,62 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
-/*
- * Copyright (C) 2010 Red Hat, Inc.
- * Copyright (C) 2010 Igalia, S.L.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifndef WEBKIT_SOUP_DIRECTORY_INPUT_STREAM_H
-#define WEBKIT_SOUP_DIRECTORY_INPUT_STREAM_H 1
-
-#include <gio/gio.h>
-#include <libsoup/soup-types.h>
-#include <libsoup/soup-message-body.h>
-
-G_BEGIN_DECLS
-
-#define WEBKIT_TYPE_SOUP_DIRECTORY_INPUT_STREAM            (webkit_soup_directory_input_stream_get_type ())
-#define WEBKIT_SOUP_DIRECTORY_INPUT_STREAM(obj)            (G_TYPE_CHECK_INSTANCE_CAST ((obj), WEBKIT_TYPE_SOUP_DIRECTORY_INPUT_STREAM, WebKitSoupDirectoryInputStream))
-#define WEBKIT_SOUP_DIRECTORY_INPUT_STREAM_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), WEBKIT_TYPE_SOUP_DIRECTORY_INPUT_STREAM, WebKitSoupDirectoryInputStreamClass))
-#define WEBKIT_IS_SOUP_DIRECTORY_INPUT_STREAM(obj)         (G_TYPE_CHECK_INSTANCE_TYPE ((obj), WEBKIT_TYPE_SOUP_DIRECTORY_INPUT_STREAM))
-#define WEBKIT_IS_SOUP_DIRECTORY_INPUT_STREAM_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((obj), WEBKIT_TYPE_SOUP_DIRECTORY_INPUT_STREAM))
-#define WEBKIT_SOUP_DIRECTORY_INPUT_STREAM_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj), WEBKIT_TYPE_SOUP_DIRECTORY_INPUT_STREAM, WebKitSoupDirectoryInputStreamClass))
-
-typedef struct _WebKitSoupDirectoryInputStream WebKitSoupDirectoryInputStream;
-typedef struct _WebKitSoupDirectoryInputStreamClass WebKitSoupDirectoryInputStreamClass;
-
-struct _WebKitSoupDirectoryInputStream {
-	GInputStream parent;
-
-	GFileEnumerator *enumerator;
-	char *uri;
-	SoupBuffer *buffer;
-	gboolean done;
-};
-
-struct _WebKitSoupDirectoryInputStreamClass {
-	GInputStreamClass parent_class;
-};
-
-GType          webkit_soup_directory_input_stream_get_type (void);
-
-GInputStream *webkit_soup_directory_input_stream_new (GFileEnumerator *enumerator,
-						      SoupURI         *uri);
-
-
-G_END_DECLS
-
-#endif /* WEBKIT_SOUP_DIRECTORY_INPUT_STREAM_H */
diff --git a/Source/WebCore/platform/network/soup/cache/soup-http-input-stream.c b/Source/WebCore/platform/network/soup/cache/soup-http-input-stream.c
deleted file mode 100644
index 2a5d995..0000000
--- a/Source/WebCore/platform/network/soup/cache/soup-http-input-stream.c
+++ /dev/null
@@ -1,922 +0,0 @@
-/* soup-input-stream.c, based on gsocketinputstream.c
- *
- * Copyright (C) 2006-2007 Red Hat, Inc.
- * Copyright (C) 2010 Igalia, S.L.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General
- * Public License along with this library; if not, write to the
- * Free Software Foundation, Inc., 59 Temple Place, Suite 330,
- * Boston, MA 02111-1307, USA.
- */
-
-#include <config.h>
-
-#include <string.h>
-
-#include <glib.h>
-#include <gio/gio.h>
-
-#include <libsoup/soup.h>
-
-#include "soup-http-input-stream.h"
-
-static void webkit_soup_http_input_stream_seekable_iface_init (GSeekableIface *seekable_iface);
-
-G_DEFINE_TYPE_WITH_CODE (WebKitSoupHTTPInputStream, webkit_soup_http_input_stream, G_TYPE_INPUT_STREAM,
-			 G_IMPLEMENT_INTERFACE (G_TYPE_SEEKABLE,
-						webkit_soup_http_input_stream_seekable_iface_init))
-
-typedef void (*WebKitSoupHTTPInputStreamCallback)(GInputStream *);
-
-typedef struct {
-	SoupSession *session;
-	GMainContext *async_context;
-	SoupMessage *msg;
-	gboolean got_headers, finished;
-	goffset offset;
-
-	GCancellable *cancellable;
-	GSource *cancel_watch;
-	WebKitSoupHTTPInputStreamCallback got_headers_cb;
-	WebKitSoupHTTPInputStreamCallback got_chunk_cb;
-	WebKitSoupHTTPInputStreamCallback finished_cb;
-	WebKitSoupHTTPInputStreamCallback cancelled_cb;
-
-	guchar *leftover_buffer;
-	gsize leftover_bufsize, leftover_offset;
-
-	guchar *caller_buffer;
-	gsize caller_bufsize, caller_nread;
-	GAsyncReadyCallback outstanding_callback;
-	GSimpleAsyncResult *result;
-} WebKitSoupHTTPInputStreamPrivate;
-#define WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE(o) (G_TYPE_INSTANCE_GET_PRIVATE ((o), WEBKIT_TYPE_SOUP_HTTP_INPUT_STREAM, WebKitSoupHTTPInputStreamPrivate))
-
-
-static gssize   webkit_soup_http_input_stream_read (GInputStream         *stream,
-						    void                 *buffer,
-						    gsize count,
-						    GCancellable         *cancellable,
-						    GError              **error);
-static gboolean webkit_soup_http_input_stream_close (GInputStream         *stream,
-						     GCancellable         *cancellable,
-						     GError              **error);
-static void     webkit_soup_http_input_stream_read_async (GInputStream         *stream,
-							  void                 *buffer,
-							  gsize count,
-							  int io_priority,
-							  GCancellable         *cancellable,
-							  GAsyncReadyCallback callback,
-							  gpointer data);
-static gssize   webkit_soup_http_input_stream_read_finish (GInputStream         *stream,
-							   GAsyncResult         *result,
-							   GError              **error);
-static void     webkit_soup_http_input_stream_close_async (GInputStream         *stream,
-							   int io_priority,
-							   GCancellable         *cancellable,
-							   GAsyncReadyCallback callback,
-							   gpointer data);
-static gboolean webkit_soup_http_input_stream_close_finish (GInputStream         *stream,
-							    GAsyncResult         *result,
-							    GError              **error);
-
-static goffset  webkit_soup_http_input_stream_tell (GSeekable            *seekable);
-
-static gboolean webkit_soup_http_input_stream_can_seek (GSeekable            *seekable);
-static gboolean webkit_soup_http_input_stream_seek (GSeekable            *seekable,
-						    goffset offset,
-						    GSeekType type,
-						    GCancellable         *cancellable,
-						    GError              **error);
-
-static gboolean webkit_soup_http_input_stream_can_truncate (GSeekable            *seekable);
-static gboolean webkit_soup_http_input_stream_truncate (GSeekable            *seekable,
-							goffset offset,
-							GCancellable         *cancellable,
-							GError              **error);
-
-static void webkit_soup_http_input_stream_got_headers (SoupMessage *msg, gpointer stream);
-static void webkit_soup_http_input_stream_got_chunk (SoupMessage *msg, SoupBuffer *chunk, gpointer stream);
-static void webkit_soup_http_input_stream_finished (SoupMessage *msg, gpointer stream);
-
-static void
-webkit_soup_http_input_stream_finalize (GObject *object)
-{
-	WebKitSoupHTTPInputStream *stream = WEBKIT_SOUP_HTTP_INPUT_STREAM (object);
-	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
-
-	g_object_unref (priv->session);
-
-	g_signal_handlers_disconnect_by_func (priv->msg, G_CALLBACK (webkit_soup_http_input_stream_got_headers), stream);
-	g_signal_handlers_disconnect_by_func (priv->msg, G_CALLBACK (webkit_soup_http_input_stream_got_chunk), stream);
-	g_signal_handlers_disconnect_by_func (priv->msg, G_CALLBACK (webkit_soup_http_input_stream_finished), stream);
-	g_object_unref (priv->msg);
-	g_free (priv->leftover_buffer);
-
-	if (G_OBJECT_CLASS (webkit_soup_http_input_stream_parent_class)->finalize)
-		(*G_OBJECT_CLASS (webkit_soup_http_input_stream_parent_class)->finalize)(object);
-}
-
-static void
-webkit_soup_http_input_stream_class_init (WebKitSoupHTTPInputStreamClass *klass)
-{
-	GObjectClass *gobject_class = G_OBJECT_CLASS (klass);
-	GInputStreamClass *stream_class = G_INPUT_STREAM_CLASS (klass);
-
-	g_type_class_add_private (klass, sizeof (WebKitSoupHTTPInputStreamPrivate));
-
-	gobject_class->finalize = webkit_soup_http_input_stream_finalize;
-
-	stream_class->read_fn = webkit_soup_http_input_stream_read;
-	stream_class->close_fn = webkit_soup_http_input_stream_close;
-	stream_class->read_async = webkit_soup_http_input_stream_read_async;
-	stream_class->read_finish = webkit_soup_http_input_stream_read_finish;
-	stream_class->close_async = webkit_soup_http_input_stream_close_async;
-	stream_class->close_finish = webkit_soup_http_input_stream_close_finish;
-}
-
-static void
-webkit_soup_http_input_stream_seekable_iface_init (GSeekableIface *seekable_iface)
-{
-	seekable_iface->tell = webkit_soup_http_input_stream_tell;
-	seekable_iface->can_seek = webkit_soup_http_input_stream_can_seek;
-	seekable_iface->seek = webkit_soup_http_input_stream_seek;
-	seekable_iface->can_truncate = webkit_soup_http_input_stream_can_truncate;
-	seekable_iface->truncate_fn = webkit_soup_http_input_stream_truncate;
-}
-
-static void
-webkit_soup_http_input_stream_init (WebKitSoupHTTPInputStream *stream)
-{
-	;
-}
-
-static void
-webkit_soup_http_input_stream_queue_message (WebKitSoupHTTPInputStream *stream)
-{
-	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
-
-	priv->got_headers = priv->finished = FALSE;
-
-	/* Add an extra ref since soup_session_queue_message steals one */
-	g_object_ref (priv->msg);
-	soup_session_queue_message (priv->session, priv->msg, NULL, NULL);
-}
-
-/**
- * webkit_soup_http_input_stream_new:
- * @session: the #SoupSession to use
- * @msg: the #SoupMessage whose response will be streamed
- *
- * Prepares to send @msg over @session, and returns a #GInputStream
- * that can be used to read the response.
- *
- * @msg may not be sent until the first read call; if you need to look
- * at the status code or response headers before reading the body, you
- * can use webkit_soup_http_input_stream_send() or webkit_soup_http_input_stream_send_async()
- * to force the message to be sent and the response headers read.
- *
- * If @msg gets a non-2xx result, the first read (or send) will return
- * an error with type %WEBKIT_SOUP_HTTP_INPUT_STREAM_HTTP_ERROR.
- *
- * Internally, #WebKitSoupHTTPInputStream is implemented using asynchronous I/O,
- * so if you are using the synchronous API (eg,
- * g_input_stream_read()), you should create a new #GMainContext and
- * set it as the %SOUP_SESSION_ASYNC_CONTEXT property on @session. (If
- * you don't, then synchronous #GInputStream calls will cause the main
- * loop to be run recursively.) The async #GInputStream API works fine
- * with %SOUP_SESSION_ASYNC_CONTEXT either set or unset.
- *
- * Returns: a new #GInputStream.
- **/
-WebKitSoupHTTPInputStream *
-webkit_soup_http_input_stream_new (SoupSession *session, SoupMessage *msg)
-{
-	WebKitSoupHTTPInputStream *stream;
-	WebKitSoupHTTPInputStreamPrivate *priv;
-
-	g_return_val_if_fail (SOUP_IS_MESSAGE (msg), NULL);
-
-	stream = g_object_new (WEBKIT_TYPE_SOUP_HTTP_INPUT_STREAM, NULL);
-	priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
-
-	priv->session = g_object_ref (session);
-	priv->async_context = soup_session_get_async_context (session);
-	priv->msg = g_object_ref (msg);
-
-	g_signal_connect (msg, "got_headers",
-			  G_CALLBACK (webkit_soup_http_input_stream_got_headers), stream);
-	g_signal_connect (msg, "got_chunk",
-			  G_CALLBACK (webkit_soup_http_input_stream_got_chunk), stream);
-	g_signal_connect (msg, "finished",
-			  G_CALLBACK (webkit_soup_http_input_stream_finished), stream);
-
-	webkit_soup_http_input_stream_queue_message (stream);
-	return stream;
-}
-
-static void
-webkit_soup_http_input_stream_got_headers (SoupMessage *msg, gpointer stream)
-{
-	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
-
-	/* If the status is unsuccessful, we just ignore the signal and let
-	 * libsoup keep going (eventually either it will requeue the request
-	 * (after handling authentication/redirection), or else the
-	 * "finished" handler will run).
-	 */
-	if (!SOUP_STATUS_IS_SUCCESSFUL (msg->status_code))
-		return;
-
-	priv->got_headers = TRUE;
-	if (!priv->caller_buffer) {
-		/* Not ready to read the body yet */
-		soup_session_pause_message (priv->session, msg);
-	}
-
-	if (priv->got_headers_cb)
-		priv->got_headers_cb (stream);
-}
-
-static void
-webkit_soup_http_input_stream_got_chunk (SoupMessage *msg, SoupBuffer *chunk_buffer,
-					 gpointer stream)
-{
-	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
-	const gchar *chunk = chunk_buffer->data;
-	gsize chunk_size = chunk_buffer->length;
-
-	/* We only pay attention to the chunk if it's part of a successful
-	 * response.
-	 */
-	if (!SOUP_STATUS_IS_SUCCESSFUL (msg->status_code))
-		return;
-
-	/* Sanity check */
-	if (priv->caller_bufsize == 0 || priv->leftover_bufsize != 0)
-		g_warning ("webkit_soup_http_input_stream_got_chunk called again before previous chunk was processed");
-
-	/* Copy what we can into priv->caller_buffer */
-	if (priv->caller_bufsize > priv->caller_nread) {
-		gsize nread = MIN (chunk_size, priv->caller_bufsize - priv->caller_nread);
-
-		memcpy (priv->caller_buffer + priv->caller_nread, chunk, nread);
-		priv->caller_nread += nread;
-		priv->offset += nread;
-		chunk += nread;
-		chunk_size -= nread;
-	}
-
-	if (chunk_size > 0) {
-		/* Copy the rest into priv->leftover_buffer. If
-		 * there's already some data there, realloc and
-		 * append. Otherwise just copy.
-		 */
-		if (priv->leftover_bufsize) {
-			priv->leftover_buffer = g_realloc (priv->leftover_buffer,
-							   priv->leftover_bufsize + chunk_size);
-			memcpy (priv->leftover_buffer + priv->leftover_bufsize,
-				chunk, chunk_size);
-			priv->leftover_bufsize += chunk_size;
-		} else {
-			priv->leftover_bufsize = chunk_size;
-			priv->leftover_buffer = g_memdup (chunk, chunk_size);
-			priv->leftover_offset = 0;
-		}
-	}
-
-	soup_session_pause_message (priv->session, msg);
-	if (priv->got_chunk_cb)
-		priv->got_chunk_cb (stream);
-}
-
-static void
-webkit_soup_http_input_stream_finished (SoupMessage *msg, gpointer stream)
-{
-	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
-
-	priv->finished = TRUE;
-
-	if (priv->finished_cb)
-		priv->finished_cb (stream);
-}
-
-static gboolean
-webkit_soup_http_input_stream_cancelled (GIOChannel *chan, GIOCondition condition,
-					 gpointer stream)
-{
-	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
-
-	priv->cancel_watch = NULL;
-
-	soup_session_pause_message (priv->session, priv->msg);
-	if (priv->cancelled_cb)
-		priv->cancelled_cb (stream);
-
-	return FALSE;
-}
-
-static void
-webkit_soup_http_input_stream_prepare_for_io (GInputStream *stream,
-					      GCancellable *cancellable,
-					      guchar       *buffer,
-					      gsize count)
-{
-	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
-	int cancel_fd;
-
-	priv->cancellable = cancellable;
-	cancel_fd = g_cancellable_get_fd (cancellable);
-	if (cancel_fd != -1) {
-		GIOChannel *chan = g_io_channel_unix_new (cancel_fd);
-		priv->cancel_watch = soup_add_io_watch (priv->async_context, chan,
-							G_IO_IN | G_IO_ERR | G_IO_HUP,
-							webkit_soup_http_input_stream_cancelled,
-							stream);
-		g_io_channel_unref (chan);
-	}
-
-	priv->caller_buffer = buffer;
-	priv->caller_bufsize = count;
-	priv->caller_nread = 0;
-
-	if (priv->got_headers)
-		soup_session_unpause_message (priv->session, priv->msg);
-}
-
-static void
-webkit_soup_http_input_stream_done_io (GInputStream *stream)
-{
-	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
-
-	if (priv->cancel_watch) {
-		g_source_destroy (priv->cancel_watch);
-		priv->cancel_watch = NULL;
-		g_cancellable_release_fd (priv->cancellable);
-	}
-	priv->cancellable = NULL;
-
-	priv->caller_buffer = NULL;
-	priv->caller_bufsize = 0;
-}
-
-static gboolean
-set_error_if_http_failed (SoupMessage *msg, GError **error)
-{
-	if (!SOUP_STATUS_IS_SUCCESSFUL (msg->status_code)) {
-		g_set_error_literal (error, SOUP_HTTP_ERROR,
-				     msg->status_code, msg->reason_phrase);
-		return TRUE;
-	}
-	return FALSE;
-}
-
-static gsize
-read_from_leftover (WebKitSoupHTTPInputStreamPrivate *priv,
-		    gpointer buffer, gsize bufsize)
-{
-	gsize nread;
-
-	if (priv->leftover_bufsize - priv->leftover_offset <= bufsize) {
-		nread = priv->leftover_bufsize - priv->leftover_offset;
-		memcpy (buffer, priv->leftover_buffer + priv->leftover_offset, nread);
-
-		g_free (priv->leftover_buffer);
-		priv->leftover_buffer = NULL;
-		priv->leftover_bufsize = priv->leftover_offset = 0;
-	} else {
-		nread = bufsize;
-		memcpy (buffer, priv->leftover_buffer + priv->leftover_offset, nread);
-		priv->leftover_offset += nread;
-	}
-
-	priv->offset += nread;
-	return nread;
-}
-
-/* This does the work of webkit_soup_http_input_stream_send(), assuming that the
- * GInputStream pending flag has already been set. It is also used by
- * webkit_soup_http_input_stream_send_async() in some circumstances.
- */
-static gboolean
-webkit_soup_http_input_stream_send_internal (GInputStream  *stream,
-					     GCancellable  *cancellable,
-					     GError       **error)
-{
-	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
-
-	webkit_soup_http_input_stream_prepare_for_io (stream, cancellable, NULL, 0);
-	while (!priv->finished && !priv->got_headers &&
-	       !g_cancellable_is_cancelled (cancellable))
-		g_main_context_iteration (priv->async_context, TRUE);
-	webkit_soup_http_input_stream_done_io (stream);
-
-	if (g_cancellable_set_error_if_cancelled (cancellable, error))
-		return FALSE;
-	else if (set_error_if_http_failed (priv->msg, error))
-		return FALSE;
-	return TRUE;
-}
-
-static void
-send_sync_finished (GInputStream *stream)
-{
-	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
-	GError *error = NULL;
-
-	if (!g_cancellable_set_error_if_cancelled (priv->cancellable, &error))
-		set_error_if_http_failed (priv->msg, &error);
-
-	priv->got_headers_cb = NULL;
-	priv->finished_cb = NULL;
-
-	/* Wake up the main context iteration */
-	g_source_attach (g_idle_source_new (), NULL);
-}
-
-/**
- * webkit_soup_http_input_stream_send:
- * @httpstream: a #WebKitSoupHTTPInputStream
- * @cancellable: optional #GCancellable object, %NULL to ignore.
- * @error: location to store the error occuring, or %NULL to ignore
- *
- * Synchronously sends the HTTP request associated with @stream, and
- * reads the response headers. Call this after webkit_soup_http_input_stream_new()
- * and before the first g_input_stream_read() if you want to check the
- * HTTP status code before you start reading.
- *
- * Return value: %TRUE if msg has a successful (2xx) status, %FALSE if
- * not.
- **/
-gboolean
-webkit_soup_http_input_stream_send (WebKitSoupHTTPInputStream  *httpstream,
-				    GCancellable         *cancellable,
-				    GError              **error)
-{
-	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (httpstream);
-	GInputStream *istream = (GInputStream *)httpstream;
-	gboolean result;
-
-	g_return_val_if_fail (WEBKIT_IS_SOUP_HTTP_INPUT_STREAM (httpstream), FALSE);
-
-	if (!g_input_stream_set_pending (istream, error))
-		return FALSE;
-
-	priv->got_headers_cb = send_sync_finished;
-	priv->finished_cb = send_sync_finished;
-
-	result = webkit_soup_http_input_stream_send_internal (istream, cancellable, error);
-	g_input_stream_clear_pending (istream);
-
-	return result;
-}
-
-static gssize
-webkit_soup_http_input_stream_read (GInputStream *stream,
-				    void         *buffer,
-				    gsize count,
-				    GCancellable *cancellable,
-				    GError      **error)
-{
-	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
-
-	if (priv->finished)
-		return 0;
-
-	/* If there is data leftover from a previous read, return it. */
-	if (priv->leftover_bufsize)
-		return read_from_leftover (priv, buffer, count);
-
-	/* No leftover data, accept one chunk from the network */
-	webkit_soup_http_input_stream_prepare_for_io (stream, cancellable, buffer, count);
-	while (!priv->finished && priv->caller_nread == 0 &&
-	       !g_cancellable_is_cancelled (cancellable))
-		g_main_context_iteration (priv->async_context, TRUE);
-	webkit_soup_http_input_stream_done_io (stream);
-
-	if (priv->caller_nread > 0)
-		return priv->caller_nread;
-
-	if (g_cancellable_set_error_if_cancelled (cancellable, error))
-		return -1;
-	else if (set_error_if_http_failed (priv->msg, error))
-		return -1;
-	else
-		return 0;
-}
-
-static gboolean
-webkit_soup_http_input_stream_close (GInputStream *stream,
-				     GCancellable *cancellable,
-				     GError      **error)
-{
-	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
-
-	if (!priv->finished)
-		soup_session_cancel_message (priv->session, priv->msg, SOUP_STATUS_CANCELLED);
-
-	return TRUE;
-}
-
-static void
-wrapper_callback (GObject *source_object, GAsyncResult *res,
-		  gpointer user_data)
-{
-	GInputStream *stream = G_INPUT_STREAM (source_object);
-	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
-
-	g_input_stream_clear_pending (stream);
-	if (priv->outstanding_callback)
-		(*priv->outstanding_callback)(source_object, res, user_data);
-	priv->outstanding_callback = NULL;
-	g_object_unref (stream);
-}
-
-static void
-send_async_thread (GSimpleAsyncResult *res,
-		   GObject *object,
-		   GCancellable *cancellable)
-{
-	GError *error = NULL;
-	gboolean success;
-
-	success = webkit_soup_http_input_stream_send_internal (G_INPUT_STREAM (object),
-							cancellable, &error);
-	g_simple_async_result_set_op_res_gboolean (res, success);
-	if (error) {
-		g_simple_async_result_set_from_error (res, error);
-		g_error_free (error);
-	}
-}
-
-static void
-webkit_soup_http_input_stream_send_async_in_thread (GInputStream        *stream,
-						    int io_priority,
-						    GCancellable        *cancellable,
-						    GAsyncReadyCallback callback,
-						    gpointer user_data)
-{
-	GSimpleAsyncResult *res;
-
-	res = g_simple_async_result_new (G_OBJECT (stream), callback, user_data,
-					 webkit_soup_http_input_stream_send_async_in_thread);
-	g_simple_async_result_run_in_thread (res, send_async_thread,
-					     io_priority, cancellable);
-	g_object_unref (res);
-}
-
-static void
-send_async_finished (GInputStream *stream)
-{
-	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
-	GSimpleAsyncResult *result;
-	GError *error = NULL;
-
-	if (!g_cancellable_set_error_if_cancelled (priv->cancellable, &error))
-		set_error_if_http_failed (priv->msg, &error);
-
-	priv->got_headers_cb = NULL;
-	priv->finished_cb = NULL;
-	webkit_soup_http_input_stream_done_io (stream);
-
-	result = priv->result;
-	priv->result = NULL;
-
-	g_simple_async_result_set_op_res_gboolean (result, error == NULL);
-	if (error) {
-		g_simple_async_result_set_from_error (result, error);
-		g_error_free (error);
-	}
-	g_simple_async_result_complete (result);
-	g_object_unref (result);
-}
-
-static void
-webkit_soup_http_input_stream_send_async_internal (GInputStream        *stream,
-						   int io_priority,
-						   GCancellable        *cancellable,
-						   GAsyncReadyCallback callback,
-						   gpointer user_data)
-{
-	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
-
-	g_object_ref (stream);
-	priv->outstanding_callback = callback;
-
-	/* If the session uses the default GMainContext, then we can do
-	 * async I/O directly. But if it has its own main context, it's
-	 * easier to just run it in another thread.
-	 */
-	if (soup_session_get_async_context (priv->session)) {
-		webkit_soup_http_input_stream_send_async_in_thread (stream, io_priority, cancellable,
-							     wrapper_callback, user_data);
-		return;
-	}
-
-	priv->got_headers_cb = send_async_finished;
-	priv->finished_cb = send_async_finished;
-
-	webkit_soup_http_input_stream_prepare_for_io (stream, cancellable, NULL, 0);
-	priv->result = g_simple_async_result_new (G_OBJECT (stream),
-						  wrapper_callback, user_data,
-						  webkit_soup_http_input_stream_send_async);
-}
-
-/**
- * webkit_soup_http_input_stream_send_async:
- * @httpstream: a #WebKitSoupHTTPInputStream
- * @io_priority: the io priority of the request.
- * @cancellable: optional #GCancellable object, %NULL to ignore.
- * @callback: callback to call when the request is satisfied
- * @user_data: the data to pass to callback function
- *
- * Asynchronously sends the HTTP request associated with @stream, and
- * reads the response headers. Call this after webkit_soup_http_input_stream_new()
- * and before the first g_input_stream_read_async() if you want to
- * check the HTTP status code before you start reading.
- **/
-void
-webkit_soup_http_input_stream_send_async (WebKitSoupHTTPInputStream *httpstream,
-					  int io_priority,
-					  GCancellable        *cancellable,
-					  GAsyncReadyCallback callback,
-					  gpointer user_data)
-{
-	GInputStream *istream = (GInputStream *)httpstream;
-	GError *error = NULL;
-
-	g_return_if_fail (WEBKIT_IS_SOUP_HTTP_INPUT_STREAM (httpstream));
-
-	if (!g_input_stream_set_pending (istream, &error)) {
-		g_simple_async_report_gerror_in_idle (G_OBJECT (httpstream),
-						      callback,
-						      user_data,
-						      error);
-		g_error_free (error);
-		return;
-	}
-	webkit_soup_http_input_stream_send_async_internal (istream, io_priority, cancellable,
-						    callback, user_data);
-}
-
-/**
- * webkit_soup_http_input_stream_send_finish:
- * @httpstream: a #WebKitSoupHTTPInputStream
- * @result: a #GAsyncResult.
- * @error: a #GError location to store the error occuring, or %NULL to
- * ignore.
- *
- * Finishes a webkit_soup_http_input_stream_send_async() operation.
- *
- * Return value: %TRUE if the message was sent successfully and
- * received a successful status code, %FALSE if not.
- **/
-gboolean
-webkit_soup_http_input_stream_send_finish (WebKitSoupHTTPInputStream  *httpstream,
-					   GAsyncResult         *result,
-					   GError              **error)
-{
-	GSimpleAsyncResult *simple;
-
-	g_return_val_if_fail (G_IS_SIMPLE_ASYNC_RESULT (result), FALSE);
-	simple = G_SIMPLE_ASYNC_RESULT (result);
-
-	g_return_val_if_fail (g_simple_async_result_get_source_tag (simple) == webkit_soup_http_input_stream_send_async, FALSE);
-
-	if (g_simple_async_result_propagate_error (simple, error))
-		return FALSE;
-
-	return g_simple_async_result_get_op_res_gboolean (simple);
-}
-
-static void
-read_async_done (GInputStream *stream)
-{
-	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
-	GSimpleAsyncResult *result;
-	GError *error = NULL;
-
-	result = priv->result;
-	priv->result = NULL;
-
-	if (g_cancellable_set_error_if_cancelled (priv->cancellable, &error) ||
-	    set_error_if_http_failed (priv->msg, &error)) {
-		g_simple_async_result_set_from_error (result, error);
-		g_error_free (error);
-	} else
-		g_simple_async_result_set_op_res_gssize (result, priv->caller_nread);
-
-	priv->got_chunk_cb = NULL;
-	priv->finished_cb = NULL;
-	priv->cancelled_cb = NULL;
-	webkit_soup_http_input_stream_done_io (stream);
-
-	g_simple_async_result_complete (result);
-	g_object_unref (result);
-}
-
-static void
-webkit_soup_http_input_stream_read_async (GInputStream        *stream,
-					  void                *buffer,
-					  gsize count,
-					  int io_priority,
-					  GCancellable        *cancellable,
-					  GAsyncReadyCallback callback,
-					  gpointer user_data)
-{
-	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
-	GSimpleAsyncResult *result;
-
-	/* If the session uses the default GMainContext, then we can do
-	 * async I/O directly. But if it has its own main context, we fall
-	 * back to the async-via-sync-in-another-thread implementation.
-	 */
-	if (soup_session_get_async_context (priv->session)) {
-		G_INPUT_STREAM_CLASS (webkit_soup_http_input_stream_parent_class)->
-		read_async (stream, buffer, count, io_priority,
-			    cancellable, callback, user_data);
-		return;
-	}
-
-	result = g_simple_async_result_new (G_OBJECT (stream),
-					    callback, user_data,
-					    webkit_soup_http_input_stream_read_async);
-
-	if (priv->finished) {
-		g_simple_async_result_set_op_res_gssize (result, 0);
-		g_simple_async_result_complete_in_idle (result);
-		g_object_unref (result);
-		return;
-	}
-
-	if (priv->leftover_bufsize) {
-		gsize nread = read_from_leftover (priv, buffer, count);
-		g_simple_async_result_set_op_res_gssize (result, nread);
-		g_simple_async_result_complete_in_idle (result);
-		g_object_unref (result);
-		return;
-	}
-
-	priv->result = result;
-
-	priv->got_chunk_cb = read_async_done;
-	priv->finished_cb = read_async_done;
-	priv->cancelled_cb = read_async_done;
-	webkit_soup_http_input_stream_prepare_for_io (stream, cancellable, buffer, count);
-}
-
-static gssize
-webkit_soup_http_input_stream_read_finish (GInputStream  *stream,
-					   GAsyncResult  *result,
-					   GError       **error)
-{
-	GSimpleAsyncResult *simple;
-
-	g_return_val_if_fail (G_IS_SIMPLE_ASYNC_RESULT (result), -1);
-	simple = G_SIMPLE_ASYNC_RESULT (result);
-	g_return_val_if_fail (g_simple_async_result_get_source_tag (simple) == webkit_soup_http_input_stream_read_async, -1);
-
-	return g_simple_async_result_get_op_res_gssize (simple);
-}
-
-static void
-webkit_soup_http_input_stream_close_async (GInputStream       *stream,
-					   int io_priority,
-					   GCancellable       *cancellable,
-					   GAsyncReadyCallback callback,
-					   gpointer user_data)
-{
-	GSimpleAsyncResult *result;
-	gboolean success;
-	GError *error = NULL;
-
-	result = g_simple_async_result_new (G_OBJECT (stream),
-					    callback, user_data,
-					    webkit_soup_http_input_stream_close_async);
-	success = webkit_soup_http_input_stream_close (stream, cancellable, &error);
-	g_simple_async_result_set_op_res_gboolean (result, success);
-	if (error) {
-		g_simple_async_result_set_from_error (result, error);
-		g_error_free (error);
-	}
-
-	g_simple_async_result_complete_in_idle (result);
-	g_object_unref (result);
-}
-
-static gboolean
-webkit_soup_http_input_stream_close_finish (GInputStream  *stream,
-					    GAsyncResult  *result,
-					    GError       **error)
-{
-	/* Failures handled in generic close_finish code */
-	return TRUE;
-}
-
-static goffset
-webkit_soup_http_input_stream_tell (GSeekable *seekable)
-{
-	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (seekable);
-
-	return priv->offset;
-}
-
-static gboolean
-webkit_soup_http_input_stream_can_seek (GSeekable *seekable)
-{
-	return TRUE;
-}
-
-extern void soup_message_io_cleanup (SoupMessage *msg);
-
-static gboolean
-webkit_soup_http_input_stream_seek (GSeekable     *seekable,
-				    goffset offset,
-				    GSeekType type,
-				    GCancellable  *cancellable,
-				    GError       **error)
-{
-	GInputStream *stream = G_INPUT_STREAM (seekable);
-	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (seekable);
-	char *range;
-
-	if (type == G_SEEK_END) {
-		/* FIXME: we could send "bytes=-offset", but unless we
-		 * know the Content-Length, we wouldn't be able to
-		 * answer a tell() properly. We could find the
-		 * Content-Length by doing a HEAD...
-		 */
-
-		g_set_error_literal (error, G_IO_ERROR, G_IO_ERROR_NOT_SUPPORTED,
-				     "G_SEEK_END not currently supported");
-		return FALSE;
-	}
-
-	if (!g_input_stream_set_pending (stream, error))
-		return FALSE;
-
-	soup_session_cancel_message (priv->session, priv->msg, SOUP_STATUS_CANCELLED);
-	soup_message_io_cleanup (priv->msg);
-
-	switch (type) {
-		case G_SEEK_CUR:
-			offset += priv->offset;
-		/* fall through */
-
-		case G_SEEK_SET:
-			range = g_strdup_printf ("bytes=%" G_GUINT64_FORMAT "-", (guint64)offset);
-			priv->offset = offset;
-			break;
-
-		case G_SEEK_END:
-			range = NULL; /* keep compilers happy */
-			g_return_val_if_reached (FALSE);
-			break;
-
-		default:
-			g_return_val_if_reached (FALSE);
-	}
-
-	soup_message_headers_remove (priv->msg->request_headers, "Range");
-	soup_message_headers_append (priv->msg->request_headers, "Range", range);
-	g_free (range);
-
-	webkit_soup_http_input_stream_queue_message (WEBKIT_SOUP_HTTP_INPUT_STREAM (stream));
-
-	g_input_stream_clear_pending (stream);
-	return TRUE;
-}
-
-static gboolean
-webkit_soup_http_input_stream_can_truncate (GSeekable *seekable)
-{
-	return FALSE;
-}
-
-static gboolean
-webkit_soup_http_input_stream_truncate (GSeekable     *seekable,
-					goffset offset,
-					GCancellable  *cancellable,
-					GError       **error)
-{
-	g_set_error_literal (error, G_IO_ERROR, G_IO_ERROR_NOT_SUPPORTED,
-			     "Truncate not allowed on input stream");
-	return FALSE;
-}
-
-SoupMessage *
-webkit_soup_http_input_stream_get_message (WebKitSoupHTTPInputStream *httpstream)
-{
-	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (httpstream);
-	return priv->msg ? g_object_ref (priv->msg) : NULL;
-}
diff --git a/Source/WebCore/platform/network/soup/cache/soup-http-input-stream.h b/Source/WebCore/platform/network/soup/cache/soup-http-input-stream.h
deleted file mode 100644
index 6b98559..0000000
--- a/Source/WebCore/platform/network/soup/cache/soup-http-input-stream.h
+++ /dev/null
@@ -1,77 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
-/*
- * Copyright (C) 2006, 2007, 2009 Red Hat, Inc.
- * Copyright (C) 2010 Igalia, S.L.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General
- * Public License along with this library; if not, write to the
- * Free Software Foundation, Inc., 59 Temple Place, Suite 330,
- * Boston, MA 02111-1307, USA.
- */
-
-#ifndef __WEBKIT_SOUP_HTTP_INPUT_STREAM_H__
-#define __WEBKIT_SOUP_HTTP_INPUT_STREAM_H__
-
-#include <gio/gio.h>
-#include <libsoup/soup-types.h>
-
-G_BEGIN_DECLS
-
-#define WEBKIT_TYPE_SOUP_HTTP_INPUT_STREAM         (webkit_soup_http_input_stream_get_type ())
-#define WEBKIT_SOUP_HTTP_INPUT_STREAM(o)           (G_TYPE_CHECK_INSTANCE_CAST ((o), WEBKIT_TYPE_SOUP_HTTP_INPUT_STREAM, WebKitSoupHTTPInputStream))
-#define WEBKIT_SOUP_HTTP_INPUT_STREAM_CLASS(k)     (G_TYPE_CHECK_CLASS_CAST ((k), WEBKIT_TYPE_SOUP_HTTP_INPUT_STREAM, WebKitSoupHTTPInputStreamClass))
-#define WEBKIT_IS_SOUP_HTTP_INPUT_STREAM(o)        (G_TYPE_CHECK_INSTANCE_TYPE ((o), WEBKIT_TYPE_SOUP_HTTP_INPUT_STREAM))
-#define WEBKIT_IS_SOUP_HTTP_INPUT_STREAM_CLASS(k)  (G_TYPE_CHECK_CLASS_TYPE ((k), WEBKIT_TYPE_SOUP_HTTP_INPUT_STREAM))
-#define WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_CLASS(o) (G_TYPE_INSTANCE_GET_CLASS ((o), WEBKIT_TYPE_SOUP_HTTP_INPUT_STREAM, WebKitSoupHTTPInputStreamClass))
-
-typedef struct WebKitSoupHTTPInputStream WebKitSoupHTTPInputStream;
-typedef struct WebKitSoupHTTPInputStreamClass WebKitSoupHTTPInputStreamClass;
-
-struct WebKitSoupHTTPInputStream {
-	GInputStream parent;
-};
-
-struct WebKitSoupHTTPInputStreamClass {
-	GInputStreamClass parent_class;
-
-	/* Padding for future expansion */
-	void (*_g_reserved1)(void);
-	void (*_g_reserved2)(void);
-	void (*_g_reserved3)(void);
-	void (*_g_reserved4)(void);
-	void (*_g_reserved5)(void);
-};
-
-GType webkit_soup_http_input_stream_get_type (void) G_GNUC_CONST;
-
-WebKitSoupHTTPInputStream *webkit_soup_http_input_stream_new (SoupSession         *session,
-							      SoupMessage         *msg);
-
-gboolean             webkit_soup_http_input_stream_send (WebKitSoupHTTPInputStream *httpstream,
-							 GCancellable        *cancellable,
-							 GError             **error);
-
-void                 webkit_soup_http_input_stream_send_async (WebKitSoupHTTPInputStream *httpstream,
-							       int io_priority,
-							       GCancellable        *cancellable,
-							       GAsyncReadyCallback callback,
-							       gpointer user_data);
-gboolean             webkit_soup_http_input_stream_send_finish (WebKitSoupHTTPInputStream *httpstream,
-								GAsyncResult        *result,
-								GError             **error);
-
-SoupMessage         *webkit_soup_http_input_stream_get_message (WebKitSoupHTTPInputStream *httpstream);
-
-G_END_DECLS
-
-#endif /* __WEBKIT_SOUP_HTTP_INPUT_STREAM_H__ */
diff --git a/Source/WebCore/platform/network/soup/cache/soup-request-data.c b/Source/WebCore/platform/network/soup/cache/soup-request-data.c
deleted file mode 100644
index ced5c4a..0000000
--- a/Source/WebCore/platform/network/soup/cache/soup-request-data.c
+++ /dev/null
@@ -1,170 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
-/*
- * soup-request-data.c: data: URI request object
- *
- * Copyright (C) 2009 Red Hat, Inc.
- * Copyright (C) 2010 Igalia, S.L.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifdef HAVE_CONFIG_H
-#include <config.h>
-#endif
-#include "soup-request-data.h"
-
-#include "soup-requester.h"
-#include <libsoup/soup.h>
-#include <glib/gi18n.h>
-
-G_DEFINE_TYPE (WebKitSoupRequestData, webkit_soup_request_data, WEBKIT_TYPE_SOUP_REQUEST)
-
-struct _WebKitSoupRequestDataPrivate {
-	gsize content_length;
-	char *content_type;
-};
-
-static void
-webkit_soup_request_data_init (WebKitSoupRequestData *data)
-{
-	data->priv = G_TYPE_INSTANCE_GET_PRIVATE (data, WEBKIT_TYPE_SOUP_REQUEST_DATA, WebKitSoupRequestDataPrivate);
-}
-
-static void
-webkit_soup_request_data_finalize (GObject *object)
-{
-	WebKitSoupRequestData *data = WEBKIT_SOUP_REQUEST_DATA (object);
-
-	g_free (data->priv->content_type);
-
-	G_OBJECT_CLASS (webkit_soup_request_data_parent_class)->finalize (object);
-}
-
-static gboolean
-webkit_soup_request_data_check_uri (WebKitSoupRequest  *request,
-				    SoupURI      *uri,
-				    GError      **error)
-{
-	return uri->host == NULL;
-}
-
-static GInputStream *
-webkit_soup_request_data_send (WebKitSoupRequest   *request,
-			       GCancellable  *cancellable,
-			       GError       **error)
-{
-	WebKitSoupRequestData *data = WEBKIT_SOUP_REQUEST_DATA (request);
-	SoupURI *uri = webkit_soup_request_get_uri (request);
-	GInputStream *memstream;
-	const char *comma, *semi, *start, *end;
-	gboolean base64 = FALSE;
-
-	gchar *uristr = soup_uri_to_string (uri, FALSE);
-	comma = strchr (uristr, ',');
-	if (comma && comma != uristr) {
-		/* Deal with MIME type / params */
-		semi = memchr (uristr, ';', comma - uristr);
-		end = semi ? semi : comma;
-
-		if (semi && !g_ascii_strncasecmp (semi, ";base64", MAX ((size_t) (comma - semi), strlen (";base64"))))
-			base64 = TRUE;
-
-		if (end != uristr)
-			if (base64)
-				data->priv->content_type = g_strndup (uristr, end - uristr);
-			else
-				data->priv->content_type =
-					webkit_soup_request_uri_decoded_copy (uristr, end - uristr);
-	}
-
-	memstream = g_memory_input_stream_new ();
-
-	start = comma ? comma + 1 : uristr;
-
-	if (*start) {
-		guchar *buf;
-
-		if (base64) {
-			int inlen, state = 0;
-			guint save = 0;
-
-			inlen = strlen (start);
-			buf = g_malloc0 (inlen * 3 / 4 + 3);
-			data->priv->content_length =
-				g_base64_decode_step (start, inlen, buf,
-						      &state, &save);
-			if (state != 0) {
-				g_free (buf);
-				goto fail;
-			}
-		} else {
-			/* Cannot use g_uri_unescape_string nor
-			   soup_uri_decode because we don't want to
-			   fail for things like "%3E%%3C" -> ">%<" */
-			buf = (guchar *)webkit_soup_request_uri_decoded_copy (start, strlen (start));
-			if (!buf)
-				goto fail;
-			data->priv->content_length = strlen ((char *)buf);
-		}
-
-		g_memory_input_stream_add_data (G_MEMORY_INPUT_STREAM (memstream),
-						buf, data->priv->content_length,
-						g_free);
-	}
-	g_free (uristr);
-
-	return memstream;
-
- fail:
-	g_free (uristr);
-	g_set_error (error, WEBKIT_SOUP_ERROR, WEBKIT_SOUP_ERROR_BAD_URI,
-		     _ ("Unable to decode URI: %s"), start);
-	g_object_unref (memstream);
-	return NULL;
-}
-
-static goffset
-webkit_soup_request_data_get_content_length (WebKitSoupRequest *request)
-{
-	WebKitSoupRequestData *data = WEBKIT_SOUP_REQUEST_DATA (request);
-
-	return data->priv->content_length;
-}
-
-static const char *
-webkit_soup_request_data_get_content_type (WebKitSoupRequest *request)
-{
-	WebKitSoupRequestData *data = WEBKIT_SOUP_REQUEST_DATA (request);
-
-	return data->priv->content_type;
-}
-
-static void
-webkit_soup_request_data_class_init (WebKitSoupRequestDataClass *request_data_class)
-{
-	GObjectClass *object_class = G_OBJECT_CLASS (request_data_class);
-	WebKitSoupRequestClass *request_class =
-		WEBKIT_SOUP_REQUEST_CLASS (request_data_class);
-
-	g_type_class_add_private (request_data_class, sizeof (WebKitSoupRequestDataPrivate));
-
-	object_class->finalize = webkit_soup_request_data_finalize;
-
-	request_class->check_uri = webkit_soup_request_data_check_uri;
-	request_class->send = webkit_soup_request_data_send;
-	request_class->get_content_length = webkit_soup_request_data_get_content_length;
-	request_class->get_content_type = webkit_soup_request_data_get_content_type;
-}
diff --git a/Source/WebCore/platform/network/soup/cache/soup-request-data.h b/Source/WebCore/platform/network/soup/cache/soup-request-data.h
deleted file mode 100644
index c9631a4..0000000
--- a/Source/WebCore/platform/network/soup/cache/soup-request-data.h
+++ /dev/null
@@ -1,52 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
-/*
- * Copyright (C) 2009 Red Hat, Inc.
- * Copyright (C) 2010 Igalia, S.L.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifndef WEBKIT_SOUP_REQUEST_DATA_H
-#define WEBKIT_SOUP_REQUEST_DATA_H 1
-
-#include "soup-request.h"
-
-G_BEGIN_DECLS
-
-#define WEBKIT_TYPE_SOUP_REQUEST_DATA            (webkit_soup_request_data_get_type ())
-#define WEBKIT_SOUP_REQUEST_DATA(object)         (G_TYPE_CHECK_INSTANCE_CAST ((object), WEBKIT_TYPE_SOUP_REQUEST_DATA, WebKitSoupRequestData))
-#define WEBKIT_SOUP_REQUEST_DATA_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), WEBKIT_TYPE_SOUP_REQUEST_DATA, WebKitSoupRequestDataClass))
-#define WEBKIT_IS_SOUP_REQUEST_DATA(object)      (G_TYPE_CHECK_INSTANCE_TYPE ((object), WEBKIT_TYPE_SOUP_REQUEST_DATA))
-#define WEBKIT_IS_SOUP_REQUEST_DATA_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), WEBKIT_TYPE_SOUP_REQUEST_DATA))
-#define WEBKIT_SOUP_REQUEST_DATA_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj), WEBKIT_TYPE_SOUP_REQUEST_DATA, WebKitSoupRequestDataClass))
-
-typedef struct _WebKitSoupRequestDataPrivate WebKitSoupRequestDataPrivate;
-
-typedef struct {
-	WebKitSoupRequest parent;
-
-	WebKitSoupRequestDataPrivate *priv;
-} WebKitSoupRequestData;
-
-typedef struct {
-	WebKitSoupRequestClass parent;
-} WebKitSoupRequestDataClass;
-
-GType webkit_soup_request_data_get_type (void);
-
-G_END_DECLS
-
-#endif /* WEBKIT_SOUP_REQUEST_DATA_H */
diff --git a/Source/WebCore/platform/network/soup/cache/soup-request-file.c b/Source/WebCore/platform/network/soup/cache/soup-request-file.c
deleted file mode 100644
index 24ccb10..0000000
--- a/Source/WebCore/platform/network/soup/cache/soup-request-file.c
+++ /dev/null
@@ -1,331 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
-/*
- * soup-request-file.c: file: URI request object
- *
- * Copyright (C) 2009 Red Hat, Inc.
- * Copyright (C) 2010 Igalia, S.L.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifdef HAVE_CONFIG_H
-#include <config.h>
-#endif
-
-#include "soup-request-file.h"
-#include "soup-directory-input-stream.h"
-#include "soup-requester.h"
-#include <glib/gi18n.h>
-
-G_DEFINE_TYPE (WebKitSoupRequestFile, webkit_soup_request_file, WEBKIT_TYPE_SOUP_REQUEST)
-
-struct _WebKitSoupRequestFilePrivate {
-	GFile *gfile;
-
-	char *mime_type;
-	goffset size;
-};
-
-GFile *
-webkit_soup_request_file_get_file (WebKitSoupRequestFile *file)
-{
-	return g_object_ref (file->priv->gfile);
-}
-
-static void
-webkit_soup_request_file_init (WebKitSoupRequestFile *file)
-{
-	file->priv = G_TYPE_INSTANCE_GET_PRIVATE (file, WEBKIT_TYPE_SOUP_REQUEST_FILE, WebKitSoupRequestFilePrivate);
-
-	file->priv->size = -1;
-}
-
-static void
-webkit_soup_request_file_finalize (GObject *object)
-{
-	WebKitSoupRequestFile *file = WEBKIT_SOUP_REQUEST_FILE (object);
-
-	if (file->priv->gfile)
-		g_object_unref (file->priv->gfile);
-	g_free (file->priv->mime_type);
-
-	G_OBJECT_CLASS (webkit_soup_request_file_parent_class)->finalize (object);
-}
-
-static gboolean
-webkit_soup_request_file_check_uri (WebKitSoupRequest  *request,
-				    SoupURI      *uri,
-				    GError      **error)
-{
-	/* "file:/foo" is not valid */
-	if (!uri->host)
-		return FALSE;
-
-	/* but it must be "file:///..." or "file://localhost/..." */
-	if (uri->scheme == SOUP_URI_SCHEME_FILE &&
-	    *uri->host &&
-	    g_ascii_strcasecmp (uri->host, "localhost") != 0)
-		return FALSE;
-
-	return TRUE;
-}
-
-static void
-webkit_soup_request_file_ftp_main_loop_quit (GObject      *object,
-					     GAsyncResult *result,
-					     gpointer loop)
-{
-	g_main_loop_quit (loop);
-}
-
-/* This is a somewhat hacky way to get FTP to almost work. The proper way to
- * get FTP to _really_ work involves hacking GIO to have APIs to handle
- * canoncial URLs.
- */
-static GFile *
-webkit_soup_request_file_ensure_file_ftp (SoupURI       *uri,
-					  GCancellable  *cancellable,
-					  GError       **error)
-{
-	SoupURI *host;
-	char *s;
-	GFile *file, *result;
-	GMount *mount;
-
-	host = soup_uri_copy_host (uri);
-	s = soup_uri_to_string (host, FALSE);
-	file = g_file_new_for_uri (s);
-	soup_uri_free (host);
-	g_free (s);
-
-	mount = g_file_find_enclosing_mount (file, cancellable, error);
-	if (mount == NULL && g_file_supports_thread_contexts (file)) {
-		GMainContext *context = g_main_context_new ();
-		GMainLoop *loop = g_main_loop_new (context, FALSE);
-
-		g_clear_error (error);
-		g_main_context_push_thread_default (context);
-		g_file_mount_enclosing_volume (file,
-					       G_MOUNT_MOUNT_NONE,
-					       NULL, /* FIXME! */
-					       cancellable,
-					       webkit_soup_request_file_ftp_main_loop_quit,
-					       loop);
-		g_main_loop_run (loop);
-		g_main_context_pop_thread_default (context);
-		g_main_loop_unref (loop);
-		g_main_context_unref (context);
-		mount = g_file_find_enclosing_mount (file, cancellable, error);
-	}
-	if (mount == NULL)
-		return NULL;
-	g_object_unref (file);
-
-	file = g_mount_get_default_location (mount);
-	g_object_unref (mount);
-
-	s = g_strdup (uri->path);
-	if (strchr (s, ';'))
-		*strchr (s, ';') = 0;
-
-	result = g_file_resolve_relative_path (file, s);
-	g_free (s);
-	g_object_unref (file);
-
-	return result;
-}
-
-static gboolean
-webkit_soup_request_file_ensure_file (WebKitSoupRequestFile  *file,
-				      GCancellable     *cancellable,
-				      GError          **error)
-{
-	SoupURI *uri;
-
-	if (file->priv->gfile)
-		return TRUE;
-
-	uri = webkit_soup_request_get_uri (WEBKIT_SOUP_REQUEST (file));
-	if (uri->scheme == SOUP_URI_SCHEME_FILE) {
-		/* We cannot use soup_uri_decode as it incorrectly
-		 * returns NULL for incorrectly encoded URIs (that
-		 * could be valid filenames). This will be hopefully
-		 * shipped in libsoup 2.32.1 but we want to land this
-		 * first. TODO: replace uri_decoded_copy by
-		 * soup_uri_decode when the required libsoup version
-		 * is bumped out to 2.32.1
-		 */
-		gchar *decoded_uri = webkit_soup_request_uri_decoded_copy (uri->path, strlen (uri->path));
-
-		if (decoded_uri) {
-			/* Do not use new_for_uri() as the decoded URI
-			 *  could not be a valid URI
-			 */
-			file->priv->gfile = g_file_new_for_path (decoded_uri);
-			g_free (decoded_uri);
-		}
-
-		return TRUE;
-	} else if (uri->scheme == SOUP_URI_SCHEME_FTP) {
-		file->priv->gfile = webkit_soup_request_file_ensure_file_ftp (uri,
-									      cancellable,
-									      error);
-		return file->priv->gfile != NULL;
-	}
-
-	g_set_error (error, WEBKIT_SOUP_ERROR, WEBKIT_SOUP_ERROR_UNSUPPORTED_URI_SCHEME,
-		     _ ("Unsupported URI scheme '%s'"), uri->scheme);
-	return FALSE;
-}
-
-static GInputStream *
-webkit_soup_request_file_send (WebKitSoupRequest          *request,
-			       GCancellable         *cancellable,
-			       GError              **error)
-{
-	WebKitSoupRequestFile *file = WEBKIT_SOUP_REQUEST_FILE (request);
-	GInputStream *stream;
-	GError *my_error = NULL;
-
-	if (!webkit_soup_request_file_ensure_file (file, cancellable, error))
-		return NULL;
-
-	stream = G_INPUT_STREAM (g_file_read (file->priv->gfile,
-					      cancellable, &my_error));
-	if (stream == NULL) {
-		if (g_error_matches (my_error, G_IO_ERROR, G_IO_ERROR_IS_DIRECTORY)) {
-			GFileEnumerator *enumerator;
-			g_clear_error (&my_error);
-			enumerator = g_file_enumerate_children (file->priv->gfile,
-								"*",
-								G_FILE_QUERY_INFO_NONE,
-								cancellable,
-								error);
-			if (enumerator) {
-				stream = webkit_soup_directory_input_stream_new (enumerator,
-										 webkit_soup_request_get_uri (request));
-				g_object_unref (enumerator);
-				file->priv->mime_type = g_strdup ("text/html");
-			}
-		} else {
-			g_propagate_error (error, my_error);
-		}
-	} else {
-		GFileInfo *info = g_file_query_info (file->priv->gfile,
-						     G_FILE_ATTRIBUTE_STANDARD_CONTENT_TYPE ","
-						     G_FILE_ATTRIBUTE_STANDARD_SIZE,
-						     0, cancellable, NULL);
-		if (info) {
-			const char *content_type;
-			file->priv->size = g_file_info_get_size (info);
-			content_type = g_file_info_get_content_type (info);
-
-			if (content_type)
-				file->priv->mime_type = g_content_type_get_mime_type (content_type);
-			g_object_unref (info);
-		}
-	}
-
-	return stream;
-}
-
-static void
-webkit_soup_request_file_send_async_thread (GSimpleAsyncResult *res,
-					    GObject            *object,
-					    GCancellable       *cancellable)
-{
-	GInputStream *stream;
-	WebKitSoupRequest *request;
-	GError *error = NULL;
-
-	request = WEBKIT_SOUP_REQUEST (object);
-
-	stream = webkit_soup_request_file_send (request, cancellable, &error);
-
-	if (stream == NULL) {
-		g_simple_async_result_set_from_error (res, error);
-		g_error_free (error);
-	} else {
-		g_simple_async_result_set_op_res_gpointer (res, stream, g_object_unref);
-	}
-}
-
-static void
-webkit_soup_request_file_send_async (WebKitSoupRequest          *request,
-				     GCancellable         *cancellable,
-				     GAsyncReadyCallback callback,
-				     gpointer user_data)
-{
-	GSimpleAsyncResult *res;
-
-	res = g_simple_async_result_new (G_OBJECT (request), callback, user_data, webkit_soup_request_file_send_async);
-
-	g_simple_async_result_run_in_thread (res, webkit_soup_request_file_send_async_thread, G_PRIORITY_DEFAULT, cancellable);
-	g_object_unref (res);
-}
-
-static GInputStream *
-webkit_soup_request_file_send_finish (WebKitSoupRequest          *request,
-				      GAsyncResult         *result,
-				      GError              **error)
-{
-	GSimpleAsyncResult *simple = G_SIMPLE_ASYNC_RESULT (result);
-
-	g_warn_if_fail (g_simple_async_result_get_source_tag (simple) == webkit_soup_request_file_send_async);
-
-	if (g_simple_async_result_propagate_error (simple, error))
-		return NULL;
-
-	return g_object_ref (g_simple_async_result_get_op_res_gpointer (simple));
-}
-
-static goffset
-webkit_soup_request_file_get_content_length (WebKitSoupRequest *request)
-{
-	WebKitSoupRequestFile *file = WEBKIT_SOUP_REQUEST_FILE (request);
-
-	return file->priv->size;
-}
-
-static const char *
-webkit_soup_request_file_get_content_type (WebKitSoupRequest *request)
-{
-	WebKitSoupRequestFile *file = WEBKIT_SOUP_REQUEST_FILE (request);
-
-	if (!file->priv->mime_type)
-		return "application/octet-stream";
-
-	return file->priv->mime_type;
-}
-
-static void
-webkit_soup_request_file_class_init (WebKitSoupRequestFileClass *request_file_class)
-{
-	GObjectClass *object_class = G_OBJECT_CLASS (request_file_class);
-	WebKitSoupRequestClass *request_class =
-		WEBKIT_SOUP_REQUEST_CLASS (request_file_class);
-
-	g_type_class_add_private (request_file_class, sizeof (WebKitSoupRequestFilePrivate));
-
-	object_class->finalize = webkit_soup_request_file_finalize;
-
-	request_class->check_uri = webkit_soup_request_file_check_uri;
-	request_class->send = webkit_soup_request_file_send;
-	request_class->send_async = webkit_soup_request_file_send_async;
-	request_class->send_finish = webkit_soup_request_file_send_finish;
-	request_class->get_content_length = webkit_soup_request_file_get_content_length;
-	request_class->get_content_type = webkit_soup_request_file_get_content_type;
-}
diff --git a/Source/WebCore/platform/network/soup/cache/soup-request-file.h b/Source/WebCore/platform/network/soup/cache/soup-request-file.h
deleted file mode 100644
index 459e82a..0000000
--- a/Source/WebCore/platform/network/soup/cache/soup-request-file.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
-/*
- * Copyright (C) 2009 Red Hat, Inc.
- * Copyright (C) 2010 Igalia, S.L.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifndef WEBKIT_SOUP_REQUEST_FILE_H
-#define WEBKIT_SOUP_REQUEST_FILE_H 1
-
-#include "soup-request.h"
-
-G_BEGIN_DECLS
-
-#define WEBKIT_TYPE_SOUP_REQUEST_FILE            (webkit_soup_request_file_get_type ())
-#define WEBKIT_SOUP_REQUEST_FILE(object)         (G_TYPE_CHECK_INSTANCE_CAST ((object), WEBKIT_TYPE_SOUP_REQUEST_FILE, WebKitSoupRequestFile))
-#define WEBKIT_SOUP_REQUEST_FILE_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), WEBKIT_TYPE_SOUP_REQUEST_FILE, WebKitSoupRequestFileClass))
-#define WEBKIT_IS_SOUP_REQUEST_FILE(object)      (G_TYPE_CHECK_INSTANCE_TYPE ((object), WEBKIT_TYPE_SOUP_REQUEST_FILE))
-#define WEBKIT_IS_SOUP_REQUEST_FILE_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), WEBKIT_TYPE_SOUP_REQUEST_FILE))
-#define WEBKIT_SOUP_REQUEST_FILE_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj), WEBKIT_TYPE_SOUP_REQUEST_FILE, WebKitSoupRequestFileClass))
-
-typedef struct _WebKitSoupRequestFilePrivate WebKitSoupRequestFilePrivate;
-
-typedef struct {
-	WebKitSoupRequest parent;
-
-	WebKitSoupRequestFilePrivate *priv;
-} WebKitSoupRequestFile;
-
-typedef struct {
-	WebKitSoupRequestClass parent;
-} WebKitSoupRequestFileClass;
-
-GType webkit_soup_request_file_get_type (void);
-
-GFile  *webkit_soup_request_file_get_file (WebKitSoupRequestFile *file);
-
-G_END_DECLS
-
-#endif /* WEBKIT_SOUP_REQUEST_FILE_H */
diff --git a/Source/WebCore/platform/network/soup/cache/soup-request-http.c b/Source/WebCore/platform/network/soup/cache/soup-request-http.c
deleted file mode 100644
index 777fd72..0000000
--- a/Source/WebCore/platform/network/soup/cache/soup-request-http.c
+++ /dev/null
@@ -1,356 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
-/*
- * soup-request-http.c: http: URI request object
- *
- * Copyright (C) 2009 Red Hat, Inc.
- * Copyright (C) 2010 Igalia, S.L.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifdef HAVE_CONFIG_H
-#include <config.h>
-#endif
-
-#include <glib/gi18n.h>
-
-#include "soup-cache.h"
-#include "soup-cache-private.h"
-#include "soup-http-input-stream.h"
-#include "soup-request-http.h"
-
-G_DEFINE_TYPE (WebKitSoupRequestHTTP, webkit_soup_request_http, WEBKIT_TYPE_SOUP_REQUEST)
-
-struct _WebKitSoupRequestHTTPPrivate {
-	SoupMessage *msg;
-};
-
-/**
- * webkit_soup_request_http_get_message:
- * @http: a #WebKitSoupRequestHTTP object
- *
- * Gets a new reference to the #SoupMessage associated to this SoupRequest
- *
- * Returns: a new reference to the #SoupMessage
- **/
-SoupMessage *
-webkit_soup_request_http_get_message (WebKitSoupRequestHTTP *http)
-{
-	g_return_val_if_fail (WEBKIT_IS_SOUP_REQUEST_HTTP (http), NULL);
-
-	return g_object_ref (http->priv->msg);
-}
-
-static void
-webkit_soup_request_http_init (WebKitSoupRequestHTTP *http)
-{
-	http->priv = G_TYPE_INSTANCE_GET_PRIVATE (http, WEBKIT_TYPE_SOUP_REQUEST_HTTP, WebKitSoupRequestHTTPPrivate);
-}
-
-static gboolean
-webkit_soup_request_http_check_uri (WebKitSoupRequest  *request,
-				    SoupURI      *uri,
-				    GError      **error)
-{
-	WebKitSoupRequestHTTP *http = WEBKIT_SOUP_REQUEST_HTTP (request);
-
-	if (!SOUP_URI_VALID_FOR_HTTP (uri))
-		return FALSE;
-
-	http->priv->msg = soup_message_new_from_uri (SOUP_METHOD_GET, uri);
-	return TRUE;
-}
-
-static void
-webkit_soup_request_http_finalize (GObject *object)
-{
-	WebKitSoupRequestHTTP *http = WEBKIT_SOUP_REQUEST_HTTP (object);
-
-	if (http->priv->msg)
-		g_object_unref (http->priv->msg);
-
-	G_OBJECT_CLASS (webkit_soup_request_http_parent_class)->finalize (object);
-}
-
-static GInputStream *
-webkit_soup_request_http_send (WebKitSoupRequest          *request,
-			       GCancellable         *cancellable,
-			       GError              **error)
-{
-	WebKitSoupHTTPInputStream *httpstream;
-	WebKitSoupRequestHTTP *http = WEBKIT_SOUP_REQUEST_HTTP (request);
-
-	httpstream = webkit_soup_http_input_stream_new (webkit_soup_request_get_session (request), http->priv->msg);
-	if (!webkit_soup_http_input_stream_send (httpstream, cancellable, error)) {
-		g_object_unref (httpstream);
-		return NULL;
-	}
-	return (GInputStream *)httpstream;
-}
-
-
-static void
-sent_async (GObject *source, GAsyncResult *result, gpointer user_data)
-{
-	WebKitSoupHTTPInputStream *httpstream = WEBKIT_SOUP_HTTP_INPUT_STREAM (source);
-	GSimpleAsyncResult *simple = user_data;
-	GError *error = NULL;
-
-	if (webkit_soup_http_input_stream_send_finish (httpstream, result, &error)) {
-		g_simple_async_result_set_op_res_gpointer (simple, httpstream, g_object_unref);
-	} else {
-		g_simple_async_result_set_from_error (simple, error);
-		g_error_free (error);
-		g_object_unref (httpstream);
-	}
-	g_simple_async_result_complete (simple);
-	g_object_unref (simple);
-}
-
-
-typedef struct {
-	WebKitSoupRequestHTTP *req;
-	SoupMessage *original;
-	GCancellable *cancellable;
-	GAsyncReadyCallback callback;
-	gpointer user_data;
-} ConditionalHelper;
-
-
-static void
-conditional_get_ready_cb (SoupSession *session, SoupMessage *msg, gpointer user_data)
-{
-	ConditionalHelper *helper = (ConditionalHelper *)user_data;
-	GSimpleAsyncResult *simple;
-	WebKitSoupHTTPInputStream *httpstream;
-
-	simple = g_simple_async_result_new (G_OBJECT (helper->req),
-					    helper->callback, helper->user_data,
-					    conditional_get_ready_cb);
-
-	if (msg->status_code == SOUP_STATUS_NOT_MODIFIED) {
-		WebKitSoupCache *cache = (WebKitSoupCache *)soup_session_get_feature (session, WEBKIT_TYPE_SOUP_CACHE);
-
-		httpstream = (WebKitSoupHTTPInputStream *)webkit_soup_cache_send_response (cache, msg);
-		if (httpstream) {
-			const gchar *content_type;
-
-			g_simple_async_result_set_op_res_gpointer (simple, httpstream, g_object_unref);
-
-			soup_message_got_headers (helper->original);
-
-			/* FIXME: Uncomment this when this becomes part of libsoup
-			 * if (!soup_message_disables_feature(helper->original, SOUP_TYPE_CONTENT_SNIFFER)) {
-			 * 	const gchar *content_type = soup_message_headers_get_content_type (msg->response_headers, NULL);
-			 * 	soup_message_content_sniffed (helper->original, content_type, NULL);
-			 * }
-			 */
-			content_type = soup_message_headers_get_content_type (msg->response_headers, NULL);
-			soup_message_content_sniffed (helper->original, content_type, NULL);
-
-			g_simple_async_result_complete (simple);
-
-			soup_message_finished (helper->original);
-
-			g_object_unref (simple);
-		} else {
-			/* Ask again for the resource, somehow the cache cannot locate it */
-			httpstream = webkit_soup_http_input_stream_new (session, helper->original);
-			webkit_soup_http_input_stream_send_async (httpstream, G_PRIORITY_DEFAULT,
-								  helper->cancellable, sent_async, simple);
-		}
-	} else {
-		/* It is in the cache but it was modified remotely */
-		httpstream = webkit_soup_http_input_stream_new (session, helper->original);
-		webkit_soup_http_input_stream_send_async (httpstream, G_PRIORITY_DEFAULT,
-							  helper->cancellable, sent_async, simple);
-	}
-
-	g_object_unref (helper->req);
-	g_object_unref (helper->original);
-	g_slice_free (ConditionalHelper, helper);
-}
-
-typedef struct {
-	WebKitSoupRequestHTTP *http;
-	GAsyncReadyCallback callback;
-	gpointer user_data;
-	WebKitSoupHTTPInputStream *httpstream;
-} SendAsyncHelper;
-
-static void webkit_soup_request_http_send_async (WebKitSoupRequest          *request,
-						 GCancellable         *cancellable,
-						 GAsyncReadyCallback callback,
-						 gpointer user_data);
-
-static gboolean
-send_async_cb (gpointer data)
-{
-	GSimpleAsyncResult *simple;
-	SendAsyncHelper *helper = (SendAsyncHelper *)data;
-	const gchar *content_type;
-
-	simple = g_simple_async_result_new (G_OBJECT (helper->http),
-					    helper->callback, helper->user_data,
-					    webkit_soup_request_http_send_async);
-	g_simple_async_result_set_op_res_gpointer (simple, helper->httpstream, g_object_unref);
-
-	/* Update message status */
-	soup_message_set_status (helper->http->priv->msg, SOUP_STATUS_OK);
-
-	/* Issue signals  */
-	soup_message_got_headers (helper->http->priv->msg);
-
-	/* FIXME: Uncomment this when this becomes part of libsoup
-	 * if (!soup_message_disables_feature(helper->http->priv->msg, SOUP_TYPE_CONTENT_SNIFFER)) {
-	 *	const gchar *content_type = soup_message_headers_get_content_type (helper->http->priv->msg->response_headers, NULL);
-	 *	soup_message_content_sniffed (helper->http->priv->msg, content_type, NULL);
-	 * }
-	 */
-	content_type = soup_message_headers_get_content_type (helper->http->priv->msg->response_headers, NULL);
-	soup_message_content_sniffed (helper->http->priv->msg, content_type, NULL);
-
-	g_simple_async_result_complete (simple);
-
-	soup_message_finished (helper->http->priv->msg);
-
-	g_object_unref (simple);
-
-	g_object_unref (helper->http);
-	g_slice_free (SendAsyncHelper, helper);
-
-	return FALSE;
-}
-
-static void
-webkit_soup_request_http_send_async (WebKitSoupRequest          *request,
-				     GCancellable         *cancellable,
-				     GAsyncReadyCallback callback,
-				     gpointer user_data)
-{
-	WebKitSoupRequestHTTP *http = WEBKIT_SOUP_REQUEST_HTTP (request);
-	WebKitSoupHTTPInputStream *httpstream;
-	GSimpleAsyncResult *simple;
-	SoupSession *session;
-	WebKitSoupCache *cache;
-
-	session = webkit_soup_request_get_session (request);
-	cache = (WebKitSoupCache *)soup_session_get_feature (session, WEBKIT_TYPE_SOUP_CACHE);
-
-	if (cache) {
-		WebKitSoupCacheResponse response;
-
-		response = webkit_soup_cache_has_response (cache, http->priv->msg);
-		if (response == WEBKIT_SOUP_CACHE_RESPONSE_FRESH) {
-			WebKitSoupHTTPInputStream *httpstream;
-
-			httpstream = (WebKitSoupHTTPInputStream *)
-				webkit_soup_cache_send_response (cache, SOUP_MESSAGE (http->priv->msg));
-
-			/* Cached resource file could have been deleted outside
-			 */
-			if (httpstream) {
-				/* Do return the stream asynchronously as in
-				 * the other cases. It's not enough to use
-				 * g_simple_async_result_complete_in_idle as
-				 * the signals must be also emitted
-				 * asynchronously
-				 */
-				SendAsyncHelper *helper = g_slice_new (SendAsyncHelper);
-				helper->http = g_object_ref (http);
-				helper->callback = callback;
-				helper->user_data = user_data;
-				helper->httpstream = httpstream;
-				g_timeout_add (0, send_async_cb, helper);
-				return;
-			}
-		} else if (response == WEBKIT_SOUP_CACHE_RESPONSE_NEEDS_VALIDATION) {
-			SoupMessage *conditional_msg;
-			ConditionalHelper *helper;
-
-			conditional_msg = webkit_soup_cache_generate_conditional_request (cache, http->priv->msg);
-
-			helper = g_slice_new0 (ConditionalHelper);
-			helper->req = g_object_ref (http);
-			helper->original = g_object_ref (http->priv->msg);
-			helper->cancellable = cancellable;
-			helper->callback = callback;
-			helper->user_data = user_data;
-			soup_session_queue_message (session, conditional_msg,
-						    conditional_get_ready_cb,
-						    helper);
-			return;
-		}
-	}
-
-	simple = g_simple_async_result_new (G_OBJECT (http),
-					    callback, user_data,
-					    webkit_soup_request_http_send_async);
-	httpstream = webkit_soup_http_input_stream_new (webkit_soup_request_get_session (request),
-							http->priv->msg);
-	webkit_soup_http_input_stream_send_async (httpstream, G_PRIORITY_DEFAULT,
-						  cancellable, sent_async, simple);
-}
-
-static GInputStream *
-webkit_soup_request_http_send_finish (WebKitSoupRequest          *request,
-				      GAsyncResult         *result,
-				      GError              **error)
-{
-	GSimpleAsyncResult *simple;
-
-	g_return_val_if_fail (g_simple_async_result_is_valid (result, G_OBJECT (request), webkit_soup_request_http_send_async) || g_simple_async_result_is_valid (result, G_OBJECT (request), conditional_get_ready_cb), NULL);
-
-	simple = G_SIMPLE_ASYNC_RESULT (result);
-	if (g_simple_async_result_propagate_error (simple, error))
-		return NULL;
-	return g_object_ref (g_simple_async_result_get_op_res_gpointer (simple));
-}
-
-static goffset
-webkit_soup_request_http_get_content_length (WebKitSoupRequest *request)
-{
-	WebKitSoupRequestHTTP *http = WEBKIT_SOUP_REQUEST_HTTP (request);
-
-	return soup_message_headers_get_content_length (http->priv->msg->response_headers);
-}
-
-static const char *
-webkit_soup_request_http_get_content_type (WebKitSoupRequest *request)
-{
-	WebKitSoupRequestHTTP *http = WEBKIT_SOUP_REQUEST_HTTP (request);
-
-	return soup_message_headers_get_content_type (http->priv->msg->response_headers, NULL);
-}
-
-static void
-webkit_soup_request_http_class_init (WebKitSoupRequestHTTPClass *request_http_class)
-{
-	GObjectClass *object_class = G_OBJECT_CLASS (request_http_class);
-	WebKitSoupRequestClass *request_class =
-		WEBKIT_SOUP_REQUEST_CLASS (request_http_class);
-
-	g_type_class_add_private (request_http_class, sizeof (WebKitSoupRequestHTTPPrivate));
-
-	object_class->finalize = webkit_soup_request_http_finalize;
-
-	request_class->check_uri = webkit_soup_request_http_check_uri;
-	request_class->send = webkit_soup_request_http_send;
-	request_class->send_async = webkit_soup_request_http_send_async;
-	request_class->send_finish = webkit_soup_request_http_send_finish;
-	request_class->get_content_length = webkit_soup_request_http_get_content_length;
-	request_class->get_content_type = webkit_soup_request_http_get_content_type;
-}
diff --git a/Source/WebCore/platform/network/soup/cache/soup-request-http.h b/Source/WebCore/platform/network/soup/cache/soup-request-http.h
deleted file mode 100644
index a06a821..0000000
--- a/Source/WebCore/platform/network/soup/cache/soup-request-http.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
-/*
- * Copyright (C) 2009 Red Hat, Inc.
- * Copyright (C) 2010 Igalia, S.L.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifndef WEBKIT_SOUP_REQUEST_HTTP_H
-#define WEBKIT_SOUP_REQUEST_HTTP_H 1
-
-#include "soup-request.h"
-
-G_BEGIN_DECLS
-
-#define WEBKIT_TYPE_SOUP_REQUEST_HTTP            (webkit_soup_request_http_get_type ())
-#define WEBKIT_SOUP_REQUEST_HTTP(object)         (G_TYPE_CHECK_INSTANCE_CAST ((object), WEBKIT_TYPE_SOUP_REQUEST_HTTP, WebKitSoupRequestHTTP))
-#define WEBKIT_SOUP_REQUEST_HTTP_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), WEBKIT_TYPE_SOUP_REQUEST_HTTP, WebKitSoupRequestHTTPClass))
-#define WEBKIT_IS_SOUP_REQUEST_HTTP(object)      (G_TYPE_CHECK_INSTANCE_TYPE ((object), WEBKIT_TYPE_SOUP_REQUEST_HTTP))
-#define WEBKIT_IS_SOUP_REQUEST_HTTP_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), WEBKIT_TYPE_SOUP_REQUEST_HTTP))
-#define WEBKIT_SOUP_REQUEST_HTTP_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj), WEBKIT_TYPE_SOUP_REQUEST_HTTP, WebKitSoupRequestHTTPClass))
-
-typedef struct _WebKitSoupRequestHTTPPrivate WebKitSoupRequestHTTPPrivate;
-
-typedef struct {
-	WebKitSoupRequest parent;
-
-	WebKitSoupRequestHTTPPrivate *priv;
-} WebKitSoupRequestHTTP;
-
-typedef struct {
-	WebKitSoupRequestClass parent;
-} WebKitSoupRequestHTTPClass;
-
-GType webkit_soup_request_http_get_type (void);
-
-SoupMessage  *webkit_soup_request_http_get_message (WebKitSoupRequestHTTP *http);
-
-G_END_DECLS
-
-#endif /* WEBKIT_SOUP_REQUEST_HTTP_H */
diff --git a/Source/WebCore/platform/network/soup/cache/soup-request.c b/Source/WebCore/platform/network/soup/cache/soup-request.c
deleted file mode 100644
index 46b9f5a..0000000
--- a/Source/WebCore/platform/network/soup/cache/soup-request.c
+++ /dev/null
@@ -1,312 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
-/*
- * soup-request.c: Protocol-independent streaming request interface
- *
- * Copyright (C) 2009 Red Hat, Inc.
- * Copyright (C) 2010, Igalia S.L.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifdef HAVE_CONFIG_H
-#include <config.h>
-#endif
-
-#include <glib/gi18n.h>
-
-#include "soup-request.h"
-#include "soup-requester.h"
-
-/**
- * SECTION:soup-request
- * @short_description: Protocol-independent streaming request interface
- *
- * FIXME
- **/
-
-/**
- * WebKitSoupRequest:
- *
- * FIXME
- *
- * Since: 2.30
- **/
-
-static void webkit_soup_request_initable_interface_init (GInitableIface *initable_interface);
-
-G_DEFINE_TYPE_WITH_CODE (WebKitSoupRequest, webkit_soup_request, G_TYPE_OBJECT,
-			 G_IMPLEMENT_INTERFACE (G_TYPE_INITABLE,
-						webkit_soup_request_initable_interface_init))
-
-enum {
-	PROP_0,
-	PROP_URI,
-	PROP_SESSION
-};
-
-struct _WebKitSoupRequestPrivate {
-	SoupURI *uri;
-	SoupSession *session;
-};
-
-static void
-webkit_soup_request_init (WebKitSoupRequest *request)
-{
-	request->priv = G_TYPE_INSTANCE_GET_PRIVATE (request, WEBKIT_TYPE_SOUP_REQUEST, WebKitSoupRequestPrivate);
-}
-
-static void
-webkit_soup_request_finalize (GObject *object)
-{
-	WebKitSoupRequest *request = WEBKIT_SOUP_REQUEST (object);
-
-	if (request->priv->uri)
-		soup_uri_free (request->priv->uri);
-	if (request->priv->session)
-		g_object_unref (request->priv->session);
-
-	G_OBJECT_CLASS (webkit_soup_request_parent_class)->finalize (object);
-}
-
-static void
-webkit_soup_request_set_property (GObject      *object,
-				  guint prop_id,
-				  const GValue *value,
-				  GParamSpec   *pspec)
-{
-	WebKitSoupRequest *request = WEBKIT_SOUP_REQUEST (object);
-
-	switch (prop_id) {
-	case PROP_URI:
-		if (request->priv->uri)
-			soup_uri_free (request->priv->uri);
-		request->priv->uri = g_value_dup_boxed (value);
-		break;
-	case PROP_SESSION:
-		if (request->priv->session)
-			g_object_unref (request->priv->session);
-		request->priv->session = g_value_dup_object (value);
-		break;
-	default:
-		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
-		break;
-	}
-}
-
-static void
-webkit_soup_request_get_property (GObject    *object,
-				  guint prop_id,
-				  GValue     *value,
-				  GParamSpec *pspec)
-{
-	WebKitSoupRequest *request = WEBKIT_SOUP_REQUEST (object);
-
-	switch (prop_id) {
-	case PROP_URI:
-		g_value_set_boxed (value, request->priv->uri);
-		break;
-	case PROP_SESSION:
-		g_value_set_object (value, request->priv->session);
-		break;
-	default:
-		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
-		break;
-	}
-}
-
-static gboolean
-webkit_soup_request_initable_init (GInitable     *initable,
-				   GCancellable  *cancellable,
-				   GError       **error)
-{
-	WebKitSoupRequest *request = WEBKIT_SOUP_REQUEST (initable);
-	gboolean ok;
-
-	if (!request->priv->uri) {
-		g_set_error (error, WEBKIT_SOUP_ERROR, WEBKIT_SOUP_ERROR_BAD_URI,
-			     _ ("No URI provided"));
-		return FALSE;
-	}
-
-	ok = WEBKIT_SOUP_REQUEST_GET_CLASS (initable)->
-		check_uri (request, request->priv->uri, error);
-
-	if (!ok && error) {
-		char *uri_string = soup_uri_to_string (request->priv->uri, FALSE);
-		g_set_error (error, WEBKIT_SOUP_ERROR, WEBKIT_SOUP_ERROR_BAD_URI,
-			     _ ("Invalid '%s' URI: %s"),
-			     request->priv->uri->scheme,
-			     uri_string);
-		g_free (uri_string);
-	}
-
-	return ok;
-}
-
-static gboolean
-webkit_soup_request_default_check_uri (WebKitSoupRequest  *request,
-				       SoupURI      *uri,
-				       GError      **error)
-{
-	return TRUE;
-}
-
-/* Default implementation: assume the sync implementation doesn't block */
-static void
-webkit_soup_request_default_send_async (WebKitSoupRequest          *request,
-					GCancellable         *cancellable,
-					GAsyncReadyCallback callback,
-					gpointer user_data)
-{
-	GSimpleAsyncResult *simple;
-
-	simple = g_simple_async_result_new (G_OBJECT (request),
-					    callback, user_data,
-					    webkit_soup_request_default_send_async);
-	g_simple_async_result_complete_in_idle (simple);
-	g_object_unref (simple);
-}
-
-static GInputStream *
-webkit_soup_request_default_send_finish (WebKitSoupRequest          *request,
-					 GAsyncResult         *result,
-					 GError              **error)
-{
-	g_return_val_if_fail (g_simple_async_result_is_valid (result, G_OBJECT (request), webkit_soup_request_default_send_async), NULL);
-
-	return webkit_soup_request_send (request, NULL, error);
-}
-
-GInputStream *
-webkit_soup_request_send (WebKitSoupRequest          *request,
-			  GCancellable         *cancellable,
-			  GError              **error)
-{
-	return WEBKIT_SOUP_REQUEST_GET_CLASS (request)->
-		send (request, cancellable, error);
-}
-
-void
-webkit_soup_request_send_async (WebKitSoupRequest          *request,
-				GCancellable         *cancellable,
-				GAsyncReadyCallback callback,
-				gpointer user_data)
-{
-	WEBKIT_SOUP_REQUEST_GET_CLASS (request)->
-		send_async (request, cancellable, callback, user_data);
-}
-
-GInputStream *
-webkit_soup_request_send_finish (WebKitSoupRequest          *request,
-				 GAsyncResult         *result,
-				 GError              **error)
-{
-	return WEBKIT_SOUP_REQUEST_GET_CLASS (request)->
-		send_finish (request, result, error);
-}
-
-static void
-webkit_soup_request_class_init (WebKitSoupRequestClass *request_class)
-{
-	GObjectClass *object_class = G_OBJECT_CLASS (request_class);
-
-	g_type_class_add_private (request_class, sizeof (WebKitSoupRequestPrivate));
-
-	request_class->check_uri = webkit_soup_request_default_check_uri;
-	request_class->send_async = webkit_soup_request_default_send_async;
-	request_class->send_finish = webkit_soup_request_default_send_finish;
-
-	object_class->finalize = webkit_soup_request_finalize;
-	object_class->set_property = webkit_soup_request_set_property;
-	object_class->get_property = webkit_soup_request_get_property;
-
-	g_object_class_install_property (
-		 object_class, PROP_URI,
-		 g_param_spec_boxed (WEBKIT_SOUP_REQUEST_URI,
-				     "URI",
-				     "The request URI",
-				     SOUP_TYPE_URI,
-				     G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY));
-	g_object_class_install_property (
-		 object_class, PROP_SESSION,
-		 g_param_spec_object (WEBKIT_SOUP_REQUEST_SESSION,
-				      "Session",
-				      "The request's session",
-				      SOUP_TYPE_SESSION,
-				      G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY));
-}
-
-static void
-webkit_soup_request_initable_interface_init (GInitableIface *initable_interface)
-{
-	initable_interface->init = webkit_soup_request_initable_init;
-}
-
-SoupURI *
-webkit_soup_request_get_uri (WebKitSoupRequest *request)
-{
-	return request->priv->uri;
-}
-
-SoupSession *
-webkit_soup_request_get_session (WebKitSoupRequest *request)
-{
-	return request->priv->session;
-}
-
-goffset
-webkit_soup_request_get_content_length (WebKitSoupRequest *request)
-{
-	return WEBKIT_SOUP_REQUEST_GET_CLASS (request)->get_content_length (request);
-}
-
-const char *
-webkit_soup_request_get_content_type (WebKitSoupRequest  *request)
-{
-	return WEBKIT_SOUP_REQUEST_GET_CLASS (request)->get_content_type (request);
-}
-
-#define XDIGIT(c) ((c) <= '9' ? (c) - '0' : ((c) & 0x4F) - 'A' + 10)
-#define HEXCHAR(s) ((XDIGIT (s[1]) << 4) + XDIGIT (s[2]))
-
-/* Copy&pasted from libsoup's soup-uri.c after applying the patch in
- * https://bugzilla.gnome.org/show_bug.cgi?id=630540. We need this
- * instead of soup_uri_decode() as it incorrectly returns NULL for
- * incorrectly encoded URLs. TODO: remove this when required libsoup
- * version is bumped out to 2.32.1
- */
-gchar *
-webkit_soup_request_uri_decoded_copy (const char *part, int length)
-{
-	unsigned char *s, *d;
-        char *decoded = g_strndup (part, length);
-
-        s = d = (unsigned char *)decoded;
-        do {
-                if (*s == '%') {
-                        if (!g_ascii_isxdigit (s[1]) ||
-                            !g_ascii_isxdigit (s[2])) {
-                                *d++ = *s;
-                                continue;
-                        }
-                        *d++ = HEXCHAR (s);
-                        s += 2;
-                } else
-                        *d++ = *s;
-        } while (*s++);
-
-        return decoded;
-}
diff --git a/Source/WebCore/platform/network/soup/cache/soup-request.h b/Source/WebCore/platform/network/soup/cache/soup-request.h
deleted file mode 100644
index 837d8f4..0000000
--- a/Source/WebCore/platform/network/soup/cache/soup-request.h
+++ /dev/null
@@ -1,100 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
-/*
- * Copyright (C) 2009 Red Hat, Inc.
- * Copyright (C) 2010 Igalia, S.L.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifndef WEBKIT_SOUP_REQUEST_H
-#define WEBKIT_SOUP_REQUEST_H 1
-
-#include <libsoup/soup.h>
-#include <gio/gio.h>
-
-G_BEGIN_DECLS
-
-#define WEBKIT_TYPE_SOUP_REQUEST            (webkit_soup_request_get_type ())
-#define WEBKIT_SOUP_REQUEST(obj)            (G_TYPE_CHECK_INSTANCE_CAST ((obj), WEBKIT_TYPE_SOUP_REQUEST, WebKitSoupRequest))
-#define WEBKIT_SOUP_REQUEST_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), WEBKIT_TYPE_SOUP_REQUEST, WebKitSoupRequestClass))
-#define WEBKIT_IS_SOUP_REQUEST(obj)         (G_TYPE_CHECK_INSTANCE_TYPE ((obj), WEBKIT_TYPE_SOUP_REQUEST))
-#define WEBKIT_IS_SOUP_REQUEST_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), WEBKIT_TYPE_SOUP_REQUEST))
-#define WEBKIT_SOUP_REQUEST_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj), WEBKIT_TYPE_SOUP_REQUEST, WebKitSoupRequestClass))
-
-typedef struct _WebKitSoupRequest WebKitSoupRequest;
-typedef struct _WebKitSoupRequestPrivate WebKitSoupRequestPrivate;
-typedef struct _WebKitSoupRequestClass WebKitSoupRequestClass;
-
-struct _WebKitSoupRequest {
-	GObject parent;
-
-	WebKitSoupRequestPrivate *priv;
-};
-
-struct _WebKitSoupRequestClass {
-	GObjectClass parent;
-
-	gboolean (*check_uri)(WebKitSoupRequest          *req_base,
-			      SoupURI              *uri,
-			      GError              **error);
-
-	GInputStream * (*send)(WebKitSoupRequest          *request,
-			       GCancellable         *cancellable,
-			       GError              **error);
-	void (*send_async)(WebKitSoupRequest          *request,
-			   GCancellable         *cancellable,
-			   GAsyncReadyCallback callback,
-			   gpointer user_data);
-	GInputStream * (*send_finish)(WebKitSoupRequest          *request,
-				      GAsyncResult         *result,
-				      GError              **error);
-
-	goffset (*get_content_length)(WebKitSoupRequest   *request);
-	const char *   (*get_content_type)(WebKitSoupRequest   *request);
-};
-
-GType webkit_soup_request_get_type (void);
-
-#define WEBKIT_SOUP_REQUEST_URI     "uri"
-#define WEBKIT_SOUP_REQUEST_SESSION "session"
-
-GInputStream *webkit_soup_request_send (WebKitSoupRequest          *request,
-					GCancellable         *cancellable,
-					GError              **error);
-void          webkit_soup_request_send_async (WebKitSoupRequest          *request,
-					      GCancellable         *cancellable,
-					      GAsyncReadyCallback callback,
-					      gpointer user_data);
-GInputStream *webkit_soup_request_send_finish (WebKitSoupRequest          *request,
-					       GAsyncResult         *result,
-					       GError              **error);
-
-SoupURI      *webkit_soup_request_get_uri (WebKitSoupRequest          *request);
-SoupSession  *webkit_soup_request_get_session (WebKitSoupRequest          *request);
-
-goffset       webkit_soup_request_get_content_length (WebKitSoupRequest          *request);
-const char   *webkit_soup_request_get_content_type (WebKitSoupRequest          *request);
-
-/* Used by WebKitSoupRequestFile and WebKitSoupRequestData. Ideally
- * should be located in some util file but I'll place it here as it
- * will be removed with libsoup 2.32.1 that will ship fixed versions
- * of soup_uri_decode/normalize
- */
-gchar *webkit_soup_request_uri_decoded_copy (const char *part, int length);
-
-G_END_DECLS
-
-#endif /* WEBKIT_SOUP_REQUEST_H */
diff --git a/Source/WebCore/platform/network/soup/cache/soup-requester.c b/Source/WebCore/platform/network/soup/cache/soup-requester.c
deleted file mode 100644
index 4d8a860..0000000
--- a/Source/WebCore/platform/network/soup/cache/soup-requester.c
+++ /dev/null
@@ -1,188 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
-/*
- * soup-requester.c:
- *
- * Copyright (C) 2010, Igalia S.L.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-#include "soup-requester.h"
-
-#include "soup-request-data.h"
-#include "soup-request-file.h"
-#include "soup-request-http.h"
-#include <glib/gi18n.h>
-#include <libsoup/soup.h>
-
-struct _WebKitSoupRequesterPrivate {
-	GHashTable *request_types;
-};
-
-#define WEBKIT_SOUP_REQUESTER_GET_PRIVATE(o) (G_TYPE_INSTANCE_GET_PRIVATE ((o), WEBKIT_TYPE_SOUP_REQUESTER, WebKitSoupRequesterPrivate))
-
-G_DEFINE_TYPE (WebKitSoupRequester, webkit_soup_requester, G_TYPE_OBJECT)
-
-static void webkit_soup_requester_init (WebKitSoupRequester *requester)
-{
-	requester->priv = WEBKIT_SOUP_REQUESTER_GET_PRIVATE (requester);
-
-	requester->priv->request_types = 0;
-}
-
-static void finalize (GObject *object)
-{
-	WebKitSoupRequester *requester = WEBKIT_SOUP_REQUESTER (object);
-
-	if (requester->priv->request_types)
-		g_hash_table_destroy (requester->priv->request_types);
-
-	G_OBJECT_CLASS (webkit_soup_requester_parent_class)->finalize (object);
-}
-
-static void webkit_soup_requester_class_init (WebKitSoupRequesterClass *requester_class)
-{
-	GObjectClass *object_class = G_OBJECT_CLASS (requester_class);
-
-	g_type_class_add_private (requester_class, sizeof (WebKitSoupRequesterPrivate));
-
-	/* virtual method override */
-	object_class->finalize = finalize;
-}
-
-static void init_request_types (WebKitSoupRequesterPrivate *priv)
-{
-	if (priv->request_types)
-		return;
-
-	priv->request_types = g_hash_table_new_full (soup_str_case_hash,
-						     soup_str_case_equal,
-						     g_free, 0);
-	g_hash_table_insert (priv->request_types, g_strdup ("file"),
-			     GSIZE_TO_POINTER (WEBKIT_TYPE_SOUP_REQUEST_FILE));
-	g_hash_table_insert (priv->request_types, g_strdup ("data"),
-			     GSIZE_TO_POINTER (WEBKIT_TYPE_SOUP_REQUEST_DATA));
-	g_hash_table_insert (priv->request_types, g_strdup ("http"),
-			     GSIZE_TO_POINTER (WEBKIT_TYPE_SOUP_REQUEST_HTTP));
-	g_hash_table_insert (priv->request_types, g_strdup ("https"),
-			     GSIZE_TO_POINTER (WEBKIT_TYPE_SOUP_REQUEST_HTTP));
-	g_hash_table_insert (priv->request_types, g_strdup ("ftp"),
-			     GSIZE_TO_POINTER (WEBKIT_TYPE_SOUP_REQUEST_FILE));
-}
-
-WebKitSoupRequester *webkit_soup_requester_new (void)
-{
-	return (WebKitSoupRequester *)g_object_new (WEBKIT_TYPE_SOUP_REQUESTER, NULL);
-}
-
-WebKitSoupRequest *webkit_soup_requester_request (WebKitSoupRequester *requester, const char *uriString, SoupSession *session, GError **error)
-{
-	SoupURI *uri = NULL;
-	WebKitSoupRequest *req;
-
-	uri = soup_uri_new (uriString);
-	if (!uri) {
-		g_set_error (error, WEBKIT_SOUP_ERROR, WEBKIT_SOUP_ERROR_BAD_URI,
-			     _ ("Could not parse URI '%s'"), uriString);
-		return 0;
-	}
-
-	req = webkit_soup_requester_request_uri (requester, uri, session, error);
-	soup_uri_free (uri);
-	return req;
-}
-
-WebKitSoupRequest *webkit_soup_requester_request_uri (WebKitSoupRequester *requester, SoupURI *uri, SoupSession *session, GError **error)
-{
-	GType requestType;
-
-	g_return_val_if_fail (WEBKIT_IS_SOUP_REQUESTER (requester), 0);
-
-	init_request_types (requester->priv);
-	requestType = (GType)GPOINTER_TO_SIZE (g_hash_table_lookup (requester->priv->request_types, uri->scheme));
-	if (!requestType) {
-		g_set_error (error, WEBKIT_SOUP_ERROR, WEBKIT_SOUP_ERROR_UNSUPPORTED_URI_SCHEME,
-			     _ ("Unsupported URI scheme '%s'"), uri->scheme);
-		return 0;
-	}
-
-	if (g_type_is_a (requestType, G_TYPE_INITABLE)) {
-		return (WebKitSoupRequest *)g_initable_new (requestType, 0, error,
-							    "uri", uri,
-							    "session", session,
-							    NULL);
-	} else {
-		return (WebKitSoupRequest *)g_object_new (requestType,
-							  "uri", uri,
-							  "session", session,
-							  NULL);
-	}
-}
-
-/* RFC 2396, 3.1 */
-static gboolean
-soup_scheme_is_valid (const char *scheme)
-{
-	if (scheme == NULL ||
-	    !g_ascii_isalpha (*scheme))
-		return FALSE;
-
-	scheme++;
-	while (*scheme) {
-		if (!g_ascii_isalpha (*scheme) &&
-		    !g_ascii_isdigit (*scheme) &&
-		    *scheme != '+' &&
-		    *scheme != '-' &&
-		    *scheme != '.')
-			return FALSE;
-		scheme++;
-	}
-	return TRUE;
-}
-
-void
-webkit_soup_requester_add_protocol (WebKitSoupRequester *requester,
-				    const char  *scheme,
-				    GType request_type)
-{
-	g_return_if_fail (WEBKIT_IS_SOUP_REQUESTER (requester));
-	g_return_if_fail (soup_scheme_is_valid (scheme));
-
-	init_request_types (requester->priv);
-	g_hash_table_insert (requester->priv->request_types, g_strdup (scheme),
-			     GSIZE_TO_POINTER (request_type));
-}
-
-void
-webkit_soup_requester_remove_protocol (WebKitSoupRequester *requester,
-				       const char  *scheme)
-{
-	g_return_if_fail (WEBKIT_IS_SOUP_REQUESTER (requester));
-	g_return_if_fail (soup_scheme_is_valid (scheme));
-
-	init_request_types (requester->priv);
-	g_hash_table_remove (requester->priv->request_types, scheme);
-}
-
-GQuark
-webkit_soup_error_quark (void)
-{
-	static GQuark error;
-	if (!error)
-		error = g_quark_from_static_string ("webkit_soup_error_quark");
-	return error;
-}
diff --git a/Source/WebCore/platform/network/soup/cache/soup-requester.h b/Source/WebCore/platform/network/soup/cache/soup-requester.h
deleted file mode 100644
index 71ff103..0000000
--- a/Source/WebCore/platform/network/soup/cache/soup-requester.h
+++ /dev/null
@@ -1,81 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
-/*
- * Copyright (C) 2010 Igalia S.L.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifndef WEBKIT_SOUP_REQUESTER_H
-#define WEBKIT_SOUP_REQUESTER_H 1
-
-#include "soup-request.h"
-#include <libsoup/soup.h>
-
-G_BEGIN_DECLS
-
-#define WEBKIT_TYPE_SOUP_REQUESTER            (webkit_soup_requester_get_type ())
-#define WEBKIT_SOUP_REQUESTER(obj)            (G_TYPE_CHECK_INSTANCE_CAST ((obj), WEBKIT_TYPE_SOUP_REQUESTER, WebKitSoupRequester))
-#define WEBKIT_SOUP_REQUESTER_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), WEBKIT_TYPE_SOUP_REQUESTER, WebKitSoupRequesterClass))
-#define WEBKIT_IS_SOUP_REQUESTER(obj)         (G_TYPE_CHECK_INSTANCE_TYPE ((obj), WEBKIT_TYPE_SOUP_REQUESTER))
-#define WEBKIT_IS_SOUP_REQUESTER_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((obj), WEBKIT_TYPE_SOUP_REQUESTER))
-#define WEBKIT_SOUP_REQUESTER_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj), WEBKIT_TYPE_SOUP_REQUESTER, WebKitSoupRequesterClass))
-
-#define WEBKIT_SOUP_ERROR webkit_soup_error_quark ()
-
-typedef enum {
-	WEBKIT_SOUP_ERROR_BAD_URI,
-	WEBKIT_SOUP_ERROR_UNSUPPORTED_URI_SCHEME
-} WebKitSoupError;
-
-typedef struct _WebKitSoupRequester WebKitSoupRequester;
-typedef struct _WebKitSoupRequesterPrivate WebKitSoupRequesterPrivate;
-
-struct _WebKitSoupRequester {
-	GObject parent;
-
-	WebKitSoupRequesterPrivate *priv;
-};
-
-typedef struct {
-	GObjectClass parent_class;
-} WebKitSoupRequesterClass;
-
-GType webkit_soup_requester_get_type (void);
-
-WebKitSoupRequester *webkit_soup_requester_new (void);
-
-GQuark webkit_soup_error_quark (void);
-
-WebKitSoupRequest *webkit_soup_requester_request (WebKitSoupRequester *requester,
-						  const char *uriString,
-						  SoupSession *session,
-						  GError **error);
-
-WebKitSoupRequest *webkit_soup_requester_request_uri (WebKitSoupRequester *requester,
-						      SoupURI *uri,
-						      SoupSession *session,
-						      GError **error);
-
-void webkit_soup_requester_add_protocol (WebKitSoupRequester *requester,
-					 const char  *scheme,
-					 GType request_type);
-
-void webkit_soup_requester_remove_protocol (WebKitSoupRequester *requester,
-					    const char  *scheme);
-
-G_END_DECLS
-
-#endif /* WEBKIT_SOUP_REQUESTER_H */
diff --git a/Source/WebCore/platform/network/soup/cache/webkit/soup-cache-private.h b/Source/WebCore/platform/network/soup/cache/webkit/soup-cache-private.h
deleted file mode 100644
index 8af8de2..0000000
--- a/Source/WebCore/platform/network/soup/cache/webkit/soup-cache-private.h
+++ /dev/null
@@ -1,42 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
-/*
- * soup-cache-private.h:
- *
- * Copyright (C) 2010 Igalia, S.L.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifndef WEBKIT_SOUP_CACHE_PRIVATE_H
-#define WEBKIT_SOUP_CACHE_PRIVATE_H 1
-
-#include "soup-cache.h"
-#include <libsoup/soup-message.h>
-
-G_BEGIN_DECLS
-
-WebKitSoupCacheResponse webkit_soup_cache_has_response (WebKitSoupCache   *cache,
-							SoupMessage *msg);
-GInputStream *webkit_soup_cache_send_response (WebKitSoupCache   *cache,
-					       SoupMessage *msg);
-WebKitSoupCacheability  webkit_soup_cache_get_cacheability (WebKitSoupCache   *cache,
-							    SoupMessage *msg);
-SoupMessage *webkit_soup_cache_generate_conditional_request (WebKitSoupCache   *cache,
-							     SoupMessage *original);
-
-G_END_DECLS
-
-#endif /* WEBKIT_SOUP_CACHE_PRIVATE_H */
diff --git a/Source/WebCore/platform/network/soup/cache/webkit/soup-cache.c b/Source/WebCore/platform/network/soup/cache/webkit/soup-cache.c
deleted file mode 100644
index b96428d..0000000
--- a/Source/WebCore/platform/network/soup/cache/webkit/soup-cache.c
+++ /dev/null
@@ -1,1677 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
-/*
- * soup-cache.c
- *
- * Copyright (C) 2009, 2010 Igalia S.L.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-/* TODO:
- * - Need to hook the feature in the sync SoupSession.
- * - Need more tests.
- */
-
-#ifdef HAVE_CONFIG_H
-#include <config.h>
-#endif
-
-#include "soup-cache.h"
-#include "soup-cache-private.h"
-#include <libsoup/soup.h>
-#include <gio/gio.h>
-#include <stdlib.h>
-
-static SoupSessionFeatureInterface *webkit_soup_cache_default_feature_interface;
-static void webkit_soup_cache_session_feature_init (SoupSessionFeatureInterface *feature_interface, gpointer interface_data);
-
-#define DEFAULT_MAX_SIZE 50 * 1024 * 1024
-#define MAX_ENTRY_DATA_PERCENTAGE 10 /* Percentage of the total size
-	                                of the cache that can be
-	                                filled by a single entry */
-
-typedef struct _WebKitSoupCacheEntry {
-	char *key;
-	char *filename;
-	guint freshness_lifetime;
-	gboolean must_revalidate;
-	GString *data;
-	gsize pos;
-	gsize length;
-	time_t corrected_initial_age;
-	time_t response_time;
-	gboolean writing;
-	gboolean dirty;
-	gboolean got_body;
-	gboolean being_validated;
-	SoupMessageHeaders *headers;
-	GOutputStream *stream;
-	GError *error;
-	guint hits;
-	GCancellable *cancellable;
-} WebKitSoupCacheEntry;
-
-struct _WebKitSoupCachePrivate {
-	char *cache_dir;
-	GHashTable *cache;
-	guint n_pending;
-	SoupSession *session;
-	WebKitSoupCacheType cache_type;
-	guint size;
-	guint max_size;
-	guint max_entry_data_size; /* Computed value. Here for performance reasons */
-	GList *lru_start;
-};
-
-typedef struct {
-	WebKitSoupCache *cache;
-	WebKitSoupCacheEntry *entry;
-	SoupMessage *msg;
-	gulong got_chunk_handler;
-	gulong got_body_handler;
-	gulong restarted_handler;
-} WebKitSoupCacheWritingFixture;
-
-enum {
-	PROP_0,
-	PROP_CACHE_DIR,
-	PROP_CACHE_TYPE
-};
-
-#define WEBKIT_SOUP_CACHE_GET_PRIVATE(o) (G_TYPE_INSTANCE_GET_PRIVATE ((o), WEBKIT_TYPE_SOUP_CACHE, WebKitSoupCachePrivate))
-
-G_DEFINE_TYPE_WITH_CODE (WebKitSoupCache, webkit_soup_cache, G_TYPE_OBJECT,
-			 G_IMPLEMENT_INTERFACE (SOUP_TYPE_SESSION_FEATURE,
-						webkit_soup_cache_session_feature_init))
-
-static gboolean webkit_soup_cache_entry_remove (WebKitSoupCache *cache, WebKitSoupCacheEntry *entry);
-static void make_room_for_new_entry (WebKitSoupCache *cache, guint length_to_add);
-static gboolean cache_accepts_entries_of_size (WebKitSoupCache *cache, guint length_to_add);
-
-static WebKitSoupCacheability
-get_cacheability (WebKitSoupCache *cache, SoupMessage *msg)
-{
-	WebKitSoupCacheability cacheability;
-	const char *cache_control;
-
-	/* 1. The request method must be cacheable */
-	if (msg->method == SOUP_METHOD_GET)
-		cacheability = WEBKIT_SOUP_CACHE_CACHEABLE;
-	else if (msg->method == SOUP_METHOD_HEAD ||
-		 msg->method == SOUP_METHOD_TRACE ||
-		 msg->method == SOUP_METHOD_CONNECT)
-		return WEBKIT_SOUP_CACHE_UNCACHEABLE;
-	else
-		return (WEBKIT_SOUP_CACHE_UNCACHEABLE | WEBKIT_SOUP_CACHE_INVALIDATES);
-
-	cache_control = soup_message_headers_get (msg->response_headers, "Cache-Control");
-	if (cache_control) {
-		GHashTable *hash;
-		WebKitSoupCachePrivate *priv = WEBKIT_SOUP_CACHE_GET_PRIVATE (cache);
-
-		hash = soup_header_parse_param_list (cache_control);
-
-		/* Shared caches MUST NOT store private resources */
-		if (priv->cache_type == WEBKIT_SOUP_CACHE_SHARED) {
-			if (g_hash_table_lookup_extended (hash, "private", NULL, NULL)) {
-				soup_header_free_param_list (hash);
-				return WEBKIT_SOUP_CACHE_UNCACHEABLE;
-			}
-		}
-
-		/* 2. The 'no-store' cache directive does not appear in the
-		 * headers
-		 */
-		if (g_hash_table_lookup_extended (hash, "no-store", NULL, NULL)) {
-			soup_header_free_param_list (hash);
-			return WEBKIT_SOUP_CACHE_UNCACHEABLE;
-		}
-
-		/* This does not appear in section 2.1, but I think it makes
-		 * sense to check it too?
-		 */
-		if (g_hash_table_lookup_extended (hash, "no-cache", NULL, NULL)) {
-			soup_header_free_param_list (hash);
-			return WEBKIT_SOUP_CACHE_UNCACHEABLE;
-		}
-
-		soup_header_free_param_list (hash);
-	}
-
-	switch (msg->status_code) {
-	case SOUP_STATUS_PARTIAL_CONTENT:
-		/* We don't cache partial responses, but they only
-		 * invalidate cached full responses if the headers
-		 * don't match.
-		 */
-		cacheability = WEBKIT_SOUP_CACHE_UNCACHEABLE;
-		break;
-
-	case SOUP_STATUS_NOT_MODIFIED:
-		/* A 304 response validates an existing cache entry */
-		cacheability = WEBKIT_SOUP_CACHE_VALIDATES;
-		break;
-
-	case SOUP_STATUS_MULTIPLE_CHOICES:
-	case SOUP_STATUS_MOVED_PERMANENTLY:
-	case SOUP_STATUS_GONE:
-		/* FIXME: cacheable unless indicated otherwise */
-		cacheability = WEBKIT_SOUP_CACHE_UNCACHEABLE;
-		break;
-
-	case SOUP_STATUS_FOUND:
-	case SOUP_STATUS_TEMPORARY_REDIRECT:
-		/* FIXME: cacheable if explicitly indicated */
-		cacheability = WEBKIT_SOUP_CACHE_UNCACHEABLE;
-		break;
-
-	case SOUP_STATUS_SEE_OTHER:
-	case SOUP_STATUS_FORBIDDEN:
-	case SOUP_STATUS_NOT_FOUND:
-	case SOUP_STATUS_METHOD_NOT_ALLOWED:
-		return (WEBKIT_SOUP_CACHE_UNCACHEABLE | WEBKIT_SOUP_CACHE_INVALIDATES);
-
-	default:
-		/* Any 5xx status or any 4xx status not handled above
-		 * is uncacheable but doesn't break the cache.
-		 */
-		if ((msg->status_code >= SOUP_STATUS_BAD_REQUEST &&
-		     msg->status_code <= SOUP_STATUS_FAILED_DEPENDENCY) ||
-		    msg->status_code >= SOUP_STATUS_INTERNAL_SERVER_ERROR)
-			return WEBKIT_SOUP_CACHE_UNCACHEABLE;
-
-		/* An unrecognized 2xx, 3xx, or 4xx response breaks
-		 * the cache.
-		 */
-		if ((msg->status_code > SOUP_STATUS_PARTIAL_CONTENT &&
-		     msg->status_code < SOUP_STATUS_MULTIPLE_CHOICES) ||
-		    (msg->status_code > SOUP_STATUS_TEMPORARY_REDIRECT &&
-		     msg->status_code < SOUP_STATUS_INTERNAL_SERVER_ERROR))
-			return (WEBKIT_SOUP_CACHE_UNCACHEABLE | WEBKIT_SOUP_CACHE_INVALIDATES);
-		break;
-	}
-
-	return cacheability;
-}
-
-static void
-webkit_soup_cache_entry_free (WebKitSoupCacheEntry *entry, gboolean purge)
-{
-	if (purge) {
-		GFile *file = g_file_new_for_path (entry->filename);
-		g_file_delete (file, NULL, NULL);
-		g_object_unref (file);
-	}
-
-	g_free (entry->filename);
-	entry->filename = NULL;
-	g_free (entry->key);
-	entry->key = NULL;
-
-	if (entry->headers) {
-		soup_message_headers_free (entry->headers);
-		entry->headers = NULL;
-	}
-
-	if (entry->data) {
-		g_string_free (entry->data, TRUE);
-		entry->data = NULL;
-	}
-	if (entry->error) {
-		g_error_free (entry->error);
-		entry->error = NULL;
-	}
-	if (entry->cancellable) {
-		g_object_unref (entry->cancellable);
-		entry->cancellable = NULL;
-	}
-
-	g_slice_free (WebKitSoupCacheEntry, entry);
-}
-
-static void
-copy_headers (const char *name, const char *value, SoupMessageHeaders *headers)
-{
-	soup_message_headers_append (headers, name, value);
-}
-
-static void
-update_headers (const char *name, const char *value, SoupMessageHeaders *headers)
-{
-	if (soup_message_headers_get (headers, name))
-		soup_message_headers_replace (headers, name, value);
-	else
-		soup_message_headers_append (headers, name, value);
-}
-
-static guint
-webkit_soup_cache_entry_get_current_age (WebKitSoupCacheEntry *entry)
-{
-	time_t now = time (NULL);
-	time_t resident_time;
-
-	resident_time = now - entry->response_time;
-	return entry->corrected_initial_age + resident_time;
-}
-
-static gboolean
-webkit_soup_cache_entry_is_fresh_enough (WebKitSoupCacheEntry *entry, gint min_fresh)
-{
-	guint limit = (min_fresh == -1) ? webkit_soup_cache_entry_get_current_age (entry) : (guint) min_fresh;
-	return entry->freshness_lifetime > limit;
-}
-
-static char *
-soup_message_get_cache_key (SoupMessage *msg)
-{
-	SoupURI *uri = soup_message_get_uri (msg);
-	return soup_uri_to_string (uri, FALSE);
-}
-
-static void
-webkit_soup_cache_entry_set_freshness (WebKitSoupCacheEntry *entry, SoupMessage *msg, WebKitSoupCache *cache)
-{
-	const char *cache_control;
-	const char *expires, *date, *last_modified;
-
-	cache_control = soup_message_headers_get (entry->headers, "Cache-Control");
-	if (cache_control) {
-		const char *max_age, *s_maxage;
-		gint64 freshness_lifetime = 0;
-		GHashTable *hash;
-		WebKitSoupCachePrivate *priv = WEBKIT_SOUP_CACHE_GET_PRIVATE (cache);
-
-		hash = soup_header_parse_param_list (cache_control);
-
-		/* Should we re-validate the entry when it goes stale */
-		entry->must_revalidate = g_hash_table_lookup_extended (hash, "must-revalidate", NULL, NULL);
-
-		/* Section 2.3.1 */
-		if (priv->cache_type == WEBKIT_SOUP_CACHE_SHARED) {
-			s_maxage = g_hash_table_lookup (hash, "s-maxage");
-			if (s_maxage) {
-				freshness_lifetime = g_ascii_strtoll (s_maxage, NULL, 10);
-				if (freshness_lifetime) {
-					/* Implies proxy-revalidate. TODO: is it true? */
-					entry->must_revalidate = TRUE;
-					soup_header_free_param_list (hash);
-					return;
-				}
-			}
-		}
-
-		/* If 'max-age' cache directive is present, use that */
-		max_age = g_hash_table_lookup (hash, "max-age");
-		if (max_age)
-			freshness_lifetime = g_ascii_strtoll (max_age, NULL, 10);
-
-		if (freshness_lifetime) {
-			entry->freshness_lifetime = (guint)MIN (freshness_lifetime, G_MAXUINT32);
-			soup_header_free_param_list (hash);
-			return;
-		}
-
-		soup_header_free_param_list (hash);
-	}
-
-	/* If the 'Expires' response header is present, use its value
-	 * minus the value of the 'Date' response header
-	 */
-	expires = soup_message_headers_get (entry->headers, "Expires");
-	date = soup_message_headers_get (entry->headers, "Date");
-	if (expires && date) {
-		SoupDate *expires_d, *date_d;
-		time_t expires_t, date_t;
-
-		expires_d = soup_date_new_from_string (expires);
-		if (expires_d) {
-			date_d = soup_date_new_from_string (date);
-
-			expires_t = soup_date_to_time_t (expires_d);
-			date_t = soup_date_to_time_t (date_d);
-
-			soup_date_free (expires_d);
-			soup_date_free (date_d);
-
-			if (expires_t && date_t) {
-				entry->freshness_lifetime = (guint)MAX (expires_t - date_t, 0);
-				return;
-			}
-		} else {
-			/* If Expires is not a valid date we should
-			   treat it as already expired, see section
-			   3.3 */
-			entry->freshness_lifetime = 0;
-			return;
-		}
-	}
-
-	/* Otherwise an heuristic may be used */
-
-	/* Heuristics MUST NOT be used with these status codes
-	   (section 2.3.1.1) */
-	if (msg->status_code != SOUP_STATUS_OK &&
-	    msg->status_code != SOUP_STATUS_NON_AUTHORITATIVE &&
-	    msg->status_code != SOUP_STATUS_PARTIAL_CONTENT &&
-	    msg->status_code != SOUP_STATUS_MULTIPLE_CHOICES &&
-	    msg->status_code != SOUP_STATUS_MOVED_PERMANENTLY &&
-	    msg->status_code != SOUP_STATUS_GONE)
-		goto expire;
-
-	/* TODO: attach warning 113 if response's current_age is more
-	   than 24h (section 2.3.1.1) when using heuristics */
-
-	/* Last-Modified based heuristic */
-	last_modified = soup_message_headers_get (entry->headers, "Last-Modified");
-	if (last_modified) {
-		SoupDate *soup_date;
-		time_t now, last_modified_t;
-
-		soup_date = soup_date_new_from_string (last_modified);
-		last_modified_t = soup_date_to_time_t (soup_date);
-		now = time (NULL);
-
-#define HEURISTIC_FACTOR 0.1 /* From Section 2.3.1.1 */
-
-		entry->freshness_lifetime = MAX (0, (now - last_modified_t) * HEURISTIC_FACTOR);
-		soup_date_free (soup_date);
-	}
-
-	return;
-
- expire:
-	/* If all else fails, make the entry expire immediately */
-	entry->freshness_lifetime = 0;
-}
-
-static WebKitSoupCacheEntry *
-webkit_soup_cache_entry_new (WebKitSoupCache *cache, SoupMessage *msg, time_t request_time, time_t response_time)
-{
-	WebKitSoupCacheEntry *entry;
-	SoupMessageHeaders *headers;
-	const char *date;
-	char *md5;
-
-	entry = g_slice_new0 (WebKitSoupCacheEntry);
-	entry->dirty = FALSE;
-	entry->writing = FALSE;
-	entry->got_body = FALSE;
-	entry->being_validated = FALSE;
-	entry->data = g_string_new (NULL);
-	entry->pos = 0;
-	entry->error = NULL;
-
-	/* key & filename */
-	entry->key = soup_message_get_cache_key (msg);
-	md5 = g_compute_checksum_for_string (G_CHECKSUM_MD5, entry->key, -1);
-	entry->filename = g_build_filename (cache->priv->cache_dir, md5, NULL);
-	g_free (md5);
-
-	/* Headers */
-	headers = soup_message_headers_new (SOUP_MESSAGE_HEADERS_RESPONSE);
-	soup_message_headers_foreach (msg->response_headers,
-				      (SoupMessageHeadersForeachFunc)copy_headers,
-				      headers);
-	entry->headers = headers;
-
-	/* LRU list */
-	entry->hits = 0;
-
-	/* Section 2.3.1, Freshness Lifetime */
-	webkit_soup_cache_entry_set_freshness (entry, msg, cache);
-
-	/* Section 2.3.2, Calculating Age */
-	date = soup_message_headers_get (entry->headers, "Date");
-
-	if (date) {
-		SoupDate *soup_date;
-		const char *age;
-		time_t date_value, apparent_age, corrected_received_age, response_delay, age_value = 0;
-
-		soup_date = soup_date_new_from_string (date);
-		date_value = soup_date_to_time_t (soup_date);
-		soup_date_free (soup_date);
-
-		age = soup_message_headers_get (entry->headers, "Age");
-		if (age)
-			age_value = g_ascii_strtoll (age, NULL, 10);
-
-		entry->response_time = response_time;
-		apparent_age = MAX (0, entry->response_time - date_value);
-		corrected_received_age = MAX (apparent_age, age_value);
-		response_delay = entry->response_time - request_time;
-		entry->corrected_initial_age = corrected_received_age + response_delay;
-	} else {
-		/* Is this correct ? */
-		entry->corrected_initial_age = time (NULL);
-	}
-
-	return entry;
-}
-
-static void
-webkit_soup_cache_writing_fixture_free (WebKitSoupCacheWritingFixture *fixture)
-{
-	/* Free fixture. And disconnect signals, we don't want to
-	   listen to more SoupMessage events as we're finished with
-	   this resource */
-	if (g_signal_handler_is_connected (fixture->msg, fixture->got_chunk_handler))
-		g_signal_handler_disconnect (fixture->msg, fixture->got_chunk_handler);
-	if (g_signal_handler_is_connected (fixture->msg, fixture->got_body_handler))
-		g_signal_handler_disconnect (fixture->msg, fixture->got_body_handler);
-	if (g_signal_handler_is_connected (fixture->msg, fixture->restarted_handler))
-		g_signal_handler_disconnect (fixture->msg, fixture->restarted_handler);
-	g_object_unref (fixture->msg);
-	g_object_unref (fixture->cache);
-	g_slice_free (WebKitSoupCacheWritingFixture, fixture);
-}
-
-static void
-close_ready_cb (GObject *source, GAsyncResult *result, WebKitSoupCacheWritingFixture *fixture)
-{
-	WebKitSoupCacheEntry *entry = fixture->entry;
-	WebKitSoupCache *cache = fixture->cache;
-	GOutputStream *stream = G_OUTPUT_STREAM (source);
-	goffset content_length;
-
-	g_warn_if_fail (entry->error == NULL);
-
-	/* FIXME: what do we do on error ? */
-
-	if (stream) {
-		g_output_stream_close_finish (stream, result, NULL);
-		g_object_unref (stream);
-	}
-	entry->stream = NULL;
-
-	content_length = soup_message_headers_get_content_length (entry->headers);
-
-	/* If the process was cancelled, then delete the entry from
-	   the cache. Do it also if the size of a chunked resource is
-	   too much for the cache */
-	if (g_cancellable_is_cancelled (entry->cancellable)) {
-		entry->dirty = FALSE;
-		webkit_soup_cache_entry_remove (cache, entry);
-		webkit_soup_cache_entry_free (entry, TRUE);
-		entry = NULL;
-	} else if ((soup_message_headers_get_encoding (entry->headers) == SOUP_ENCODING_CHUNKED) ||
-		   entry->length != (gsize) content_length) {
-		/** Two options here:
-		 *
-		 * 1. "chunked" data, entry was temporarily added to
-		 * cache (as content-length is 0) and now that we have
-		 * the actual size we have to evaluate if we want it
-		 * in the cache or not
-		 *
-		 * 2. Content-Length has a different value than actual
-		 * length, means that the content was encoded for
-		 * transmission (typically compressed) and thus we
-		 * have to substract the content-length value that was
-		 * added to the cache and add the unencoded length
-		 **/
-		gint length_to_add = entry->length - content_length;
-
-		/* Make room in cache if needed */
-		if (cache_accepts_entries_of_size (cache, length_to_add)) {
-			make_room_for_new_entry (cache, length_to_add);
-
-			cache->priv->size += length_to_add;
-		} else {
-			entry->dirty = FALSE;
-			webkit_soup_cache_entry_remove (cache, entry);
-			webkit_soup_cache_entry_free (entry, TRUE);
-			entry = NULL;
-		}
-	}
-
-	if (entry) {
-		/* Get rid of the GString in memory for the resource now */
-		if (entry->data) {
-			g_string_free (entry->data, TRUE);
-			entry->data = NULL;
-		}
-
-		entry->dirty = FALSE;
-		entry->writing = FALSE;
-		entry->got_body = FALSE;
-		entry->pos = 0;
-
-		g_object_unref (entry->cancellable);
-		entry->cancellable = NULL;
-	}
-
-	cache->priv->n_pending--;
-
-	/* Frees */
-	webkit_soup_cache_writing_fixture_free (fixture);
-}
-
-static void
-write_ready_cb (GObject *source, GAsyncResult *result, WebKitSoupCacheWritingFixture *fixture)
-{
-	GOutputStream *stream = G_OUTPUT_STREAM (source);
-	GError *error = NULL;
-	gssize write_size;
-	WebKitSoupCacheEntry *entry = fixture->entry;
-
-	if (g_cancellable_is_cancelled (entry->cancellable)) {
-		g_output_stream_close_async (stream,
-					     G_PRIORITY_LOW,
-					     entry->cancellable,
-					     (GAsyncReadyCallback)close_ready_cb,
-					     fixture);
-		return;
-	}
-
-	write_size = g_output_stream_write_finish (stream, result, &error);
-	if (write_size <= 0 || error) {
-		if (error)
-			entry->error = error;
-		g_output_stream_close_async (stream,
-					     G_PRIORITY_LOW,
-					     entry->cancellable,
-					     (GAsyncReadyCallback)close_ready_cb,
-					     fixture);
-		/* FIXME: We should completely stop caching the
-		   resource at this point */
-	} else {
-		entry->pos += write_size;
-
-		/* Are we still writing and is there new data to write
-		   already ? */
-		if (entry->data && entry->pos < entry->data->len) {
-			g_output_stream_write_async (entry->stream,
-						     entry->data->str + entry->pos,
-						     entry->data->len - entry->pos,
-						     G_PRIORITY_LOW,
-						     entry->cancellable,
-						     (GAsyncReadyCallback)write_ready_cb,
-						     fixture);
-		} else {
-			entry->writing = FALSE;
-
-			if (entry->got_body) {
-				/* If we already received 'got-body'
-				   and we have written all the data,
-				   we can close the stream */
-				g_output_stream_close_async (entry->stream,
-							     G_PRIORITY_LOW,
-							     entry->cancellable,
-							     (GAsyncReadyCallback)close_ready_cb,
-							     fixture);
-			}
-		}
-	}
-}
-
-static void
-msg_got_chunk_cb (SoupMessage *msg, SoupBuffer *chunk, WebKitSoupCacheWritingFixture *fixture)
-{
-	WebKitSoupCacheEntry *entry = fixture->entry;
-
-	g_return_if_fail (chunk->data && chunk->length);
-	g_return_if_fail (entry);
-
-	/* Ignore this if the writing or appending was cancelled */
-	if (!g_cancellable_is_cancelled (entry->cancellable)) {
-		g_string_append_len (entry->data, chunk->data, chunk->length);
-		entry->length = entry->data->len;
-
-		if (!cache_accepts_entries_of_size (fixture->cache, entry->length)) {
-			/* Quickly cancel the caching of the resource */
-			g_cancellable_cancel (entry->cancellable);
-		}
-	}
-
-	/* FIXME: remove the error check when we cancel the caching at
-	   the first write error */
-	/* Only write if the entry stream is ready */
-	if (entry->writing == FALSE && entry->error == NULL && entry->stream) {
-		GString *data = entry->data;
-		entry->writing = TRUE;
-		g_output_stream_write_async (entry->stream,
-					     data->str + entry->pos,
-					     data->len - entry->pos,
-					     G_PRIORITY_LOW,
-					     entry->cancellable,
-					     (GAsyncReadyCallback)write_ready_cb,
-					     fixture);
-	}
-}
-
-static void
-msg_got_body_cb (SoupMessage *msg, WebKitSoupCacheWritingFixture *fixture)
-{
-	WebKitSoupCacheEntry *entry = fixture->entry;
-	g_return_if_fail (entry);
-
-	entry->got_body = TRUE;
-
-	if (!entry->stream && entry->pos != entry->length)
-		/* The stream is not ready to be written but we still
-		   have data to write, we'll write it when the stream
-		   is opened for writing */
-		return;
-
-
-	if (entry->pos != entry->length) {
-		/* If we still have data to write, write it,
-		   write_ready_cb will close the stream */
-		if (entry->writing == FALSE && entry->error == NULL && entry->stream) {
-			g_output_stream_write_async (entry->stream,
-						     entry->data->str + entry->pos,
-						     entry->data->len - entry->pos,
-						     G_PRIORITY_LOW,
-						     entry->cancellable,
-						     (GAsyncReadyCallback)write_ready_cb,
-						     fixture);
-		}
-		return;
-	}
-
-	if (entry->stream && !entry->writing)
-		g_output_stream_close_async (entry->stream,
-					     G_PRIORITY_LOW,
-					     entry->cancellable,
-					     (GAsyncReadyCallback)close_ready_cb,
-					     fixture);
-}
-
-static gboolean
-webkit_soup_cache_entry_remove (WebKitSoupCache *cache, WebKitSoupCacheEntry *entry)
-{
-	GList *lru_item;
-
-	/* if (entry->dirty && !g_cancellable_is_cancelled (entry->cancellable)) { */
-	if (entry->dirty) {
-		g_cancellable_cancel (entry->cancellable);
-		return FALSE;
-	}
-
-	g_assert (!entry->dirty);
-	g_assert (g_list_length (cache->priv->lru_start) == g_hash_table_size (cache->priv->cache));
-
-	/* Remove from cache */
-	if (!g_hash_table_remove (cache->priv->cache, entry->key))
-		return FALSE;
-
-	/* Remove from LRU */
-	lru_item = g_list_find (cache->priv->lru_start, entry);
-	cache->priv->lru_start = g_list_delete_link (cache->priv->lru_start, lru_item);
-
-	/* Adjust cache size */
-	cache->priv->size -= entry->length;
-
-	g_assert (g_list_length (cache->priv->lru_start) == g_hash_table_size (cache->priv->cache));
-
-	return TRUE;
-}
-
-static gint
-lru_compare_func (gconstpointer a, gconstpointer b)
-{
-	WebKitSoupCacheEntry *entry_a = (WebKitSoupCacheEntry *)a;
-	WebKitSoupCacheEntry *entry_b = (WebKitSoupCacheEntry *)b;
-
-	/** The rationale of this sorting func is
-	 *
-	 * 1. sort by hits -> LRU algorithm, then
-	 *
-	 * 2. sort by freshness lifetime, we better discard first
-	 * entries that are close to expire
-	 *
-	 * 3. sort by size, replace first small size resources as they
-	 * are cheaper to download
-	 **/
-
-	/* Sort by hits */
-	if (entry_a->hits != entry_b->hits)
-		return entry_a->hits - entry_b->hits;
-
-	/* Sort by freshness_lifetime */
-	if (entry_a->freshness_lifetime != entry_b->freshness_lifetime)
-		return entry_a->freshness_lifetime - entry_b->freshness_lifetime;
-
-	/* Sort by size */
-	return entry_a->length - entry_b->length;
-}
-
-static gboolean
-cache_accepts_entries_of_size (WebKitSoupCache *cache, guint length_to_add)
-{
-	/* We could add here some more heuristics. TODO: review how
-	   this is done by other HTTP caches */
-
-	return length_to_add <= cache->priv->max_entry_data_size;
-}
-
-static void
-make_room_for_new_entry (WebKitSoupCache *cache, guint length_to_add)
-{
-	GList *lru_entry = cache->priv->lru_start;
-
-	/* Check that there is enough room for the new entry. This is
-	   an approximation as we're not working out the size of the
-	   cache file or the size of the headers for performance
-	   reasons. TODO: check if that would be really that expensive */
-
-	while (lru_entry &&
-	       (length_to_add + cache->priv->size > cache->priv->max_size)) {
-		WebKitSoupCacheEntry *old_entry = (WebKitSoupCacheEntry *)lru_entry->data;
-
-		/* Discard entries. Once cancelled resources will be
-		 * freed in close_ready_cb
-		 */
-		if (webkit_soup_cache_entry_remove (cache, old_entry)) {
-			webkit_soup_cache_entry_free (old_entry, TRUE);
-			lru_entry = cache->priv->lru_start;
-		} else
-			lru_entry = g_list_next (lru_entry);
-	}
-}
-
-static gboolean
-webkit_soup_cache_entry_insert_by_key (WebKitSoupCache *cache,
-				       const char *key,
-				       WebKitSoupCacheEntry *entry,
-				       gboolean sort)
-{
-	guint length_to_add = 0;
-
-	if (soup_message_headers_get_encoding (entry->headers) != SOUP_ENCODING_CHUNKED)
-		length_to_add = soup_message_headers_get_content_length (entry->headers);
-
-	/* Check if we are going to store the resource depending on its size */
-	if (length_to_add) {
-		if (!cache_accepts_entries_of_size (cache, length_to_add))
-			return FALSE;
-
-		/* Make room for new entry if needed */
-		make_room_for_new_entry (cache, length_to_add);
-	}
-
-	g_hash_table_insert (cache->priv->cache, g_strdup (key), entry);
-
-	/* Compute new cache size */
-	cache->priv->size += length_to_add;
-
-	/* Update LRU */
-	if (sort)
-		cache->priv->lru_start = g_list_insert_sorted (cache->priv->lru_start, entry, lru_compare_func);
-	else
-		cache->priv->lru_start = g_list_prepend (cache->priv->lru_start, entry);
-
-	g_assert (g_list_length (cache->priv->lru_start) == g_hash_table_size (cache->priv->cache));
-
-	return TRUE;
-}
-
-static void
-msg_restarted_cb (SoupMessage *msg, WebKitSoupCacheEntry *entry)
-{
-	/* FIXME: What should we do here exactly? */
-}
-
-static void
-append_to_ready_cb (GObject *source, GAsyncResult *result, WebKitSoupCacheWritingFixture *fixture)
-{
-	GFile *file = (GFile *)source;
-	GOutputStream *stream;
-	WebKitSoupCacheEntry *entry = fixture->entry;
-
-	stream = (GOutputStream *)g_file_append_to_finish (file, result, &entry->error);
-
-	if (g_cancellable_is_cancelled (entry->cancellable) || entry->error) {
-		fixture->cache->priv->n_pending--;
-		entry->dirty = FALSE;
-		webkit_soup_cache_entry_remove (fixture->cache, entry);
-		webkit_soup_cache_entry_free (entry, TRUE);
-		webkit_soup_cache_writing_fixture_free (fixture);
-		return;
-	}
-
-	entry->stream = g_object_ref (stream);
-	g_object_unref (file);
-
-	/* If we already got all the data we have to initiate the
-	   writing here, since we won't get more 'got-chunk'
-	   signals */
-	if (entry->got_body) {
-		GString *data = entry->data;
-
-		/* It could happen that reading the data from server
-		   was completed before this happens. In that case
-		   there is no data */
-		if (data) {
-			entry->writing = TRUE;
-			g_output_stream_write_async (entry->stream,
-						     data->str + entry->pos,
-						     data->len - entry->pos,
-						     G_PRIORITY_LOW,
-						     entry->cancellable,
-						     (GAsyncReadyCallback)write_ready_cb,
-						     fixture);
-		}
-	}
-}
-
-typedef struct {
-	time_t request_time;
-	SoupSessionFeature *feature;
-	gulong got_headers_handler;
-} RequestHelper;
-
-static void
-msg_got_headers_cb (SoupMessage *msg, gpointer user_data)
-{
-	WebKitSoupCache *cache;
-	WebKitSoupCacheability cacheable;
-	RequestHelper *helper;
-	time_t request_time, response_time;
-
-	response_time = time (NULL);
-
-	helper = (RequestHelper *)user_data;
-	cache = WEBKIT_SOUP_CACHE (helper->feature);
-	request_time = helper->request_time;
-	g_signal_handlers_disconnect_by_func (msg, msg_got_headers_cb, user_data);
-	g_slice_free (RequestHelper, helper);
-
-	cacheable = webkit_soup_cache_get_cacheability (cache, msg);
-
-	if (cacheable & WEBKIT_SOUP_CACHE_CACHEABLE) {
-		WebKitSoupCacheEntry *entry;
-		char *key;
-		GFile *file;
-		WebKitSoupCacheWritingFixture *fixture;
-
-		/* Check if we are already caching this resource */
-		key = soup_message_get_cache_key (msg);
-		entry = g_hash_table_lookup (cache->priv->cache, key);
-		g_free (key);
-
-		if (entry && entry->dirty)
-			return;
-
-		/* Create a new entry, deleting any old one if present */
-		if (entry) {
-			webkit_soup_cache_entry_remove (cache, entry);
-			webkit_soup_cache_entry_free (entry, TRUE);
-		}
-
-		entry = webkit_soup_cache_entry_new (cache, msg, request_time, response_time);
-		entry->hits = 1;
-
-		/* Do not continue if it can not be stored */
-		if (!webkit_soup_cache_entry_insert_by_key (cache, (const gchar *)entry->key, entry, TRUE)) {
-			webkit_soup_cache_entry_free (entry, TRUE);
-			return;
-		}
-
-		fixture = g_slice_new0 (WebKitSoupCacheWritingFixture);
-		fixture->cache = g_object_ref (cache);
-		fixture->entry = entry;
-		fixture->msg = g_object_ref (msg);
-
-		/* We connect now to these signals and buffer the data
-		   if it comes before the file is ready for writing */
-		fixture->got_chunk_handler =
-			g_signal_connect (msg, "got-chunk", G_CALLBACK (msg_got_chunk_cb), fixture);
-		fixture->got_body_handler =
-			g_signal_connect (msg, "got-body", G_CALLBACK (msg_got_body_cb), fixture);
-		fixture->restarted_handler =
-			g_signal_connect (msg, "restarted", G_CALLBACK (msg_restarted_cb), entry);
-
-		/* Prepare entry */
-		file = g_file_new_for_path (entry->filename);
-		cache->priv->n_pending++;
-
-		entry->dirty = TRUE;
-		entry->cancellable = g_cancellable_new ();
-		g_file_append_to_async (file, 0,
-					G_PRIORITY_LOW, entry->cancellable,
-					(GAsyncReadyCallback)append_to_ready_cb,
-					fixture);
-	} else if (cacheable & WEBKIT_SOUP_CACHE_INVALIDATES) {
-		char *key;
-		WebKitSoupCacheEntry *entry;
-
-		key = soup_message_get_cache_key (msg);
-		entry = g_hash_table_lookup (cache->priv->cache, key);
-		g_free (key);
-
-		if (entry) {
-			if (webkit_soup_cache_entry_remove (cache, entry))
-				webkit_soup_cache_entry_free (entry, TRUE);
-		}
-	} else if (cacheable & WEBKIT_SOUP_CACHE_VALIDATES) {
-		char *key;
-		WebKitSoupCacheEntry *entry;
-
-		key = soup_message_get_cache_key (msg);
-		entry = g_hash_table_lookup (cache->priv->cache, key);
-		g_free (key);
-
-		/* It's possible to get a CACHE_VALIDATES with no
-		 * entry in the hash table. This could happen if for
-		 * example the soup client is the one creating the
-		 * conditional request.
-		 */
-		if (entry) {
-			entry->being_validated = FALSE;
-
-			/* We update the headers of the existing cache item,
-			   plus its age */
-			soup_message_headers_foreach (msg->response_headers,
-						      (SoupMessageHeadersForeachFunc)update_headers,
-						      entry->headers);
-			webkit_soup_cache_entry_set_freshness (entry, msg, cache);
-		}
-	}
-}
-
-GInputStream *
-webkit_soup_cache_send_response (WebKitSoupCache *cache, SoupMessage *msg)
-{
-	char *key;
-	WebKitSoupCacheEntry *entry;
-	char *current_age;
-	GInputStream *stream = NULL;
-	GFile *file;
-
-	g_return_val_if_fail (WEBKIT_IS_SOUP_CACHE (cache), NULL);
-	g_return_val_if_fail (SOUP_IS_MESSAGE (msg), NULL);
-
-	key = soup_message_get_cache_key (msg);
-	entry = g_hash_table_lookup (cache->priv->cache, key);
-	g_free (key);
-	g_return_val_if_fail (entry, NULL);
-
-	/* If we are told to send a response from cache any validation
-	   in course is over by now */
-	entry->being_validated = FALSE;
-
-	/* Headers */
-	soup_message_headers_foreach (entry->headers,
-				      (SoupMessageHeadersForeachFunc)update_headers,
-				      msg->response_headers);
-
-	/* Add 'Age' header with the current age */
-	current_age = g_strdup_printf ("%d", webkit_soup_cache_entry_get_current_age (entry));
-	soup_message_headers_replace (msg->response_headers,
-				      "Age",
-				      current_age);
-	g_free (current_age);
-
-	/* TODO: the original idea was to save reads, but current code
-	   assumes that a stream is always returned. Need to reach
-	   some agreement here. Also we have to handle the situation
-	   were the file was no longer there (for example files
-	   removed without notifying the cache */
-	file = g_file_new_for_path (entry->filename);
-	stream = (GInputStream *)g_file_read (file, NULL, NULL);
-
-	return stream;
-}
-
-static void
-request_started (SoupSessionFeature *feature, SoupSession *session,
-		 SoupMessage *msg, SoupSocket *socket)
-{
-	RequestHelper *helper = g_slice_new0 (RequestHelper);
-	helper->request_time = time (NULL);
-	helper->feature = feature;
-	helper->got_headers_handler = g_signal_connect (msg, "got-headers",
-							G_CALLBACK (msg_got_headers_cb),
-							helper);
-}
-
-static void
-attach (SoupSessionFeature *feature, SoupSession *session)
-{
-	WebKitSoupCache *cache = WEBKIT_SOUP_CACHE (feature);
-	cache->priv->session = session;
-
-	webkit_soup_cache_default_feature_interface->attach (feature, session);
-}
-
-static void
-webkit_soup_cache_session_feature_init (SoupSessionFeatureInterface *feature_interface,
-					gpointer interface_data)
-{
-	webkit_soup_cache_default_feature_interface =
-		g_type_default_interface_peek (SOUP_TYPE_SESSION_FEATURE);
-
-	feature_interface->attach = attach;
-	feature_interface->request_started = request_started;
-}
-
-static void
-webkit_soup_cache_init (WebKitSoupCache *cache)
-{
-	WebKitSoupCachePrivate *priv;
-
-	priv = cache->priv = WEBKIT_SOUP_CACHE_GET_PRIVATE (cache);
-
-	priv->cache = g_hash_table_new_full (g_str_hash,
-					     g_str_equal,
-					     (GDestroyNotify)g_free,
-					     NULL);
-
-	/* LRU */
-	priv->lru_start = NULL;
-
-	/* */
-	priv->n_pending = 0;
-
-	/* Cache size */
-	priv->max_size = DEFAULT_MAX_SIZE;
-	priv->max_entry_data_size = priv->max_size / MAX_ENTRY_DATA_PERCENTAGE;
-	priv->size = 0;
-}
-
-static void
-remove_cache_item (gpointer data,
-		   gpointer user_data)
-{
-	WebKitSoupCache *cache = (WebKitSoupCache *) user_data;
-	WebKitSoupCacheEntry *entry = (WebKitSoupCacheEntry *) data;
-
-	if (webkit_soup_cache_entry_remove (cache, entry))
-		webkit_soup_cache_entry_free (entry, FALSE);
-}
-
-static void
-webkit_soup_cache_finalize (GObject *object)
-{
-	WebKitSoupCachePrivate *priv;
-	GList *entries;
-
-	priv = WEBKIT_SOUP_CACHE (object)->priv;
-
-	// Cannot use g_hash_table_foreach as callbacks must not modify the hash table
-	entries = g_hash_table_get_values (priv->cache);
-	g_list_foreach (entries, remove_cache_item, object);
-	g_list_free (entries);
-
-	g_hash_table_destroy (priv->cache);
-	g_free (priv->cache_dir);
-
-	g_list_free (priv->lru_start);
-	priv->lru_start = NULL;
-
-	G_OBJECT_CLASS (webkit_soup_cache_parent_class)->finalize (object);
-}
-
-static void
-webkit_soup_cache_set_property (GObject *object, guint prop_id,
-				const GValue *value, GParamSpec *pspec)
-{
-	WebKitSoupCachePrivate *priv = WEBKIT_SOUP_CACHE (object)->priv;
-
-	switch (prop_id) {
-	case PROP_CACHE_DIR:
-		priv->cache_dir = g_value_dup_string (value);
-		/* Create directory if it does not exist (FIXME: should we?) */
-		if (!g_file_test (priv->cache_dir, G_FILE_TEST_EXISTS | G_FILE_TEST_IS_DIR))
-			g_mkdir_with_parents (priv->cache_dir, 0700);
-		break;
-	case PROP_CACHE_TYPE:
-		priv->cache_type = g_value_get_enum (value);
-		/* TODO: clear private entries and issue a warning if moving to shared? */
-		break;
-	default:
-		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
-		break;
-	}
-}
-
-static void
-webkit_soup_cache_get_property (GObject *object, guint prop_id,
-				GValue *value, GParamSpec *pspec)
-{
-	WebKitSoupCachePrivate *priv = WEBKIT_SOUP_CACHE (object)->priv;
-
-	switch (prop_id) {
-	case PROP_CACHE_DIR:
-		g_value_set_string (value, priv->cache_dir);
-		break;
-	case PROP_CACHE_TYPE:
-		g_value_set_enum (value, priv->cache_type);
-		break;
-	default:
-		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
-		break;
-	}
-}
-
-static void
-webkit_soup_cache_constructed (GObject *object)
-{
-	WebKitSoupCachePrivate *priv;
-
-	priv = WEBKIT_SOUP_CACHE (object)->priv;
-
-	if (!priv->cache_dir) {
-		/* Set a default cache dir, different for each user */
-		priv->cache_dir = g_build_filename (g_get_user_cache_dir (),
-						    "httpcache",
-						    NULL);
-		if (!g_file_test (priv->cache_dir, G_FILE_TEST_EXISTS | G_FILE_TEST_IS_DIR))
-			g_mkdir_with_parents (priv->cache_dir, 0700);
-	}
-
-	if (G_OBJECT_CLASS (webkit_soup_cache_parent_class)->constructed)
-		G_OBJECT_CLASS (webkit_soup_cache_parent_class)->constructed (object);
-}
-
-#define WEBKIT_SOUP_CACHE_TYPE_TYPE (webkit_soup_cache_type_get_type ())
-static GType
-webkit_soup_cache_type_get_type (void)
-{
-	static GType cache_type = 0;
-
-	static const GEnumValue cache_types[] = {
-		{ WEBKIT_SOUP_CACHE_SINGLE_USER, "Single user cache", "user" },
-		{ WEBKIT_SOUP_CACHE_SHARED, "Shared cache", "shared" },
-		{ 0, NULL, NULL }
-	};
-
-	if (!cache_type) {
-		cache_type = g_enum_register_static ("WebKitSoupCacheTypeType", cache_types);
-	}
-	return cache_type;
-}
-
-static void
-webkit_soup_cache_class_init (WebKitSoupCacheClass *cache_class)
-{
-	GObjectClass *gobject_class = (GObjectClass *)cache_class;
-
-	gobject_class->finalize = webkit_soup_cache_finalize;
-	gobject_class->constructed = webkit_soup_cache_constructed;
-	gobject_class->set_property = webkit_soup_cache_set_property;
-	gobject_class->get_property = webkit_soup_cache_get_property;
-
-	cache_class->get_cacheability = get_cacheability;
-
-	g_object_class_install_property (gobject_class, PROP_CACHE_DIR,
-					 g_param_spec_string ("cache-dir",
-							      "Cache directory",
-							      "The directory to store the cache files",
-							      NULL,
-							      G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY));
-
-	g_object_class_install_property (gobject_class, PROP_CACHE_TYPE,
-					 g_param_spec_enum ("cache-type",
-							    "Cache type",
-							    "Whether the cache is private or shared",
-							    WEBKIT_SOUP_CACHE_TYPE_TYPE,
-							    WEBKIT_SOUP_CACHE_SINGLE_USER,
-							    G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY));
-
-	g_type_class_add_private (cache_class, sizeof (WebKitSoupCachePrivate));
-}
-
-/**
- * webkit_soup_cache_new:
- * @cache_dir: the directory to store the cached data, or %NULL to use the default one
- * @cache_type: the #WebKitSoupCacheType of the cache
- *
- * Creates a new #WebKitSoupCache.
- *
- * Returns: a new #WebKitSoupCache
- *
- * Since: 2.28
- **/
-WebKitSoupCache *
-webkit_soup_cache_new (const char *cache_dir, WebKitSoupCacheType cache_type)
-{
-	return g_object_new (WEBKIT_TYPE_SOUP_CACHE,
-			     "cache-dir", cache_dir,
-			     "cache-type", cache_type,
-			     NULL);
-}
-
-/**
- * webkit_soup_cache_has_response:
- * @cache: a #WebKitSoupCache
- * @msg: a #SoupMessage
- *
- * This function calculates whether the @cache object has a proper
- * response for the request @msg given the flags both in the request
- * and the cached reply and the time ellapsed since it was cached.
- *
- * Returns: whether or not the @cache has a valid response for @msg
- **/
-WebKitSoupCacheResponse
-webkit_soup_cache_has_response (WebKitSoupCache *cache, SoupMessage *msg)
-{
-	char *key;
-	WebKitSoupCacheEntry *entry;
-	const char *cache_control;
-	gpointer value;
-	gboolean must_revalidate;
-	int max_age, max_stale, min_fresh;
-	GList *lru_item, *item;
-
-	key = soup_message_get_cache_key (msg);
-	entry = g_hash_table_lookup (cache->priv->cache, key);
-	g_free (key);
-
-	/* 1. The presented Request-URI and that of stored response
-	 * match
-	 */
-	if (!entry)
-		return WEBKIT_SOUP_CACHE_RESPONSE_STALE;
-
-	/* Increase hit count. Take sorting into account */
-	entry->hits++;
-	lru_item = g_list_find (cache->priv->lru_start, entry);
-	item = lru_item;
-	while (item->next && lru_compare_func (item->data, item->next->data) > 0)
-		item = g_list_next (item);
-
-	if (item != lru_item) {
-		cache->priv->lru_start = g_list_remove_link (cache->priv->lru_start, lru_item);
-		item = g_list_insert_sorted (item, lru_item->data, lru_compare_func);
-		g_list_free (lru_item);
-	}
-
-	if (entry->dirty || entry->being_validated)
-		return WEBKIT_SOUP_CACHE_RESPONSE_STALE;
-
-	/* 2. The request method associated with the stored response
-	 *  allows it to be used for the presented request
-	 */
-
-	/* In practice this means we only return our resource for GET,
-	 * cacheability for other methods is a TODO in the RFC
-	 * (TODO: although we could return the headers for HEAD
-	 * probably).
-	 */
-	if (msg->method != SOUP_METHOD_GET)
-		return WEBKIT_SOUP_CACHE_RESPONSE_STALE;
-
-	/* 3. Selecting request-headers nominated by the stored
-	 * response (if any) match those presented.
-	 */
-
-	/* TODO */
-
-	/* 4. The request is a conditional request issued by the client.
-	 */
-	if (soup_message_headers_get (msg->request_headers, "If-Modified-Since") ||
-	    soup_message_headers_get (msg->request_headers, "If-None-Match"))
-		return WEBKIT_SOUP_CACHE_RESPONSE_STALE;
-
-	/* 5. The presented request and stored response are free from
-	 * directives that would prevent its use.
-	 */
-
-	must_revalidate = FALSE;
-	max_age = max_stale = min_fresh = -1;
-
-	cache_control = soup_message_headers_get (msg->request_headers, "Cache-Control");
-	if (cache_control) {
-		GHashTable *hash = soup_header_parse_param_list (cache_control);
-
-		if (g_hash_table_lookup_extended (hash, "no-store", NULL, NULL)) {
-			soup_header_free_param_list (hash);
-			return WEBKIT_SOUP_CACHE_RESPONSE_STALE;
-		}
-
-		if (g_hash_table_lookup_extended (hash, "no-cache", NULL, NULL)) {
-			entry->must_revalidate = TRUE;
-		}
-
-		if (g_hash_table_lookup_extended (hash, "max-age", NULL, &value)) {
-			max_age = (int)MIN (g_ascii_strtoll (value, NULL, 10), G_MAXINT32);
-		}
-
-		/* max-stale can have no value set, we need to use _extended */
-		if (g_hash_table_lookup_extended (hash, "max-stale", NULL, &value)) {
-			if (value)
-				max_stale = (int)MIN (g_ascii_strtoll (value, NULL, 10), G_MAXINT32);
-			else
-				max_stale = G_MAXINT32;
-		}
-
-		value = g_hash_table_lookup (hash, "min-fresh");
-		if (value)
-			min_fresh = (int)MIN (g_ascii_strtoll (value, NULL, 10), G_MAXINT32);
-
-		soup_header_free_param_list (hash);
-
-		if (max_age != -1) {
-			guint current_age = webkit_soup_cache_entry_get_current_age (entry);
-
-			/* If we are over max-age and max-stale is not
-			   set, do not use the value from the cache
-			   without validation */
-			if ((guint) max_age <= current_age && max_stale == -1)
-				return WEBKIT_SOUP_CACHE_RESPONSE_NEEDS_VALIDATION;
-		}
-	}
-
-	/* 6. The stored response is either: fresh, allowed to be
-	 * served stale or succesfully validated
-	 */
-	/* TODO consider also proxy-revalidate & s-maxage */
-	if (entry->must_revalidate)
-		return WEBKIT_SOUP_CACHE_RESPONSE_NEEDS_VALIDATION;
-
-	if (!webkit_soup_cache_entry_is_fresh_enough (entry, min_fresh)) {
-		/* Not fresh, can it be served stale? */
-		if (max_stale != -1) {
-			/* G_MAXINT32 means we accept any staleness */
-			if (max_stale == G_MAXINT32)
-				return WEBKIT_SOUP_CACHE_RESPONSE_FRESH;
-
-			if ((webkit_soup_cache_entry_get_current_age (entry) - entry->freshness_lifetime) <= (guint) max_stale)
-				return WEBKIT_SOUP_CACHE_RESPONSE_FRESH;
-		}
-
-		return WEBKIT_SOUP_CACHE_RESPONSE_NEEDS_VALIDATION;
-	}
-
-	return WEBKIT_SOUP_CACHE_RESPONSE_FRESH;
-}
-
-/**
- * webkit_soup_cache_get_cacheability:
- * @cache: a #WebKitSoupCache
- * @msg: a #SoupMessage
- *
- * Calculates whether the @msg can be cached or not.
- *
- * Returns: a #WebKitSoupCacheability value indicating whether the @msg can be cached or not.
- **/
-WebKitSoupCacheability
-webkit_soup_cache_get_cacheability (WebKitSoupCache *cache, SoupMessage *msg)
-{
-	g_return_val_if_fail (WEBKIT_IS_SOUP_CACHE (cache), WEBKIT_SOUP_CACHE_UNCACHEABLE);
-	g_return_val_if_fail (SOUP_IS_MESSAGE (msg), WEBKIT_SOUP_CACHE_UNCACHEABLE);
-
-	return WEBKIT_SOUP_CACHE_GET_CLASS (cache)->get_cacheability (cache, msg);
-}
-
-static gboolean
-force_flush_timeout (gpointer data)
-{
-	gboolean *forced = (gboolean *)data;
-	*forced = TRUE;
-
-	return FALSE;
-}
-
-/**
- * webkit_soup_cache_flush:
- * @cache: a #WebKitSoupCache
- * @session: the #SoupSession associated with the @cache
- *
- * This function will force all pending writes in the @cache to be
- * committed to disk. For doing so it will iterate the #GMainContext
- * associated with the @session (which can be the default one) as long
- * as needed.
- **/
-void
-webkit_soup_cache_flush (WebKitSoupCache *cache)
-{
-	GMainContext *async_context;
-	SoupSession *session;
-	guint timeout_id;
-	gboolean forced = FALSE;
-
-	g_return_if_fail (WEBKIT_IS_SOUP_CACHE (cache));
-
-	session = cache->priv->session;
-	g_return_if_fail (SOUP_IS_SESSION (session));
-	async_context = soup_session_get_async_context (session);
-
-	/* We give cache 10 secs to finish */
-	timeout_id = g_timeout_add (10000, force_flush_timeout, &forced);
-
-	while (!forced && cache->priv->n_pending > 0)
-		g_main_context_iteration (async_context, FALSE);
-
-	if (!forced)
-		g_source_remove (timeout_id);
-	else
-		g_warning ("Cache flush finished despite %d pending requests", cache->priv->n_pending);
-}
-
-static void
-clear_cache_item (gpointer data,
-		  gpointer user_data)
-{
-	WebKitSoupCache *cache = (WebKitSoupCache *) user_data;
-	WebKitSoupCacheEntry *entry = (WebKitSoupCacheEntry *) data;
-
-	if (webkit_soup_cache_entry_remove (cache, entry))
-		webkit_soup_cache_entry_free (entry, TRUE);
-}
-
-/**
- * webkit_soup_cache_clear:
- * @cache: a #WebKitSoupCache
- *
- * Will remove all entries in the @cache plus all the cache files
- * associated with them.
- **/
-void
-webkit_soup_cache_clear (WebKitSoupCache *cache)
-{
-	GHashTable *hash;
-	GList *entries;
-
-	g_return_if_fail (WEBKIT_IS_SOUP_CACHE (cache));
-
-	hash = cache->priv->cache;
-	g_return_if_fail (hash);
-
-	// Cannot use g_hash_table_foreach as callbacks must not modify the hash table
-	entries = g_hash_table_get_values (hash);
-	g_list_foreach (entries, clear_cache_item, cache);
-	g_list_free (entries);
-}
-
-SoupMessage *
-webkit_soup_cache_generate_conditional_request (WebKitSoupCache *cache, SoupMessage *original)
-{
-	SoupMessage *msg;
-	SoupURI *uri;
-	WebKitSoupCacheEntry *entry;
-	char *key;
-	const char *value;
-
-	g_return_val_if_fail (WEBKIT_IS_SOUP_CACHE (cache), NULL);
-	g_return_val_if_fail (SOUP_IS_MESSAGE (original), NULL);
-
-	/* First copy the data we need from the original message */
-	uri = soup_message_get_uri (original);
-	msg = soup_message_new_from_uri (original->method, uri);
-
-	soup_message_headers_foreach (original->request_headers,
-				      (SoupMessageHeadersForeachFunc)copy_headers,
-				      msg->request_headers);
-
-	/* Now add the validator entries in the header from the cached
-	   data */
-	key = soup_message_get_cache_key (original);
-	entry = g_hash_table_lookup (cache->priv->cache, key);
-	g_free (key);
-
-	g_return_val_if_fail (entry, NULL);
-
-	entry->being_validated = TRUE;
-
-	value = soup_message_headers_get (entry->headers, "Last-Modified");
-	if (value)
-		soup_message_headers_append (msg->request_headers,
-					     "If-Modified-Since",
-					     value);
-	value = soup_message_headers_get (entry->headers, "ETag");
-	if (value)
-		soup_message_headers_append (msg->request_headers,
-					     "If-None-Match",
-					     value);
-	return msg;
-}
-
-#define WEBKIT_SOUP_CACHE_FILE "soup.cache"
-
-#define WEBKIT_SOUP_CACHE_HEADERS_FORMAT "{ss}"
-#define WEBKIT_SOUP_CACHE_PHEADERS_FORMAT "(ssbuuuuua" WEBKIT_SOUP_CACHE_HEADERS_FORMAT ")"
-#define WEBKIT_SOUP_CACHE_ENTRIES_FORMAT "a" WEBKIT_SOUP_CACHE_PHEADERS_FORMAT
-
-/* Basically the same format than above except that some strings are
-   prepended with &. This way the GVariant returns a pointer to the
-   data instead of duplicating the string */
-#define WEBKIT_SOUP_CACHE_DECODE_HEADERS_FORMAT "{&s&s}"
-
-static void
-pack_entry (gpointer data,
-	    gpointer user_data)
-{
-	WebKitSoupCacheEntry *entry = (WebKitSoupCacheEntry *) data;
-	SoupMessageHeadersIter iter;
-	const gchar *header_key, *header_value;
-	GVariantBuilder *headers_builder;
-	GVariantBuilder *entries_builder = (GVariantBuilder *)user_data;
-
-	/* Do not store non-consolidated entries */
-	if (entry->dirty || entry->writing || !entry->key)
-		return;
-
-	/* Pack headers */
-	headers_builder = g_variant_builder_new (G_VARIANT_TYPE_ARRAY);
-	soup_message_headers_iter_init (&iter, entry->headers);
-	while (soup_message_headers_iter_next (&iter, &header_key, &header_value)) {
-		if (g_utf8_validate (header_value, -1, NULL))
-			g_variant_builder_add (headers_builder, WEBKIT_SOUP_CACHE_HEADERS_FORMAT,
-					       header_key, header_value);
-	}
-
-	/* Entry data */
-	g_variant_builder_add (entries_builder, WEBKIT_SOUP_CACHE_PHEADERS_FORMAT,
-			       entry->key, entry->filename, entry->must_revalidate,
-			       entry->freshness_lifetime, entry->corrected_initial_age,
-			       entry->response_time, entry->hits, entry->length, headers_builder);
-
-	g_variant_builder_unref (headers_builder);
-}
-
-void
-webkit_soup_cache_dump (WebKitSoupCache *cache)
-{
-	WebKitSoupCachePrivate *priv = WEBKIT_SOUP_CACHE_GET_PRIVATE (cache);
-	gchar *filename;
-	GVariantBuilder *entries_builder;
-	GVariant *cache_variant;
-
-	if (!g_list_length (cache->priv->lru_start))
-		return;
-
-	/* Create the builder and iterate over all entries */
-	entries_builder = g_variant_builder_new (G_VARIANT_TYPE_ARRAY);
-	g_list_foreach (cache->priv->lru_start, pack_entry, entries_builder);
-
-	/* Serialize and dump */
-	cache_variant = g_variant_new (WEBKIT_SOUP_CACHE_ENTRIES_FORMAT, entries_builder);
-	g_variant_builder_unref (entries_builder);
-
-	filename = g_build_filename (priv->cache_dir, WEBKIT_SOUP_CACHE_FILE, NULL);
-	g_file_set_contents (filename, (const gchar *)g_variant_get_data (cache_variant),
-			     g_variant_get_size (cache_variant), NULL);
-	g_free (filename);
-	g_variant_unref (cache_variant);
-}
-
-void
-webkit_soup_cache_load (WebKitSoupCache *cache)
-{
-	gchar *filename = NULL, *contents = NULL;
-	GVariant *cache_variant;
-	GVariantIter *entries_iter, *headers_iter;
-	GVariantType *variant_format;
-	gsize length;
-	WebKitSoupCacheEntry *entry;
-	WebKitSoupCachePrivate *priv = cache->priv;
-
-	filename = g_build_filename (priv->cache_dir, WEBKIT_SOUP_CACHE_FILE, NULL);
-	if (!g_file_get_contents (filename, &contents, &length, NULL)) {
-		g_free (filename);
-		g_free (contents);
-		return;
-	}
-	g_free (filename);
-
-	variant_format = g_variant_type_new (WEBKIT_SOUP_CACHE_ENTRIES_FORMAT);
-	cache_variant = g_variant_new_from_data (variant_format, (const gchar *)contents, length, FALSE, g_free, contents);
-	g_variant_type_free (variant_format);
-
-	g_variant_get (cache_variant, WEBKIT_SOUP_CACHE_ENTRIES_FORMAT, &entries_iter);
-	entry = g_slice_new0 (WebKitSoupCacheEntry);
-
-	while (g_variant_iter_loop (entries_iter, WEBKIT_SOUP_CACHE_PHEADERS_FORMAT,
-				    &entry->key, &entry->filename, &entry->must_revalidate,
-				    &entry->freshness_lifetime, &entry->corrected_initial_age,
-				    &entry->response_time, &entry->hits, &entry->length,
-                                    &headers_iter)) {
-		const gchar *header_key, *header_value;
-
-		/* SoupMessage Headers */
-		entry->headers = soup_message_headers_new (SOUP_MESSAGE_HEADERS_RESPONSE);
-		while (g_variant_iter_loop (headers_iter, WEBKIT_SOUP_CACHE_DECODE_HEADERS_FORMAT, &header_key, &header_value))
-			soup_message_headers_append (entry->headers, header_key, header_value);
-
-		/* Insert in cache */
-		if (!webkit_soup_cache_entry_insert_by_key (cache, (const gchar *)entry->key, entry, FALSE))
-			webkit_soup_cache_entry_free (entry, TRUE);
-
-		/* New entry for the next iteration. This creates an
-		   extra object the last iteration but it's worth it
-		   as we save several if's */
-		entry = g_slice_new0 (WebKitSoupCacheEntry);
-	}
-	/* Remove last created entry */
-	g_slice_free (WebKitSoupCacheEntry, entry);
-
-	/* Sort LRU (shouldn't be needed). First reverse as elements
-	 * are always prepended when inserting
-	 */
-	cache->priv->lru_start = g_list_reverse (cache->priv->lru_start);
-	cache->priv->lru_start = g_list_sort (cache->priv->lru_start, lru_compare_func);
-
-	/* frees */
-	g_variant_iter_free (entries_iter);
-	g_variant_unref (cache_variant);
-}
-
-void
-webkit_soup_cache_set_max_size (WebKitSoupCache *cache,
-				guint max_size)
-{
-	cache->priv->max_size = max_size;
-	cache->priv->max_entry_data_size = cache->priv->max_size / MAX_ENTRY_DATA_PERCENTAGE;
-}
-
-guint
-webkit_soup_cache_get_max_size (WebKitSoupCache *cache)
-{
-	return cache->priv->max_size;
-}
diff --git a/Source/WebCore/platform/network/soup/cache/webkit/soup-cache.h b/Source/WebCore/platform/network/soup/cache/webkit/soup-cache.h
deleted file mode 100644
index a926f98..0000000
--- a/Source/WebCore/platform/network/soup/cache/webkit/soup-cache.h
+++ /dev/null
@@ -1,106 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
-/*
- * soup-cache.h:
- *
- * Copyright (C) 2009, 2010 Igalia, S.L.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifndef WEBKIT_SOUP_CACHE_H
-#define WEBKIT_SOUP_CACHE_H 1
-
-#ifdef G_OS_WIN32
-    #ifdef BUILDING_WEBKIT
-        #define WEBKIT_API __declspec(dllexport)
-    #else
-        #define WEBKIT_API __declspec(dllimport)
-    #endif
-    #define WEBKIT_OBSOLETE_API WEBKIT_API
-#else
-    #define WEBKIT_API __attribute__((visibility("default")))
-    #define WEBKIT_OBSOLETE_API WEBKIT_API __attribute__((deprecated))
-#endif
-
-#include <libsoup/soup-types.h>
-#include <gio/gio.h>
-
-G_BEGIN_DECLS
-
-#define WEBKIT_TYPE_SOUP_CACHE            (webkit_soup_cache_get_type ())
-#define WEBKIT_SOUP_CACHE(obj)            (G_TYPE_CHECK_INSTANCE_CAST ((obj), WEBKIT_TYPE_SOUP_CACHE, WebKitSoupCache))
-#define WEBKIT_SOUP_CACHE_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), WEBKIT_TYPE_SOUP_CACHE, WebKitSoupCacheClass))
-#define WEBKIT_IS_SOUP_CACHE(obj)         (G_TYPE_CHECK_INSTANCE_TYPE ((obj), WEBKIT_TYPE_SOUP_CACHE))
-#define WEBKIT_IS_SOUP_CACHE_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((obj), WEBKIT_TYPE_SOUP_CACHE))
-#define WEBKIT_SOUP_CACHE_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj), WEBKIT_TYPE_SOUP_CACHE, WebKitSoupCacheClass))
-
-typedef struct _WebKitSoupCache WebKitSoupCache;
-typedef struct _WebKitSoupCachePrivate WebKitSoupCachePrivate;
-
-typedef enum {
-	WEBKIT_SOUP_CACHE_CACHEABLE = (1 << 0),
-	WEBKIT_SOUP_CACHE_UNCACHEABLE = (1 << 1),
-	WEBKIT_SOUP_CACHE_INVALIDATES = (1 << 2),
-	WEBKIT_SOUP_CACHE_VALIDATES = (1 << 3)
-} WebKitSoupCacheability;
-
-typedef enum {
-	WEBKIT_SOUP_CACHE_RESPONSE_FRESH,
-	WEBKIT_SOUP_CACHE_RESPONSE_NEEDS_VALIDATION,
-	WEBKIT_SOUP_CACHE_RESPONSE_STALE
-} WebKitSoupCacheResponse;
-
-typedef enum {
-	WEBKIT_SOUP_CACHE_SINGLE_USER,
-	WEBKIT_SOUP_CACHE_SHARED
-} WebKitSoupCacheType;
-
-struct _WebKitSoupCache {
-	GObject parent_instance;
-
-	WebKitSoupCachePrivate *priv;
-};
-
-typedef struct {
-	GObjectClass parent_class;
-
-	/* methods */
-	WebKitSoupCacheability (*get_cacheability)(WebKitSoupCache *cache, SoupMessage *msg);
-
-	/* Padding for future expansion */
-	void (*_libsoup_reserved1)(void);
-	void (*_libsoup_reserved2)(void);
-	void (*_libsoup_reserved3)(void);
-} WebKitSoupCacheClass;
-
-WEBKIT_API GType             webkit_soup_cache_get_type (void);
-WEBKIT_API WebKitSoupCache  *webkit_soup_cache_new (const char  *cache_dir,
-						    WebKitSoupCacheType cache_type);
-WEBKIT_API void              webkit_soup_cache_flush (WebKitSoupCache   *cache);
-WEBKIT_API void              webkit_soup_cache_clear (WebKitSoupCache   *cache);
-
-WEBKIT_API void              webkit_soup_cache_dump (WebKitSoupCache *cache);
-WEBKIT_API void              webkit_soup_cache_load (WebKitSoupCache *cache);
-
-WEBKIT_API void              webkit_soup_cache_set_max_size (WebKitSoupCache *cache,
-							     guint max_size);
-WEBKIT_API guint             webkit_soup_cache_get_max_size (WebKitSoupCache *cache);
-
-G_END_DECLS
-
-
-#endif /* WEBKIT_SOUP_CACHE_H */
-
diff --git a/Source/WebCore/platform/network/win/DownloadBundleWin.cpp b/Source/WebCore/platform/network/win/DownloadBundleWin.cpp
new file mode 100644
index 0000000..f0f3027
--- /dev/null
+++ b/Source/WebCore/platform/network/win/DownloadBundleWin.cpp
@@ -0,0 +1,196 @@
+/*
+ * Copyright (C) 2011 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DownloadBundle.h"
+
+#include <CoreFoundation/CoreFoundation.h>
+#include <io.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+namespace DownloadBundle {
+
+static UInt32 magicNumber()
+{
+    return 0xDECAF4EA;
+}
+
+const String& fileExtension()
+{
+    DEFINE_STATIC_LOCAL(const String, extension, (".download"));
+    return extension;
+}
+
+bool appendResumeData(CFDataRef resumeData, const String& bundlePath)
+{
+    if (!resumeData) {
+        LOG_ERROR("Invalid resume data to write to bundle path");
+        return false;
+    }
+    if (bundlePath.isEmpty()) {
+        LOG_ERROR("Cannot write resume data to empty download bundle path");
+        return false;
+    }
+
+    String nullifiedPath = bundlePath;
+    FILE* bundle = 0;
+    if (_wfopen_s(&bundle, nullifiedPath.charactersWithNullTermination(), TEXT("ab")) || !bundle) {
+        LOG_ERROR("Failed to open file %s to append resume data", bundlePath.ascii().data());
+        return false;
+    }
+
+    bool result = false;
+
+    const UInt8* resumeBytes = CFDataGetBytePtr(resumeData);
+    ASSERT(resumeBytes);
+    if (!resumeBytes)
+        goto exit;
+
+    CFIndex resumeLength = CFDataGetLength(resumeData);
+    ASSERT(resumeLength > 0);
+    if (resumeLength < 1)
+        goto exit;
+
+    if (fwrite(resumeBytes, 1, resumeLength, bundle) != resumeLength) {
+        LOG_ERROR("Failed to write resume data to the bundle - errno(%i)", errno);
+        goto exit;
+    }
+
+    if (fwrite(&resumeLength, 4, 1, bundle) != 1) {
+        LOG_ERROR("Failed to write footer length to the bundle - errno(%i)", errno);
+        goto exit;
+    }
+
+    const UInt32& magic = magicNumber();
+    if (fwrite(&magic, 4, 1, bundle) != 1) {
+        LOG_ERROR("Failed to write footer magic number to the bundle - errno(%i)", errno);
+        goto exit;
+    }
+
+    result = true;
+exit:
+    fclose(bundle);
+    return result;
+}
+
+CFDataRef extractResumeData(const String& bundlePath)
+{
+    if (bundlePath.isEmpty()) {
+        LOG_ERROR("Cannot create resume data from empty download bundle path");
+        return 0;
+    }
+
+    // Open a handle to the bundle file
+    String nullifiedPath = bundlePath;
+    FILE* bundle = 0;
+    if (_wfopen_s(&bundle, nullifiedPath.charactersWithNullTermination(), TEXT("r+b")) || !bundle) {
+        LOG_ERROR("Failed to open file %s to get resume data", bundlePath.ascii().data());
+        return 0;
+    }
+
+    CFDataRef result = 0;
+    Vector<UInt8> footerBuffer;
+
+    // Stat the file to get its size
+    struct _stat64 fileStat;
+    if (_fstat64(_fileno(bundle), &fileStat))
+        goto exit;
+
+    // Check for the bundle magic number at the end of the file
+    fpos_t footerMagicNumberPosition = fileStat.st_size - 4;
+    ASSERT(footerMagicNumberPosition >= 0);
+    if (footerMagicNumberPosition < 0)
+        goto exit;
+    if (fsetpos(bundle, &footerMagicNumberPosition))
+        goto exit;
+
+    UInt32 footerMagicNumber = 0;
+    if (fread(&footerMagicNumber, 4, 1, bundle) != 1) {
+        LOG_ERROR("Failed to read footer magic number from the bundle - errno(%i)", errno);
+        goto exit;
+    }
+
+    if (footerMagicNumber != magicNumber()) {
+        LOG_ERROR("Footer's magic number does not match 0x%X - errno(%i)", magicNumber(), errno);
+        goto exit;
+    }
+
+    // Now we're *reasonably* sure this is a .download bundle we actually wrote.
+    // Get the length of the resume data
+    fpos_t footerLengthPosition = fileStat.st_size - 8;
+    ASSERT(footerLengthPosition >= 0);
+    if (footerLengthPosition < 0)
+        goto exit;
+
+    if (fsetpos(bundle, &footerLengthPosition))
+        goto exit;
+
+    UInt32 footerLength = 0;
+    if (fread(&footerLength, 4, 1, bundle) != 1) {
+        LOG_ERROR("Failed to read ResumeData length from the bundle - errno(%i)", errno);
+        goto exit;
+    }
+
+    // Make sure theres enough bytes to read in for the resume data, and perform the read
+    fpos_t footerStartPosition = fileStat.st_size - 8 - footerLength;
+    ASSERT(footerStartPosition >= 0);
+    if (footerStartPosition < 0)
+        goto exit;
+    if (fsetpos(bundle, &footerStartPosition))
+        goto exit;
+
+    footerBuffer.resize(footerLength);
+    if (fread(footerBuffer.data(), 1, footerLength, bundle) != footerLength) {
+        LOG_ERROR("Failed to read ResumeData from the bundle - errno(%i)", errno);
+        goto exit;
+    }
+
+    // CFURLDownload will seek to the appropriate place in the file (before our footer) and start overwriting from there
+    // However, say we were within a few hundred bytes of the end of a download when it was paused -
+    // The additional footer extended the length of the file beyond its final length, and there will be junk data leftover
+    // at the end.  Therefore, now that we've retrieved the footer data, we need to truncate it.
+    if (errno_t resizeError = _chsize_s(_fileno(bundle), footerStartPosition)) {
+        LOG_ERROR("Failed to truncate the resume footer off the end of the file - errno(%i)", resizeError);
+        goto exit;
+    }
+
+    // Finally, make the resume data.  Now, it is possible by some twist of fate the bundle magic number
+    // was naturally at the end of the file and its not actually a valid bundle.  That, or someone engineered
+    // it that way to try to attack us.  In that cause, this CFData will successfully create but when we 
+    // actually try to start the CFURLDownload using this bogus data, it will fail and we will handle that gracefully
+    result = CFDataCreate(0, footerBuffer.data(), footerLength);
+exit:
+    fclose(bundle);
+    return result;
+}
+
+} // namespace DownloadBundle
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/qt/ClipboardQt.h b/Source/WebCore/platform/qt/ClipboardQt.h
index fb5abef..8d78634 100644
--- a/Source/WebCore/platform/qt/ClipboardQt.h
+++ b/Source/WebCore/platform/qt/ClipboardQt.h
@@ -26,8 +26,8 @@
 #ifndef ClipboardQt_h
 #define ClipboardQt_h
 
-#include "Clipboard.h"
 #include "CachedResourceClient.h"
+#include "Clipboard.h"
 
 QT_BEGIN_NAMESPACE
 class QMimeData;
@@ -35,56 +35,56 @@ QT_END_NAMESPACE
 
 namespace WebCore {
 
-    class CachedImage;
+class CachedImage;
 
-    // State available during IE's events for drag and drop and copy/paste
-    class ClipboardQt : public Clipboard, public CachedResourceClient {
-        WTF_MAKE_FAST_ALLOCATED;
-    public:
-        static PassRefPtr<ClipboardQt> create(ClipboardAccessPolicy policy, const QMimeData* readableClipboard)
-        {
-            return adoptRef(new ClipboardQt(policy, readableClipboard));
-        }
-        static PassRefPtr<ClipboardQt> create(ClipboardAccessPolicy policy, ClipboardType clipboardType = CopyAndPaste)
-        {
-            return adoptRef(new ClipboardQt(policy, clipboardType));
-        }
-        virtual ~ClipboardQt();
+// State available during IE's events for drag and drop and copy/paste
+class ClipboardQt : public Clipboard, public CachedResourceClient {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    static PassRefPtr<ClipboardQt> create(ClipboardAccessPolicy policy, const QMimeData* readableClipboard)
+    {
+        return adoptRef(new ClipboardQt(policy, readableClipboard));
+    }
+    static PassRefPtr<ClipboardQt> create(ClipboardAccessPolicy policy, ClipboardType clipboardType = CopyAndPaste)
+    {
+        return adoptRef(new ClipboardQt(policy, clipboardType));
+    }
+    virtual ~ClipboardQt();
 
-        void clearData(const String& type);
-        void clearAllData();
-        String getData(const String& type, bool& success) const;
-        bool setData(const String& type, const String& data);
+    void clearData(const String& type);
+    void clearAllData();
+    String getData(const String& type, bool& success) const;
+    bool setData(const String& type, const String& data);
 
-        // extensions beyond IE's API
-        virtual HashSet<String> types() const;
-        virtual PassRefPtr<FileList> files() const;
+    // extensions beyond IE's API
+    virtual HashSet<String> types() const;
+    virtual PassRefPtr<FileList> files() const;
 
-        void setDragImage(CachedImage*, const IntPoint&);
-        void setDragImageElement(Node*, const IntPoint&);
+    void setDragImage(CachedImage*, const IntPoint&);
+    void setDragImageElement(Node*, const IntPoint&);
 
-        virtual DragImageRef createDragImage(IntPoint& dragLoc) const;
-        virtual void declareAndWriteDragImage(Element*, const KURL&, const String& title, Frame*);
-        virtual void writeURL(const KURL&, const String&, Frame*);
-        virtual void writeRange(Range*, Frame*);
-        virtual void writePlainText(const String&);
+    virtual DragImageRef createDragImage(IntPoint& dragLoc) const;
+    virtual void declareAndWriteDragImage(Element*, const KURL&, const String& title, Frame*);
+    virtual void writeURL(const KURL&, const String&, Frame*);
+    virtual void writeRange(Range*, Frame*);
+    virtual void writePlainText(const String&);
 
-        virtual bool hasData();
+    virtual bool hasData();
 
-        QMimeData* clipboardData() const { return m_writableData; }
-        void invalidateWritableData() { m_writableData = 0; }
+    QMimeData* clipboardData() const { return m_writableData; }
+    void invalidateWritableData() { m_writableData = 0; }
 
-    private:
-        ClipboardQt(ClipboardAccessPolicy, const QMimeData* readableClipboard);
+private:
+    ClipboardQt(ClipboardAccessPolicy, const QMimeData* readableClipboard);
 
-        // Clipboard is writable so it will create its own QMimeData object
-        ClipboardQt(ClipboardAccessPolicy, ClipboardType);
+    // Clipboard is writable so it will create its own QMimeData object
+    ClipboardQt(ClipboardAccessPolicy, ClipboardType);
 
-        void setDragImage(CachedImage*, Node*, const IntPoint& loc);
+    void setDragImage(CachedImage*, Node*, const IntPoint& loc);
 
-        const QMimeData* m_readableData;
-        QMimeData* m_writableData;
-    };
+    const QMimeData* m_readableData;
+    QMimeData* m_writableData;
+};
 }
 
 #endif // ClipboardQt_h
diff --git a/Source/WebCore/platform/qt/CookieJarQt.cpp b/Source/WebCore/platform/qt/CookieJarQt.cpp
index b7ff5d1..e5a2dcd 100644
--- a/Source/WebCore/platform/qt/CookieJarQt.cpp
+++ b/Source/WebCore/platform/qt/CookieJarQt.cpp
@@ -114,10 +114,12 @@ String cookieRequestHeaderFieldValue(const Document* document, const KURL &url)
 
 bool cookiesEnabled(const Document* document)
 {
-    if (QNetworkAccessManager* manager = networkAccessManager(document))
-        return !!manager->cookieJar();
+    QNetworkAccessManager* manager = networkAccessManager(document);
+    if (!manager)
+        return false;
 
-    return false;
+    QtNAMThreadSafeProxy managerProxy(manager);
+    return managerProxy.hasCookieJar();
 }
 
 bool getRawCookies(const Document*, const KURL&, Vector<Cookie>& rawCookies)
diff --git a/Source/WebCore/platform/qt/DragDataQt.cpp b/Source/WebCore/platform/qt/DragDataQt.cpp
index f68ad1d..2554df4 100644
--- a/Source/WebCore/platform/qt/DragDataQt.cpp
+++ b/Source/WebCore/platform/qt/DragDataQt.cpp
@@ -125,7 +125,8 @@ String DragData::asURL(Frame*, FilenameConversionPolicy filenamePolicy, String*)
     if (urls.isEmpty())
         return String();
 
-    return encodeWithURLEscapeSequences(urls.first().toString());
+    QByteArray encodedUrl = urls.first().toEncoded();
+    return String(encodedUrl.constData(), encodedUrl.length());
 }
 
 PassRefPtr<DocumentFragment> DragData::asFragment(Frame* frame, PassRefPtr<Range>, bool, bool&) const
diff --git a/Source/WebCore/platform/qt/MIMETypeRegistryQt.cpp b/Source/WebCore/platform/qt/MIMETypeRegistryQt.cpp
index 12db891..01cef12 100644
--- a/Source/WebCore/platform/qt/MIMETypeRegistryQt.cpp
+++ b/Source/WebCore/platform/qt/MIMETypeRegistryQt.cpp
@@ -29,6 +29,9 @@
 #include "config.h"
 #include "MIMETypeRegistry.h"
 
+#include <wtf/Assertions.h>
+#include <wtf/MainThread.h>
+
 namespace WebCore {
 
 struct ExtensionMap {
@@ -70,6 +73,8 @@ static const ExtensionMap extensionMap[] = {
 
 String MIMETypeRegistry::getMIMETypeForExtension(const String &ext)
 {
+    ASSERT(isMainThread());
+
     String s = ext.lower();
 
     const ExtensionMap *e = extensionMap;
diff --git a/Source/WebCore/platform/qt/RenderThemeQt.cpp b/Source/WebCore/platform/qt/RenderThemeQt.cpp
index 8d5cfcd..d4688cf 100644
--- a/Source/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/Source/WebCore/platform/qt/RenderThemeQt.cpp
@@ -726,7 +726,7 @@ bool RenderThemeQt::paintMenuList(RenderObject* o, const PaintInfo& i, const Int
     initStyleOption(p.widget, opt);
     initializeCommonQStyleOptions(opt, o);
 
-    const QPoint topLeft = r.topLeft();
+    const QPoint topLeft = r.location();
     p.painter->translate(topLeft);
     opt.rect.moveTo(QPoint(0, 0));
     opt.rect.setSize(r.size());
@@ -825,7 +825,7 @@ bool RenderThemeQt::paintProgressBar(RenderObject* o, const PaintInfo& pi, const
     option.minimum = 0;
     option.progress = (renderProgress->position() * std::numeric_limits<int>::max());
 
-    const QPoint topLeft = r.topLeft();
+    const QPoint topLeft = r.location();
     p.painter->translate(topLeft);
     option.rect.moveTo(QPoint(0, 0));
     option.rect.setSize(r.size());
@@ -887,7 +887,7 @@ bool RenderThemeQt::paintSliderTrack(RenderObject* o, const PaintInfo& pi,
         option.state |= QStyle::State_Sunken;
     }
 
-    const QPoint topLeft = r.topLeft();
+    const QPoint topLeft = r.location();
     p.painter->translate(topLeft);
     option.rect.moveTo(QPoint(0, 0));
     option.rect.setSize(r.size());
@@ -1174,7 +1174,26 @@ QColor RenderThemeQt::getMediaControlForegroundColor(RenderObject* o) const
 
 bool RenderThemeQt::paintMediaFullscreenButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
-    return RenderTheme::paintMediaFullscreenButton(o, paintInfo, r);
+    HTMLMediaElement* mediaElement = getMediaElementFromRenderObject(o);
+    if (!mediaElement)
+        return false;
+
+    StylePainter p(this, paintInfo);
+    if (!p.isValid())
+        return true;
+
+    p.painter->setRenderHint(QPainter::Antialiasing, true);
+
+    paintMediaBackground(p.painter, r);
+
+    WorldMatrixTransformer transformer(p.painter, o, r);
+    const QPointF arrowPolygon[9] = { QPointF(20, 0), QPointF(100, 0), QPointF(100, 80),
+            QPointF(80, 80), QPointF(80, 30), QPointF(10, 100), QPointF(0, 90), QPointF(70, 20), QPointF(20, 20)};
+
+    p.painter->setBrush(getMediaControlForegroundColor(o));
+    p.painter->drawPolygon(arrowPolygon, 9);
+
+    return false;
 }
 
 bool RenderThemeQt::paintMediaMuteButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
diff --git a/Source/WebCore/platform/qt/ScrollbarQt.cpp b/Source/WebCore/platform/qt/ScrollbarQt.cpp
index dda82e9..5afb1ae6 100644
--- a/Source/WebCore/platform/qt/ScrollbarQt.cpp
+++ b/Source/WebCore/platform/qt/ScrollbarQt.cpp
@@ -74,6 +74,11 @@ bool Scrollbar::contextMenu(const PlatformMouseEvent& event)
     QAction* actionSelected = menu.exec(globalPos);
 
     if (actionSelected == actScrollHere) {
+        // Set the pressed position to the middle of the thumb so that when we 
+        // do move, the delta will be from the current pixel position of the
+        // thumb to the new position
+        int position = theme()->trackPosition(this) + theme()->thumbPosition(this) + theme()->thumbLength(this) / 2;
+        setPressedPos(position); 
         const QPoint pos = convertFromContainingWindow(event.pos());
         moveThumb(horizontal ? pos.x() : pos.y());
     } else if (actionSelected == actScrollTop)
diff --git a/Source/WebCore/platform/sql/SQLiteStatement.cpp b/Source/WebCore/platform/sql/SQLiteStatement.cpp
index af9518a..d9186dc 100644
--- a/Source/WebCore/platform/sql/SQLiteStatement.cpp
+++ b/Source/WebCore/platform/sql/SQLiteStatement.cpp
@@ -176,6 +176,20 @@ int SQLiteStatement::bindBlob(int index, const void* blob, int size)
     return sqlite3_bind_blob(m_statement, index, blob, size, SQLITE_TRANSIENT);
 }
 
+int SQLiteStatement::bindBlob(int index, const String& text)
+{
+    // String::characters() returns 0 for the empty string, which SQLite
+    // treats as a null, so we supply a non-null pointer for that case.
+    UChar anyCharacter = 0;
+    const UChar* characters;
+    if (text.isEmpty() && !text.isNull())
+        characters = &anyCharacter;
+    else
+        characters = text.characters();
+
+    return bindBlob(index, characters, text.length() * sizeof(UChar));
+}
+
 int SQLiteStatement::bindText(int index, const String& text)
 {
     ASSERT(m_isPrepared);
@@ -355,7 +369,29 @@ int64_t SQLiteStatement::getColumnInt64(int col)
         return 0;
     return sqlite3_column_int64(m_statement, col);
 }
-    
+
+String SQLiteStatement::getColumnBlobAsString(int col)
+{
+    ASSERT(col >= 0);
+
+    if (!m_statement && prepareAndStep() != SQLITE_ROW)
+        return String();
+
+    if (columnCount() <= col)
+        return String();
+
+    const void* blob = sqlite3_column_blob(m_statement, col);
+    if (!blob)
+        return String();
+
+    int size = sqlite3_column_bytes(m_statement, col);
+    if (size < 0)
+        return String();
+
+    ASSERT(!(size % sizeof(UChar)));
+    return String(static_cast<const UChar*>(blob), size / sizeof(UChar));
+}
+
 void SQLiteStatement::getColumnBlobAsVector(int col, Vector<char>& result)
 {
     ASSERT(col >= 0);
@@ -379,7 +415,7 @@ void SQLiteStatement::getColumnBlobAsVector(int col, Vector<char>& result)
     int size = sqlite3_column_bytes(m_statement, col);
     result.resize((size_t)size);
     for (int i = 0; i < size; ++i)
-        result[i] = ((const unsigned char*)blob)[i];
+        result[i] = (static_cast<const unsigned char*>(blob))[i];
 }
 
 const void* SQLiteStatement::getColumnBlob(int col, int& size)
diff --git a/Source/WebCore/platform/sql/SQLiteStatement.h b/Source/WebCore/platform/sql/SQLiteStatement.h
index fd1abfb..35dcecf 100644
--- a/Source/WebCore/platform/sql/SQLiteStatement.h
+++ b/Source/WebCore/platform/sql/SQLiteStatement.h
@@ -42,6 +42,7 @@ public:
     
     int prepare();
     int bindBlob(int index, const void* blob, int size);
+    int bindBlob(int index, const String&);
     int bindText(int index, const String&);
     int bindInt(int index, int);
     int bindInt64(int index, int64_t);
@@ -80,6 +81,7 @@ public:
     int getColumnInt(int col);
     int64_t getColumnInt64(int col);
     const void* getColumnBlob(int col, int& size);
+    String getColumnBlobAsString(int col);
     void getColumnBlobAsVector(int col, Vector<char>&);
 
     bool returnTextResults(int col, Vector<String>&);
diff --git a/Source/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp b/Source/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp
index 37f96be..6dbc384 100644
--- a/Source/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp
+++ b/Source/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp
@@ -34,938 +34,23 @@
 #include "PlatformBridge.h"
 #include <sqlite3.h>
 
-#include <errno.h>
 #include <fcntl.h>
 #include <string.h>
-#include <sys/stat.h>
-#include <sys/time.h>
-#include <sys/types.h>
 #include <unistd.h>
 
 using namespace WebCore;
 
-// Chromium's Posix implementation of SQLite VFS.
-// This is heavily based on SQLite's os_unix.c,
-// without parts we don't need.
-
-// Identifies a file by its device number and inode.
-struct ChromiumFileId {
-    dev_t dev; // Device number.
-    ino_t ino; // Inode number.
-};
-
-// Information about file locks (one per open inode). Note that many open
-// file descriptors may refer to the same inode.
-struct ChromiumLockInfo {
-    ChromiumFileId lockKey; // File identifier.
-    int cnt; // Number of shared locks held.
-    int locktype; // Type of the lock.
-    int nRef; // Reference count.
-
-    // Double-linked list pointers.
-    ChromiumLockInfo* pNext; 
-    ChromiumLockInfo* pPrev;
-};
-
-// Information about a file descriptor that cannot be closed immediately.
-struct ChromiumUnusedFd {
-    int fd; // File descriptor.
-    int flags; // Flags this file descriptor was opened with.
-    ChromiumUnusedFd* pNext; // Next unused file descriptor on the same file.
-};
-
-// Information about an open inode. When we want to close an inode
-// that still has locks, we defer the close until all locks are cleared.
-struct ChromiumOpenInfo {
-    ChromiumFileId fileId; // The lookup key.
-    int nRef; // Reference count.
-    int nLock; // Number of outstanding locks.
-    ChromiumUnusedFd* pUnused; // List of file descriptors to close.
-
-    // Double-linked list pointers.
-    ChromiumOpenInfo* pNext;
-    ChromiumOpenInfo* pPrev;
-};
-
-// Keep track of locks and inodes in double-linked lists.
-static struct ChromiumLockInfo* lockList = 0;
-static struct ChromiumOpenInfo* openList = 0;
-
-// Extension of sqlite3_file specific to the chromium VFS.
-struct ChromiumFile {
-    sqlite3_io_methods const* pMethod; // Implementation of sqlite3_file.
-    ChromiumOpenInfo* pOpen; // Information about all open file descriptors for this file.
-    ChromiumLockInfo* pLock; // Information about all locks for this file.
-    int h; // File descriptor.
-    int dirfd; // File descriptor for the file directory.
-    unsigned char locktype; // Type of the lock used for this file.
-    int lastErrno; // Value of errno for last operation on this file.
-    ChromiumUnusedFd* pUnused; // Information about unused file descriptors for this file.
-};
-
-// The following constants specify the range of bytes used for locking.
-// SQLiteSharedSize is the number of bytes available in the pool from which
-// a random byte is selected for a shared lock.  The pool of bytes for
-// shared locks begins at SQLiteSharedFirstByte. 
-// The values are the same as used by SQLite for compatibility.
-static const off_t SQLitePendingByte = 0x40000000;
-static const off_t SQLiteReservedByte = SQLitePendingByte + 1;
-static const off_t SQLiteSharedFirstByte = SQLitePendingByte + 2;
-static const off_t SQLiteSharedSize = 510;
-
-// Maps a POSIX error code to an SQLite error code.
-static int sqliteErrorFromPosixError(int posixError, int sqliteIOErr)
-{
-    switch (posixError) {
-    case 0: 
-        return SQLITE_OK;
-    case EAGAIN:
-    case ETIMEDOUT:
-    case EBUSY:
-    case EINTR:
-    case ENOLCK:  
-        return SQLITE_BUSY;
-    case EACCES: 
-        // EACCES is like EAGAIN during locking operations.
-        if ((sqliteIOErr == SQLITE_IOERR_LOCK) ||
-            (sqliteIOErr == SQLITE_IOERR_UNLOCK) ||
-            (sqliteIOErr == SQLITE_IOERR_RDLOCK) ||
-            (sqliteIOErr == SQLITE_IOERR_CHECKRESERVEDLOCK))
-            return SQLITE_BUSY;
-        return SQLITE_PERM;
-    case EPERM: 
-        return SQLITE_PERM;
-    case EDEADLK:
-        return SQLITE_IOERR_BLOCKED;
-    default: 
-        return sqliteIOErr;
-    }
-}
-
-// Releases a ChromiumLockInfo structure previously allocated by findLockInfo().
-static void releaseLockInfo(ChromiumLockInfo* pLock)
-{
-    if (!pLock)
-        return;
-
-    pLock->nRef--;
-    if (pLock->nRef > 0)
-        return;
-
-    if (pLock->pPrev) {
-        ASSERT(pLock->pPrev->pNext == pLock);
-        pLock->pPrev->pNext = pLock->pNext;
-    } else {
-        ASSERT(lockList == pLock);
-        lockList = pLock->pNext;
-    }
-    if (pLock->pNext) {
-        ASSERT(pLock->pNext->pPrev == pLock);
-        pLock->pNext->pPrev = pLock->pPrev;
-    }
-
-    sqlite3_free(pLock);
-}
-
-// Releases a ChromiumOpenInfo structure previously allocated by findLockInfo().
-static void releaseOpenInfo(ChromiumOpenInfo* pOpen)
-{
-    if (!pOpen)
-        return;
-
-    pOpen->nRef--;
-    if (pOpen->nRef > 0)
-        return;
-
-    if (pOpen->pPrev) {
-        ASSERT(pOpen->pPrev->pNext == pOpen);
-        pOpen->pPrev->pNext = pOpen->pNext;
-    } else {
-        ASSERT(openList == pOpen);
-        openList = pOpen->pNext;
-    }
-    if (pOpen->pNext) {
-        ASSERT(pOpen->pNext->pPrev == pOpen);
-        pOpen->pNext->pPrev = pOpen->pPrev;
-    }
-
-    ASSERT(!pOpen->pUnused); // Make sure we're not leaking memory and file descriptors.
-
-    sqlite3_free(pOpen);
-}
-
-// Locates ChromiumLockInfo and ChromiumOpenInfo for given file descriptor (creating new ones if needed).
-// Returns a SQLite error code.
-static int findLockInfo(ChromiumFile* pFile, ChromiumLockInfo** ppLock, ChromiumOpenInfo** ppOpen)
-{
-    int fd = pFile->h;
-    struct stat statbuf;
-    int rc = fstat(fd, &statbuf);
-    if (rc) {
-        pFile->lastErrno = errno;
-#ifdef EOVERFLOW
-        if (pFile->lastErrno == EOVERFLOW)
-            return SQLITE_NOLFS;
-#endif
-        return SQLITE_IOERR;
-    }
-
-#if OS(DARWIN)
-    // On OS X on an msdos/fat filesystems, the inode number is reported
-    // incorrectly for zero-size files. See http://www.sqlite.org/cvstrac/tktview?tn=3260.
-    // To work around this problem we always increase the file size to 1 by writing a single byte
-    // prior to accessing the inode number. The one byte written is an ASCII 'S' character which
-    // also happens to be the first byte in the header of every SQLite database.  In this way,
-    // if there is a race condition such that another thread has already populated the first page
-    // of the database, no damage is done.
-    if (!statbuf.st_size) {
-        rc = write(fd, "S", 1);
-        if (rc != 1)
-            return SQLITE_IOERR;
-        rc = fstat(fd, &statbuf);
-        if (rc) {
-            pFile->lastErrno = errno;
-            return SQLITE_IOERR;
-        }
-    }
-#endif
-
-    ChromiumFileId fileId;
-    memset(&fileId, 0, sizeof(fileId));
-    fileId.dev = statbuf.st_dev;
-    fileId.ino = statbuf.st_ino;
-
-    ChromiumLockInfo* pLock = 0;
-
-    if (ppLock) {
-        pLock = lockList;
-        while (pLock && memcmp(&fileId, &pLock->lockKey, sizeof(fileId)))
-            pLock = pLock->pNext;
-        if (pLock)
-            pLock->nRef++;
-        else {
-            pLock = static_cast<ChromiumLockInfo*>(sqlite3_malloc(sizeof(*pLock)));
-            if (!pLock)
-                return SQLITE_NOMEM;
-            pLock->lockKey = fileId;
-            pLock->nRef = 1;
-            pLock->cnt = 0;
-            pLock->locktype = 0;
-            pLock->pNext = lockList;
-            pLock->pPrev = 0;
-            if (lockList)
-                lockList->pPrev = pLock;
-            lockList = pLock;
-        }
-        *ppLock = pLock;
-    }
-
-    if (ppOpen) {
-        ChromiumOpenInfo* pOpen = openList;
-        while (pOpen && memcmp(&fileId, &pOpen->fileId, sizeof(fileId)))
-            pOpen = pOpen->pNext;
-        if (pOpen)
-            pOpen->nRef++;
-        else {
-            pOpen = static_cast<ChromiumOpenInfo*>(sqlite3_malloc(sizeof(*pOpen)));
-            if (!pOpen) {
-                releaseLockInfo(pLock);
-                return SQLITE_NOMEM;
-            }
-            memset(pOpen, 0, sizeof(*pOpen));
-            pOpen->fileId = fileId;
-            pOpen->nRef = 1;
-            pOpen->pNext = openList;
-            if (openList)
-                openList->pPrev = pOpen;
-            openList = pOpen;
-        }
-        *ppOpen = pOpen;
-    }
-
-    return rc;
-}
-
-// Checks if there is a RESERVED lock held on the specified file by this or any other process.
-// If the lock is held, sets pResOut to a non-zero value. Returns a SQLite error code.
-static int chromiumCheckReservedLock(sqlite3_file* id, int* pResOut)
-{
-    ChromiumFile* pFile = reinterpret_cast<ChromiumFile*>(id);
-    ASSERT(pFile);
-
-    // Look for locks held by this process.
-    int reserved = 0;
-    if (pFile->pLock->locktype > SQLITE_LOCK_SHARED)
-        reserved = 1;
-
-    // Look for locks held by other processes.
-    int rc = SQLITE_OK;
-    if (!reserved) {
-        struct flock lock;
-        lock.l_whence = SEEK_SET;
-        lock.l_start = SQLiteReservedByte;
-        lock.l_len = 1;
-        lock.l_type = F_WRLCK;
-        if (-1 == fcntl(pFile->h, F_GETLK, &lock)) {
-            int tErrno = errno;
-            rc = sqliteErrorFromPosixError(tErrno, SQLITE_IOERR_CHECKRESERVEDLOCK);
-            pFile->lastErrno = tErrno;
-        } else if (lock.l_type != F_UNLCK)
-            reserved = 1;
-    }
-
-    *pResOut = reserved;
-    return rc;
-}
-
-// Performs a file locking operation on a range of bytes in a file.
-// The |op| parameter should be one of F_RFLCK, F_WRLCK or F_UNLCK.
-// Returns a Unix error code, and also writes it to pErrcode.
-static int rangeLock(ChromiumFile* pFile, int op, int* pErrcode)
-{
-    struct flock lock;
-    lock.l_type = op;
-    lock.l_start = SQLiteSharedFirstByte;
-    lock.l_whence = SEEK_SET;
-    lock.l_len = SQLiteSharedSize;
-    int rc = fcntl(pFile->h, F_SETLK, &lock);
-    *pErrcode = errno;
-    return rc;
-}
-
-// Locks the file with the lock specified by parameter locktype - one
-// of the following:
-//
-//     (1) SQLITE_LOCK_SHARED
-//     (2) SQLITE_LOCK_RESERVED
-//     (3) SQLITE_LOCK_PENDING
-//     (4) SQLITE_LOCK_EXCLUSIVE
-//
-// Sometimes when requesting one lock state, additional lock states
-// are inserted in between.  The locking might fail on one of the later
-// transitions leaving the lock state different from what it started but
-// still short of its goal.  The following chart shows the allowed
-// transitions and the inserted intermediate states:
-//
-//    UNLOCKED -> SHARED
-//    SHARED -> RESERVED
-//    SHARED -> (PENDING) -> EXCLUSIVE
-//    RESERVED -> (PENDING) -> EXCLUSIVE
-//    PENDING -> EXCLUSIVE
-static int chromiumLock(sqlite3_file* id, int locktype)
-{
-    // To obtain a SHARED lock, a read-lock is obtained on the 'pending
-    // byte'.  If this is successful, a random byte from the 'shared byte
-    // range' is read-locked and the lock on the 'pending byte' released.
-    //
-    // A process may only obtain a RESERVED lock after it has a SHARED lock.
-    // A RESERVED lock is implemented by grabbing a write-lock on the
-    // 'reserved byte'. 
-    //
-    // A process may only obtain a PENDING lock after it has obtained a
-    // SHARED lock. A PENDING lock is implemented by obtaining a write-lock
-    // on the 'pending byte'. This ensures that no new SHARED locks can be
-    // obtained, but existing SHARED locks are allowed to persist. A process
-    // does not have to obtain a RESERVED lock on the way to a PENDING lock.
-    // This property is used by the algorithm for rolling back a journal file
-    // after a crash.
-    //
-    // An EXCLUSIVE lock, obtained after a PENDING lock is held, is
-    // implemented by obtaining a write-lock on the entire 'shared byte
-    // range'. Since all other locks require a read-lock on one of the bytes
-    // within this range, this ensures that no other locks are held on the
-    // database. 
-
-    int rc = SQLITE_OK;
-    struct flock lock;
-    int s = 0;
-    int tErrno;
-
-    ChromiumFile* pFile = reinterpret_cast<ChromiumFile*>(id);
-    ASSERT(pFile);
-
-    ChromiumLockInfo* pLock = pFile->pLock;
-
-    // If there is already a lock of this type or more restrictive, do nothing.
-    if (pFile->locktype >= locktype)
-        return SQLITE_OK;
-
-    // Make sure we never move from unlocked to anything higher than shared lock.
-    ASSERT(pFile->locktype != SQLITE_LOCK_NONE || locktype == SQLITE_LOCK_SHARED);
-
-    // Make sure we never request a pending lock.
-    ASSERT(locktype != SQLITE_LOCK_PENDING);
-
-    // Make sure a shared lock is always held when a RESERVED lock is requested.
-    ASSERT(locktype != SQLITE_LOCK_RESERVED || pFile->locktype == SQLITE_LOCK_SHARED);
-
-    // If some thread using this PID has a lock via a different ChromiumFile
-    // handle that precludes the requested lock, return BUSY.
-    if (pFile->locktype != pLock->locktype &&
-        (pLock->locktype >= SQLITE_LOCK_PENDING || locktype > SQLITE_LOCK_SHARED))
-        return SQLITE_BUSY;
-
-    // If a SHARED lock is requested, and some thread using this PID already
-    // has a SHARED or RESERVED lock, then just increment reference counts.
-    if (locktype == SQLITE_LOCK_SHARED &&
-        (pLock->locktype == SQLITE_LOCK_SHARED || pLock->locktype == SQLITE_LOCK_RESERVED)) {
-        ASSERT(!pFile->locktype);
-        ASSERT(pLock->cnt > 0);
-        pFile->locktype = SQLITE_LOCK_SHARED;
-        pLock->cnt++;
-        pFile->pOpen->nLock++;
-        return SQLITE_OK;
-    }
-
-    // A PENDING lock is needed before acquiring a SHARED lock and before
-    // acquiring an EXCLUSIVE lock.  For the SHARED lock, the PENDING will
-    // be released.
-    lock.l_len = 1;
-    lock.l_whence = SEEK_SET;
-    if (locktype == SQLITE_LOCK_SHARED ||
-        (locktype == SQLITE_LOCK_EXCLUSIVE && pFile->locktype < SQLITE_LOCK_PENDING)) {
-        lock.l_type = (locktype == SQLITE_LOCK_SHARED ? F_RDLCK : F_WRLCK);
-        lock.l_start = SQLitePendingByte;
-        s = fcntl(pFile->h, F_SETLK, &lock);
-        if (s == -1) {
-            tErrno = errno;
-            rc = sqliteErrorFromPosixError(tErrno, SQLITE_IOERR_LOCK);
-            if ((rc != SQLITE_OK) && (rc != SQLITE_BUSY))
-                pFile->lastErrno = tErrno;
-            return rc;
-        }
-    }
-
-    if (locktype == SQLITE_LOCK_SHARED) {
-        ASSERT(!pLock->cnt);
-        ASSERT(!pLock->locktype);
-
-        s = rangeLock(pFile, F_RDLCK, &tErrno);
-
-        // Drop the temporary PENDING lock.
-        lock.l_start = SQLitePendingByte;
-        lock.l_len = 1;
-        lock.l_type = F_UNLCK;
-        if (fcntl(pFile->h, F_SETLK, &lock)) {
-            if (s != -1) {
-                tErrno = errno; 
-                rc = sqliteErrorFromPosixError(tErrno, SQLITE_IOERR_UNLOCK); 
-                if ((rc != SQLITE_OK) && (rc != SQLITE_BUSY))
-                    pFile->lastErrno = tErrno;
-                return rc;
-            }
-        }
-        if (s == -1) {
-            rc = sqliteErrorFromPosixError(tErrno, SQLITE_IOERR_LOCK);
-            if ((rc != SQLITE_OK) && (rc != SQLITE_BUSY))
-                pFile->lastErrno = tErrno;
-        } else {
-            pFile->locktype = SQLITE_LOCK_SHARED;
-            pFile->pOpen->nLock++;
-            pLock->cnt = 1;
-        }
-    } else if (locktype == SQLITE_LOCK_EXCLUSIVE && pLock->cnt > 1) {
-        // We are trying for an exclusive lock but another thread in the
-        // same process is still holding a shared lock.
-        rc = SQLITE_BUSY;
-    }  else {
-        // The request was for a RESERVED or EXCLUSIVE lock.  It is
-        // assumed that there is a SHARED or greater lock on the file
-        // already.
-        ASSERT(pFile->locktype);
-        lock.l_type = F_WRLCK;
-        switch (locktype) {
-        case SQLITE_LOCK_RESERVED:
-            lock.l_start = SQLiteReservedByte;
-            s = fcntl(pFile->h, F_SETLK, &lock);
-            tErrno = errno;
-            break;
-        case SQLITE_LOCK_EXCLUSIVE:
-            s = rangeLock(pFile, F_WRLCK, &tErrno);
-            break;
-        default:
-            ASSERT_NOT_REACHED();
-        }
-        if (s == -1) {
-            rc = sqliteErrorFromPosixError(tErrno, SQLITE_IOERR_LOCK);
-            if ((rc != SQLITE_OK) && (rc != SQLITE_BUSY))
-                pFile->lastErrno = tErrno;
-        }
-    }
-  
-    if (rc == SQLITE_OK) {
-        pFile->locktype = locktype;
-        pLock->locktype = locktype;
-    } else if (locktype == SQLITE_LOCK_EXCLUSIVE) {
-        pFile->locktype = SQLITE_LOCK_PENDING;
-        pLock->locktype = SQLITE_LOCK_PENDING;
-    }
-
-    return rc;
-}
-
-// Closes all file descriptors for given ChromiumFile for which the close has been deferred.
-// Returns a SQLite error code.
-static int closePendingFds(ChromiumFile* pFile)
-{
-    int rc = SQLITE_OK;
-    ChromiumOpenInfo* pOpen = pFile->pOpen;
-    ChromiumUnusedFd* pError = 0;
-    ChromiumUnusedFd* pNext;
-    for (ChromiumUnusedFd* p = pOpen->pUnused; p; p = pNext) {
-        pNext = p->pNext;
-        if (close(p->fd)) {
-            pFile->lastErrno = errno;
-            rc = SQLITE_IOERR_CLOSE;
-            p->pNext = pError;
-            pError = p;
-        } else
-            sqlite3_free(p);
-    }
-    pOpen->pUnused = pError;
-    return rc;
-}
-
-// Lowers the locking level on file descriptor.
-// locktype must be either SQLITE_LOCK_NONE or SQLITE_LOCK_SHARED.
-static int chromiumUnlock(sqlite3_file* id, int locktype)
-{
-    ChromiumFile* pFile = reinterpret_cast<ChromiumFile*>(id);
-    ASSERT(pFile);
-    ASSERT(locktype <= SQLITE_LOCK_SHARED);
-
-    if (pFile->locktype <= locktype)
-        return SQLITE_OK;
-
-    ChromiumLockInfo* pLock = pFile->pLock;
-    ASSERT(pLock->cnt);
-
-    struct flock lock;
-    int rc = SQLITE_OK;
-    int h = pFile->h;
-    int tErrno;
-
-    if (pFile->locktype > SQLITE_LOCK_SHARED) {
-        ASSERT(pLock->locktype == pFile->locktype);
-
-        if (locktype == SQLITE_LOCK_SHARED && rangeLock(pFile, F_RDLCK, &tErrno) == -1) {
-            rc = sqliteErrorFromPosixError(tErrno, SQLITE_IOERR_RDLOCK);
-            if ((rc != SQLITE_OK) && (rc != SQLITE_BUSY))
-                pFile->lastErrno = tErrno;
-            if (rc == SQLITE_OK)
-                pFile->locktype = locktype;
-            return rc;
-        }
-        lock.l_type = F_UNLCK;
-        lock.l_whence = SEEK_SET;
-        lock.l_start = SQLitePendingByte;
-        lock.l_len = 2;
-        if (fcntl(h, F_SETLK, &lock) != -1)
-            pLock->locktype = SQLITE_LOCK_SHARED;
-        else {
-            tErrno = errno;
-            rc = sqliteErrorFromPosixError(tErrno, SQLITE_IOERR_UNLOCK);
-            if ((rc != SQLITE_OK) && (rc != SQLITE_BUSY))
-                pFile->lastErrno = tErrno;
-            if (rc == SQLITE_OK)
-                pFile->locktype = locktype;
-            return rc;
-        }
-    }
-    if (locktype == SQLITE_LOCK_NONE) {
-        struct ChromiumOpenInfo *pOpen;
-
-        pLock->cnt--;
-
-        // Release the lock using an OS call only when all threads in this same process have released the lock.
-        if (!pLock->cnt) {
-            lock.l_type = F_UNLCK;
-            lock.l_whence = SEEK_SET;
-            lock.l_start = lock.l_len = 0L;
-            if (fcntl(h, F_SETLK, &lock) != -1)
-                pLock->locktype = SQLITE_LOCK_NONE;
-            else {
-                tErrno = errno;
-                rc = sqliteErrorFromPosixError(tErrno, SQLITE_IOERR_UNLOCK);
-                if ((rc != SQLITE_OK) && (rc != SQLITE_BUSY))
-                    pFile->lastErrno = tErrno;
-                pLock->locktype = SQLITE_LOCK_NONE;
-                pFile->locktype = SQLITE_LOCK_NONE;
-            }
-        }
-
-        pOpen = pFile->pOpen;
-        pOpen->nLock--;
-        ASSERT(pOpen->nLock >= 0);
-        if (!pOpen->nLock) {
-            int rc2 = closePendingFds(pFile);
-            if (rc == SQLITE_OK)
-                rc = rc2;
-        }
-    }
-
-    if (rc == SQLITE_OK)
-        pFile->locktype = locktype;
-    return rc;
+// Defined in Chromium's codebase in third_party/sqlite/src/os_unix.c
+extern "C" {
+void chromium_sqlite3_initialize_unix_sqlite3_file(sqlite3_file* file);
+int chromium_sqlite3_fill_in_unix_sqlite3_file(sqlite3_vfs* vfs, int fd, int dirfd, sqlite3_file* file, const char* fileName, int noLock);
+int chromium_sqlite3_get_reusable_file_handle(sqlite3_file* file, const char* fileName, int flags, int* fd);
+void chromium_sqlite3_update_reusable_file_handle(sqlite3_file* file, int fd, int flags);
+void chromium_sqlite3_destroy_reusable_file_handle(sqlite3_file* file);
 }
 
-// Closes all file handles for given ChromiumFile and sets all its fields to 0.
-// Returns a SQLite error code.
-static int chromiumCloseNoLock(sqlite3_file* id)
-{
-    ChromiumFile* pFile = reinterpret_cast<ChromiumFile*>(id);
-    if (!pFile)
-        return SQLITE_OK;
-    if (pFile->dirfd >= 0) {
-        if (close(pFile->dirfd)) {
-            pFile->lastErrno = errno;
-            return SQLITE_IOERR_DIR_CLOSE;
-        }
-        pFile->dirfd = -1;
-    }
-    if (pFile->h >= 0 && close(pFile->h)) {
-        pFile->lastErrno = errno;
-        return SQLITE_IOERR_CLOSE;
-    }
-    sqlite3_free(pFile->pUnused);
-    memset(pFile, 0, sizeof(ChromiumFile));
-    return SQLITE_OK;
-}
-
-// Closes a ChromiumFile, including locking operations. Returns a SQLite error code.
-static int chromiumClose(sqlite3_file* id)
-{
-    if (!id)
-        return SQLITE_OK;
-
-    ChromiumFile* pFile = reinterpret_cast<ChromiumFile*>(id);
-    chromiumUnlock(id, SQLITE_LOCK_NONE);
-    if (pFile->pOpen && pFile->pOpen->nLock) {
-        // If there are outstanding locks, do not actually close the file just
-        // yet because that would clear those locks.
-        ChromiumOpenInfo* pOpen = pFile->pOpen;
-        ChromiumUnusedFd* p = pFile->pUnused;
-        p->pNext = pOpen->pUnused;
-        pOpen->pUnused = p;
-        pFile->h = -1;
-        pFile->pUnused = 0;
-    }
-    releaseLockInfo(pFile->pLock);
-    releaseOpenInfo(pFile->pOpen);
-    return chromiumCloseNoLock(id);
-}
-
-static int chromiumCheckReservedLockNoop(sqlite3_file*, int* pResOut)
-{
-    *pResOut = 0;
-    return SQLITE_OK;
-}
-
-static int chromiumLockNoop(sqlite3_file*, int)
-{
-    return SQLITE_OK;
-}
-
-static int chromiumUnlockNoop(sqlite3_file*, int)
-{
-    return SQLITE_OK;
-}
-
-// Seeks to the requested offset and reads up to |cnt| bytes into |pBuf|. Returns number of bytes actually read.
-static int seekAndRead(ChromiumFile* id, sqlite3_int64 offset, void* pBuf, int cnt)
-{
-    sqlite_int64 newOffset = lseek(id->h, offset, SEEK_SET);
-    if (newOffset != offset) {
-        id->lastErrno = (newOffset == -1) ? errno : 0;
-        return -1;
-    }
-    int got = read(id->h, pBuf, cnt);
-    if (got < 0)
-        id->lastErrno = errno;
-    return got;
-}
-
-// Reads data from file into a buffer. Returns a SQLite error code.
-static int chromiumRead(sqlite3_file* id, void* pBuf, int amt, sqlite3_int64 offset)
-{
-    ChromiumFile* pFile = reinterpret_cast<ChromiumFile*>(id);
-    ASSERT(pFile);
-
-    // The bytes in the locking range should never be read.
-    ASSERT(!pFile->pUnused || offset >= SQLitePendingByte + 512 || offset + amt <= SQLitePendingByte);
-
-    int got = seekAndRead(pFile, offset, pBuf, amt);
-    if (got == amt)
-        return SQLITE_OK;
-
-    if (got < 0)
-        return SQLITE_IOERR_READ;
-
-    // Unread parts of the buffer must be zero-filled.
-    memset(&(reinterpret_cast<char*>(pBuf))[got], 0, amt - got);
-    pFile->lastErrno = 0;
-    return SQLITE_IOERR_SHORT_READ;
-}
-
-// Seeks to the requested offset and writes up to |cnt| bytes. Returns number of bytes actually written.
-static int seekAndWrite(ChromiumFile* id, sqlite_int64 offset, const void* pBuf, int cnt)
-{
-    sqlite_int64 newOffset = lseek(id->h, offset, SEEK_SET);
-    if (newOffset != offset) {
-        id->lastErrno = (newOffset == -1) ? errno : 0;
-        return -1;
-    }
-    int got = write(id->h, pBuf, cnt);
-    if (got < 0)
-        id->lastErrno = errno;
-    return got;
-}
-
-// Writes data from buffer into a file. Returns a SQLite error code.
-static int chromiumWrite(sqlite3_file* id, const void* pBuf, int amt, sqlite3_int64 offset)
-{
-    ChromiumFile* pFile = reinterpret_cast<ChromiumFile*>(id);
-    ASSERT(pFile);
-    ASSERT(amt > 0);
-
-    // The bytes in the locking range should never be written.
-    ASSERT(!pFile->pUnused || offset >= SQLitePendingByte + 512 || offset + amt <= SQLitePendingByte);
-
-    int wrote = 0;
-    while (amt > 0 && (wrote = seekAndWrite(pFile, offset, pBuf, amt)) > 0) {
-        amt -= wrote;
-        offset += wrote;
-        pBuf = &(reinterpret_cast<const char*>(pBuf))[wrote];
-    }
-    if (amt > 0) {
-        if (wrote < 0)
-            return SQLITE_IOERR_WRITE;
-        pFile->lastErrno = 0;
-        return SQLITE_FULL;
-    }
-    return SQLITE_OK;
-}
-
-static bool syncWrapper(int fd, bool fullSync)
-{
-#if OS(DARWIN)
-    bool success = false;
-    if (fullSync)
-        success = !fcntl(fd, F_FULLFSYNC, 0);
-    if (!success)
-        success = !fsync(fd);
-    return success;
-#else
-    return !fdatasync(fd);
-#endif
-}
-
-// Makes sure all writes to a particular file are committed to disk. Returns a SQLite error code.
-static int chromiumSync(sqlite3_file* id, int flags)
-{
-    ASSERT((flags & 0x0F) == SQLITE_SYNC_NORMAL || (flags & 0x0F) == SQLITE_SYNC_FULL);
-
-    ChromiumFile* pFile = reinterpret_cast<ChromiumFile*>(id);
-    ASSERT(pFile);
-
-    bool isFullSync = ((flags & 0x0F) == SQLITE_SYNC_FULL);
-
-    if (!syncWrapper(pFile->h, isFullSync)) {
-        pFile->lastErrno = errno;
-        return SQLITE_IOERR_FSYNC;
-    }
-
-    if (pFile->dirfd >= 0) {
-#if !OS(DARWIN)
-        if (!isFullSync) {
-            // Ignore directory sync failures, see http://www.sqlite.org/cvstrac/tktview?tn=1657.
-            syncWrapper(pFile->dirfd, false);
-        }
-#endif
-        if (!close(pFile->dirfd))
-            pFile->dirfd = -1;
-        else {
-            pFile->lastErrno = errno;
-            return SQLITE_IOERR_DIR_CLOSE;
-        }
-    }
-
-    return SQLITE_OK;
-}
-
-// Truncates an open file to the specified size. Returns a SQLite error code.
-static int chromiumTruncate(sqlite3_file* id, sqlite_int64 nByte)
-{
-    ChromiumFile* pFile = reinterpret_cast<ChromiumFile*>(id);
-    ASSERT(pFile);
-
-    if (ftruncate(pFile->h, nByte)) {
-        pFile->lastErrno = errno;
-        return SQLITE_IOERR_TRUNCATE;
-    }
-
-    return SQLITE_OK;
-}
-
-// Determines the size of a file in bytes. Returns a SQLite error code.
-static int chromiumFileSize(sqlite3_file* id, sqlite_int64* pSize)
-{
-    ChromiumFile* pFile = reinterpret_cast<ChromiumFile*>(id);
-    ASSERT(pFile);
-
-    struct stat buf;
-    if (fstat(pFile->h, &buf)) {
-        pFile->lastErrno = errno;
-        return SQLITE_IOERR_FSTAT;
-    }
-    *pSize = buf.st_size;
-
-    // When opening a zero-size database, findLockInfo writes a single byte into that file
-    // in order to work around a bug in the OS X msdos filesystem. In order to avoid problems
-    // with upper layers, we need to report this file size as zero even though it is really 1.
-    // See http://www.sqlite.org/cvstrac/tktview?tn=3260.
-    if (*pSize == 1)
-        *pSize = 0;
-
-    return SQLITE_OK;
-}
-
-static int chromiumFileControl(sqlite3_file* id, int op, void* pArg)
-{
-    ChromiumFile* pFile = reinterpret_cast<ChromiumFile*>(id);
-    ASSERT(pFile);
-
-    switch (op) {
-    case SQLITE_FCNTL_LOCKSTATE:
-        *reinterpret_cast<int*>(pArg) = pFile->locktype;
-        return SQLITE_OK;
-    case SQLITE_LAST_ERRNO:
-        *reinterpret_cast<int*>(pArg) = pFile->lastErrno;
-        return SQLITE_OK;
-    }
-    return SQLITE_ERROR;
-}
-
-// Same as SQLITE_DEFAULT_SECTOR_SIZE from sqlite's os.h.
-static const int SQLiteDefaultSectorSize = 512;
-
-static int chromiumSectorSize(sqlite3_file*)
-{
-    return SQLiteDefaultSectorSize;
-}
-
-static int chromiumDeviceCharacteristics(sqlite3_file*)
-{
-    return 0;
-}
-
-static const sqlite3_io_methods posixIoMethods = {
-    1,
-    chromiumClose,
-    chromiumRead,
-    chromiumWrite,
-    chromiumTruncate,
-    chromiumSync,
-    chromiumFileSize,
-    chromiumLock,
-    chromiumUnlock,
-    chromiumCheckReservedLock,
-    chromiumFileControl,
-    chromiumSectorSize,
-    chromiumDeviceCharacteristics
-};
-
-static const sqlite3_io_methods nolockIoMethods = {
-    1,
-    chromiumCloseNoLock,
-    chromiumRead,
-    chromiumWrite,
-    chromiumTruncate,
-    chromiumSync,
-    chromiumFileSize,
-    chromiumLockNoop,
-    chromiumUnlockNoop,
-    chromiumCheckReservedLockNoop,
-    chromiumFileControl,
-    chromiumSectorSize,
-    chromiumDeviceCharacteristics
-};
-
-// Initializes a ChromiumFile. Returns a SQLite error code.
-static int fillInChromiumFile(sqlite3_vfs* pVfs, int h, int dirfd, sqlite3_file* pId, const char* zFilename, int noLock)
-{
-    ChromiumFile* pNew = reinterpret_cast<ChromiumFile*>(pId);
-
-    ASSERT(!pNew->pLock);
-    ASSERT(!pNew->pOpen);
-
-    pNew->h = h;
-    pNew->dirfd = dirfd;
-
-    int rc = SQLITE_OK;
-    const sqlite3_io_methods* pLockingStyle;
-    if (noLock)
-        pLockingStyle = &nolockIoMethods;
-    else {
-        pLockingStyle = &posixIoMethods;
-        rc = findLockInfo(pNew, &pNew->pLock, &pNew->pOpen);
-        if (rc != SQLITE_OK) {
-            // If an error occured in findLockInfo(), close the file descriptor
-            // immediately. This can happen in two scenarios:
-            //
-            //   (a) A call to fstat() failed.
-            //   (b) A malloc failed.
-            //
-            // Scenario (b) may only occur if the process is holding no other
-            // file descriptors open on the same file. If there were other file
-            // descriptors on this file, then no malloc would be required by
-            // findLockInfo(). If this is the case, it is quite safe to close
-            // handle h - as it is guaranteed that no posix locks will be released
-            // by doing so.
-            //
-            // If scenario (a) caused the error then things are not so safe. The
-            // implicit assumption here is that if fstat() fails, things are in
-            // such bad shape that dropping a lock or two doesn't matter much.
-            close(h);
-            h = -1;
-        }
-    }
-
-    pNew->lastErrno = 0;
-    if (rc != SQLITE_OK) {
-        if (dirfd >= 0)
-            close(dirfd);
-        if (h >= 0)
-            close(h);
-    } else
-        pNew->pMethod = pLockingStyle;
-    return rc;
-}
-
-// Searches for an unused file descriptor that was opened on the database 
-// file identified by zPath with matching flags. Returns 0 if not found.
-static ChromiumUnusedFd* findReusableFd(const char* zPath, int flags)
-{
-    ChromiumUnusedFd* pUnused = 0;
-
-    struct stat sStat;
-    if (!stat(zPath, &sStat)) {
-        ChromiumFileId id;
-        id.dev = sStat.st_dev;
-        id.ino = sStat.st_ino;
-
-        ChromiumOpenInfo* pO = 0;
-        for (pO = openList; pO && memcmp(&id, &pO->fileId, sizeof(id)); pO = pO->pNext) { }
-        if (pO) {
-            ChromiumUnusedFd** pp;
-            for (pp = &pO->pUnused; *pp && (*pp)->flags != flags; pp = &((*pp)->pNext)) { }
-            pUnused = *pp;
-            if (pUnused)
-                *pp = pUnused->pNext;
-        }
-    }
-    return pUnused;
-}
+// Chromium's Posix implementation of SQLite VFS
+namespace {
 
 // Opens a file.
 //
@@ -974,26 +59,14 @@ static ChromiumUnusedFd* findReusableFd(const char* zPath, int flags)
 // id - the structure that will manipulate the newly opened file.
 // desiredFlags - the desired open mode flags.
 // usedFlags - the actual open mode flags that were used.
-static int chromiumOpen(sqlite3_vfs* vfs, const char* fileName,
-                        sqlite3_file* id, int desiredFlags, int* usedFlags)
+int chromiumOpen(sqlite3_vfs* vfs, const char* fileName,
+                 sqlite3_file* id, int desiredFlags, int* usedFlags)
 {
-    // The mask 0x00007F00 gives us the 7 bits that determine the type of the file SQLite is trying to open.
-    int fileType = desiredFlags & 0x00007F00;
-
-    memset(id, 0, sizeof(ChromiumFile));
-    ChromiumFile* chromiumFile = reinterpret_cast<ChromiumFile*>(id);
+    chromium_sqlite3_initialize_unix_sqlite3_file(id);
     int fd = -1;
-    if (fileType == SQLITE_OPEN_MAIN_DB) {
-        ChromiumUnusedFd* unusedFd = findReusableFd(fileName, desiredFlags);
-        if (unusedFd)
-            fd = unusedFd->fd;
-        else {
-            unusedFd = static_cast<ChromiumUnusedFd*>(sqlite3_malloc(sizeof(*unusedFd)));
-            if (!unusedFd)
-                return SQLITE_NOMEM;
-        }
-        chromiumFile->pUnused = unusedFd;
-    }
+    int result = chromium_sqlite3_get_reusable_file_handle(id, fileName, desiredFlags, &fd);
+    if (result != SQLITE_OK)
+        return result;
 
     if (fd < 0) {
         fd = PlatformBridge::databaseOpenFile(fileName, desiredFlags);
@@ -1003,24 +76,23 @@ static int chromiumOpen(sqlite3_vfs* vfs, const char* fileName,
         }
     }
     if (fd < 0) {
-        sqlite3_free(chromiumFile->pUnused);
+        chromium_sqlite3_destroy_reusable_file_handle(id);
         return SQLITE_CANTOPEN;
     }
 
     if (usedFlags)
         *usedFlags = desiredFlags;
-    if (chromiumFile->pUnused) {
-        chromiumFile->pUnused->fd = fd;
-        chromiumFile->pUnused->flags = desiredFlags;
-    }
+    chromium_sqlite3_update_reusable_file_handle(id, fd, desiredFlags);
 
     fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
 
+    // The mask 0x00007F00 gives us the 7 bits that determine the type of the file SQLite is trying to open.
+    int fileType = desiredFlags & 0x00007F00;
     int noLock = (fileType != SQLITE_OPEN_MAIN_DB);
-    int rc = fillInChromiumFile(vfs, fd, -1, id, fileName, noLock);
-    if (rc != SQLITE_OK)
-        sqlite3_free(chromiumFile->pUnused);
-    return rc;
+    result = chromium_sqlite3_fill_in_unix_sqlite3_file(vfs, fd, -1, id, fileName, noLock);
+    if (result != SQLITE_OK)
+        chromium_sqlite3_destroy_reusable_file_handle(id);
+    return result;
 }
 
 // Deletes the given file.
@@ -1029,7 +101,7 @@ static int chromiumOpen(sqlite3_vfs* vfs, const char* fileName,
 // fileName - the name of the file.
 // syncDir - determines if the directory to which this file belongs
 //           should be synched after the file is deleted.
-static int chromiumDelete(sqlite3_vfs*, const char* fileName, int syncDir)
+int chromiumDelete(sqlite3_vfs*, const char* fileName, int syncDir)
 {
     return PlatformBridge::databaseDeleteFile(fileName, syncDir);
 }
@@ -1040,7 +112,7 @@ static int chromiumDelete(sqlite3_vfs*, const char* fileName, int syncDir)
 // fileName - the name of the file.
 // flag - the type of test to make on this file.
 // res - the result.
-static int chromiumAccess(sqlite3_vfs*, const char* fileName, int flag, int* res)
+int chromiumAccess(sqlite3_vfs*, const char* fileName, int flag, int* res)
 {
     int attr = static_cast<int>(PlatformBridge::databaseGetFileAttributes(fileName));
     if (attr < 0) {
@@ -1050,7 +122,7 @@ static int chromiumAccess(sqlite3_vfs*, const char* fileName, int flag, int* res
 
     switch (flag) {
     case SQLITE_ACCESS_EXISTS:
-        *res = 1; // if the file doesn't exist, attr < 0
+        *res = 1;   // if the file doesn't exist, attr < 0
         break;
     case SQLITE_ACCESS_READWRITE:
         *res = (attr & W_OK) && (attr & R_OK);
@@ -1071,8 +143,8 @@ static int chromiumAccess(sqlite3_vfs*, const char* fileName, int flag, int* res
 // relativePath - the relative path.
 // bufSize - the size of the output buffer in bytes.
 // absolutePath - the output buffer where the absolute path will be stored.
-static int chromiumFullPathname(sqlite3_vfs* vfs, const char* relativePath,
-                                int, char* absolutePath)
+int chromiumFullPathname(sqlite3_vfs* vfs, const char* relativePath,
+                         int, char* absolutePath)
 {
     // The renderer process doesn't need to know the absolute path of the file
     sqlite3_snprintf(vfs->mxPathname, absolutePath, "%s", relativePath);
@@ -1080,107 +152,44 @@ static int chromiumFullPathname(sqlite3_vfs* vfs, const char* relativePath,
 }
 
 #ifndef SQLITE_OMIT_LOAD_EXTENSION
-// We disallow loading DSOs inside the renderer process, so the following procedures are no-op.
-static void* chromiumDlOpen(sqlite3_vfs*, const char*)
-{
-    return 0;
-}
-
-static void chromiumDlError(sqlite3_vfs*, int, char*)
-{
-}
-
-static void (*chromiumDlSym(sqlite3_vfs*, void*, const char*))()
+// Returns NULL, thus disallowing loading libraries in the renderer process.
+//
+// vfs - pointer to the sqlite3_vfs object.
+// fileName - the name of the shared library file.
+void* chromiumDlOpen(sqlite3_vfs*, const char*)
 {
     return 0;
 }
-
-static void chromiumDlClose(sqlite3_vfs*, void*)
-{
-}
 #else
 #define chromiumDlOpen 0
-#define chromiumDlError 0
-#define chromiumDlSym 0
-#define chromiumDlClose 0
 #endif // SQLITE_OMIT_LOAD_EXTENSION
 
-// Generates a seed for SQLite's PRNG.
-static int chromiumRandomness(sqlite3_vfs*, int nBuf, char *zBuf)
-{
-    ASSERT(static_cast<size_t>(nBuf) >= (sizeof(time_t) + sizeof(int)));
-
-    memset(zBuf, 0, nBuf);
-    int fd = open("/dev/urandom", O_RDONLY);
-    if (fd < 0) {
-        time_t t;
-        time(&t);
-        memcpy(zBuf, &t, sizeof(t));
-        int pid = getpid();
-        memcpy(&zBuf[sizeof(t)], &pid, sizeof(pid));
-        return sizeof(t) + sizeof(pid);
-    }
-    nBuf = read(fd, zBuf, nBuf);
-    close(fd);
-    return nBuf;
-}
-
-// Sleeps for at least |microseconds|, and returns the actual
-// amount of time spent sleeping (in microseconds).
-static int chromiumSleep(sqlite3_vfs*, int microseconds)
-{
-#if OS(DARWIN)
-    usleep(microseconds);
-    return microseconds;
-#else
-    // Round to the nearest second.
-    int seconds = (microseconds + 999999) / 1000000;
-    sleep(seconds);
-    return seconds * 1000000;
-#endif
-}
-
-// Retrieves the current system time (UTC).
-static int chromiumCurrentTime(sqlite3_vfs*, double* now)
-{
-    struct timeval timeval;
-    gettimeofday(&timeval, 0);
-    *now = 2440587.5 + timeval.tv_sec / 86400.0 + timeval.tv_usec / 86400000000.0;
-    return 0;
-}
-
-// This is not yet implemented in SQLite core.
-static int chromiumGetLastError(sqlite3_vfs*, int, char*)
-{
-    return 0;
-}
-
-// Same as MAX_PATHNAME from sqlite's os_unix.c.
-static const int chromiumMaxPathname = 512;
+} // namespace
 
 namespace WebCore {
 
 void SQLiteFileSystem::registerSQLiteVFS()
 {
+    sqlite3_vfs* unix_vfs = sqlite3_vfs_find("unix");
     static sqlite3_vfs chromium_vfs = {
         1,
-        sizeof(ChromiumFile),
-        chromiumMaxPathname,
+        unix_vfs->szOsFile,
+        unix_vfs->mxPathname,
         0,
         "chromium_vfs",
-        0,
+        unix_vfs->pAppData,
         chromiumOpen,
         chromiumDelete,
         chromiumAccess,
         chromiumFullPathname,
         chromiumDlOpen,
-        chromiumDlError,
-        chromiumDlSym,
-        chromiumDlClose,
-        chromiumRandomness,
-        chromiumSleep,
-        chromiumCurrentTime,
-        chromiumGetLastError
+        unix_vfs->xDlError,
+        unix_vfs->xDlSym,
+        unix_vfs->xDlClose,
+        unix_vfs->xRandomness,
+        unix_vfs->xSleep,
+        unix_vfs->xCurrentTime,
+        unix_vfs->xGetLastError
     };
     sqlite3_vfs_register(&chromium_vfs, 0);
 }
diff --git a/Source/WebCore/platform/text/Base64.cpp b/Source/WebCore/platform/text/Base64.cpp
index 98b537a..bf706f6 100644
--- a/Source/WebCore/platform/text/Base64.cpp
+++ b/Source/WebCore/platform/text/Base64.cpp
@@ -60,9 +60,11 @@ static const char base64DecMap[128] = {
     0x31, 0x32, 0x33, 0x00, 0x00, 0x00, 0x00, 0x00
 };
 
-void base64Encode(const Vector<char>& in, Vector<char>& out, bool insertLFs)
+String base64Encode(const char* data, unsigned length, bool insertLFs)
 {
-    base64Encode(in.data(), in.size(), out, insertLFs);
+    Vector<char> result;
+    base64Encode(data, length, result, insertLFs);
+    return String(result.data(), result.size());
 }
 
 void base64Encode(const char* data, unsigned len, Vector<char>& out, bool insertLFs)
diff --git a/Source/WebCore/platform/text/Base64.h b/Source/WebCore/platform/text/Base64.h
index 211bd3c..70855de 100644
--- a/Source/WebCore/platform/text/Base64.h
+++ b/Source/WebCore/platform/text/Base64.h
@@ -27,20 +27,45 @@
 #ifndef Base64_h
 #define Base64_h
 
-#include <wtf/Forward.h>
 #include <wtf/Vector.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
 enum Base64DecodePolicy { FailOnInvalidCharacter, IgnoreWhitespace, IgnoreInvalidCharacters };
 
-void base64Encode(const Vector<char>&, Vector<char>&, bool insertLFs = false);
 void base64Encode(const char*, unsigned, Vector<char>&, bool insertLFs = false);
+void base64Encode(const Vector<char>&, Vector<char>&, bool insertLFs = false);
+void base64Encode(const CString&, Vector<char>&, bool insertLFs = false);
+String base64Encode(const char*, unsigned, bool insertLFs = false);
+String base64Encode(const Vector<char>&, bool insertLFs = false);
+String base64Encode(const CString&, bool insertLFs = false);
 
 bool base64Decode(const String&, Vector<char>&, Base64DecodePolicy = FailOnInvalidCharacter);
 bool base64Decode(const Vector<char>&, Vector<char>&, Base64DecodePolicy = FailOnInvalidCharacter);
 bool base64Decode(const char*, unsigned, Vector<char>&, Base64DecodePolicy = FailOnInvalidCharacter);
 
+inline void base64Encode(const Vector<char>& in, Vector<char>& out, bool insertLFs)
+{
+    base64Encode(in.data(), in.size(), out, insertLFs);
 }
 
+inline void base64Encode(const CString& in, Vector<char>& out, bool insertLFs)
+{
+    base64Encode(in.data(), in.length(), out, insertLFs);
+}
+
+inline String base64Encode(const Vector<char>& in, bool insertLFs)
+{
+    return base64Encode(in.data(), in.size(), insertLFs);
+}
+
+inline String base64Encode(const CString& in, bool insertLFs)
+{
+    return base64Encode(in.data(), in.length(), insertLFs);
+}
+
+} // namespace WebCore
+
 #endif // Base64_h
diff --git a/Source/WebCore/platform/text/BidiResolver.h b/Source/WebCore/platform/text/BidiResolver.h
index 8abd698..72d163c 100644
--- a/Source/WebCore/platform/text/BidiResolver.h
+++ b/Source/WebCore/platform/text/BidiResolver.h
@@ -161,7 +161,7 @@ public :
     MidpointState<Iterator>& midpointState() { return m_midpointState; }
 
     void embed(WTF::Unicode::Direction);
-    void commitExplicitEmbedding();
+    bool commitExplicitEmbedding();
 
     void createBidiRunsForLine(const Iterator& end, bool visualOrder = false, bool hardLineBreak = false);
 
@@ -400,7 +400,7 @@ void BidiResolver<Iterator, Run>::raiseExplicitEmbeddingLevel(WTF::Unicode::Dire
 }
 
 template <class Iterator, class Run>
-void BidiResolver<Iterator, Run>::commitExplicitEmbedding()
+bool BidiResolver<Iterator, Run>::commitExplicitEmbedding()
 {
     using namespace WTF::Unicode;
 
@@ -440,6 +440,8 @@ void BidiResolver<Iterator, Run>::commitExplicitEmbedding()
     setContext(toContext);
 
     m_currentExplicitEmbeddingSequence.clear();
+
+    return fromLevel != toLevel;
 }
 
 template <class Iterator, class Run>
@@ -881,8 +883,8 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, boo
 
         increment();
         if (!m_currentExplicitEmbeddingSequence.isEmpty()) {
-            commitExplicitEmbedding();
-            if (pastEnd) {
+            bool committed = commitExplicitEmbedding();
+            if (committed && pastEnd) {
                 current = end;
                 m_status = stateAtEnd.m_status;
                 sor = stateAtEnd.sor; 
diff --git a/Source/WebCore/platform/text/CharacterNames.h b/Source/WebCore/platform/text/CharacterNames.h
deleted file mode 100644
index c4b496e..0000000
--- a/Source/WebCore/platform/text/CharacterNames.h
+++ /dev/null
@@ -1,90 +0,0 @@
-/*
- * Copyright (C) 2007, 2009, 2010 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CharacterNames_h
-#define CharacterNames_h
-
-#include <wtf/unicode/Unicode.h>
-
-namespace WebCore {
-
-// Names here are taken from the Unicode standard.
-
-// Most of these are UChar constants, not UChar32, which makes them
-// more convenient for WebCore code that mostly uses UTF-16.
-
-const UChar32 aegeanWordSeparatorLine = 0x10100;
-const UChar32 aegeanWordSeparatorDot = 0x10101;
-const UChar blackCircle = 0x25CF;
-const UChar blackSquare = 0x25A0;
-const UChar blackUpPointingTriangle = 0x25B2;
-const UChar bullet = 0x2022;
-const UChar bullseye = 0x25CE;
-const UChar carriageReturn = 0x000D;
-const UChar ethiopicPrefaceColon = 0x1366;
-const UChar ethiopicWordspace = 0x1361;
-const UChar fisheye = 0x25C9;
-const UChar hebrewPunctuationGeresh = 0x05F3;
-const UChar hebrewPunctuationGershayim = 0x05F4;
-const UChar horizontalEllipsis = 0x2026;
-const UChar hyphen = 0x2010;
-const UChar hyphenMinus = 0x002D;
-const UChar ideographicComma = 0x3001;
-const UChar ideographicFullStop = 0x3002;
-const UChar ideographicSpace = 0x3000;
-const UChar leftDoubleQuotationMark = 0x201C;
-const UChar leftSingleQuotationMark = 0x2018;
-const UChar leftToRightEmbed = 0x202A;
-const UChar leftToRightMark = 0x200E;
-const UChar leftToRightOverride = 0x202D;
-const UChar minusSign = 0x2212;
-const UChar newlineCharacter = 0x000A;
-const UChar noBreakSpace = 0x00A0;
-const UChar objectReplacementCharacter = 0xFFFC;
-const UChar popDirectionalFormatting = 0x202C;
-const UChar replacementCharacter = 0xFFFD;
-const UChar rightDoubleQuotationMark = 0x201D;
-const UChar rightSingleQuotationMark = 0x2019;
-const UChar rightToLeftEmbed = 0x202B;
-const UChar rightToLeftMark = 0x200F;
-const UChar rightToLeftOverride = 0x202E;
-const UChar sesameDot = 0xFE45;
-const UChar softHyphen = 0x00AD;
-const UChar space = 0x0020;
-const UChar tibetanMarkIntersyllabicTsheg = 0x0F0B;
-const UChar tibetanMarkDelimiterTshegBstar = 0x0F0C;
-const UChar32 ugariticWordDivider = 0x1039F;
-const UChar whiteBullet = 0x25E6;
-const UChar whiteCircle = 0x25CB;
-const UChar whiteSesameDot = 0xFE46;
-const UChar whiteUpPointingTriangle = 0x25B3;
-const UChar yenSign = 0x00A5;
-const UChar zeroWidthJoiner = 0x200D;
-const UChar zeroWidthNonJoiner = 0x200C;
-const UChar zeroWidthSpace = 0x200B;
-
-}
-
-#endif // CharacterNames_h
diff --git a/Source/WebCore/inspector/InspectorSettings.h b/Source/WebCore/platform/text/LocalizedNumber.h
index 717d11f..45873b8 100644
--- a/Source/WebCore/inspector/InspectorSettings.h
+++ b/Source/WebCore/platform/text/LocalizedNumber.h
@@ -28,46 +28,32 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef InspectorSettings_h
-#define InspectorSettings_h
+#ifndef LocalizedNumber_h
+#define LocalizedNumber_h
 
-#if ENABLE(INSPECTOR)
-
-#include "PlatformString.h"
-
-#include <wtf/HashMap.h>
-#include <wtf/text/StringHash.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
-class InspectorClient;
-
-class InspectorSettings {
-public:
-    static const char* MonitoringXHREnabled;
-    static const char* ProfilerAlwaysEnabled;
-    static const char* DebuggerAlwaysEnabled;
-    static const char* InspectorStartsAttached;
-    static const char* InspectorAttachedHeight;
-
-    InspectorSettings(InspectorClient* client);
-
-    bool getBoolean(const String& name);
-    void setBoolean(const String& name, bool value);
-
-    long getLong(const String& name);
-    void setLong(const String& name, long value);
-
-private:
-    void registerBoolean(const String& name, bool defaultValue);
-    void registerLong(const String& name, long defaultValue);
-
-    typedef HashMap<String, String> Dictionary;
-    Dictionary m_defaultValues;
-    InspectorClient* m_client;
-};
+// Parses a string representation of a floating point number localized
+// for the browser's current locale. If the input string is not valid
+// or an implementation doesn't support localized numbers, this
+// function returns NaN. This function doesn't need to support
+// scientific notation, NaN, +Infinity and -Infinity, and doesn't need
+// to support the standard representations of ECMAScript and HTML5.
+double parseLocalizedNumber(const String&);
+
+// Serializes the specified floating point number for the browser's
+// current locale.  If an implementation doesn't support localized
+// numbers or the input value is NaN or Infinitiy, the function should
+// return an empty string.
+String formatLocalizedNumber(double);
+
+// Returns true if the input character can be used to represent a
+// number in the browser locale. For example, this should return true for 0-9 .
+// , + - for en-US locale.
+bool isLocalizedNumberCharacter(UChar32);
 
 } // namespace WebCore
 
-#endif // ENABLE(INSPECTOR)
-#endif // !defined(InspectorSettings_h)
+#endif // LocalizedNumber_h
diff --git a/Source/WebCore/platform/graphics/chromium/IconChromiumMac.cpp b/Source/WebCore/platform/text/LocalizedNumberNone.cpp
index a24afb2..6f017e9 100644
--- a/Source/WebCore/platform/graphics/chromium/IconChromiumMac.cpp
+++ b/Source/WebCore/platform/text/LocalizedNumberNone.cpp
@@ -1,10 +1,10 @@
 /*
- * Copyright (c) 2008, Google Inc. All rights reserved.
- * 
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -29,22 +29,27 @@
  */
 
 #include "config.h"
-#include "Icon.h"
+#include "LocalizedNumber.h"
 
-#include "PassRefPtr.h"
+#include <limits>
+
+using namespace std;
 
-// FIXME: These are temporary stubs, we need real implementations which
-// may come in the form of IconChromium.cpp.  The Windows Chromium
-// implementation is currently in IconWin.cpp.
- 
 namespace WebCore {
 
-Icon::~Icon()
+double parseLocalizedNumber(const String&)
 {
+    return numeric_limits<double>::quiet_NaN();
 }
 
-void Icon::paint(GraphicsContext*, const IntRect&)
+String formatLocalizedNumber(double)
 {
+    return String();
 }
 
+bool isLocalizedNumberCharacter(UChar32)
+{
+    return false;
 }
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/text/RegularExpression.cpp b/Source/WebCore/platform/text/RegularExpression.cpp
index 9b063c9..e020b91 100644
--- a/Source/WebCore/platform/text/RegularExpression.cpp
+++ b/Source/WebCore/platform/text/RegularExpression.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2004, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Collabora Ltd.
+ * Copyright (C) 2011 Peter Varga (pvarga@webkit.org), University of Szeged
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,52 +28,48 @@
 #include "config.h"
 #include "RegularExpression.h"
 
+#include <wtf/BumpPointerAllocator.h>
+#include <yarr/Yarr.h>
 #include "Logging.h"
-#include <pcre/pcre.h>
 
 namespace WebCore {
 
 class RegularExpression::Private : public RefCounted<RegularExpression::Private> {
 public:
-    static PassRefPtr<Private> create(const String& pattern, TextCaseSensitivity);
-    ~Private();
+    static PassRefPtr<Private> create(const String& pattern, TextCaseSensitivity caseSensitivity)
+    {
+        return adoptRef(new Private(pattern, caseSensitivity));
+    }
 
-    JSRegExp* regexp() const { return m_regexp; }
-    int lastMatchLength;    
+    int lastMatchLength;
 
-private:
-    Private(const String& pattern, TextCaseSensitivity);
-    static JSRegExp* compile(const String& pattern, TextCaseSensitivity);
+    unsigned m_numSubpatterns;
+    OwnPtr<JSC::Yarr::BytecodePattern> m_regExpByteCode;
 
-    JSRegExp* m_regexp;
-};
+private:
+    Private(const String& pattern, TextCaseSensitivity caseSensitivity)
+        : lastMatchLength(-1)
+        , m_regExpByteCode(compile(pattern, caseSensitivity))
+        , m_constructionError(0)
+    {
+    }
 
-inline JSRegExp* RegularExpression::Private::compile(const String& pattern, TextCaseSensitivity caseSensitivity)
-{
-    const char* errorMessage;
-    JSRegExp* regexp = jsRegExpCompile(pattern.characters(), pattern.length(),
-        caseSensitivity == TextCaseSensitive ? JSRegExpDoNotIgnoreCase : JSRegExpIgnoreCase, JSRegExpSingleLine,
-        0, &errorMessage);
-    if (!regexp)
-        LOG_ERROR("RegularExpression: pcre_compile failed with '%s'", errorMessage);
-    return regexp;
-}
+    PassOwnPtr<JSC::Yarr::BytecodePattern> compile(const String& patternString, TextCaseSensitivity caseSensitivity)
+    {
+        JSC::Yarr::YarrPattern pattern(JSC::UString(patternString.impl()), (caseSensitivity == TextCaseInsensitive), false, &m_constructionError);
+        if (m_constructionError) {
+            LOG_ERROR("RegularExpression: YARR compile failed with '%s'", m_constructionError);
+            return PassOwnPtr<JSC::Yarr::BytecodePattern>();
+        }
 
-inline RegularExpression::Private::Private(const String& pattern, TextCaseSensitivity caseSensitivity)
-    : lastMatchLength(-1)
-    , m_regexp(compile(pattern, caseSensitivity))
-{
-}
+        m_numSubpatterns = pattern.m_numSubpatterns;
 
-inline PassRefPtr<RegularExpression::Private> RegularExpression::Private::create(const String& pattern, TextCaseSensitivity caseSensitivity)
-{
-    return adoptRef(new Private(pattern, caseSensitivity));
-}
+        return JSC::Yarr::byteCompile(pattern, &m_regexAllocator);
+    }
 
-RegularExpression::Private::~Private()
-{
-    jsRegExpFree(m_regexp);
-}
+    BumpPointerAllocator m_regexAllocator;
+    const char* m_constructionError;
+};
 
 RegularExpression::RegularExpression(const String& pattern, TextCaseSensitivity caseSensitivity)
     : d(Private::create(pattern, caseSensitivity))
@@ -96,28 +93,36 @@ RegularExpression& RegularExpression::operator=(const RegularExpression& re)
 
 int RegularExpression::match(const String& str, int startFrom, int* matchLength) const
 {
-    if (!d->regexp())
+    if (!d->m_regExpByteCode)
         return -1;
 
     if (str.isNull())
         return -1;
 
-    // First 2 offsets are start and end offsets; 3rd entry is used internally by pcre
-    static const size_t maxOffsets = 3;
-    int offsets[maxOffsets];
-    int result = jsRegExpExecute(d->regexp(), str.characters(), str.length(), startFrom, offsets, maxOffsets);
+    int offsetVectorSize = (d->m_numSubpatterns + 1) * 2;
+    int* offsetVector;
+    Vector<int, 32> nonReturnedOvector;
+
+    nonReturnedOvector.resize(offsetVectorSize);
+    offsetVector = nonReturnedOvector.data();
+
+    ASSERT(offsetVector);
+    for (unsigned j = 0, i = 0; i < d->m_numSubpatterns + 1; j += 2, i++)
+        offsetVector[j] = -1;
+
+    int result = JSC::Yarr::interpret(d->m_regExpByteCode.get(), str.characters(), startFrom, str.length(), offsetVector);
+    ASSERT(result >= -1);
+
     if (result < 0) {
-        if (result != JSRegExpErrorNoMatch)
-            LOG_ERROR("RegularExpression: pcre_exec() failed with result %d", result);
         d->lastMatchLength = -1;
         return -1;
     }
 
-    // 1 means 1 match; 0 means more than one match. First match is recorded in offsets.
-    d->lastMatchLength = offsets[1] - offsets[0];
+    // 1 means 1 match; 0 means more than one match. First match is recorded in offsetVector.
+    d->lastMatchLength = offsetVector[1] - offsetVector[0];
     if (matchLength)
         *matchLength = d->lastMatchLength;
-    return offsets[0];
+    return offsetVector[0];
 }
 
 int RegularExpression::searchRev(const String& str) const
diff --git a/Source/WebCore/platform/text/SegmentedString.cpp b/Source/WebCore/platform/text/SegmentedString.cpp
index 5e9755b..7c859dc 100644
--- a/Source/WebCore/platform/text/SegmentedString.cpp
+++ b/Source/WebCore/platform/text/SegmentedString.cpp
@@ -186,17 +186,6 @@ void SegmentedString::advanceSubstring()
     }
 }
 
-int SegmentedString::numberOfCharactersConsumedSlow() const
-{
-    int result = m_numberOfCharactersConsumedPriorToCurrentString + m_currentString.numberOfCharactersConsumed();
-    if (m_pushedChar1) {
-        --result;
-        if (m_pushedChar2)
-            --result;
-    }
-    return result;
-}
-
 String SegmentedString::toString() const
 {
     String result;
@@ -262,14 +251,14 @@ WTF::ZeroBasedNumber SegmentedString::currentLine() const
 
 WTF::ZeroBasedNumber SegmentedString::currentColumn() const
 {
-    int zeroBasedColumn = numberOfCharactersConsumedSlow() - m_numberOfCharactersConsumedPriorToCurrentLine;
+    int zeroBasedColumn = numberOfCharactersConsumed() - m_numberOfCharactersConsumedPriorToCurrentLine;
     return WTF::ZeroBasedNumber::fromZeroBasedInt(zeroBasedColumn);
 }
 
 void SegmentedString::setCurrentPosition(WTF::ZeroBasedNumber line, WTF::ZeroBasedNumber columnAftreProlog, int prologLength)
 {
     m_currentLine = line.zeroBasedInt();
-    m_numberOfCharactersConsumedPriorToCurrentLine = numberOfCharactersConsumedSlow() + prologLength - columnAftreProlog.zeroBasedInt();
+    m_numberOfCharactersConsumedPriorToCurrentLine = numberOfCharactersConsumed() + prologLength - columnAftreProlog.zeroBasedInt();
 }
 
 }
diff --git a/Source/WebCore/platform/text/SegmentedString.h b/Source/WebCore/platform/text/SegmentedString.h
index 30c899d..3784b50 100644
--- a/Source/WebCore/platform/text/SegmentedString.h
+++ b/Source/WebCore/platform/text/SegmentedString.h
@@ -206,13 +206,15 @@ public:
 
     int numberOfCharactersConsumed() const
     {
-        // We don't currently handle the case when there are pushed character.
-        ASSERT(!m_pushedChar1);
-        return m_numberOfCharactersConsumedPriorToCurrentString + m_currentString.numberOfCharactersConsumed();
+        int numberOfPushedCharacters = 0;
+        if (m_pushedChar1) {
+            ++numberOfPushedCharacters;
+            if (m_pushedChar2)
+                ++numberOfPushedCharacters;
+        }
+        return m_numberOfCharactersConsumedPriorToCurrentString + m_currentString.numberOfCharactersConsumed() - numberOfPushedCharacters;
     }
 
-    int numberOfCharactersConsumedSlow() const;
-
     String toString() const;
 
     const UChar& operator*() const { return *current(); }
diff --git a/Source/WebCore/platform/text/TextCodecICU.cpp b/Source/WebCore/platform/text/TextCodecICU.cpp
index 6a579f9..92a158a 100644
--- a/Source/WebCore/platform/text/TextCodecICU.cpp
+++ b/Source/WebCore/platform/text/TextCodecICU.cpp
@@ -27,7 +27,6 @@
 #include "config.h"
 #include "TextCodecICU.h"
 
-#include "CharacterNames.h"
 #include "PlatformString.h"
 #include "ThreadGlobalData.h"
 #include <unicode/ucnv.h>
@@ -37,6 +36,7 @@
 #include <wtf/PassOwnPtr.h>
 #include <wtf/StringExtras.h>
 #include <wtf/Threading.h>
+#include <wtf/unicode/CharacterNames.h>
 
 using std::min;
 
diff --git a/Source/WebCore/platform/text/TextCodecUTF16.cpp b/Source/WebCore/platform/text/TextCodecUTF16.cpp
index e88e83b..4ceed23 100644
--- a/Source/WebCore/platform/text/TextCodecUTF16.cpp
+++ b/Source/WebCore/platform/text/TextCodecUTF16.cpp
@@ -71,6 +71,8 @@ String TextCodecUTF16::decode(const char* bytes, size_t length, bool, bool, bool
     if (!length)
         return String();
 
+    // FIXME: This should generate an error if there is an unpaired surrogate.
+
     const unsigned char* p = reinterpret_cast<const unsigned char*>(bytes);
     size_t numBytes = length + m_haveBufferedByte;
     size_t numChars = numBytes / 2;
diff --git a/Source/WebCore/platform/text/TextCodecUTF8.cpp b/Source/WebCore/platform/text/TextCodecUTF8.cpp
new file mode 100644
index 0000000..8944d68
--- /dev/null
+++ b/Source/WebCore/platform/text/TextCodecUTF8.cpp
@@ -0,0 +1,276 @@
+/*
+ * Copyright (C) 2004, 2006, 2008, 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "TextCodecUTF8.h"
+
+#include <wtf/text/CString.h>
+#include <wtf/text/StringBuffer.h>
+#include <wtf/unicode/UTF8.h>
+
+using namespace WTF::Unicode;
+using namespace std;
+
+namespace WebCore {
+
+// Assuming that a pointer is the size of a "machine word", then
+// uintptr_t is an integer type that is also a machine word.
+typedef uintptr_t MachineWord;
+
+// This constant has type uintptr_t since we will use it to align
+// pointers. Not because MachineWord is uintptr_t.
+const uintptr_t machineWordAlignmentMask = sizeof(MachineWord) - 1;
+
+template<size_t size> struct NonASCIIMask;
+template<> struct NonASCIIMask<4> {
+    static unsigned value() { return 0x80808080U; }
+};
+template<> struct NonASCIIMask<8> {
+    static unsigned long long value() { return 0x8080808080808080ULL; }
+};
+
+template<size_t size> struct UCharByteFiller;
+template<> struct UCharByteFiller<4> {
+    static void copy(UChar* destination, const uint8_t* source)
+    {
+        destination[0] = source[0];
+        destination[1] = source[1];
+        destination[2] = source[2];
+        destination[3] = source[3];
+    }
+};
+template<> struct UCharByteFiller<8> {
+    static void copy(UChar* destination, const uint8_t* source)
+    {
+        destination[0] = source[0];
+        destination[1] = source[1];
+        destination[2] = source[2];
+        destination[3] = source[3];
+        destination[4] = source[4];
+        destination[5] = source[5];
+        destination[6] = source[6];
+        destination[7] = source[7];
+    }
+};
+
+static inline bool isAlignedToMachineWord(const void* pointer)
+{
+    return !(reinterpret_cast<uintptr_t>(pointer) & machineWordAlignmentMask);
+}
+
+template<typename T> static inline T* alignToMachineWord(T* pointer)
+{
+    return reinterpret_cast<T*>(reinterpret_cast<uintptr_t>(pointer) & ~machineWordAlignmentMask);
+}
+
+PassOwnPtr<TextCodec> TextCodecUTF8::create(const TextEncoding&, const void*)
+{
+    return adoptPtr(new TextCodecUTF8);
+}
+
+void TextCodecUTF8::registerEncodingNames(EncodingNameRegistrar registrar)
+{
+    registrar("UTF-8", "UTF-8");
+}
+
+void TextCodecUTF8::registerCodecs(TextCodecRegistrar registrar)
+{
+    registrar("UTF-8", create, 0);
+}
+
+static inline int nonASCIISequenceLength(unsigned char firstByte)
+{
+    ASSERT(!isASCII(firstByte));
+    switch (firstByte >> 4) {
+    case 0xF:
+        return 4;
+    case 0xE:
+        return 3;
+    }
+    return 2;
+}
+
+static inline int decodeNonASCIISequence(const unsigned char* sequence, unsigned length)
+{
+    ASSERT(!isASCII(sequence[0]));
+    if (length == 2) {
+        ASSERT(sequence[0] <= 0xDF);
+        if (sequence[0] < 0xC2)
+            return -1;
+        if (sequence[1] < 0x80 || sequence[1] > 0xBF)
+            return -1;
+        return ((sequence[0] << 6) + sequence[1]) - 0x00003080;
+    }
+    if (length == 3) {
+        ASSERT(sequence[0] >= 0xE0 && sequence[0] <= 0xEF);
+        switch (sequence[0]) {
+        case 0xE0:
+            if (sequence[1] < 0xA0 || sequence[1] > 0xBF)
+                return -1;
+            break;
+        case 0xED:
+            if (sequence[1] < 0x80 || sequence[1] > 0x9F)
+                return -1;
+            break;
+        default:
+            if (sequence[1] < 0x80 || sequence[1] > 0xBF)
+                return -1;
+        }
+        if (sequence[2] < 0x80 || sequence[2] > 0xBF)
+            return -1;
+        return ((sequence[0] << 12) + (sequence[1] << 6) + sequence[2]) - 0x000E2080;
+    }
+    ASSERT(length == 4);
+    ASSERT(sequence[0] >= 0xF0 && sequence[0] <= 0xF4);
+    switch (sequence[0]) {
+    case 0xF0:
+        if (sequence[1] < 0x90 || sequence[1] > 0xBF)
+            return -1;
+        break;
+    case 0xF4:
+        if (sequence[1] < 0x80 || sequence[1] > 0x8F)
+            return -1;
+        break;
+    default:
+        if (sequence[1] < 0x80 || sequence[1] > 0xBF)
+            return -1;
+    }
+    if (sequence[2] < 0x80 || sequence[2] > 0xBF)
+        return -1;
+    if (sequence[3] < 0x80 || sequence[3] > 0xBF)
+        return -1;
+    return ((sequence[0] << 18) + (sequence[1] << 12) + (sequence[2] << 6) + sequence[3]) - 0x03C82080;
+}
+
+String TextCodecUTF8::decode(const char* bytes, size_t length, bool flush, bool stopOnError, bool& sawError)
+{
+    StringBuffer buffer(length);
+
+    const uint8_t* source = reinterpret_cast<const uint8_t*>(bytes);
+    const uint8_t* end = source + length;
+    const uint8_t* alignedEnd = alignToMachineWord(end);
+    UChar* destination = buffer.characters();
+
+    int count;
+    int character;
+
+    if (m_partialSequenceSize) {
+        count = nonASCIISequenceLength(m_partialSequence[0]);
+        ASSERT(count > m_partialSequenceSize);
+        if (count - m_partialSequenceSize > end - source) {
+            memcpy(m_partialSequence + m_partialSequenceSize, source, end - source);
+            m_partialSequenceSize += end - source;
+            source = end;
+        } else {
+            uint8_t completeSequence[U8_MAX_LENGTH];
+            memcpy(completeSequence, m_partialSequence, m_partialSequenceSize);
+            memcpy(completeSequence + m_partialSequenceSize, source, count - m_partialSequenceSize);
+            source += count - m_partialSequenceSize;
+            m_partialSequenceSize = 0;
+            character = decodeNonASCIISequence(completeSequence, count);
+            goto decodedNonASCII;
+        }
+    }
+
+    while (source < end) {
+        if (isASCII(*source)) {
+            // Fast path for ASCII. Most UTF-8 text will be ASCII.
+            if (isAlignedToMachineWord(source)) {
+                while (source < alignedEnd) {
+                    MachineWord chunk = *reinterpret_cast_ptr<const MachineWord*>(source);
+                    if (chunk & NonASCIIMask<sizeof(MachineWord)>::value()) {
+                        if (isASCII(*source))
+                            break;
+                        goto nonASCII;
+                    }
+                    UCharByteFiller<sizeof(MachineWord)>::copy(destination, source);
+                    source += sizeof(MachineWord);
+                    destination += sizeof(MachineWord);
+                }
+                if (source == end)
+                    break;
+            }
+            *destination++ = *source++;
+        } else {
+nonASCII:
+            count = nonASCIISequenceLength(*source);
+            ASSERT(count >= 2);
+            ASSERT(count <= 4);
+            if (count > end - source) {
+                ASSERT(end - source <= static_cast<ptrdiff_t>(sizeof(m_partialSequence)));
+                ASSERT(!m_partialSequenceSize);
+                m_partialSequenceSize = end - source;
+                memcpy(m_partialSequence, source, m_partialSequenceSize);
+                break;
+            }
+            character = decodeNonASCIISequence(source, count);
+            source += count;
+decodedNonASCII:
+            if (character < 0) {
+                if (stopOnError) {
+                    sawError = true;
+                    break;
+                }
+            } else {
+                ASSERT(!U_IS_SURROGATE(character));
+                if (U_IS_BMP(character))
+                    *destination++ = character;
+                else {
+                    *destination++ = U16_LEAD(character);
+                    *destination++ = U16_TRAIL(character);
+                }
+            }
+        }
+    }
+
+    buffer.shrink(destination - buffer.characters());
+
+    if (flush && m_partialSequenceSize)
+        sawError = true;
+
+    return String::adopt(buffer);
+}
+
+CString TextCodecUTF8::encode(const UChar* characters, size_t length, UnencodableHandling)
+{
+    // The maximum number of UTF-8 bytes needed per UTF-16 code unit is 3.
+    // BMP characters take only one UTF-16 code unit and can take up to 3 bytes (3x).
+    // Non-BMP characters take two UTF-16 code units and can take up to 4 bytes (2x).
+    if (length > numeric_limits<size_t>::max() / 3)
+        CRASH();
+    Vector<uint8_t> bytes(length * 3);
+
+    size_t i = 0;
+    size_t bytesWritten = 0;
+    while (i < length) {
+        UChar32 character;
+        U16_NEXT(characters, i, length, character);
+        U8_APPEND_UNSAFE(bytes.data(), bytesWritten, character);
+    }
+
+    return CString(reinterpret_cast<char*>(bytes.data()), bytesWritten);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/text/TextCodecUTF8.h b/Source/WebCore/platform/text/TextCodecUTF8.h
new file mode 100644
index 0000000..f3b6b7a
--- /dev/null
+++ b/Source/WebCore/platform/text/TextCodecUTF8.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef TextCodecUTF8_h
+#define TextCodecUTF8_h
+
+#include "TextCodec.h"
+
+namespace WebCore {
+
+class TextCodecUTF8 : public TextCodec {
+public:
+    static void registerEncodingNames(EncodingNameRegistrar);
+    static void registerCodecs(TextCodecRegistrar);
+
+    virtual String decode(const char*, size_t length, bool flush, bool stopOnError, bool& sawError);
+    virtual CString encode(const UChar*, size_t length, UnencodableHandling);
+
+private:
+    static PassOwnPtr<TextCodec> create(const TextEncoding&, const void*);
+    TextCodecUTF8() : m_partialSequenceSize(0) { }
+
+    int m_partialSequenceSize;
+    char m_partialSequence[U8_MAX_LENGTH - 1];
+    
+};
+
+} // namespace WebCore
+
+#endif // TextCodecUTF8_h
diff --git a/Source/WebCore/platform/text/TextEncodingRegistry.cpp b/Source/WebCore/platform/text/TextEncodingRegistry.cpp
index c0c0255..1dc09ee 100644
--- a/Source/WebCore/platform/text/TextEncodingRegistry.cpp
+++ b/Source/WebCore/platform/text/TextEncodingRegistry.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2007-2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -27,14 +27,12 @@
 #include "config.h"
 #include "TextEncodingRegistry.h"
 
-#include "PlatformString.h"
 #include "TextCodecLatin1.h"
 #include "TextCodecUserDefined.h"
 #include "TextCodecUTF16.h"
+#include "TextCodecUTF8.h"
 #include "TextEncoding.h"
 #include <wtf/ASCIICType.h>
-#include <wtf/Assertions.h>
-#include <wtf/HashFunctions.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/StdLibExtras.h>
@@ -68,7 +66,6 @@ const size_t maxEncodingNameLength = 63;
 
 // Hash for all-ASCII strings that does case folding.
 struct TextEncodingNameHash {
-
     static bool equal(const char* s1, const char* s2)
     {
         char c1;
@@ -129,9 +126,7 @@ static bool didExtendTextCodecMaps;
 static HashSet<const char*>* japaneseEncodings;
 static HashSet<const char*>* nonBackslashEncodings;
 
-static const char* const textEncodingNameBlacklist[] = {
-    "UTF-7"
-};
+static const char* const textEncodingNameBlacklist[] = { "UTF-7" };
 
 #if ERROR_DISABLED
 
@@ -268,7 +263,7 @@ static void buildQuirksSets()
     ASSERT(!japaneseEncodings);
     ASSERT(!nonBackslashEncodings);
 
-    japaneseEncodings = new HashSet<const char*>();
+    japaneseEncodings = new HashSet<const char*>;
     addEncodingName(japaneseEncodings, "EUC-JP");
     addEncodingName(japaneseEncodings, "ISO-2022-JP");
     addEncodingName(japaneseEncodings, "ISO-2022-JP-1");
@@ -284,7 +279,7 @@ static void buildQuirksSets()
     addEncodingName(japaneseEncodings, "cp932");
     addEncodingName(japaneseEncodings, "x-mac-japanese");
 
-    nonBackslashEncodings = new HashSet<const char*>();
+    nonBackslashEncodings = new HashSet<const char*>;
     // The text encodings below treat backslash as a currency symbol for IE compatibility.
     // See http://blogs.msdn.com/michkap/archive/2005/09/17/469941.aspx for more information.
     addEncodingName(nonBackslashEncodings, "x-mac-japanese");
diff --git a/Source/WebCore/platform/text/mac/TextCodecMac.cpp b/Source/WebCore/platform/text/mac/TextCodecMac.cpp
index b743f3d..64d0485 100644
--- a/Source/WebCore/platform/text/mac/TextCodecMac.cpp
+++ b/Source/WebCore/platform/text/mac/TextCodecMac.cpp
@@ -27,15 +27,15 @@
 #include "config.h"
 #include "TextCodecMac.h"
 
-#include "CharacterNames.h"
 #include "CharsetData.h"
 #include "PlatformString.h"
 #include "ThreadGlobalData.h"
 #include <wtf/Assertions.h>
-#include <wtf/text/CString.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/RetainPtr.h>
 #include <wtf/Threading.h>
+#include <wtf/text/CString.h>
+#include <wtf/unicode/CharacterNames.h>
 
 using namespace std;
 
diff --git a/Source/WebCore/platform/text/transcoder/FontTranscoder.cpp b/Source/WebCore/platform/text/transcoder/FontTranscoder.cpp
index 68601f9..4e07f50 100644
--- a/Source/WebCore/platform/text/transcoder/FontTranscoder.cpp
+++ b/Source/WebCore/platform/text/transcoder/FontTranscoder.cpp
@@ -31,9 +31,9 @@
 #include "config.h"
 #include "FontTranscoder.h"
 
-#include "CharacterNames.h"
 #include "FontDescription.h"
 #include "TextEncoding.h"
+#include <wtf/unicode/CharacterNames.h>
 
 namespace WebCore {
 
diff --git a/Source/WebCore/platform/win/BString.cpp b/Source/WebCore/platform/win/BString.cpp
index 4d6d11e..6622f96 100644
--- a/Source/WebCore/platform/win/BString.cpp
+++ b/Source/WebCore/platform/win/BString.cpp
@@ -28,9 +28,8 @@
 
 #include "KURL.h"
 #include "PlatformString.h"
-#include <wtf/text/AtomicString.h>
-#include <tchar.h>
 #include <windows.h>
+#include <wtf/text/AtomicString.h>
 
 #if PLATFORM(CF)
 #include <CoreFoundation/CoreFoundation.h>
@@ -102,7 +101,7 @@ BString::BString(CFStringRef cfstr)
 
     const UniChar* uniChars = CFStringGetCharactersPtr(cfstr);
     if (uniChars) {
-        m_bstr = SysAllocStringLen((LPCTSTR)uniChars, CFStringGetLength(cfstr));
+        m_bstr = SysAllocStringLen((LPCWSTR)uniChars, CFStringGetLength(cfstr));
         return;
     }
 
@@ -158,7 +157,7 @@ bool operator ==(const BString& a, const BString& b)
         return true;
     if (!(BSTR)a || !(BSTR)b)
         return false;
-    return !_tcscmp((BSTR)a, (BSTR)b);
+    return !wcscmp((BSTR)a, (BSTR)b);
 }
 
 bool operator !=(const BString& a, const BString& b)
@@ -174,7 +173,7 @@ bool operator ==(const BString& a, BSTR b)
         return true;
     if (!(BSTR)a || !b)
         return false;
-    return !_tcscmp((BSTR)a, b);
+    return !wcscmp((BSTR)a, b);
 }
 
 bool operator !=(const BString& a, BSTR b)
@@ -190,7 +189,7 @@ bool operator ==(BSTR a, const BString& b)
         return true;
     if (!a || !(BSTR)b)
         return false;
-    return !_tcscmp(a, (BSTR)b);
+    return !wcscmp(a, (BSTR)b);
 }
 
 bool operator !=(BSTR a, const BString& b)
diff --git a/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp b/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
index eb1e659..77b95ef 100644
--- a/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
+++ b/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
@@ -31,6 +31,7 @@
 #include "PlatformString.h"
 #include "TextEncoding.h"
 #include "markup.h"
+#include <shlobj.h>
 #include <shlwapi.h>
 #include <wininet.h> // for INTERNET_MAX_URL_LENGTH
 #include <wtf/StringExtras.h>
@@ -70,6 +71,15 @@ static bool urlFromPath(CFStringRef path, String& url)
 }
 #endif
 
+static bool getDataMapItem(const DragDataMap* dataObject, FORMATETC* format, String& item)
+{
+    DragDataMap::const_iterator found = dataObject->find(format->cfFormat);
+    if (found == dataObject->end())
+        return false;
+    item = found->second[0];
+    return true;
+}
+
 static bool getWebLocData(IDataObject* dataObject, String& url, String* title) 
 {
     bool succeeded = false;
@@ -111,6 +121,34 @@ exit:
     return succeeded;
 }
 
+static bool getWebLocData(const DragDataMap* dataObject, String& url, String* title) 
+{
+#if PLATFORM(CF)
+    WCHAR filename[MAX_PATH];
+    WCHAR urlBuffer[INTERNET_MAX_URL_LENGTH];
+
+    if (!dataObject->contains(cfHDropFormat()->cfFormat))
+        return false;
+
+    wcscpy(filename, dataObject->get(cfHDropFormat()->cfFormat)[0].characters());
+    if (_wcsicmp(PathFindExtensionW(filename), L".url"))
+        return false;    
+
+    if (!GetPrivateProfileStringW(L"InternetShortcut", L"url", 0, urlBuffer, WTF_ARRAY_LENGTH(urlBuffer), filename))
+        return false;
+
+    if (title) {
+        PathRemoveExtension(filename);
+        *title = filename;
+    }
+    
+    url = urlBuffer;
+    return true;
+#else
+    return false;
+#endif
+}
+
 static String extractURL(const String &inURL, String* title)
 {
     String url = inURL;
@@ -386,6 +424,33 @@ String getURL(IDataObject* dataObject, DragData::FilenameConversionPolicy filena
     return url;
 }
 
+String getURL(const DragDataMap* data, DragData::FilenameConversionPolicy filenamePolicy, String* title)
+{
+    String url;
+
+    if (getWebLocData(data, url, title))
+        return url;
+    if (getDataMapItem(data, urlWFormat(), url))
+        return extractURL(url, title);
+    if (getDataMapItem(data, urlFormat(), url))
+        return extractURL(url, title);
+#if PLATFORM(CF)
+    if (filenamePolicy != DragData::ConvertFilenames)
+        return url;
+
+    String stringData;
+    if (!getDataMapItem(data, filenameWFormat(), stringData))
+        getDataMapItem(data, filenameFormat(), stringData);
+
+    if (stringData.isEmpty() || (!PathFileExists(stringData.charactersWithNullTermination()) && !PathIsUNC(stringData.charactersWithNullTermination())))
+        return url;
+    RetainPtr<CFStringRef> pathAsCFString(AdoptCF, CFStringCreateWithCharacters(kCFAllocatorDefault, (const UniChar *)stringData.charactersWithNullTermination(), stringData.length()));
+    if (urlFromPath(pathAsCFString.get(), url) && title)
+        *title = url;
+#endif
+    return url;
+}
+
 String getPlainText(IDataObject* dataObject, bool& success)
 {
     STGMEDIUM store;
@@ -415,6 +480,17 @@ String getPlainText(IDataObject* dataObject, bool& success)
     return text;
 }
 
+String getPlainText(const DragDataMap* data)
+{
+    String text;
+    
+    if (getDataMapItem(data, plainTextWFormat(), text))
+        return text;
+    if (getDataMapItem(data, plainTextFormat(), text))
+        return text;
+    return getURL(data, DragData::DoNotConvertFilenames);
+}
+
 String getTextHTML(IDataObject* data, bool& success)
 {
     STGMEDIUM store;
@@ -430,6 +506,13 @@ String getTextHTML(IDataObject* data, bool& success)
     return html;
 }
 
+String getTextHTML(const DragDataMap* data)
+{
+    String text;
+    getDataMapItem(data, texthtmlFormat(), text);
+    return text;
+}
+
 String getCFHTML(IDataObject* data, bool& success)
 {
     String cfhtml = getFullCFHTML(data, success);
@@ -438,18 +521,37 @@ String getCFHTML(IDataObject* data, bool& success)
     return String();
 }
 
+String getCFHTML(const DragDataMap* dataMap)
+{
+    String cfhtml;
+    getDataMapItem(dataMap, htmlFormat(), cfhtml);
+    return extractMarkupFromCFHTML(cfhtml);
+}
+
 PassRefPtr<DocumentFragment> fragmentFromFilenames(Document*, const IDataObject*)
 {
     // FIXME: We should be able to create fragments from files
     return 0;
 }
 
+PassRefPtr<DocumentFragment> fragmentFromFilenames(Document*, const DragDataMap*)
+{
+    // FIXME: We should be able to create fragments from files
+    return 0;
+}
+
 bool containsFilenames(const IDataObject*)
 {
     // FIXME: We'll want to update this once we can produce fragments from files
     return false;
 }
 
+bool containsFilenames(const DragDataMap*)
+{
+    // FIXME: We'll want to update this once we can produce fragments from files
+    return false;
+}
+
 // Convert a String containing CF_HTML formatted text to a DocumentFragment
 PassRefPtr<DocumentFragment> fragmentFromCFHTML(Document* doc, const String& cfhtml)
 {
@@ -477,8 +579,8 @@ PassRefPtr<DocumentFragment> fragmentFromHTML(Document* doc, IDataObject* data)
     bool success = false;
     String cfhtml = getFullCFHTML(data, success);
     if (success) {
-        if (PassRefPtr<DocumentFragment> fragment = fragmentFromCFHTML(doc, cfhtml))
-            return fragment;
+        if (RefPtr<DocumentFragment> fragment = fragmentFromCFHTML(doc, cfhtml))
+            return fragment.release();
     }
 
     String html = getTextHTML(data, success);
@@ -489,9 +591,180 @@ PassRefPtr<DocumentFragment> fragmentFromHTML(Document* doc, IDataObject* data)
     return 0;
 }
 
+PassRefPtr<DocumentFragment> fragmentFromHTML(Document* document, const DragDataMap* data) 
+{
+    if (!document || !data || data->isEmpty())
+        return 0;
+
+    String stringData;
+    if (getDataMapItem(data, htmlFormat(), stringData)) {
+        if (RefPtr<DocumentFragment> fragment = fragmentFromCFHTML(document, stringData))
+            return fragment.release();
+    }
+
+    String srcURL;
+    if (getDataMapItem(data, texthtmlFormat(), stringData))
+        return createFragmentFromMarkup(document, stringData, srcURL, FragmentScriptingNotAllowed);
+
+    return 0;
+}
+
 bool containsHTML(IDataObject* data)
 {
     return SUCCEEDED(data->QueryGetData(texthtmlFormat())) || SUCCEEDED(data->QueryGetData(htmlFormat()));
 }
 
+bool containsHTML(const DragDataMap* data)
+{
+    return data->contains(texthtmlFormat()->cfFormat) || data->contains(htmlFormat()->cfFormat);
+}
+
+typedef void (*GetStringFunction)(IDataObject*, FORMATETC*, Vector<String>&);
+typedef void (*SetStringFunction)(IDataObject*, FORMATETC*, const Vector<String>&);
+
+struct ClipboardDataItem {
+    GetStringFunction getString;
+    SetStringFunction setString;
+    FORMATETC* format;
+
+    ClipboardDataItem(FORMATETC* format, GetStringFunction getString, SetStringFunction setString): format(format), getString(getString), setString(setString) { }
+};
+
+typedef HashMap<UINT, ClipboardDataItem*> ClipboardFormatMap;
+
+// Getter functions.
+
+template<typename T> void getStringData(IDataObject* data, FORMATETC* format, Vector<String>& dataStrings)
+{
+    STGMEDIUM store;
+    if (FAILED(data->GetData(format, &store)))
+        return;
+    dataStrings.append(String(static_cast<T*>(GlobalLock(store.hGlobal)), ::GlobalSize(store.hGlobal) / sizeof(T)));
+    GlobalUnlock(store.hGlobal);
+    ReleaseStgMedium(&store);
+}
+
+void getUtf8Data(IDataObject* data, FORMATETC* format, Vector<String>& dataStrings)
+{
+    STGMEDIUM store;
+    if (FAILED(data->GetData(format, &store)))
+        return;
+    dataStrings.append(String(UTF8Encoding().decode(static_cast<char*>(GlobalLock(store.hGlobal)), GlobalSize(store.hGlobal))));
+    GlobalUnlock(store.hGlobal);
+    ReleaseStgMedium(&store);
+}
+
+#if PLATFORM(CF)
+void getCFData(IDataObject* data, FORMATETC* format, Vector<String>& dataStrings)
+{
+    STGMEDIUM store;
+    if (FAILED(data->GetData(format, &store)))
+        return;
+
+    HDROP hdrop = reinterpret_cast<HDROP>(GlobalLock(store.hGlobal));
+    if (!hdrop)
+        return;
+
+    WCHAR filename[MAX_PATH];
+    UINT fileCount = DragQueryFileW(hdrop, 0xFFFFFFFF, 0, 0);
+    for (UINT i = 0; i < fileCount; i++) {
+        if (!DragQueryFileW(hdrop, i, filename, WTF_ARRAY_LENGTH(filename)))
+            continue;
+        dataStrings.append(static_cast<UChar*>(filename));
+    }
+
+    GlobalUnlock(store.hGlobal);
+    ReleaseStgMedium(&store);
+}
+#endif
+
+// Setter functions.
+
+void setUCharData(IDataObject* data, FORMATETC* format, const Vector<String>& dataStrings)
+{
+    STGMEDIUM medium = {0};
+    medium.tymed = TYMED_HGLOBAL;
+
+    medium.hGlobal = createGlobalData(dataStrings.first());
+    if (!medium.hGlobal)
+        return;
+    data->SetData(format, &medium, FALSE);
+    ::GlobalFree(medium.hGlobal);
+}
+
+void setUtf8Data(IDataObject* data, FORMATETC* format, const Vector<String>& dataStrings)
+{
+    STGMEDIUM medium = {0};
+    medium.tymed = TYMED_HGLOBAL;
+
+    CString charString = dataStrings.first().utf8();
+    size_t stringLength = charString.length();
+    medium.hGlobal = ::GlobalAlloc(GPTR, stringLength + 1);
+    if (!medium.hGlobal)
+        return;
+    char* buffer = static_cast<char*>(GlobalLock(medium.hGlobal));
+    memcpy(buffer, charString.data(), stringLength);
+    buffer[stringLength] = 0;
+    GlobalUnlock(medium.hGlobal);
+    data->SetData(format, &medium, FALSE);
+    ::GlobalFree(medium.hGlobal);
+}
+
+#if PLATFORM(CF)
+void setCFData(IDataObject* data, FORMATETC* format, const Vector<String>& dataStrings)
+{
+    STGMEDIUM medium = {0};
+    SIZE_T dropFilesSize = sizeof(DROPFILES) + (sizeof(WCHAR) * (dataStrings.first().length() + 2));
+    medium.hGlobal = ::GlobalAlloc(GHND | GMEM_SHARE, dropFilesSize);
+    if (!medium.hGlobal) 
+        return;
+
+    DROPFILES* dropFiles = reinterpret_cast<DROPFILES *>(GlobalLock(medium.hGlobal));
+    dropFiles->pFiles = sizeof(DROPFILES);
+    dropFiles->fWide = TRUE;
+    String filename = dataStrings.first();
+    wcscpy(reinterpret_cast<LPWSTR>(dropFiles + 1), filename.charactersWithNullTermination());    
+    GlobalUnlock(medium.hGlobal);
+    data->SetData(format, &medium, FALSE);
+    ::GlobalFree(medium.hGlobal);
+}
+#endif
+
+static const ClipboardFormatMap& getClipboardMap()
+{
+    static ClipboardFormatMap formatMap;
+    if (formatMap.isEmpty()) {
+        formatMap.add(htmlFormat()->cfFormat, new ClipboardDataItem(htmlFormat(), getUtf8Data, setUtf8Data));
+        formatMap.add(texthtmlFormat()->cfFormat, new ClipboardDataItem(texthtmlFormat(), getStringData<UChar>, setUCharData));
+        formatMap.add(plainTextFormat()->cfFormat,  new ClipboardDataItem(plainTextFormat(), getStringData<char>, setUtf8Data));
+        formatMap.add(plainTextWFormat()->cfFormat,  new ClipboardDataItem(plainTextWFormat(), getStringData<UChar>, setUCharData));
+#if PLATFORM(CF)
+        formatMap.add(cfHDropFormat()->cfFormat,  new ClipboardDataItem(cfHDropFormat(), getCFData, setCFData));
+#endif
+        formatMap.add(filenameFormat()->cfFormat,  new ClipboardDataItem(filenameFormat(), getStringData<char>, setUtf8Data));
+        formatMap.add(filenameWFormat()->cfFormat,  new ClipboardDataItem(filenameWFormat(), getStringData<UChar>, setUCharData));
+        formatMap.add(urlFormat()->cfFormat,  new ClipboardDataItem(urlFormat(), getStringData<char>, setUtf8Data));
+        formatMap.add(urlWFormat()->cfFormat,  new ClipboardDataItem(urlWFormat(), getStringData<UChar>, setUCharData));
+    }
+    return formatMap;
+}
+
+void getClipboardData(IDataObject* dataObject, FORMATETC* format, Vector<String>& dataStrings)
+{
+    const ClipboardFormatMap& formatMap = getClipboardMap();
+    ClipboardFormatMap::const_iterator found = formatMap.find(format->cfFormat);
+    if (found == formatMap.end())
+        return;
+    found->second->getString(dataObject, found->second->format, dataStrings);
+}
+
+void setClipboardData(IDataObject* dataObject, UINT format, const Vector<String>& dataStrings)
+{
+    const ClipboardFormatMap& formatMap = getClipboardMap();
+    ClipboardFormatMap::const_iterator found = formatMap.find(format);
+    if (found == formatMap.end())
+        return;
+    found->second->setString(dataObject, found->second->format, dataStrings);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/win/ClipboardUtilitiesWin.h b/Source/WebCore/platform/win/ClipboardUtilitiesWin.h
index 1a29e7e..36508d4 100644
--- a/Source/WebCore/platform/win/ClipboardUtilitiesWin.h
+++ b/Source/WebCore/platform/win/ClipboardUtilitiesWin.h
@@ -55,16 +55,27 @@ void replaceNewlinesWithWindowsStyleNewlines(String&);
 void replaceNBSPWithSpace(String&);
 
 bool containsFilenames(const IDataObject*);
+bool containsFilenames(const DragDataMap*);
 bool containsHTML(IDataObject*);
+bool containsHTML(const DragDataMap*);
 
 PassRefPtr<DocumentFragment> fragmentFromFilenames(Document*, const IDataObject*);
+PassRefPtr<DocumentFragment> fragmentFromFilenames(Document*, const DragDataMap*);
 PassRefPtr<DocumentFragment> fragmentFromHTML(Document*, IDataObject*);
+PassRefPtr<DocumentFragment> fragmentFromHTML(Document*, const DragDataMap*);
 PassRefPtr<DocumentFragment> fragmentFromCFHTML(Document*, const String& cfhtml);
 
 String getURL(IDataObject*, DragData::FilenameConversionPolicy, bool& success, String* title = 0);
+String getURL(const DragDataMap*, DragData::FilenameConversionPolicy, String* title = 0);
 String getPlainText(IDataObject*, bool& success);
+String getPlainText(const DragDataMap*);
 String getTextHTML(IDataObject*, bool& success);
+String getTextHTML(const DragDataMap*);
 String getCFHTML(IDataObject*, bool& success);
+String getCFHTML(const DragDataMap*);
+
+void getClipboardData(IDataObject*, FORMATETC* fetc, Vector<String>& dataStrings);
+void setClipboardData(IDataObject*, UINT format, const Vector<String>& dataStrings);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/win/ClipboardWin.cpp b/Source/WebCore/platform/win/ClipboardWin.cpp
index 58cfe44..c0af712 100644
--- a/Source/WebCore/platform/win/ClipboardWin.cpp
+++ b/Source/WebCore/platform/win/ClipboardWin.cpp
@@ -115,7 +115,7 @@ static inline void pathRemoveBadFSCharacters(PWSTR psz, size_t length)
 }
 #endif
 
-static String filesystemPathFromUrlOrTitle(const String& url, const String& title, TCHAR* extension, bool isLink)
+static String filesystemPathFromUrlOrTitle(const String& url, const String& title, const UChar* extension, bool isLink)
 {
 #if OS(WINCE)
     notImplemented();
@@ -163,7 +163,7 @@ static String filesystemPathFromUrlOrTitle(const String& url, const String& titl
     }
 
     String result(static_cast<UChar*>(fsPathBuffer));
-    result += String(static_cast<UChar*>(extension));
+    result += String(extension);
     return result;
 #endif
 }
@@ -195,7 +195,7 @@ static HGLOBAL createGlobalHDropContent(const KURL& url, String& fileName, Share
         // windows does not enjoy a leading slash on paths
         if (localPath[0] == '/')
             localPath = localPath.substring(1);
-        LPCTSTR localPathStr = localPath.charactersWithNullTermination();
+        LPCWSTR localPathStr = localPath.charactersWithNullTermination();
         if (wcslen(localPathStr) + 1 < MAX_PATH)
             wcscpy_s(filePath, MAX_PATH, localPathStr);
         else
@@ -277,7 +277,7 @@ static HGLOBAL createGlobalImageFileDescriptor(const String& url, const String&
         return 0;
     }
     extension.insert(".", 0);
-    fsPath = filesystemPathFromUrlOrTitle(url, preferredTitle, (TCHAR*)extension.charactersWithNullTermination(), false);
+    fsPath = filesystemPathFromUrlOrTitle(url, preferredTitle, extension.charactersWithNullTermination(), false);
 
     if (fsPath.length() <= 0) {
         GlobalUnlock(memObj);
@@ -340,7 +340,9 @@ exit:
 
 PassRefPtr<Clipboard> Clipboard::create(ClipboardAccessPolicy policy, DragData* dragData, Frame* frame)
 {
-    return ClipboardWin::create(DragAndDrop, dragData->platformData(), policy, frame);
+    if (dragData->platformData())
+        return ClipboardWin::create(DragAndDrop, dragData->platformData(), policy, frame);
+    return ClipboardWin::create(DragAndDrop, dragData->dragDataMap(), policy, frame);
 }
 
 ClipboardWin::ClipboardWin(ClipboardType clipboardType, IDataObject* dataObject, ClipboardAccessPolicy policy, Frame* frame)
@@ -359,6 +361,15 @@ ClipboardWin::ClipboardWin(ClipboardType clipboardType, WCDataObject* dataObject
 {
 }
 
+ClipboardWin::ClipboardWin(ClipboardType clipboardType, const DragDataMap& dataMap, ClipboardAccessPolicy policy, Frame* frame)
+    : Clipboard(policy, clipboardType)
+    , m_dataObject(0)
+    , m_writableDataObject(0)
+    , m_frame(frame)
+    , m_dragDataMap(dataMap)
+{
+}
+
 ClipboardWin::~ClipboardWin()
 {
 }
@@ -442,19 +453,19 @@ void ClipboardWin::clearAllData()
 String ClipboardWin::getData(const String& type, bool& success) const
 {     
     success = false;
-    if (policy() != ClipboardReadable || !m_dataObject)
+    if (policy() != ClipboardReadable || (!m_dataObject && m_dragDataMap.isEmpty()))
         return "";
 
     ClipboardDataType dataType = clipboardTypeFromMIMEType(type);
     if (dataType == ClipboardDataTypeText)
-        return getPlainText(m_dataObject.get(), success);
+        return m_dataObject ? getPlainText(m_dataObject.get(), success) : getPlainText(&m_dragDataMap);
     if (dataType == ClipboardDataTypeURL)
-        return getURL(m_dataObject.get(), DragData::DoNotConvertFilenames, success);
+        return m_dataObject ? getURL(m_dataObject.get(), DragData::DoNotConvertFilenames, success) : getURL(&m_dragDataMap, DragData::DoNotConvertFilenames);
     else if (dataType == ClipboardDataTypeTextHTML) {
-        String data = getTextHTML(m_dataObject.get(), success);
+        String data = m_dataObject ? getTextHTML(m_dataObject.get(), success) : getTextHTML(&m_dragDataMap);
         if (success)
             return data;
-        return getCFHTML(m_dataObject.get(), success);
+        return m_dataObject ? getCFHTML(m_dataObject.get(), success) : getCFHTML(&m_dragDataMap);
     }
     
     return "";
@@ -510,22 +521,30 @@ HashSet<String> ClipboardWin::types() const
     if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
         return results;
 
-    if (!m_dataObject)
+    if (!m_dataObject && m_dragDataMap.isEmpty())
         return results;
 
-    COMPtr<IEnumFORMATETC> itr;
+    if (m_dataObject) {
+        COMPtr<IEnumFORMATETC> itr;
 
-    if (FAILED(m_dataObject->EnumFormatEtc(DATADIR_GET, &itr)))
-        return results;
+        if (FAILED(m_dataObject->EnumFormatEtc(DATADIR_GET, &itr)))
+            return results;
 
-    if (!itr)
-        return results;
+        if (!itr)
+            return results;
 
-    FORMATETC data;
+        FORMATETC data;
 
-    // IEnumFORMATETC::Next returns S_FALSE if there are no more items.
-    while (itr->Next(1, &data, 0) == S_OK)
-        addMimeTypesForFormat(results, data);
+        // IEnumFORMATETC::Next returns S_FALSE if there are no more items.
+        while (itr->Next(1, &data, 0) == S_OK)
+            addMimeTypesForFormat(results, data);
+    } else {
+        for (DragDataMap::const_iterator it = m_dragDataMap.begin(); it != m_dragDataMap.end(); ++it) {
+            FORMATETC data;
+            data.cfFormat = (*it).first;
+            addMimeTypesForFormat(results, data);
+        }
+    }
 
     return results;
 }
@@ -540,27 +559,35 @@ PassRefPtr<FileList> ClipboardWin::files() const
     if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
         return files.release();
 
-    if (!m_dataObject)
+    if (!m_dataObject && m_dragDataMap.isEmpty())
         return files.release();
 
-    STGMEDIUM medium;
-    if (FAILED(m_dataObject->GetData(cfHDropFormat(), &medium)))
-        return files.release();
+    if (m_dataObject) {
+        STGMEDIUM medium;
+        if (FAILED(m_dataObject->GetData(cfHDropFormat(), &medium)))
+            return files.release();
+
+        HDROP hdrop = reinterpret_cast<HDROP>(GlobalLock(medium.hGlobal));
+        if (!hdrop)
+            return files.release();
+
+        WCHAR filename[MAX_PATH];
+        UINT fileCount = DragQueryFileW(hdrop, 0xFFFFFFFF, 0, 0);
+        for (UINT i = 0; i < fileCount; i++) {
+            if (!DragQueryFileW(hdrop, i, filename, WTF_ARRAY_LENGTH(filename)))
+                continue;
+            files->append(File::create(reinterpret_cast<UChar*>(filename)));
+        }
 
-    HDROP hdrop = reinterpret_cast<HDROP>(GlobalLock(medium.hGlobal));
-    if (!hdrop)
+        GlobalUnlock(medium.hGlobal);
+        ReleaseStgMedium(&medium);
         return files.release();
-
-    WCHAR filename[MAX_PATH];
-    UINT fileCount = DragQueryFileW(hdrop, 0xFFFFFFFF, 0, 0);
-    for (UINT i = 0; i < fileCount; i++) {
-        if (!DragQueryFileW(hdrop, i, filename, WTF_ARRAY_LENGTH(filename)))
-            continue;
-        files->append(File::create(reinterpret_cast<UChar*>(filename)));
     }
-
-    GlobalUnlock(medium.hGlobal);
-    ReleaseStgMedium(&medium);
+    if (!m_dragDataMap.contains(cfHDropFormat()->cfFormat))
+        return files.release();
+    Vector<String> filesVector = m_dragDataMap.get(cfHDropFormat()->cfFormat);
+    for (Vector<String>::iterator it = filesVector.begin(); it != filesVector.end(); ++it)
+        files->append(File::create((*it).characters()));
     return files.release();
 #endif
 }
@@ -778,25 +805,28 @@ void ClipboardWin::writePlainText(const String& text)
     
 bool ClipboardWin::hasData()
 {
-    if (!m_dataObject)
+    if (!m_dataObject && m_dragDataMap.isEmpty())
         return false;
 
-    COMPtr<IEnumFORMATETC> itr;
-    if (FAILED(m_dataObject->EnumFormatEtc(DATADIR_GET, &itr)))
-        return false;
+    if (m_dataObject) {
+        COMPtr<IEnumFORMATETC> itr;
+        if (FAILED(m_dataObject->EnumFormatEtc(DATADIR_GET, &itr)))
+            return false;
 
-    if (!itr)
-        return false;
+        if (!itr)
+            return false;
 
-    FORMATETC data;
+        FORMATETC data;
 
-    // IEnumFORMATETC::Next returns S_FALSE if there are no more items.
-    if (itr->Next(1, &data, 0) == S_OK) {
-        // There is at least one item in the IDataObject
-        return true;
-    }
+        // IEnumFORMATETC::Next returns S_FALSE if there are no more items.
+        if (itr->Next(1, &data, 0) == S_OK) {
+            // There is at least one item in the IDataObject
+            return true;
+        }
 
-    return false;
+        return false;
+    }
+    return !m_dragDataMap.isEmpty();
 }
 
 void ClipboardWin::setExternalDataObject(IDataObject *dataObject)
diff --git a/Source/WebCore/platform/win/ClipboardWin.h b/Source/WebCore/platform/win/ClipboardWin.h
index 779da26..7530eeb 100644
--- a/Source/WebCore/platform/win/ClipboardWin.h
+++ b/Source/WebCore/platform/win/ClipboardWin.h
@@ -29,6 +29,7 @@
 #include "COMPtr.h"
 #include "CachedResourceClient.h"
 #include "Clipboard.h"
+#include "DragData.h"
 
 struct IDataObject;
 
@@ -51,6 +52,10 @@ public:
     {
         return adoptRef(new ClipboardWin(clipboardType, dataObject, policy, frame));
     }
+    static PassRefPtr<ClipboardWin> create(ClipboardType clipboardType, const DragDataMap& dataMap, ClipboardAccessPolicy policy, Frame* frame)
+    {
+        return adoptRef(new ClipboardWin(clipboardType, dataMap, policy, frame));
+    }
     ~ClipboardWin();
 
     void clearData(const String& type);
@@ -80,12 +85,14 @@ public:
 private:
     ClipboardWin(ClipboardType, IDataObject*, ClipboardAccessPolicy, Frame*);
     ClipboardWin(ClipboardType, WCDataObject*, ClipboardAccessPolicy, Frame*);
+    ClipboardWin(ClipboardType, const DragDataMap&, ClipboardAccessPolicy, Frame*);
 
     void resetFromClipboard();
     void setDragImage(CachedImage*, Node*, const IntPoint&);
 
     COMPtr<IDataObject> m_dataObject;
     COMPtr<WCDataObject> m_writableDataObject;
+    DragDataMap m_dragDataMap;
     Frame* m_frame;
 };
 
diff --git a/Source/WebCore/platform/win/ContextMenuWin.cpp b/Source/WebCore/platform/win/ContextMenuWin.cpp
index ed1b895..dad0f2e 100644
--- a/Source/WebCore/platform/win/ContextMenuWin.cpp
+++ b/Source/WebCore/platform/win/ContextMenuWin.cpp
@@ -31,7 +31,6 @@
 #include "FrameView.h"
 #include "Node.h"
 #include "NotImplemented.h"
-#include <tchar.h>
 #include <windows.h>
 #include <wtf/Vector.h>
 #include <wtf/text/CString.h>
@@ -73,7 +72,7 @@ void ContextMenu::getContextMenuItems(HMENU menu, Vector<ContextMenuItem>& items
         }
 
         int menuStringLength = info.cch + 1;
-        OwnArrayPtr<WCHAR> menuString(new WCHAR[menuStringLength]);
+        OwnArrayPtr<WCHAR> menuString = adoptArrayPtr(new WCHAR[menuStringLength]);
         info.dwTypeData = menuString.get();
         info.cch = menuStringLength;
 
diff --git a/Source/WebCore/platform/win/CursorWin.cpp b/Source/WebCore/platform/win/CursorWin.cpp
index 2dd1452..0036388 100644
--- a/Source/WebCore/platform/win/CursorWin.cpp
+++ b/Source/WebCore/platform/win/CursorWin.cpp
@@ -123,9 +123,9 @@ static PassRefPtr<SharedCursor> createSharedCursor(Image* img, const IntPoint& h
     return impl.release();
 }
 
-static PassRefPtr<SharedCursor> loadSharedCursor(HINSTANCE hInstance, LPCTSTR lpCursorName)
+static PassRefPtr<SharedCursor> loadSharedCursor(HINSTANCE hInstance, LPCWSTR lpCursorName)
 {
-    return SharedCursor::create(::LoadCursor(hInstance, lpCursorName));
+    return SharedCursor::create(::LoadCursorW(hInstance, lpCursorName));
 }
 
 static PassRefPtr<SharedCursor> loadCursorByName(char* name, int x, int y)
diff --git a/Source/WebCore/platform/win/DragDataWin.cpp b/Source/WebCore/platform/win/DragDataWin.cpp
index 906119d..c5b99ea 100644
--- a/Source/WebCore/platform/win/DragDataWin.cpp
+++ b/Source/WebCore/platform/win/DragDataWin.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "DragData.h"
 
+#include "COMPtr.h"
 #include "ClipboardUtilitiesWin.h"
 #include "Frame.h"
 #include "DocumentFragment.h"
@@ -35,65 +36,109 @@
 #include <objidl.h>
 #include <shlwapi.h>
 #include <wininet.h>
+#include <wtf/Forward.h>
+#include <wtf/Hashmap.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
 
 namespace WebCore {
 
+DragData::DragData(const DragDataMap& data, const IntPoint& clientPosition, const IntPoint& globalPosition,
+    DragOperation sourceOperationMask, DragApplicationFlags flags)
+    : m_clientPosition(clientPosition)
+    , m_globalPosition(globalPosition)
+    , m_platformDragData(0)
+    , m_draggingSourceOperationMask(sourceOperationMask)
+    , m_applicationFlags(flags)
+    , m_dragDataMap(data)
+{
+}
+
 bool DragData::containsURL(Frame*, FilenameConversionPolicy filenamePolicy) const
 {
-    return SUCCEEDED(m_platformDragData->QueryGetData(urlWFormat())) 
-        || SUCCEEDED(m_platformDragData->QueryGetData(urlFormat()))
-        || (filenamePolicy == ConvertFilenames
-            && (SUCCEEDED(m_platformDragData->QueryGetData(filenameWFormat()))
-                || SUCCEEDED(m_platformDragData->QueryGetData(filenameFormat()))));
+    if (m_platformDragData)
+        return SUCCEEDED(m_platformDragData->QueryGetData(urlWFormat())) 
+            || SUCCEEDED(m_platformDragData->QueryGetData(urlFormat()))
+            || (filenamePolicy == ConvertFilenames
+                && (SUCCEEDED(m_platformDragData->QueryGetData(filenameWFormat()))
+                    || SUCCEEDED(m_platformDragData->QueryGetData(filenameFormat()))));
+    return m_dragDataMap.contains(urlWFormat()->cfFormat) || m_dragDataMap.contains(urlFormat()->cfFormat)
+        || (filenamePolicy == ConvertFilenames && (m_dragDataMap.contains(filenameWFormat()->cfFormat) || m_dragDataMap.contains(filenameFormat()->cfFormat)));
+}
+
+const DragDataMap& DragData::dragDataMap()
+{
+    if (!m_dragDataMap.isEmpty() || !m_platformDragData)
+        return m_dragDataMap;
+    // Enumerate clipboard content and load it in the map.
+    COMPtr<IEnumFORMATETC> itr;
+
+    if (FAILED(m_platformDragData->EnumFormatEtc(DATADIR_GET, &itr)) || !itr)
+        return m_dragDataMap;
+
+    FORMATETC dataFormat;
+    while (itr->Next(1, &dataFormat, 0) == S_OK) {
+        Vector<String> dataStrings;
+        getClipboardData(m_platformDragData, &dataFormat, dataStrings);
+        if (!dataStrings.isEmpty())
+            m_dragDataMap.set(dataFormat.cfFormat, dataStrings); 
+    }
+    return m_dragDataMap;
 }
 
 String DragData::asURL(Frame*, FilenameConversionPolicy filenamePolicy, String* title) const
 {
     bool success;
-    return getURL(m_platformDragData, filenamePolicy, success, title);
+    return (m_platformDragData) ? getURL(m_platformDragData, filenamePolicy, success, title) : getURL(&m_dragDataMap, filenamePolicy, title);
 }
 
 bool DragData::containsFiles() const
 {
-    return SUCCEEDED(m_platformDragData->QueryGetData(cfHDropFormat()));
+    return (m_platformDragData) ? SUCCEEDED(m_platformDragData->QueryGetData(cfHDropFormat())) : m_dragDataMap.contains(cfHDropFormat()->cfFormat);
 }
 
 void DragData::asFilenames(Vector<String>& result) const
 {
-    WCHAR filename[MAX_PATH];
-    
-    STGMEDIUM medium;
-    if (FAILED(m_platformDragData->GetData(cfHDropFormat(), &medium)))
-        return;
-    
-    HDROP hdrop = (HDROP)GlobalLock(medium.hGlobal);
-    
-    if (!hdrop)
-        return;
+    if (m_platformDragData) {
+        WCHAR filename[MAX_PATH];
+        
+        STGMEDIUM medium;
+        if (FAILED(m_platformDragData->GetData(cfHDropFormat(), &medium)))
+            return;
+        
+        HDROP hdrop = (HDROP)GlobalLock(medium.hGlobal);
+        
+        if (!hdrop)
+            return;
 
-    const unsigned numFiles = DragQueryFileW(hdrop, 0xFFFFFFFF, 0, 0);
-    for (unsigned i = 0; i < numFiles; i++) {
-        if (!DragQueryFileW(hdrop, 0, filename, WTF_ARRAY_LENGTH(filename)))
-            continue;
-        result.append((UChar*)filename);
-    }
+        const unsigned numFiles = DragQueryFileW(hdrop, 0xFFFFFFFF, 0, 0);
+        for (unsigned i = 0; i < numFiles; i++) {
+            if (!DragQueryFileW(hdrop, 0, filename, WTF_ARRAY_LENGTH(filename)))
+                continue;
+            result.append((UChar*)filename);
+        }
 
-    // Free up memory from drag
-    DragFinish(hdrop);
+        // Free up memory from drag
+        DragFinish(hdrop);
 
-    GlobalUnlock(medium.hGlobal);
+        GlobalUnlock(medium.hGlobal);
+        return;
+    }
+    result = m_dragDataMap.get(cfHDropFormat()->cfFormat);
 }
 
 bool DragData::containsPlainText() const
 {
-    return SUCCEEDED(m_platformDragData->QueryGetData(plainTextWFormat()))
-        || SUCCEEDED(m_platformDragData->QueryGetData(plainTextFormat()));
+    if (m_platformDragData)
+        return SUCCEEDED(m_platformDragData->QueryGetData(plainTextWFormat()))
+            || SUCCEEDED(m_platformDragData->QueryGetData(plainTextFormat()));
+    return m_dragDataMap.contains(plainTextWFormat()->cfFormat) || m_dragDataMap.contains(plainTextFormat()->cfFormat);
 }
 
 String DragData::asPlainText(Frame*) const
 {
     bool success;
-    return getPlainText(m_platformDragData, success);
+    return (m_platformDragData) ? getPlainText(m_platformDragData, success) : getPlainText(&m_dragDataMap);
 }
 
 bool DragData::containsColor() const
@@ -103,14 +148,16 @@ bool DragData::containsColor() const
 
 bool DragData::canSmartReplace() const
 {
-    return SUCCEEDED(m_platformDragData->QueryGetData(smartPasteFormat())); 
+    if (m_platformDragData)
+        return SUCCEEDED(m_platformDragData->QueryGetData(smartPasteFormat()));
+    return m_dragDataMap.contains(smartPasteFormat()->cfFormat);
 }
 
 bool DragData::containsCompatibleContent() const
 {
     return containsPlainText() || containsURL(0) 
-        || containsHTML(m_platformDragData) 
-        || containsFilenames(m_platformDragData) 
+        || ((m_platformDragData) ? (containsHTML(m_platformDragData) || containsFilenames(m_platformDragData))
+            : (containsHTML(&m_dragDataMap) || containsFilenames(&m_dragDataMap)))
         || containsColor();
 }
 
@@ -125,16 +172,29 @@ PassRefPtr<DocumentFragment> DragData::asFragment(Frame* frame, PassRefPtr<Range
      * * TIFF
      * * PICT
      */
-        
-     if (containsFilenames(m_platformDragData))
-         if (PassRefPtr<DocumentFragment> fragment = fragmentFromFilenames(frame->document(), m_platformDragData))
-             return fragment;
-
-     if (containsHTML(m_platformDragData))
-         if (PassRefPtr<DocumentFragment> fragment = fragmentFromHTML(frame->document(), m_platformDragData))
-             return fragment;
-
-     return 0;
+     
+    if (m_platformDragData) {
+        if (containsFilenames(m_platformDragData)) {
+            if (PassRefPtr<DocumentFragment> fragment = fragmentFromFilenames(frame->document(), m_platformDragData))
+                return fragment;
+        }
+
+        if (containsHTML(m_platformDragData)) {
+            if (PassRefPtr<DocumentFragment> fragment = fragmentFromHTML(frame->document(), m_platformDragData))
+                return fragment;
+        }
+    } else {
+        if (containsFilenames(&m_dragDataMap)) {
+            if (PassRefPtr<DocumentFragment> fragment = fragmentFromFilenames(frame->document(), &m_dragDataMap))
+                return fragment;
+        }
+
+        if (containsHTML(&m_dragDataMap)) {
+            if (PassRefPtr<DocumentFragment> fragment = fragmentFromHTML(frame->document(), &m_dragDataMap))
+                return fragment;
+        }
+    }
+    return 0;
 }
 
 Color DragData::asColor() const
@@ -143,4 +203,3 @@ Color DragData::asColor() const
 }
 
 }
-
diff --git a/Source/WebCore/platform/win/DragImageWin.cpp b/Source/WebCore/platform/win/DragImageWin.cpp
index 135e9d0..4e5d168 100644
--- a/Source/WebCore/platform/win/DragImageWin.cpp
+++ b/Source/WebCore/platform/win/DragImageWin.cpp
@@ -27,14 +27,25 @@
 #include "DragImage.h"
 
 #include "CachedImage.h"
+#include "Font.h"
+#include "FontDescription.h"
+#include "FontSelector.h"
+#include "Frame.h"
 #include "GraphicsContext.h"
 #include "Image.h"
 #include "RetainPtr.h"
+#include "Settings.h"
+#include "StringTruncator.h"
+#include "TextRun.h"
+#include "WebCoreTextRenderer.h"
 
 #include <windows.h>
 
 namespace WebCore {
 
+HBITMAP allocImage(HDC, IntSize, PlatformGraphicsContext** targetRef);
+void deallocContext(PlatformGraphicsContext* target);
+
 IntSize dragImageSize(DragImageRef image)
 {
     if (!image)
@@ -79,5 +90,141 @@ DragImageRef createDragImageIconForCachedImage(CachedImage* image)
 
     return iconInfo.hbmColor;
 }
+
+const float DragLabelBorderX = 4;
+// Keep border_y in synch with DragController::LinkDragBorderInset.
+const float DragLabelBorderY = 2;
+const float DragLabelRadius = 5;
+const float LabelBorderYOffset = 2;
+
+const float MinDragLabelWidthBeforeClip = 120;
+const float MaxDragLabelWidth = 200;
+const float MaxDragLabelStringWidth = (MaxDragLabelWidth - 2 * DragLabelBorderX);
+
+const float DragLinkLabelFontsize = 11;
+const float DragLinkUrlFontSize = 10;
+
+static Font dragLabelFont(int size, bool bold, FontRenderingMode renderingMode)
+{
+    NONCLIENTMETRICS metrics;
+    metrics.cbSize = sizeof(metrics);
+    SystemParametersInfo(SPI_GETNONCLIENTMETRICS, metrics.cbSize, &metrics, 0);
+
+    FontDescription description;
+    description.setWeight(bold ? FontWeightBold : FontWeightNormal);
+
+    FontFamily family;
+    family.setFamily(metrics.lfSmCaptionFont.lfFaceName);
+    description.setFamily(family);
+    description.setSpecifiedSize((float)size);
+    description.setComputedSize((float)size);
+    description.setRenderingMode(renderingMode);
+    Font result = Font(description, 0, 0); 
+    result.update(0);
+    return result;
+}
+
+DragImageRef createDragImageForLink(KURL& url, const String& inLabel, Frame* frame)
+{
+    // This is more or less an exact match for the Mac OS X code.
+
+    const Font* labelFont;
+    const Font* urlFont;
+
+    if (frame->settings() && frame->settings()->fontRenderingMode() == AlternateRenderingMode) {
+        static const Font alternateRenderingModeLabelFont = dragLabelFont(DragLinkLabelFontsize, true, AlternateRenderingMode);
+        static const Font alternateRenderingModeURLFont = dragLabelFont(DragLinkUrlFontSize, false, AlternateRenderingMode);
+        labelFont = &alternateRenderingModeLabelFont;
+        urlFont = &alternateRenderingModeURLFont;
+    } else {
+        static const Font normalRenderingModeLabelFont = dragLabelFont(DragLinkLabelFontsize, true, NormalRenderingMode);
+        static const Font normalRenderingModeURLFont = dragLabelFont(DragLinkUrlFontSize, false, NormalRenderingMode);
+        labelFont = &normalRenderingModeLabelFont;
+        urlFont = &normalRenderingModeURLFont;
+    }
+
+    bool drawURLString = true;
+    bool clipURLString = false;
+    bool clipLabelString = false;
+
+    String urlString = url.string(); 
+    String label = inLabel;
+    if (label.isEmpty()) {
+        drawURLString = false;
+        label = urlString;
+    }
+
+    // First step in drawing the link drag image width.
+    TextRun labelRun(label.impl());
+    TextRun urlRun(urlString.impl());
+    IntSize labelSize(labelFont->width(labelRun), labelFont->fontMetrics().ascent() + labelFont->fontMetrics().descent());
+
+    if (labelSize.width() > MaxDragLabelStringWidth) {
+        labelSize.setWidth(MaxDragLabelStringWidth);
+        clipLabelString = true;
+    }
+    
+    IntSize urlStringSize;
+    IntSize imageSize(labelSize.width() + DragLabelBorderX * 2, labelSize.height() + DragLabelBorderY * 2);
+
+    if (drawURLString) {
+        urlStringSize.setWidth(urlFont->width(urlRun));
+        urlStringSize.setHeight(urlFont->fontMetrics().ascent() + urlFont->fontMetrics().descent()); 
+        imageSize.setHeight(imageSize.height() + urlStringSize.height());
+        if (urlStringSize.width() > MaxDragLabelStringWidth) {
+            imageSize.setWidth(MaxDragLabelWidth);
+            clipURLString = true;
+        } else
+            imageSize.setWidth(std::max(labelSize.width(), urlStringSize.width()) + DragLabelBorderX * 2);
+    }
+
+    // We now know how big the image needs to be, so we create and
+    // fill the background
+    HBITMAP image = 0;
+    HDC dc = GetDC(0);
+    HDC workingDC = CreateCompatibleDC(dc);
+    if (!workingDC) {
+        ReleaseDC(0, dc);
+        return 0;
+    }
+
+    PlatformGraphicsContext* contextRef;
+    image = allocImage(workingDC, imageSize, &contextRef);
+    if (!image) {
+        DeleteDC(workingDC);
+        ReleaseDC(0, dc);
+        return 0;
+    }
+        
+    SelectObject(workingDC, image);
+    GraphicsContext context(contextRef);
+    // On Mac alpha is {0.7, 0.7, 0.7, 0.8}, however we can't control alpha
+    // for drag images on win, so we use 1
+    static const Color backgroundColor(140, 140, 140);
+    static const IntSize radii(DragLabelRadius, DragLabelRadius);
+    IntRect rect(0, 0, imageSize.width(), imageSize.height());
+    context.fillRoundedRect(rect, radii, radii, radii, radii, backgroundColor, ColorSpaceDeviceRGB);
+ 
+    // Draw the text
+    static const Color topColor(0, 0, 0, 255); // original alpha = 0.75
+    static const Color bottomColor(255, 255, 255, 127); // original alpha = 0.5
+    if (drawURLString) {
+        if (clipURLString)
+            urlString = StringTruncator::rightTruncate(urlString, imageSize.width() - (DragLabelBorderX * 2.0f), *urlFont, false);
+        IntPoint textPos(DragLabelBorderX, imageSize.height() - (LabelBorderYOffset + urlFont->fontMetrics().descent()));
+        WebCoreDrawDoubledTextAtPoint(context, urlString, textPos, *urlFont, topColor, bottomColor);
+    }
     
+    if (clipLabelString)
+        label = StringTruncator::rightTruncate(label, imageSize.width() - (DragLabelBorderX * 2.0f), *labelFont, false);
+
+    IntPoint textPos(DragLabelBorderX, DragLabelBorderY + labelFont->pixelSize());
+    WebCoreDrawDoubledTextAtPoint(context, label, textPos, *labelFont, topColor, bottomColor);
+
+    deallocContext(contextRef);
+    DeleteDC(workingDC);
+    ReleaseDC(0, dc);
+    return image;
+}
+
 }
diff --git a/Source/WebCore/platform/win/FileChooserWin.cpp b/Source/WebCore/platform/win/FileChooserWin.cpp
index 7d07b5d..195b8eb 100644
--- a/Source/WebCore/platform/win/FileChooserWin.cpp
+++ b/Source/WebCore/platform/win/FileChooserWin.cpp
@@ -29,7 +29,6 @@
 #include "LocalizedStrings.h"
 #include "StringTruncator.h"
 #include <shlwapi.h>
-#include <tchar.h>
 #include <windows.h>
 
 namespace WebCore {
@@ -44,7 +43,7 @@ String FileChooser::basenameForWidth(const Font& font, int width) const
         string = fileButtonNoFileSelectedLabel();
     else if (m_filenames.size() == 1) {
         String tmpFilename = m_filenames[0];
-        LPTSTR basename = PathFindFileName(tmpFilename.charactersWithNullTermination());
+        LPWSTR basename = PathFindFileNameW(tmpFilename.charactersWithNullTermination());
         string = String(basename);
     } else
         return StringTruncator::rightTruncate(String::number(m_filenames.size()) + " files", width, font, false);
diff --git a/Source/WebCore/platform/win/LoggingWin.cpp b/Source/WebCore/platform/win/LoggingWin.cpp
index fe237e5..1d051ae 100644
--- a/Source/WebCore/platform/win/LoggingWin.cpp
+++ b/Source/WebCore/platform/win/LoggingWin.cpp
@@ -37,7 +37,7 @@ static inline void initializeWithUserDefault(WTFLogChannel& channel)
     if (!length)
         return;
 
-    OwnArrayPtr<char> buffer(new char[length]);
+    OwnArrayPtr<char> buffer = adoptArrayPtr(new char[length]);
 
     if (!GetEnvironmentVariableA(channel.defaultName, buffer.get(), length))
         return;
diff --git a/Source/WebCore/platform/win/MIMETypeRegistryWin.cpp b/Source/WebCore/platform/win/MIMETypeRegistryWin.cpp
index 980742a..56ddab1 100644
--- a/Source/WebCore/platform/win/MIMETypeRegistryWin.cpp
+++ b/Source/WebCore/platform/win/MIMETypeRegistryWin.cpp
@@ -27,7 +27,9 @@
 #include "MIMETypeRegistry.h"
 
 #include <shlwapi.h>
+#include <wtf/Assertions.h>
 #include <wtf/HashMap.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore 
 {
@@ -64,6 +66,8 @@ String MIMETypeRegistry::getPreferredExtensionForMIMEType(const String& type)
 
 String MIMETypeRegistry::getMIMETypeForExtension(const String &ext)
 {
+    ASSERT(isMainThread());
+
     if (ext.isEmpty())
         return String();
 
diff --git a/Source/WebCore/platform/win/PopupMenuWin.cpp b/Source/WebCore/platform/win/PopupMenuWin.cpp
index 15871e6..3f3afa2 100644
--- a/Source/WebCore/platform/win/PopupMenuWin.cpp
+++ b/Source/WebCore/platform/win/PopupMenuWin.cpp
@@ -42,7 +42,6 @@
 #include "SimpleFontData.h"
 #include "TextRun.h"
 #include "WebCoreInstanceHandle.h"
-#include <tchar.h>
 #include <windows.h>
 #include <windowsx.h>
 #if OS(WINCE)
@@ -64,7 +63,7 @@ static const int maxPopupHeight = 320;
 const int optionSpacingMiddle = 1;
 const int popupWindowBorderWidth = 1;
 
-static LPCTSTR kPopupWindowClassName = _T("PopupWindowClass");
+static LPCWSTR kPopupWindowClassName = L"PopupWindowClass";
 
 // This is used from within our custom message pump when we want to send a
 // message to the web view and not have our message stolen and sent to
@@ -121,7 +120,7 @@ void PopupMenuWin::disconnectClient()
     m_popupClient = 0;
 }
 
-LPCTSTR PopupMenuWin::popupClassName()
+LPCWSTR PopupMenuWin::popupClassName()
 {
     return kPopupWindowClassName;
 }
@@ -145,7 +144,7 @@ void PopupMenuWin::show(const IntRect& r, FrameView* view, int index)
 
         DWORD exStyle = WS_EX_LTRREADING;
 
-        m_popup = ::CreateWindowEx(exStyle, kPopupWindowClassName, _T("PopupMenu"),
+        m_popup = ::CreateWindowExW(exStyle, kPopupWindowClassName, L"PopupMenu",
             WS_POPUP | WS_BORDER,
             m_windowRect.x(), m_windowRect.y(), m_windowRect.width(), m_windowRect.height(),
             hostWindow, 0, WebCore::instanceHandle(), this);
@@ -306,7 +305,7 @@ void PopupMenuWin::calculatePositionAndSize(const IntRect& r, FrameView* v)
 
     // First, determine the popup's height
     int itemCount = client()->listSize();
-    m_itemHeight = client()->menuStyle().font().height() + optionSpacingMiddle;
+    m_itemHeight = client()->menuStyle().font().fontMetrics().height() + optionSpacingMiddle;
     int naturalHeight = m_itemHeight * itemCount;
     int popupHeight = min(maxPopupHeight, naturalHeight);
     // The popup should show an integral number of items (i.e. no partial items should be visible)
@@ -347,13 +346,13 @@ void PopupMenuWin::calculatePositionAndSize(const IntRect& r, FrameView* v)
     // Always left-align items in the popup.  This matches popup menus on the mac.
     int popupX = rScreenCoords.x() + client()->clientInsetLeft();
 
-    IntRect popupRect(popupX, rScreenCoords.bottom(), popupWidth, popupHeight);
+    IntRect popupRect(popupX, rScreenCoords.maxY(), popupWidth, popupHeight);
 
     // The popup needs to stay within the bounds of the screen and not overlap any toolbars
     FloatRect screen = screenAvailableRect(v);
 
     // Check that we don't go off the screen vertically
-    if (popupRect.bottom() > screen.height()) {
+    if (popupRect.maxY() > screen.height()) {
         // The popup will go off the screen, so try placing it above the client
         if (rScreenCoords.y() - popupRect.height() < 0) {
             // The popup won't fit above, either, so place it whereever's bigger and resize it to fit
@@ -602,7 +601,7 @@ void PopupMenuWin::paint(const IntRect& damageRect, HDC hdc)
     IntRect listRect = damageRect;
     listRect.move(IntSize(0, m_scrollOffset * m_itemHeight));
 
-    for (int y = listRect.y(); y < listRect.bottom(); y += m_itemHeight) {
+    for (int y = listRect.y(); y < listRect.maxY(); y += m_itemHeight) {
         int index = y / m_itemHeight;
 
         Color optionBackgroundColor, optionTextColor;
@@ -632,7 +631,7 @@ void PopupMenuWin::paint(const IntRect& damageRect, HDC hdc)
             
         unsigned length = itemText.length();
         const UChar* string = itemText.characters();
-        TextRun textRun(string, length, false, 0, 0, itemText.defaultWritingDirection() == WTF::Unicode::RightToLeft);
+        TextRun textRun(string, length, false, 0, 0, TextRun::AllowTrailingExpansion, itemText.defaultWritingDirection() == WTF::Unicode::RightToLeft);
 
         context.setFillColor(optionTextColor, ColorSpaceDeviceRGB);
         
@@ -649,7 +648,7 @@ void PopupMenuWin::paint(const IntRect& damageRect, HDC hdc)
             int textX = max(0, client()->clientPaddingLeft() - client()->clientInsetLeft());
             if (RenderTheme::defaultTheme()->popupOptionSupportsTextIndent() && itemStyle.textDirection() == LTR)
                 textX += itemStyle.textIndent().calcMinValue(itemRect.width());
-            int textY = itemRect.y() + itemFont.ascent() + (itemRect.height() - itemFont.height()) / 2;
+            int textY = itemRect.y() + itemFont.fontMetrics().ascent() + (itemRect.height() - itemFont.fontMetrics().height()) / 2;
             context.drawBidiText(itemFont, textRun, IntPoint(textX, textY));
         }
     }
diff --git a/Source/WebCore/platform/win/PopupMenuWin.h b/Source/WebCore/platform/win/PopupMenuWin.h
index 0d7630c..05edb07 100644
--- a/Source/WebCore/platform/win/PopupMenuWin.h
+++ b/Source/WebCore/platform/win/PopupMenuWin.h
@@ -49,7 +49,7 @@ public:
     virtual void updateFromElement();
     virtual void disconnectClient();
 
-    static LPCTSTR popupClassName();
+    static LPCWSTR popupClassName();
 
 private:
     PopupMenuClient* client() const { return m_popupClient; }
diff --git a/Source/WebCore/platform/win/SystemTimeWin.cpp b/Source/WebCore/platform/win/SystemTimeWin.cpp
index 451262d..547decc 100644
--- a/Source/WebCore/platform/win/SystemTimeWin.cpp
+++ b/Source/WebCore/platform/win/SystemTimeWin.cpp
@@ -26,13 +26,9 @@
 #include "config.h"
 #include "SystemTime.h"
 
+#include <limits>
 #include <windows.h>
 
-#if COMPILER(MINGW) || (PLATFORM(QT) && COMPILER(MSVC))
-#include <float.h>
-#define FLOAT_MAX FLT_MAX
-#endif
-
 namespace WebCore {
 
 float userIdleTime()
@@ -43,7 +39,8 @@ float userIdleTime()
     if (::GetLastInputInfo(&lastInputInfo))
         return (GetTickCount() - lastInputInfo.dwTime) * 0.001; // ::GetTickCount returns ms of uptime valid for up to 49.7 days.
 #endif
-    return FLT_MAX; // return an arbitrarily high userIdleTime so that releasing pages from the page cache isn't postponed. 
+    // Return an arbitrarily high userIdleTime so that releasing pages from the page cache isn't postponed.
+    return std::numeric_limits<float>::max();
 }
 
-}
+} // namespace WebCore
diff --git a/Source/WebCore/platform/win/WCDataObject.cpp b/Source/WebCore/platform/win/WCDataObject.cpp
index 6b4c859..0c03ce0 100644
--- a/Source/WebCore/platform/win/WCDataObject.cpp
+++ b/Source/WebCore/platform/win/WCDataObject.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "WCDataObject.h"
 
+#include "ClipboardUtilitiesWin.h"
+#include "DragData.h"
 #include "PlatformString.h"
 
 namespace WebCore {
@@ -160,6 +162,17 @@ HRESULT WCDataObject::createInstance(WCDataObject** result)
     return S_OK;
 }
 
+HRESULT WCDataObject::createInstance(WCDataObject** result, const DragDataMap& dataMap)
+{
+    if (!result)
+        return E_POINTER;
+    *result = new WCDataObject;
+
+    for (DragDataMap::const_iterator it = dataMap.begin(); it != dataMap.end(); ++it)
+        setClipboardData(*result, it->first, it->second);
+    return S_OK;
+}
+
 WCDataObject::WCDataObject()
 : m_ref(1)
 {
@@ -380,5 +393,4 @@ void WCDataObject::clearData(CLIPFORMAT format)
     }
 }
 
-
 }
diff --git a/Source/WebCore/platform/win/WCDataObject.h b/Source/WebCore/platform/win/WCDataObject.h
index 133115d..e5fa298 100644
--- a/Source/WebCore/platform/win/WCDataObject.h
+++ b/Source/WebCore/platform/win/WCDataObject.h
@@ -26,10 +26,11 @@
 #ifndef WCDataObject_h
 #define WCDataObject_h
 
-#include <wtf/Forward.h>
-#include <wtf/Vector.h>
+#include "DragData.h"
 #include <ShlObj.h>
 #include <objidl.h>
+#include <wtf/Forward.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
@@ -56,6 +57,7 @@ public:
     void clearData(CLIPFORMAT);
     
     static HRESULT createInstance(WCDataObject**);
+    static HRESULT createInstance(WCDataObject**, const DragDataMap&);
 private:
     WCDataObject();
     virtual ~WCDataObject();
diff --git a/Source/WebCore/platform/wince/DragDataWinCE.cpp b/Source/WebCore/platform/wince/DragDataWinCE.cpp
index 8f531c7..679229d 100644
--- a/Source/WebCore/platform/wince/DragDataWinCE.cpp
+++ b/Source/WebCore/platform/wince/DragDataWinCE.cpp
@@ -32,6 +32,11 @@ bool DragData::containsURL(Frame*, FilenameConversionPolicy filenamePolicy) cons
     return false;
 }
 
+const DragDataMap& DragData::dragDataMap()
+{
+    return m_dragDataMap;
+}
+
 String DragData::asURL(Frame*, FilenameConversionPolicy filenamePolicy, String* title) const
 {
     return String();
diff --git a/Source/WebCore/platform/wince/KeygenWinCE.cpp b/Source/WebCore/platform/wince/KeygenWinCE.cpp
index 0c1b3c6..8537f44 100644
--- a/Source/WebCore/platform/wince/KeygenWinCE.cpp
+++ b/Source/WebCore/platform/wince/KeygenWinCE.cpp
@@ -80,10 +80,7 @@ String WebCore::signedPublicKeyAndChallengeString(unsigned index, const String&
         if (!CryptSignAndEncodeCertificate(hContext, AT_KEYEXCHANGE, X509_ASN_ENCODING, X509_KEYGEN_REQUEST_TO_BE_SIGNED, &requestInfo, &signAlgo, 0, reinterpret_cast<LPBYTE>(binary.data()), &dwEncodedLength))
             break;
 
-        Vector<char> base64;
-        base64Encode(binary, base64);
-        keyString = String(base64.data(), base64.size());
-
+        keyString = base64Encode(binary);
     } while(0);
 
     if (pPubInfo)
diff --git a/Source/WebCore/platform/wince/MIMETypeRegistryWinCE.cpp b/Source/WebCore/platform/wince/MIMETypeRegistryWinCE.cpp
index 7534b91..8a7ac8f 100644
--- a/Source/WebCore/platform/wince/MIMETypeRegistryWinCE.cpp
+++ b/Source/WebCore/platform/wince/MIMETypeRegistryWinCE.cpp
@@ -27,7 +27,9 @@
 #include "config.h"
 #include "MIMETypeRegistry.h"
 
+#include <wtf/Assertions.h>
 #include <wtf/HashMap.h>
+#include <wtf/MainThread.h>
 #include <windows.h>
 #include <winreg.h>
 
@@ -119,6 +121,8 @@ String MIMETypeRegistry::getPreferredExtensionForMIMEType(const String& type)
 
 String MIMETypeRegistry::getMIMETypeForExtension(const String &ext)
 {
+    ASSERT(isMainThread());
+
     if (ext.isEmpty())
         return String();
 
diff --git a/Source/WebCore/platform/wx/MimeTypeRegistryWx.cpp b/Source/WebCore/platform/wx/MimeTypeRegistryWx.cpp
index e7cc0e2..94a815e 100644
--- a/Source/WebCore/platform/wx/MimeTypeRegistryWx.cpp
+++ b/Source/WebCore/platform/wx/MimeTypeRegistryWx.cpp
@@ -28,6 +28,9 @@
 #include "config.h"
 #include "MIMETypeRegistry.h"
 
+#include <wtf/Assertions.h>
+#include <wtf/MainThread.h>
+
 namespace WebCore {
 
 struct ExtensionMap {
@@ -59,6 +62,8 @@ static const ExtensionMap extensionMap [] = {
     
 String MIMETypeRegistry::getMIMETypeForExtension(const String &ext)
 {
+    ASSERT(isMainThread());
+
     String s = ext.lower();
     const ExtensionMap *e = extensionMap;
     while (e->extension) {
diff --git a/Source/WebCore/platform/wx/RenderThemeWx.cpp b/Source/WebCore/platform/wx/RenderThemeWx.cpp
index c68bde9..a34e2d4 100644
--- a/Source/WebCore/platform/wx/RenderThemeWx.cpp
+++ b/Source/WebCore/platform/wx/RenderThemeWx.cpp
@@ -31,6 +31,7 @@
 #include "GraphicsContext.h"
 #include "HostWindow.h"
 #include "NotImplemented.h"
+#include "PaintInfo.h"
 #include "RenderView.h"
 
 #include <wx/defs.h>
diff --git a/Source/WebCore/platform/wx/SystemTimeWx.cpp b/Source/WebCore/platform/wx/SystemTimeWx.cpp
index f607cba..668ec00 100644
--- a/Source/WebCore/platform/wx/SystemTimeWx.cpp
+++ b/Source/WebCore/platform/wx/SystemTimeWx.cpp
@@ -26,18 +26,16 @@
 #include "config.h"
 #include "SystemTime.h"
 
-#include <float.h>
-
 #include "NotImplemented.h"
+#include <limits>
 
 namespace WebCore {
 
 float userIdleTime()
 {
     notImplemented();
-    // return an arbitrarily high userIdleTime so that releasing pages from the page cache isn't postponed
-    return FLT_MAX;
-}
-
+    // Return an arbitrarily high userIdleTime so that releasing pages from the page cache isn't postponed.
+    return std::numeric_limits<float>::max();
 }
 
+} // namespace WebCore
diff --git a/Source/WebCore/plugins/IFrameShimSupport.cpp b/Source/WebCore/plugins/IFrameShimSupport.cpp
new file mode 100644
index 0000000..3deaf09
--- /dev/null
+++ b/Source/WebCore/plugins/IFrameShimSupport.cpp
@@ -0,0 +1,167 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IFrameShimSupport.h"
+
+#include "Element.h"
+#include "FrameView.h"
+#include "HTMLElement.h"
+#include "HTMLFrameOwnerElement.h"
+#include "HTMLNames.h"
+#include "RenderBox.h"
+#include "RenderObject.h"
+#include "Widget.h"
+
+#include <wtf/HashSet.h>
+
+// This file provides plugin-related utility functions for iframe shims and is shared by platforms that inherit
+// from PluginView (e.g. Qt) and those that do not (e.g. Chromium).
+
+namespace WebCore {
+
+static void getObjectStack(const RenderObject* ro, Vector<const RenderObject*>* roStack)
+{
+    roStack->clear();
+    while (ro) {
+        roStack->append(ro);
+        ro = ro->parent();
+    }
+}
+
+// Returns true if stack1 is at or above stack2
+static bool iframeIsAbovePlugin(const Vector<const RenderObject*>& iframeZstack, const Vector<const RenderObject*>& pluginZstack)
+{
+    for (size_t i = 0; i < iframeZstack.size() && i < pluginZstack.size(); i++) {
+        // The root is at the end of these stacks.  We want to iterate
+        // root-downwards so we index backwards from the end.
+        const RenderObject* ro1 = iframeZstack[iframeZstack.size() - 1 - i];
+        const RenderObject* ro2 = pluginZstack[pluginZstack.size() - 1 - i];
+
+        if (ro1 != ro2) {
+            // When we find nodes in the stack that are not the same, then
+            // we've found the nodes just below the lowest comment ancestor.
+            // Determine which should be on top.
+
+            // See if z-index determines an order.
+            if (ro1->style() && ro2->style()) {
+                int z1 = ro1->style()->zIndex();
+                int z2 = ro2->style()->zIndex();
+                if (z1 > z2)
+                    return true;
+                if (z1 < z2)
+                    return false;
+            }
+
+            // If the plugin does not have an explicit z-index it stacks behind the iframe.
+            // This is for maintaining compatibility with IE.
+            if (ro2->style()->position() == StaticPosition) {
+                // The 0'th elements of these RenderObject arrays represent the plugin node and
+                // the iframe.
+                const RenderObject* pluginRenderObject = pluginZstack[0];
+                const RenderObject* iframeRenderObject = iframeZstack[0];
+
+                if (pluginRenderObject->style() && iframeRenderObject->style()) {
+                    if (pluginRenderObject->style()->zIndex() > iframeRenderObject->style()->zIndex())
+                        return false;
+                }
+                return true;
+            }
+
+            // Inspect the document order.  Later order means higher stacking.
+            const RenderObject* parent = ro1->parent();
+            if (!parent)
+                return false;
+            ASSERT(parent == ro2->parent());
+
+            for (const RenderObject* ro = parent->firstChild(); ro; ro = ro->nextSibling()) {
+                if (ro == ro1)
+                    return false;
+                if (ro == ro2)
+                    return true;
+            }
+            ASSERT(false); // We should have seen ro1 and ro2 by now.
+            return false;
+        }
+    }
+    return true;
+}
+
+// Return a set of rectangles that should not be overdrawn by the
+// plugin ("cutouts").  This helps implement the "iframe shim"
+// technique of overlaying a windowed plugin with content from the
+// page.  In a nutshell, iframe elements should occlude plugins when
+// they occur higher in the stacking order.
+void getPluginOcclusions(Element* element, Widget* parentWidget, const IntRect& frameRect, Vector<IntRect>& occlusions)
+{
+    RenderObject* pluginNode = element->renderer();
+    ASSERT(pluginNode);
+    if (!pluginNode->style())
+        return;
+    Vector<const RenderObject*> pluginZstack;
+    Vector<const RenderObject*> iframeZstack;
+    getObjectStack(pluginNode, &pluginZstack);
+
+    if (!parentWidget->isFrameView())
+        return;
+
+    FrameView* parentFrameView = static_cast<FrameView*>(parentWidget);
+
+    const HashSet<RefPtr<Widget> >* children = parentFrameView->children();
+    for (HashSet<RefPtr<Widget> >::const_iterator it = children->begin(); it != children->end(); ++it) {
+        // We only care about FrameView's because iframes show up as FrameViews.
+        if (!(*it)->isFrameView())
+            continue;
+
+        const FrameView* frameView = static_cast<const FrameView*>((*it).get());
+        // Check to make sure we can get both the element and the RenderObject
+        // for this FrameView, if we can't just move on to the next object.
+        if (!frameView->frame() || !frameView->frame()->ownerElement()
+            || !frameView->frame()->ownerElement()->renderer())
+            continue;
+
+        HTMLElement* element = frameView->frame()->ownerElement();
+        RenderObject* iframeRenderer = element->renderer();
+
+        if (element->hasTagName(HTMLNames::iframeTag)
+            && iframeRenderer->absoluteBoundingBoxRect().intersects(frameRect)
+            && (!iframeRenderer->style() || iframeRenderer->style()->visibility() == VISIBLE)) {
+            getObjectStack(iframeRenderer, &iframeZstack);
+            if (iframeIsAbovePlugin(iframeZstack, pluginZstack)) {
+                IntPoint point = roundedIntPoint(iframeRenderer->localToAbsolute());
+                RenderBox* rbox = toRenderBox(iframeRenderer);
+                IntSize size(rbox->width(), rbox->height());
+                occlusions.append(IntRect(point, size));
+            }
+        }
+    }
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/plugins/IFrameShimSupport.h b/Source/WebCore/plugins/IFrameShimSupport.h
new file mode 100644
index 0000000..6e55126
--- /dev/null
+++ b/Source/WebCore/plugins/IFrameShimSupport.h
@@ -0,0 +1,34 @@
+/*
+    Copyright (C) 2011 Robert Hogan <robert@roberthogan.net>.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef IFrameShimSupport_h
+#define IFrameShimSupport_h
+
+#include <wtf/Vector.h>
+
+namespace WebCore {
+class Element;
+class Widget;
+class IntRect;
+
+void getPluginOcclusions(Element*, Widget* parentWidget, const IntRect& frameRect, Vector<IntRect>& occlusions);
+
+} // namespace WebCore
+
+#endif // IFrameShimSupport_h
diff --git a/Source/WebCore/plugins/gtk/PluginPackageGtk.cpp b/Source/WebCore/plugins/gtk/PluginPackageGtk.cpp
index a702296..26409a7 100644
--- a/Source/WebCore/plugins/gtk/PluginPackageGtk.cpp
+++ b/Source/WebCore/plugins/gtk/PluginPackageGtk.cpp
@@ -104,6 +104,22 @@ bool PluginPackage::fetchInfo()
 #endif
 }
 
+#if defined(XP_UNIX)
+static int webkitgtkXError(Display* xdisplay, XErrorEvent* error)
+{
+    gchar errorMessage[64];
+    XGetErrorText(xdisplay, error->error_code, errorMessage, 63);
+    g_warning("The program '%s' received an X Window System error.\n"
+              "This probably reflects a bug in the Adobe Flash plugin.\n"
+              "The error was '%s'.\n"
+              "  (Details: serial %ld error_code %d request_code %d minor_code %d)\n",
+              g_get_prgname(), errorMessage,
+              error->serial, error->error_code,
+              error->request_code, error->minor_code);
+    return 0;
+}
+#endif
+
 bool PluginPackage::load()
 {
     if (m_isLoaded) {
@@ -137,6 +153,15 @@ bool PluginPackage::load()
 
     m_isLoaded = true;
 
+#if defined(XP_UNIX)
+    if (!g_strcmp0(baseName.get(), "libflashplayer.so")) {
+        // Flash plugin can produce X errors that are handled by the GDK X error handler, which
+        // exits the process. Since we don't want to crash due to flash bugs, we install a
+        // custom error handler to show a warning when a X error happens without aborting.
+        XSetErrorHandler(webkitgtkXError);
+    }
+#endif
+
     NP_InitializeFuncPtr NP_Initialize = 0;
     m_NPP_Shutdown = 0;
 
diff --git a/Source/WebCore/plugins/gtk/gtk2xtbin.c b/Source/WebCore/plugins/gtk/gtk2xtbin.c
index e03fad3..605e42c 100644
--- a/Source/WebCore/plugins/gtk/gtk2xtbin.c
+++ b/Source/WebCore/plugins/gtk/gtk2xtbin.c
@@ -46,7 +46,9 @@
 #include "xembed.h"
 #include "gtk2xtbin.h"
 #include <gtk/gtk.h>
+#ifdef GTK_API_VERSION_2
 #include <gdk/gdkx.h>
+#endif
 #include <glib.h>
 #include <assert.h>
 #include <sys/time.h>
diff --git a/Source/WebCore/plugins/gtk/gtk2xtbin.h b/Source/WebCore/plugins/gtk/gtk2xtbin.h
index 11f6e06..937cd77 100644
--- a/Source/WebCore/plugins/gtk/gtk2xtbin.h
+++ b/Source/WebCore/plugins/gtk/gtk2xtbin.h
@@ -41,6 +41,9 @@
 #define __GTK_XTBIN_H__
 
 #include <gtk/gtk.h>
+#ifndef GTK_API_VERSION_2
+#include <gtk/gtkx.h>
+#endif
 #include <X11/Intrinsic.h>
 #include <X11/Xutil.h>
 #include <X11/Xlib.h>
diff --git a/Source/WebCore/plugins/qt/PluginViewQt.cpp b/Source/WebCore/plugins/qt/PluginViewQt.cpp
index 579f77d..4dc4e15 100644
--- a/Source/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/Source/WebCore/plugins/qt/PluginViewQt.cpp
@@ -47,6 +47,7 @@
 #include "HTMLNames.h"
 #include "HTMLPlugInElement.h"
 #include "HostWindow.h"
+#include "IFrameShimSupport.h"
 #include "Image.h"
 #if USE(JSC)
 #include "JSDOMBinding.h"
@@ -627,10 +628,19 @@ void PluginView::setNPWindowIfNeeded()
 
     if (m_isWindowed) {
         platformPluginWidget()->setGeometry(m_windowRect);
+
+        // Cut out areas of the plugin occluded by iframe shims
+        Vector<IntRect> cutOutRects;
+        QRegion clipRegion = QRegion(m_clipRect);
+        getPluginOcclusions(m_element, this->parent(), frameRect(), cutOutRects);
+        for (size_t i = 0; i < cutOutRects.size(); i++) {
+            cutOutRects[i].move(-frameRect().x(), -frameRect().y());
+            clipRegion = clipRegion.subtracted(QRegion(cutOutRects[i]));
+        }
         // if setMask is set with an empty QRegion, no clipping will
         // be performed, so in that case we hide the plugin view
-        platformPluginWidget()->setVisible(!m_clipRect.isEmpty());
-        platformPluginWidget()->setMask(QRegion(m_clipRect));
+        platformPluginWidget()->setVisible(!clipRegion.isEmpty());
+        platformPluginWidget()->setMask(clipRegion);
 
         m_npWindow.x = m_windowRect.x();
         m_npWindow.y = m_windowRect.y();
diff --git a/Source/WebCore/plugins/symbian/PluginPackageSymbian.cpp b/Source/WebCore/plugins/symbian/PluginPackageSymbian.cpp
index a14ac20..34aec4c 100644
--- a/Source/WebCore/plugins/symbian/PluginPackageSymbian.cpp
+++ b/Source/WebCore/plugins/symbian/PluginPackageSymbian.cpp
@@ -29,6 +29,7 @@
 
 namespace WebCore {
 
+#if ENABLE(NETSCAPE_PLUGIN_API)
 bool PluginPackage::fetchInfo()
 {
     if (!load())
@@ -169,6 +170,7 @@ bool PluginPackage::load()
     m_loadCount++;
     return true;
 }
+#endif
 
 void PluginPackage::unload()
 {
@@ -186,9 +188,11 @@ void PluginPackage::unload()
     m_pluginLoader = 0;
 }
 
+#if ENABLE(NETSCAPE_PLUGIN_API)
 uint16_t PluginPackage::NPVersion() const
 {
     return NP_VERSION_MINOR;
 }
+#endif
 }
 
diff --git a/Source/WebCore/plugins/win/PluginPackageWin.cpp b/Source/WebCore/plugins/win/PluginPackageWin.cpp
index 74bd2a9..e06d1f4 100644
--- a/Source/WebCore/plugins/win/PluginPackageWin.cpp
+++ b/Source/WebCore/plugins/win/PluginPackageWin.cpp
@@ -168,7 +168,7 @@ bool PluginPackage::fetchInfo()
     if (versionInfoSize == 0)
         return false;
 
-    OwnArrayPtr<char> versionInfoData(new char[versionInfoSize]);
+    OwnArrayPtr<char> versionInfoData = adoptArrayPtr(new char[versionInfoSize]);
 
     if (!GetFileVersionInfoW(const_cast<UChar*>(m_path.charactersWithNullTermination()),
             0, versionInfoSize, versionInfoData.get()))
diff --git a/Source/WebCore/plugins/win/PluginViewWin.cpp b/Source/WebCore/plugins/win/PluginViewWin.cpp
index 3cd1902..208121e 100644
--- a/Source/WebCore/plugins/win/PluginViewWin.cpp
+++ b/Source/WebCore/plugins/win/PluginViewWin.cpp
@@ -448,7 +448,7 @@ void PluginView::updatePluginWidget()
             rgn = ::CreateRectRgn(0, 0, 0, 0);
             ::SetWindowRgn(platformPluginWidget(), rgn, FALSE);
         } else {
-            rgn = ::CreateRectRgn(m_clipRect.x(), m_clipRect.y(), m_clipRect.right(), m_clipRect.bottom());
+            rgn = ::CreateRectRgn(m_clipRect.x(), m_clipRect.y(), m_clipRect.maxX(), m_clipRect.maxY());
             ::SetWindowRgn(platformPluginWidget(), rgn, TRUE);
         }
 
@@ -456,7 +456,7 @@ void PluginView::updatePluginWidget()
             ::MoveWindow(platformPluginWidget(), m_windowRect.x(), m_windowRect.y(), m_windowRect.width(), m_windowRect.height(), TRUE);
 
         if (clipToZeroRect) {
-            rgn = ::CreateRectRgn(m_clipRect.x(), m_clipRect.y(), m_clipRect.right(), m_clipRect.bottom());
+            rgn = ::CreateRectRgn(m_clipRect.x(), m_clipRect.y(), m_clipRect.maxX(), m_clipRect.maxY());
             ::SetWindowRgn(platformPluginWidget(), rgn, TRUE);
         }
 
@@ -896,7 +896,7 @@ bool PluginView::platformGetValue(NPNVariable variable, void* value, NPError* re
 void PluginView::invalidateRect(const IntRect& rect)
 {
     if (m_isWindowed) {
-        RECT invalidRect = { rect.x(), rect.y(), rect.right(), rect.bottom() };
+        RECT invalidRect = { rect.x(), rect.y(), rect.maxX(), rect.maxY() };
         ::InvalidateRect(platformPluginWidget(), &invalidRect, false);
         return;
     }
@@ -914,7 +914,7 @@ void PluginView::invalidateRect(NPRect* rect)
     IntRect r(rect->left, rect->top, rect->right - rect->left, rect->bottom - rect->top);
 
     if (m_isWindowed) {
-        RECT invalidRect = { r.x(), r.y(), r.right(), r.bottom() };
+        RECT invalidRect = { r.x(), r.y(), r.maxX(), r.maxY() };
         InvalidateRect(platformPluginWidget(), &invalidRect, FALSE);
     } else {
         if (m_plugin->quirks().contains(PluginQuirkThrottleInvalidate)) {
diff --git a/Source/WebCore/rendering/CounterNode.cpp b/Source/WebCore/rendering/CounterNode.cpp
index fe2148a..eadd386 100644
--- a/Source/WebCore/rendering/CounterNode.cpp
+++ b/Source/WebCore/rendering/CounterNode.cpp
@@ -263,7 +263,7 @@ static void showTreeAndMark(const CounterNode* node)
 
 #ifndef NDEBUG
 
-void showTree(const WebCore::CounterNode* counter)
+void showCounterTree(const WebCore::CounterNode* counter)
 {
     if (counter)
         showTreeAndMark(counter);
diff --git a/Source/WebCore/rendering/CounterNode.h b/Source/WebCore/rendering/CounterNode.h
index 529d409..639946c 100644
--- a/Source/WebCore/rendering/CounterNode.h
+++ b/Source/WebCore/rendering/CounterNode.h
@@ -94,7 +94,7 @@ private:
 
 #ifndef NDEBUG
 // Outside the WebCore namespace for ease of invocation from gdb.
-void showTree(const WebCore::CounterNode*);
+void showCounterTree(const WebCore::CounterNode*);
 #endif
 
 #endif // CounterNode_h
diff --git a/Source/WebCore/rendering/EllipsisBox.cpp b/Source/WebCore/rendering/EllipsisBox.cpp
index d367c07..db66b43 100644
--- a/Source/WebCore/rendering/EllipsisBox.cpp
+++ b/Source/WebCore/rendering/EllipsisBox.cpp
@@ -53,7 +53,7 @@ void EllipsisBox::paint(PaintInfo& paintInfo, int tx, int ty)
     }
 
     const String& str = m_str;
-    context->drawText(style->font(), TextRun(str.characters(), str.length(), false, 0, 0, false, style->visuallyOrdered()), IntPoint(m_x + tx, m_y + ty + style->font().ascent()));
+    context->drawText(style->font(), TextRun(str.characters(), str.length(), false, 0, 0, TextRun::AllowTrailingExpansion, false, style->visuallyOrdered()), IntPoint(m_x + tx, m_y + ty + style->fontMetrics().ascent()));
 
     // Restore the regular fill color.
     if (textColor != context->fillColor())
@@ -65,7 +65,7 @@ void EllipsisBox::paint(PaintInfo& paintInfo, int tx, int ty)
     if (m_markupBox) {
         // Paint the markup box
         tx += m_x + m_logicalWidth - m_markupBox->x();
-        ty += m_y + style->font().ascent() - (m_markupBox->y() + m_markupBox->renderer()->style(m_firstLine)->font().ascent());
+        ty += m_y + style->fontMetrics().ascent() - (m_markupBox->y() + m_markupBox->renderer()->style(m_firstLine)->fontMetrics().ascent());
         m_markupBox->paint(paintInfo, tx, ty);
     }
 }
@@ -74,7 +74,7 @@ IntRect EllipsisBox::selectionRect(int tx, int ty)
 {
     RenderStyle* style = m_renderer->style(m_firstLine);
     const Font& f = style->font();
-    return enclosingIntRect(f.selectionRectForText(TextRun(m_str.characters(), m_str.length(), false, 0, 0, false, style->visuallyOrdered()),
+    return enclosingIntRect(f.selectionRectForText(TextRun(m_str.characters(), m_str.length(), false, 0, 0, TextRun::AllowTrailingExpansion, false, style->visuallyOrdered()),
             IntPoint(m_x + tx, m_y + ty + root()->selectionTop()), root()->selectionHeight()));
 }
 
@@ -94,7 +94,7 @@ void EllipsisBox::paintSelection(GraphicsContext* context, int tx, int ty, Rende
     int y = root()->selectionTop();
     int h = root()->selectionHeight();
     context->clip(IntRect(m_x + tx, y + ty, m_logicalWidth, h));
-    context->drawHighlightForText(font, TextRun(m_str.characters(), m_str.length(), false, 0, 0, false, style->visuallyOrdered()),
+    context->drawHighlightForText(font, TextRun(m_str.characters(), m_str.length(), false, 0, 0, TextRun::AllowTrailingExpansion, false, style->visuallyOrdered()),
         IntPoint(m_x + tx, m_y + ty + y), h, c, style->colorSpace());
     context->restore();
 }
@@ -108,7 +108,7 @@ bool EllipsisBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
     if (m_markupBox) {
         RenderStyle* style = m_renderer->style(m_firstLine);
         int mtx = tx + m_logicalWidth - m_markupBox->x();
-        int mty = ty + style->font().ascent() - (m_markupBox->y() + m_markupBox->renderer()->style(m_firstLine)->font().ascent());
+        int mty = ty + style->fontMetrics().ascent() - (m_markupBox->y() + m_markupBox->renderer()->style(m_firstLine)->fontMetrics().ascent());
         if (m_markupBox->nodeAtPoint(request, result, x, y, mtx, mty)) {
             renderer()->updateHitTestResult(result, IntPoint(x - mtx, y - mty));
             return true;
diff --git a/Source/WebCore/rendering/InlineBox.cpp b/Source/WebCore/rendering/InlineBox.cpp
index bbf5a748..4fcbe2d 100644
--- a/Source/WebCore/rendering/InlineBox.cpp
+++ b/Source/WebCore/rendering/InlineBox.cpp
@@ -94,14 +94,14 @@ int InlineBox::logicalHeight() const
 #endif
     
     if (renderer()->isText())
-        return m_isText ? renderer()->style(m_firstLine)->font().height() : 0;
+        return m_isText ? renderer()->style(m_firstLine)->fontMetrics().height() : 0;
     if (renderer()->isBox() && parent())
         return isHorizontal() ? toRenderBox(m_renderer)->height() : toRenderBox(m_renderer)->width();
 
     ASSERT(isInlineFlowBox());
     RenderBoxModelObject* flowObject = boxModelObject();
-    const Font& font = renderer()->style(m_firstLine)->font();
-    int result = font.height();
+    const FontMetrics& fontMetrics = renderer()->style(m_firstLine)->fontMetrics();
+    int result = fontMetrics.height();
     if (parent())
         result += flowObject->borderAndPaddingLogicalHeight();
     return result;
diff --git a/Source/WebCore/rendering/InlineBox.h b/Source/WebCore/rendering/InlineBox.h
index 5b3f682..d486ec0 100644
--- a/Source/WebCore/rendering/InlineBox.h
+++ b/Source/WebCore/rendering/InlineBox.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -61,7 +61,7 @@ public:
         , m_determinedIfPrevOnLineExists(false)
         , m_nextOnLineExists(false)
         , m_prevOnLineExists(false)
-        , m_toAdd(0)
+        , m_expansion(0)
 #ifndef NDEBUG
         , m_hasBadParent(false)
 #endif
@@ -95,7 +95,7 @@ public:
         , m_determinedIfPrevOnLineExists(false)
         , m_nextOnLineExists(false)
         , m_prevOnLineExists(false)
-        , m_toAdd(0)
+        , m_expansion(0)
 #ifndef NDEBUG
         , m_hasBadParent(false)
 #endif
@@ -290,7 +290,7 @@ public:
 
     void setHasBadParent();
 
-    int toAdd() const { return m_toAdd; }
+    int expansion() const { return m_expansion; }
     
     bool visibleToHitTesting() const { return renderer()->style()->visibility() == VISIBLE && renderer()->style()->pointerEvents() != PE_NONE; }
     
@@ -348,7 +348,7 @@ protected:
     mutable bool m_determinedIfPrevOnLineExists : 1;
     mutable bool m_nextOnLineExists : 1;
     mutable bool m_prevOnLineExists : 1;
-    int m_toAdd : 11; // for justified text
+    int m_expansion : 11; // for justified text
 
 #ifndef NDEBUG
 private:
diff --git a/Source/WebCore/rendering/InlineFlowBox.cpp b/Source/WebCore/rendering/InlineFlowBox.cpp
index 75b23c5..aa9fcb5 100644
--- a/Source/WebCore/rendering/InlineFlowBox.cpp
+++ b/Source/WebCore/rendering/InlineFlowBox.cpp
@@ -408,6 +408,7 @@ static int verticalPositionForBox(InlineBox* box, FontBaseline baselineType, boo
         
         if (verticalAlign != BASELINE) {
             const Font& font = parent->style(firstLine)->font();
+            const FontMetrics& fontMetrics = font.fontMetrics();
             int fontSize = font.pixelSize();
 
             LineDirectionMode lineDirection = parent->style()->isHorizontalWritingMode() ? HorizontalLine : VerticalLine;
@@ -417,11 +418,11 @@ static int verticalPositionForBox(InlineBox* box, FontBaseline baselineType, boo
             else if (verticalAlign == SUPER)
                 verticalPosition -= fontSize / 3 + 1;
             else if (verticalAlign == TEXT_TOP)
-                verticalPosition += renderer->baselinePosition(baselineType, firstLine, lineDirection) - font.ascent(baselineType);
+                verticalPosition += renderer->baselinePosition(baselineType, firstLine, lineDirection) - fontMetrics.ascent(baselineType);
             else if (verticalAlign == MIDDLE)
-                verticalPosition += -static_cast<int>(font.xHeight() / 2) - renderer->lineHeight(firstLine, lineDirection) / 2 + renderer->baselinePosition(baselineType, firstLine, lineDirection);
+                verticalPosition += -static_cast<int>(fontMetrics.xHeight() / 2) - renderer->lineHeight(firstLine, lineDirection) / 2 + renderer->baselinePosition(baselineType, firstLine, lineDirection);
             else if (verticalAlign == TEXT_BOTTOM) {
-                verticalPosition += font.descent(baselineType);
+                verticalPosition += fontMetrics.descent(baselineType);
                 // lineHeight - baselinePosition is always 0 for replaced elements (except inline blocks), so don't bother wasting time in that case.
                 if (!renderer->isReplaced() || renderer->isInlineBlockOrInlineTable())
                     verticalPosition -= (renderer->lineHeight(firstLine, lineDirection) - renderer->baselinePosition(baselineType, firstLine, lineDirection));
@@ -503,9 +504,10 @@ void InlineFlowBox::computeLogicalBoxHeights(int& maxPositionTop, int& maxPositi
             baseline = 0;
             int baselineToBottom = 0;
             for (size_t i = 0; i < usedFonts->size(); ++i) {
-                int halfLeading = (usedFonts->at(i)->lineSpacing() - usedFonts->at(i)->height()) / 2;
-                int usedFontBaseline = halfLeading + usedFonts->at(i)->ascent(baselineType);
-                int usedFontBaselineToBottom = usedFonts->at(i)->lineSpacing() - usedFontBaseline;
+                const FontMetrics& fontMetrics = usedFonts->at(i)->fontMetrics();
+                int halfLeading = (fontMetrics.lineSpacing() - fontMetrics.height()) / 2;
+                int usedFontBaseline = halfLeading + fontMetrics.ascent(baselineType);
+                int usedFontBaselineToBottom = fontMetrics.lineSpacing() - usedFontBaseline;
                 if (!baselineSet) {
                     baselineSet = true;
                     baseline = usedFontBaseline;
@@ -515,9 +517,9 @@ void InlineFlowBox::computeLogicalBoxHeights(int& maxPositionTop, int& maxPositi
                     baselineToBottom = max(baselineToBottom, usedFontBaselineToBottom);
                 }
                 if (!affectsAscent)
-                    affectsAscent = usedFonts->at(i)->ascent() - curr->logicalTop() > 0;
+                    affectsAscent = fontMetrics.ascent() - curr->logicalTop() > 0;
                 if (!affectsDescent)
-                    affectsDescent = usedFonts->at(i)->descent() + curr->logicalTop() > 0;
+                    affectsDescent = fontMetrics.descent() + curr->logicalTop() > 0;
             }
             lineHeight = baseline + baselineToBottom;
         } else {
@@ -527,11 +529,12 @@ void InlineFlowBox::computeLogicalBoxHeights(int& maxPositionTop, int& maxPositi
                 // Examine the font box for inline flows and text boxes to see if any part of it is above the baseline.
                 // If the top of our font box relative to the root box baseline is above the root box baseline, then
                 // we are contributing to the maxAscent value.
-                affectsAscent = curr->renderer()->style(m_firstLine)->font().ascent(baselineType) - curr->logicalTop() > 0;
+                const FontMetrics& fontMetrics = curr->renderer()->style(m_firstLine)->fontMetrics();
+                affectsAscent = fontMetrics.ascent(baselineType) - curr->logicalTop() > 0;
                 
                 // Descent is similar.  If any part of our font box is below the root box's baseline, then
                 // we contribute to the maxDescent value.
-                affectsDescent = curr->renderer()->style(m_firstLine)->font().descent(baselineType) + curr->logicalTop() > 0;
+                affectsDescent = fontMetrics.descent(baselineType) + curr->logicalTop() > 0;
             } else {
                 // Replaced elements always affect both the ascent and descent.
                 affectsAscent = true;
@@ -601,13 +604,13 @@ void InlineFlowBox::placeBoxesInBlockDirection(int top, int maxHeight, int maxAs
         }
         
         int newLogicalTop = curr->logicalTop();
-        int newLogicalTopIncludingMargins;
+        int newLogicalTopIncludingMargins = newLogicalTop;
         int boxHeight = curr->logicalHeight();
         int boxHeightIncludingMargins = boxHeight;
             
         if (curr->isText() || curr->isInlineFlowBox()) {
-            const Font& font = curr->renderer()->style(m_firstLine)->font();
-            newLogicalTop += curr->baselinePosition(baselineType) - font.ascent(baselineType);
+            const FontMetrics& fontMetrics = curr->renderer()->style(m_firstLine)->fontMetrics();
+            newLogicalTop += curr->baselinePosition(baselineType) - fontMetrics.ascent(baselineType);
             if (curr->isInlineFlowBox()) {
                 RenderBoxModelObject* boxObject = toRenderBoxModelObject(curr->renderer());
                 newLogicalTop -= boxObject->style(m_firstLine)->isHorizontalWritingMode() ? boxObject->borderTop() + boxObject->paddingTop() : 
@@ -668,8 +671,8 @@ void InlineFlowBox::placeBoxesInBlockDirection(int top, int maxHeight, int maxAs
     }
 
     if (isRootInlineBox()) {
-        const Font& font = renderer()->style(m_firstLine)->font();
-        setLogicalTop(logicalTop() + baselinePosition(baselineType) - font.ascent(baselineType));
+        const FontMetrics& fontMetrics = renderer()->style(m_firstLine)->fontMetrics();
+        setLogicalTop(logicalTop() + baselinePosition(baselineType) - fontMetrics.ascent(baselineType));
         
         if (hasTextChildren() || strictMode) {
             if (!setLineTop) {
@@ -715,14 +718,14 @@ void InlineFlowBox::addBoxShadowVisualOverflow(IntRect& logicalVisualOverflow)
     renderer()->style(m_firstLine)->getBoxShadowBlockDirectionExtent(boxShadowLogicalTop, boxShadowLogicalBottom);
     
     int logicalTopVisualOverflow = min(logicalTop() + boxShadowLogicalTop, logicalVisualOverflow.y());
-    int logicalBottomVisualOverflow = max(logicalBottom() + boxShadowLogicalBottom, logicalVisualOverflow.bottom());
+    int logicalBottomVisualOverflow = max(logicalBottom() + boxShadowLogicalBottom, logicalVisualOverflow.maxY());
     
     int boxShadowLogicalLeft;
     int boxShadowLogicalRight;
     renderer()->style(m_firstLine)->getBoxShadowInlineDirectionExtent(boxShadowLogicalLeft, boxShadowLogicalRight);
 
     int logicalLeftVisualOverflow = min(logicalLeft() + boxShadowLogicalLeft, logicalVisualOverflow.x());
-    int logicalRightVisualOverflow = max(logicalRight() + boxShadowLogicalRight, logicalVisualOverflow.right());
+    int logicalRightVisualOverflow = max(logicalRight() + boxShadowLogicalRight, logicalVisualOverflow.maxX());
     
     logicalVisualOverflow = IntRect(logicalLeftVisualOverflow, logicalTopVisualOverflow,
                                     logicalRightVisualOverflow - logicalLeftVisualOverflow, logicalBottomVisualOverflow - logicalTopVisualOverflow);
@@ -777,9 +780,9 @@ void InlineFlowBox::addTextBoxVisualOverflow(const InlineTextBox* textBox, Glyph
     int childOverflowLogicalRight = max(textShadowLogicalRight + rightGlyphOverflow, rightGlyphOverflow);
 
     int logicalTopVisualOverflow = min(textBox->logicalTop() + childOverflowLogicalTop, logicalVisualOverflow.y());
-    int logicalBottomVisualOverflow = max(textBox->logicalBottom() + childOverflowLogicalBottom, logicalVisualOverflow.bottom());
+    int logicalBottomVisualOverflow = max(textBox->logicalBottom() + childOverflowLogicalBottom, logicalVisualOverflow.maxY());
     int logicalLeftVisualOverflow = min(textBox->logicalLeft() + childOverflowLogicalLeft, logicalVisualOverflow.x());
-    int logicalRightVisualOverflow = max(textBox->logicalRight() + childOverflowLogicalRight, logicalVisualOverflow.right());
+    int logicalRightVisualOverflow = max(textBox->logicalRight() + childOverflowLogicalRight, logicalVisualOverflow.maxX());
     
     logicalVisualOverflow = IntRect(logicalLeftVisualOverflow, logicalTopVisualOverflow,
                                     logicalRightVisualOverflow - logicalLeftVisualOverflow, logicalBottomVisualOverflow - logicalTopVisualOverflow);
@@ -1005,14 +1008,21 @@ void InlineFlowBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, c
         // strip.  Even though that strip has been broken up across multiple lines, you still paint it
         // as though you had one single line.  This means each line has to pick up the background where
         // the previous line left off.
-        // FIXME: What the heck do we do with RTL here? The math we're using is obviously not right,
-        // but it isn't even clear how this should work at all.
         int logicalOffsetOnLine = 0;
-        for (InlineFlowBox* curr = prevLineBox(); curr; curr = curr->prevLineBox())
-            logicalOffsetOnLine += curr->logicalWidth();
-        int totalLogicalWidth = logicalOffsetOnLine;
-        for (InlineFlowBox* curr = this; curr; curr = curr->nextLineBox())
-            totalLogicalWidth += curr->logicalWidth();
+        int totalLogicalWidth;
+        if (renderer()->style()->direction() == LTR) {
+            for (InlineFlowBox* curr = prevLineBox(); curr; curr = curr->prevLineBox())
+                logicalOffsetOnLine += curr->logicalWidth();
+            totalLogicalWidth = logicalOffsetOnLine;
+            for (InlineFlowBox* curr = this; curr; curr = curr->nextLineBox())
+                totalLogicalWidth += curr->logicalWidth();
+        } else {
+            for (InlineFlowBox* curr = nextLineBox(); curr; curr = curr->nextLineBox())
+                logicalOffsetOnLine += curr->logicalWidth();
+            totalLogicalWidth = logicalOffsetOnLine;
+            for (InlineFlowBox* curr = this; curr; curr = curr->prevLineBox())
+                totalLogicalWidth += curr->logicalWidth();
+        }
         int stripX = tx - (isHorizontal() ? logicalOffsetOnLine : 0);
         int stripY = ty - (isHorizontal() ? 0 : logicalOffsetOnLine);
         int stripWidth = isHorizontal() ? totalLogicalWidth : width();
diff --git a/Source/WebCore/rendering/InlineFlowBox.h b/Source/WebCore/rendering/InlineFlowBox.h
index 232c3b7..d47111f8 100644
--- a/Source/WebCore/rendering/InlineFlowBox.h
+++ b/Source/WebCore/rendering/InlineFlowBox.h
@@ -183,19 +183,18 @@ public:
     void checkConsistency() const;
     void setHasBadChildList();
 
-    // Line visual and layout overflow are in the coordinate space of the block.  This means that - unlike other unprefixed uses of the words
-    // top/right/bottom/left in the code - these aren't purely physical directions.  For horizontal-tb and vertical-lr they will match physical
-    // directions, but for horizontal-bt and vertical-rl, the top/bottom and left/right respectively are inverted when compared to
-    // their physical counterparts.
-    int topLayoutOverflow() const { return m_overflow ? m_overflow->topLayoutOverflow() : m_y; }
-    int bottomLayoutOverflow() const { return m_overflow ? m_overflow->bottomLayoutOverflow() : m_y + height(); }
-    int leftLayoutOverflow() const { return m_overflow ? m_overflow->leftLayoutOverflow() : m_x; }
-    int rightLayoutOverflow() const { return m_overflow ? m_overflow->rightLayoutOverflow() : m_x + width(); }
+    // Line visual and layout overflow are in the coordinate space of the block.  This means that they aren't purely physical directions.
+    // For horizontal-tb and vertical-lr they will match physical directions, but for horizontal-bt and vertical-rl, the top/bottom and left/right
+    // respectively are flipped when compared to their physical counterparts.  For example minX is on the left in vertical-lr, but it is on the right in vertical-rl.
+    int minYLayoutOverflow() const { return m_overflow ? m_overflow->minYLayoutOverflow() : m_y; }
+    int maxYLayoutOverflow() const { return m_overflow ? m_overflow->maxYLayoutOverflow() : m_y + height(); }
+    int minXLayoutOverflow() const { return m_overflow ? m_overflow->minXLayoutOverflow() : m_x; }
+    int maxXLayoutOverflow() const { return m_overflow ? m_overflow->maxXLayoutOverflow() : m_x + width(); }
     IntRect layoutOverflowRect() const { return m_overflow ? m_overflow->layoutOverflowRect() : IntRect(m_x, m_y, width(), height()); }
-    int logicalLeftLayoutOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? leftLayoutOverflow() : topLayoutOverflow(); }
-    int logicalRightLayoutOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? rightLayoutOverflow() : bottomLayoutOverflow(); }
-    int logicalTopLayoutOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? topVisualOverflow() : leftVisualOverflow(); }
-    int logicalBottomLayoutOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? bottomLayoutOverflow() : rightLayoutOverflow(); }
+    int logicalLeftLayoutOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? minXLayoutOverflow() : minYLayoutOverflow(); }
+    int logicalRightLayoutOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? maxXLayoutOverflow() : maxYLayoutOverflow(); }
+    int logicalTopLayoutOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? minYVisualOverflow() : minXVisualOverflow(); }
+    int logicalBottomLayoutOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? maxYLayoutOverflow() : maxXLayoutOverflow(); }
     IntRect logicalLayoutOverflowRect() const
     {
         IntRect result = layoutOverflowRect();
@@ -204,15 +203,15 @@ public:
         return result;
     }
 
-    int topVisualOverflow() const { return m_overflow ? m_overflow->topVisualOverflow() : m_y; }
-    int bottomVisualOverflow() const { return m_overflow ? m_overflow->bottomVisualOverflow() : m_y + height(); }
-    int leftVisualOverflow() const { return m_overflow ? m_overflow->leftVisualOverflow() : m_x; }
-    int rightVisualOverflow() const { return m_overflow ? m_overflow->rightVisualOverflow() : m_x + width(); }
+    int minYVisualOverflow() const { return m_overflow ? m_overflow->minYVisualOverflow() : m_y; }
+    int maxYVisualOverflow() const { return m_overflow ? m_overflow->maxYVisualOverflow() : m_y + height(); }
+    int minXVisualOverflow() const { return m_overflow ? m_overflow->minXVisualOverflow() : m_x; }
+    int maxXVisualOverflow() const { return m_overflow ? m_overflow->maxXVisualOverflow() : m_x + width(); }
     IntRect visualOverflowRect() const { return m_overflow ? m_overflow->visualOverflowRect() : IntRect(m_x, m_y, width(), height()); }
-    int logicalLeftVisualOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? leftVisualOverflow() : topVisualOverflow(); }
-    int logicalRightVisualOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? rightVisualOverflow() : bottomVisualOverflow(); }
-    int logicalTopVisualOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? topVisualOverflow() : leftVisualOverflow(); }
-    int logicalBottomVisualOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? bottomVisualOverflow() : rightVisualOverflow(); }
+    int logicalLeftVisualOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? minXVisualOverflow() : minYVisualOverflow(); }
+    int logicalRightVisualOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? maxXVisualOverflow() : maxYVisualOverflow(); }
+    int logicalTopVisualOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? minYVisualOverflow() : minXVisualOverflow(); }
+    int logicalBottomVisualOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? maxYVisualOverflow() : maxXVisualOverflow(); }
     IntRect logicalVisualOverflowRect() const
     {
         IntRect result = visualOverflowRect();
diff --git a/Source/WebCore/rendering/InlineTextBox.cpp b/Source/WebCore/rendering/InlineTextBox.cpp
index 8992964..9f7e024 100644
--- a/Source/WebCore/rendering/InlineTextBox.cpp
+++ b/Source/WebCore/rendering/InlineTextBox.cpp
@@ -1,7 +1,7 @@
 /*
  * (C) 1999 Lars Knoll (knoll@kde.org)
  * (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -36,11 +36,11 @@
 #include "PaintInfo.h"
 #include "RenderArena.h"
 #include "RenderBlock.h"
+#include "RenderCombineText.h"
 #include "RenderRubyRun.h"
 #include "RenderRubyText.h"
 #include "RenderTheme.h"
 #include "Text.h"
-#include "TextRun.h"
 #include "break_lines.h"
 #include <wtf/AlwaysInline.h>
 
@@ -163,6 +163,7 @@ IntRect InlineTextBox::selectionRect(int tx, int ty, int startPos, int endPos)
         ePos = len;
     }
 
+<<<<<<< HEAD
 #ifdef ANDROID_DISABLE_ROUNDING_HACKS
     TextRun textRun = TextRun(characters, len, textObj->allowTabs(), textPos(), m_toAdd, !isLeftToRightDirection(), m_dirOverride);
     if (m_disableRoundingHacks)
@@ -170,13 +171,16 @@ IntRect InlineTextBox::selectionRect(int tx, int ty, int startPos, int endPos)
     IntRect r = enclosingIntRect(f.selectionRectForText(textRun, IntPoint(), selHeight, sPos, ePos));
 #else
     IntRect r = enclosingIntRect(f.selectionRectForText(TextRun(characters, len, textObj->allowTabs(), textPos(), m_toAdd, !isLeftToRightDirection(), m_dirOverride),
+=======
+    IntRect r = enclosingIntRect(f.selectionRectForText(TextRun(characters, len, textObj->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), !isLeftToRightDirection(), m_dirOverride),
+>>>>>>> webkit.org at r78450
                                                         IntPoint(), selHeight, sPos, ePos));
 #endif
                                                         
     int logicalWidth = r.width();
     if (r.x() > m_logicalWidth)
         logicalWidth  = 0;
-    else if (r.right() > m_logicalWidth)
+    else if (r.maxX() > m_logicalWidth)
         logicalWidth = m_logicalWidth - r.x();
     
     IntPoint topPoint = isHorizontal() ? IntPoint(tx + m_x + r.x(), ty + selTop) : IntPoint(tx + selTop, ty + m_y + r.x());
@@ -449,7 +453,7 @@ void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
     int logicalStart = logicalLeft() - logicalLeftOverflow + (isHorizontal() ? tx : ty);
     int logicalExtent = logicalWidth() + logicalLeftOverflow + logicalRightOverflow;
     
-    int paintEnd = isHorizontal() ? paintInfo.rect.right() : paintInfo.rect.bottom();
+    int paintEnd = isHorizontal() ? paintInfo.rect.maxX() : paintInfo.rect.maxY();
     int paintStart = isHorizontal() ? paintInfo.rect.x() : paintInfo.rect.y();
     
     if (logicalStart >= paintEnd || logicalStart + logicalExtent <= paintStart)
@@ -492,13 +496,15 @@ void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
     IntPoint boxOrigin = locationIncludingFlipping();
     boxOrigin.move(tx, ty);    
     IntRect boxRect(boxOrigin, IntSize(logicalWidth(), logicalHeight()));
-    IntPoint textOrigin = IntPoint(boxOrigin.x(), boxOrigin.y() + styleToUse->font().ascent());
+    IntPoint textOrigin = IntPoint(boxOrigin.x(), boxOrigin.y() + styleToUse->fontMetrics().ascent());
 
-    if (!isHorizontal()) {
+    RenderCombineText* combinedText = styleToUse->hasTextCombine() ? toRenderCombineText(textRenderer()) : 0;
+    bool shouldRotate = !isHorizontal() && (!combinedText || !combinedText->isCombined());
+    if (shouldRotate) {
         context->save();
-        context->translate(boxRect.x(), boxRect.bottom());
+        context->translate(boxRect.x(), boxRect.maxY());
         context->rotate(static_cast<float>(deg2rad(90.)));
-        context->translate(-boxRect.x(), -boxRect.bottom());
+        context->translate(-boxRect.x(), -boxRect.maxY());
     }
     
     
@@ -510,6 +516,9 @@ void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
     int d = styleToUse->textDecorationsInEffect();
     const Font& font = styleToUse->font();
 
+    if (combinedText)
+        combinedText->adjustTextOrigin(textOrigin, boxRect);
+
     // 1. Paint backgrounds behind text if needed. Examples of such backgrounds include selection
     // and composition underlines.
     if (paintInfo.phase != PaintPhaseSelection && paintInfo.phase != PaintPhaseTextClip && !isPrinting) {
@@ -609,17 +618,26 @@ void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
         }
     }
 
-    const UChar* characters = textRenderer()->text()->characters() + m_start;
     int length = m_len;
+    const UChar* characters;
+    if (!combinedText)
+        characters = textRenderer()->text()->characters() + m_start;
+    else
+        combinedText->charactersToRender(m_start, characters, length);
+
     BufferForAppendingHyphen charactersWithHyphen;
     if (hasHyphen())
         adjustCharactersAndLengthForHyphen(charactersWithHyphen, styleToUse, characters, length);
 
+<<<<<<< HEAD
     TextRun textRun(characters, length, textRenderer()->allowTabs(), textPos(), m_toAdd, !isLeftToRightDirection(), m_dirOverride || styleToUse->visuallyOrdered());
 #ifdef ANDROID_DISABLE_ROUNDING_HACKS
     if (m_disableRoundingHacks)
         textRun.disableRoundingHacks();
 #endif
+=======
+    TextRun textRun(characters, length, textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), !isLeftToRightDirection(), m_dirOverride || styleToUse->visuallyOrdered());
+>>>>>>> webkit.org at r78450
 
     int sPos = 0;
     int ePos = 0;
@@ -637,7 +655,7 @@ void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
     bool hasTextEmphasis = getEmphasisMarkPosition(styleToUse, emphasisMarkPosition);
     const AtomicString& emphasisMark = hasTextEmphasis ? styleToUse->textEmphasisMarkString() : nullAtom;
     if (!emphasisMark.isEmpty())
-        emphasisMarkOffset = emphasisMarkPosition == TextEmphasisPositionOver ? -font.ascent() - font.emphasisMarkDescent(emphasisMark) : font.descent() + font.emphasisMarkAscent(emphasisMark);
+        emphasisMarkOffset = emphasisMarkPosition == TextEmphasisPositionOver ? -font.fontMetrics().ascent() - font.emphasisMarkDescent(emphasisMark) : font.fontMetrics().descent() + font.emphasisMarkAscent(emphasisMark);
 
     if (!paintSelectedTextOnly) {
         // For stroked painting, we have to change the text drawing mode.  It's probably dangerous to leave that mutated as a side
@@ -715,7 +733,7 @@ void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
         }
     }
     
-    if (!isHorizontal())
+    if (shouldRotate)
         context->restore();
 }
 
@@ -773,6 +791,7 @@ void InlineTextBox::paintSelection(GraphicsContext* context, const IntPoint& box
     int selHeight = selectionHeight();
     IntPoint localOrigin(boxOrigin.x(), boxOrigin.y() - deltaY);
     context->clip(IntRect(localOrigin, IntSize(m_logicalWidth, selHeight)));
+<<<<<<< HEAD
 #ifdef ANDROID_DISABLE_ROUNDING_HACKS
     TextRun textRun = TextRun(characters, length, textRenderer()->allowTabs(), textPos(), m_toAdd,
                               !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
@@ -781,6 +800,9 @@ void InlineTextBox::paintSelection(GraphicsContext* context, const IntPoint& box
     context->drawHighlightForText(font, textRun, localOrigin, selHeight, c, style->colorSpace(), sPos, ePos);
 #else
     context->drawHighlightForText(font, TextRun(characters, length, textRenderer()->allowTabs(), textPos(), m_toAdd, 
+=======
+    context->drawHighlightForText(font, TextRun(characters, length, textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), 
+>>>>>>> webkit.org at r78450
                                   !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered()),
                                   localOrigin, selHeight, c, style->colorSpace(), sPos, ePos);
 #endif
@@ -805,6 +827,7 @@ void InlineTextBox::paintCompositionBackground(GraphicsContext* context, const I
     int deltaY = renderer()->style()->isFlippedLinesWritingMode() ? selectionBottom() - logicalBottom() : logicalTop() - selectionTop();
     int selHeight = selectionHeight();
     IntPoint localOrigin(boxOrigin.x(), boxOrigin.y() - deltaY);
+<<<<<<< HEAD
 #ifdef ANDROID_DISABLE_ROUNDING_HACKS
     TextRun textRun = TextRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd,
                               !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
@@ -813,6 +836,9 @@ void InlineTextBox::paintCompositionBackground(GraphicsContext* context, const I
     context->drawHighlightForText(font, textRun, localOrigin, selHeight, c, style->colorSpace(), sPos, ePos);
 #else
     context->drawHighlightForText(font, TextRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd,
+=======
+    context->drawHighlightForText(font, TextRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(),
+>>>>>>> webkit.org at r78450
                                   !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered()),
                                   localOrigin, selHeight, c, style->colorSpace(), sPos, ePos);
 #endif
@@ -864,7 +890,7 @@ void InlineTextBox::paintDecoration(GraphicsContext* context, const IntPoint& bo
     bool linesAreOpaque = !isPrinting && (!(deco & UNDERLINE) || underline.alpha() == 255) && (!(deco & OVERLINE) || overline.alpha() == 255) && (!(deco & LINE_THROUGH) || linethrough.alpha() == 255);
 
     RenderStyle* styleToUse = renderer()->style(m_firstLine);
-    int baseline = styleToUse->font().ascent();
+    int baseline = styleToUse->fontMetrics().ascent();
 
     bool setClip = false;
     int extraOffset = 0;
@@ -975,11 +1001,15 @@ void InlineTextBox::paintSpellingOrGrammarMarker(GraphicsContext* pt, const IntP
         int deltaY = renderer()->style()->isFlippedLinesWritingMode() ? selectionBottom() - logicalBottom() : logicalTop() - selectionTop();
         int selHeight = selectionHeight();
         IntPoint startPoint(boxOrigin.x(), boxOrigin.y() - deltaY);
+<<<<<<< HEAD
         TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
 #ifdef ANDROID_DISABLE_ROUNDING_HACKS
     if (m_disableRoundingHacks)
         run.disableRoundingHacks();
 #endif
+=======
+        TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
+>>>>>>> webkit.org at r78450
          
         IntRect markerRect = enclosingIntRect(font.selectionRectForText(run, startPoint, selHeight, startPosition, endPosition));
         start = markerRect.x() - startPoint.x();
@@ -1001,7 +1031,7 @@ void InlineTextBox::paintSpellingOrGrammarMarker(GraphicsContext* pt, const IntP
     // So, we generally place the underline at the bottom of the text, but in larger fonts that's not so good so
     // we pin to two pixels under the baseline.
     int lineThickness = cMisspellingLineThickness;
-    int baseline = renderer()->style(m_firstLine)->font().ascent();
+    int baseline = renderer()->style(m_firstLine)->fontMetrics().ascent();
     int descent = logicalHeight() - baseline;
     int underlineOffset;
     if (descent <= (2 + lineThickness)) {
@@ -1023,11 +1053,15 @@ void InlineTextBox::paintTextMatchMarker(GraphicsContext* pt, const IntPoint& bo
 
     int sPos = max(marker.startOffset - m_start, (unsigned)0);
     int ePos = min(marker.endOffset - m_start, (unsigned)m_len);    
+<<<<<<< HEAD
     TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
 #ifdef ANDROID_DISABLE_ROUNDING_HACKS
     if (m_disableRoundingHacks)
         run.disableRoundingHacks();
 #endif
+=======
+    TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
+>>>>>>> webkit.org at r78450
     
     // Always compute and store the rect associated with this marker. The computed rect is in absolute coordinates.
     IntRect markerRect = enclosingIntRect(font.selectionRectForText(run, IntPoint(m_x, selectionTop()), selHeight, sPos, ePos));
@@ -1055,11 +1089,15 @@ void InlineTextBox::computeRectForReplacementMarker(const DocumentMarker& marker
     
     int sPos = max(marker.startOffset - m_start, (unsigned)0);
     int ePos = min(marker.endOffset - m_start, (unsigned)m_len);    
+<<<<<<< HEAD
     TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
 #ifdef ANDROID_DISABLE_ROUNDING_HACKS
     if (m_disableRoundingHacks)
         run.disableRoundingHacks();
 #endif
+=======
+    TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
+>>>>>>> webkit.org at r78450
     IntPoint startPoint = IntPoint(m_x, y);
     
     // Compute and store the rect associated with this marker.
@@ -1085,9 +1123,7 @@ void InlineTextBox::paintDocumentMarkers(GraphicsContext* pt, const IntPoint& bo
         switch (marker.type) {
             case DocumentMarker::Grammar:
             case DocumentMarker::Spelling:
-            case DocumentMarker::Replacement:
             case DocumentMarker::CorrectionIndicator:
-            case DocumentMarker::RejectedCorrection:
                 if (background)
                     continue;
                 break;
@@ -1095,9 +1131,8 @@ void InlineTextBox::paintDocumentMarkers(GraphicsContext* pt, const IntPoint& bo
                 if (!background)
                     continue;
                 break;
-            
             default:
-                ASSERT_NOT_REACHED();
+                continue;
         }
 
         if (marker.endOffset <= start())
@@ -1124,9 +1159,6 @@ void InlineTextBox::paintDocumentMarkers(GraphicsContext* pt, const IntPoint& bo
                 computeRectForReplacementMarker(marker, style, font);
                 paintSpellingOrGrammarMarker(pt, boxOrigin, marker, style, font, false);
                 break;
-            case DocumentMarker::Replacement:
-            case DocumentMarker::RejectedCorrection:
-                break;
             default:
                 ASSERT_NOT_REACHED();
         }
@@ -1166,7 +1198,7 @@ void InlineTextBox::paintCompositionUnderline(GraphicsContext* ctx, const IntPoi
     // All other marked text underlines are 1px thick.
     // If there's not enough space the underline will touch or overlap characters.
     int lineThickness = 1;
-    int baseline = renderer()->style(m_firstLine)->font().ascent();
+    int baseline = renderer()->style(m_firstLine)->fontMetrics().ascent();
     if (underline.thick && logicalHeight() - baseline >= 2)
         lineThickness = 2;
 
@@ -1230,7 +1262,7 @@ int InlineTextBox::offsetForPosition(int lineOffset, bool includePartialGlyphs)
     int offset = f->offsetForPosition(textRun, lineOffset - logicalLeft(), includePartialGlyphs);
 #else
     int offset = f->offsetForPosition(TextRun(textRenderer()->text()->characters() + m_start, m_len,
-        textRenderer()->allowTabs(), textPos(), m_toAdd, !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered()),
+        textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered()),
         lineOffset - logicalLeft(), includePartialGlyphs);
 #endif
     if (blockIsInOppositeDirection && (!offset || offset == m_len))
@@ -1251,6 +1283,7 @@ int InlineTextBox::positionForOffset(int offset) const
     int from = !isLeftToRightDirection() ? offset - m_start : 0;
     int to = !isLeftToRightDirection() ? m_len : offset - m_start;
     // FIXME: Do we need to add rightBearing here?
+<<<<<<< HEAD
 #ifdef ANDROID_DISABLE_ROUNDING_HACKS
     TextRun textRun = TextRun(text->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, !isLeftToRightDirection(), m_dirOverride);
     if (m_disableRoundingHacks)
@@ -1260,6 +1293,10 @@ int InlineTextBox::positionForOffset(int offset) const
     return enclosingIntRect(f.selectionRectForText(TextRun(text->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, !isLeftToRightDirection(), m_dirOverride),
                                                    IntPoint(logicalLeft(), 0), 0, from, to)).right();
 #endif
+=======
+    return enclosingIntRect(f.selectionRectForText(TextRun(text->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), !isLeftToRightDirection(), m_dirOverride),
+                                                   IntPoint(logicalLeft(), 0), 0, from, to)).maxX();
+>>>>>>> webkit.org at r78450
 }
 
 bool InlineTextBox::containsCaretOffset(int offset) const
diff --git a/Source/WebCore/rendering/InlineTextBox.h b/Source/WebCore/rendering/InlineTextBox.h
index ee75f06..095fa16 100644
--- a/Source/WebCore/rendering/InlineTextBox.h
+++ b/Source/WebCore/rendering/InlineTextBox.h
@@ -1,7 +1,7 @@
 /*
  * (C) 1999 Lars Knoll (knoll@kde.org)
  * (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,6 +25,7 @@
 
 #include "InlineBox.h"
 #include "RenderText.h" // so textRenderer() can be inline
+#include "TextRun.h"
 
 namespace WebCore {
 
@@ -88,7 +89,7 @@ private:
     int selectionHeight();
 
 public:
-    virtual IntRect calculateBoundaries() const { return IntRect(x(), y(), logicalWidth(), logicalHeight()); }
+    virtual IntRect calculateBoundaries() const { return IntRect(x(), y(), width(), height()); }
 
     virtual IntRect selectionRect(int absx, int absy, int startPos, int endPos);
     bool isSelected(int startPos, int endPos) const;
@@ -116,7 +117,7 @@ private:
 public:
     virtual bool isLineBreak() const;
 
-    void setSpaceAdd(int add) { m_logicalWidth -= m_toAdd; m_toAdd = add; m_logicalWidth += m_toAdd; }
+    void setExpansion(int expansion) { m_logicalWidth -= m_expansion; m_expansion = expansion; m_logicalWidth += m_expansion; }
 
 private:
     virtual bool isInlineTextBox() const { return true; }    
@@ -166,6 +167,8 @@ private:
     void paintSpellingOrGrammarMarker(GraphicsContext*, const IntPoint& boxOrigin, const DocumentMarker&, RenderStyle*, const Font&, bool grammar);
     void paintTextMatchMarker(GraphicsContext*, const IntPoint& boxOrigin, const DocumentMarker&, RenderStyle*, const Font&);
     void computeRectForReplacementMarker(const DocumentMarker&, RenderStyle*, const Font&);
+
+    TextRun::TrailingExpansionBehavior trailingExpansionBehavior() const { return m_expansion && nextLeafChild() ? TextRun::AllowTrailingExpansion : TextRun::ForbidTrailingExpansion; }
 };
 
 inline RenderText* InlineTextBox::textRenderer() const
diff --git a/Source/WebCore/rendering/LayoutState.cpp b/Source/WebCore/rendering/LayoutState.cpp
index aeba416..8e4201e 100644
--- a/Source/WebCore/rendering/LayoutState.cpp
+++ b/Source/WebCore/rendering/LayoutState.cpp
@@ -167,11 +167,11 @@ int LayoutState::pageLogicalOffset(int childLogicalOffset) const
     return m_layoutOffset.height() + childLogicalOffset - m_pageOffset.height();
 }
 
-void LayoutState::addForcedColumnBreak(int childY)
+void LayoutState::addForcedColumnBreak(int childLogicalOffset)
 {
     if (!m_columnInfo || m_columnInfo->columnHeight())
         return;
-    m_columnInfo->addForcedBreak(pageLogicalOffset(childY));
+    m_columnInfo->addForcedBreak(pageLogicalOffset(childLogicalOffset));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/LayoutState.h b/Source/WebCore/rendering/LayoutState.h
index c499435..f14c9ff 100644
--- a/Source/WebCore/rendering/LayoutState.h
+++ b/Source/WebCore/rendering/LayoutState.h
@@ -71,7 +71,7 @@ public:
     // direction (so an x-offset in vertical text and a y-offset for horizontal text).
     int pageLogicalOffset(int childLogicalOffset) const;
 
-    void addForcedColumnBreak(int childY);
+    void addForcedColumnBreak(int childLogicalOffset);
     
     bool pageLogicalHeight() const { return m_pageLogicalHeight; }
     bool pageLogicalHeightChanged() const { return m_pageLogicalHeightChanged; }
diff --git a/Source/WebCore/rendering/MediaControlElements.cpp b/Source/WebCore/rendering/MediaControlElements.cpp
index 1f66719..3acce61 100644
--- a/Source/WebCore/rendering/MediaControlElements.cpp
+++ b/Source/WebCore/rendering/MediaControlElements.cpp
@@ -32,11 +32,13 @@
 
 #include "MediaControlElements.h"
 
+#include "CSSStyleSelector.h"
 #include "EventNames.h"
 #include "FloatConversion.h"
 #include "Frame.h"
 #include "HTMLNames.h"
 #include "LocalizedStrings.h"
+#include "MediaControls.h"
 #include "MouseEvent.h"
 #include "Page.h"
 #include "RenderMedia.h"
@@ -88,14 +90,6 @@ PassRefPtr<MediaControlShadowRootElement> MediaControlShadowRootElement::create(
     return element.release();
 }
 
-void MediaControlShadowRootElement::updateStyle()
-{
-    if (renderer()) {
-        RenderStyle* timelineContainerStyle = shadowHost()->renderer()->getCachedPseudoStyle(MEDIA_CONTROLS_TIMELINE_CONTAINER);
-        renderer()->setStyle(timelineContainerStyle);
-    }
-}
-
 void MediaControlShadowRootElement::detach()
 {
     HTMLDivElement::detach();
@@ -105,40 +99,11 @@ void MediaControlShadowRootElement::detach()
 
 // ----------------------------
 
-MediaControlElement::MediaControlElement(HTMLMediaElement* mediaElement, PseudoId pseudo)
+MediaControlElement::MediaControlElement(HTMLMediaElement* mediaElement)
     : HTMLDivElement(divTag, mediaElement->document())
     , m_mediaElement(mediaElement)
-    , m_pseudoStyleId(pseudo)
 {
     setInDocument();
-    switch (pseudo) {
-    case MEDIA_CONTROLS_CURRENT_TIME_DISPLAY:
-        m_displayType = MediaCurrentTimeDisplay;
-        break;
-    case MEDIA_CONTROLS_TIME_REMAINING_DISPLAY:
-        m_displayType = MediaTimeRemainingDisplay;
-        break;
-    case MEDIA_CONTROLS_TIMELINE_CONTAINER:
-        m_displayType = MediaTimelineContainer;
-        break;
-    case MEDIA_CONTROLS_STATUS_DISPLAY:
-        m_displayType = MediaStatusDisplay;
-        break;
-    case MEDIA_CONTROLS_PANEL:
-        m_displayType = MediaControlsPanel;
-        break;
-    case MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER:
-        m_displayType = MediaVolumeSliderContainer;
-        break;
-    default:
-        ASSERT_NOT_REACHED();
-        break;
-    }
-}
-
-PassRefPtr<MediaControlElement> MediaControlElement::create(HTMLMediaElement* mediaElement, PseudoId pseudoStyleId)
-{
-    return adoptRef(new MediaControlElement(mediaElement, pseudoStyleId));
 }
 
 void MediaControlElement::attachToParent(Element* parent)
@@ -157,7 +122,8 @@ void MediaControlElement::update()
 
 PassRefPtr<RenderStyle> MediaControlElement::styleForElement()
 {
-    RenderStyle* style = m_mediaElement->renderer()->getCachedPseudoStyle(m_pseudoStyleId);
+    ASSERT(m_mediaElement->renderer());
+    RefPtr<RenderStyle> style = document()->styleSelector()->styleForElement(this, m_mediaElement->renderer()->style(), true);
     if (!style)
         return 0;
     
@@ -225,8 +191,31 @@ void MediaControlElement::updateStyle()
 
 // ----------------------------
 
+inline MediaControlPanelElement::MediaControlPanelElement(HTMLMediaElement* mediaElement)
+    : MediaControlElement(mediaElement)
+{
+}
+
+PassRefPtr<MediaControlPanelElement> MediaControlPanelElement::create(HTMLMediaElement* mediaElement)
+{
+    return adoptRef(new MediaControlPanelElement(mediaElement));
+}
+
+MediaControlElementType MediaControlPanelElement::displayType() const
+{
+    return MediaControlsPanel;
+}
+
+const AtomicString& MediaControlPanelElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-panel"));
+    return id;
+}
+
+// ----------------------------
+
 inline MediaControlTimelineContainerElement::MediaControlTimelineContainerElement(HTMLMediaElement* mediaElement)
-    : MediaControlElement(mediaElement, MEDIA_CONTROLS_TIMELINE_CONTAINER)
+    : MediaControlElement(mediaElement)
 {
 }
 
@@ -240,20 +229,29 @@ bool MediaControlTimelineContainerElement::rendererIsNeeded(RenderStyle* style)
     if (!MediaControlElement::rendererIsNeeded(style))
         return false;
 
-    // This is for MediaControllerThemeClassic:
-    // If there is no style for MediaControlStatusDisplayElement style, don't hide
-    // the timeline.
-    if (!mediaElement()->renderer()->getCachedPseudoStyle(MEDIA_CONTROLS_STATUS_DISPLAY))
+    // Always show the timeline if the theme doesn't use status display (MediaControllerThemeClassic, for instance).
+    if (!document()->page()->theme()->usesMediaControlStatusDisplay())
         return true;
 
     float duration = mediaElement()->duration();
     return !isnan(duration) && !isinf(duration);
 }
 
+MediaControlElementType MediaControlTimelineContainerElement::displayType() const
+{
+    return MediaTimelineContainer;
+}
+
+const AtomicString& MediaControlTimelineContainerElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-timeline-container"));
+    return id;
+}
+
 // ----------------------------
 
 inline MediaControlVolumeSliderContainerElement::MediaControlVolumeSliderContainerElement(HTMLMediaElement* mediaElement)
-    : MediaControlElement(mediaElement, MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER)
+    : MediaControlElement(mediaElement)
     , m_isVisible(false)
     , m_x(0)
     , m_y(0)
@@ -298,10 +296,21 @@ bool MediaControlVolumeSliderContainerElement::hitTest(const IntPoint& absPoint)
     return false;
 }
 
+MediaControlElementType MediaControlVolumeSliderContainerElement::displayType() const
+{
+    return MediaVolumeSliderContainer;
+}
+
+const AtomicString& MediaControlVolumeSliderContainerElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-volume-slider-container"));
+    return id;
+}
+
 // ----------------------------
 
 inline MediaControlStatusDisplayElement::MediaControlStatusDisplayElement(HTMLMediaElement* mediaElement)
-    : MediaControlElement(mediaElement, MEDIA_CONTROLS_STATUS_DISPLAY)
+    : MediaControlElement(mediaElement)
     , m_stateBeingDisplayed(Nothing)
 {
 }
@@ -344,59 +353,30 @@ void MediaControlStatusDisplayElement::update()
 
 bool MediaControlStatusDisplayElement::rendererIsNeeded(RenderStyle* style)
 {
-    if (!MediaControlElement::rendererIsNeeded(style))
+    if (!MediaControlElement::rendererIsNeeded(style) || !document()->page()->theme()->usesMediaControlStatusDisplay())
         return false;
     float duration = mediaElement()->duration();
     return (isnan(duration) || isinf(duration));
 }
 
+MediaControlElementType MediaControlStatusDisplayElement::displayType() const
+{
+    return MediaStatusDisplay;
+}
+
+const AtomicString& MediaControlStatusDisplayElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-status-display"));
+    return id;
+}
+
 // ----------------------------
     
-MediaControlInputElement::MediaControlInputElement(HTMLMediaElement* mediaElement, PseudoId pseudo)
-    : HTMLInputElement(inputTag, mediaElement->document())
+MediaControlInputElement::MediaControlInputElement(HTMLMediaElement* mediaElement, MediaControlElementType displayType)
+    : HTMLInputElement(inputTag, mediaElement->document(), 0, false)
     , m_mediaElement(mediaElement)
-    , m_pseudoStyleId(pseudo)
+    , m_displayType(displayType)
 {
-    setInDocument();
-
-    switch (pseudo) {
-    case MEDIA_CONTROLS_MUTE_BUTTON:
-        m_displayType = MediaMuteButton;
-        break;
-    case MEDIA_CONTROLS_PLAY_BUTTON:
-        m_displayType = MediaPlayButton;
-        break;
-    case MEDIA_CONTROLS_SEEK_FORWARD_BUTTON:
-        m_displayType = MediaSeekForwardButton;
-        break;
-    case MEDIA_CONTROLS_SEEK_BACK_BUTTON:
-        m_displayType = MediaSeekBackButton;
-        break;
-    case MEDIA_CONTROLS_FULLSCREEN_BUTTON:
-        m_displayType = MediaFullscreenButton;
-        break;
-    case MEDIA_CONTROLS_TIMELINE:
-        m_displayType = MediaSlider;
-        break;
-    case MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON:
-        m_displayType = MediaReturnToRealtimeButton;
-        break;
-    case MEDIA_CONTROLS_REWIND_BUTTON:
-        m_displayType = MediaRewindButton;
-        break;
-    case MEDIA_CONTROLS_VOLUME_SLIDER:
-        m_displayType = MediaVolumeSlider;
-        break;
-    case MEDIA_CONTROLS_VOLUME_SLIDER_MUTE_BUTTON:
-        m_displayType = MediaVolumeSliderMuteButton;
-        break;
-    case MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON:
-        m_displayType = MediaShowClosedCaptionsButton;
-        break;
-    default:
-        ASSERT_NOT_REACHED();
-        break;
-    }
 }
 
 void MediaControlInputElement::attachToParent(Element* parent)
@@ -416,7 +396,7 @@ void MediaControlInputElement::update()
 
 PassRefPtr<RenderStyle> MediaControlInputElement::styleForElement()
 {
-    return mediaElement()->renderer()->getCachedPseudoStyle(m_pseudoStyleId);
+    return document()->styleSelector()->styleForElement(this, 0, true);
 }
 
 bool MediaControlInputElement::rendererIsNeeded(RenderStyle* style)
@@ -481,7 +461,7 @@ void MediaControlInputElement::updateStyle()
     if (Node* shadowNode = shadowRoot())
         shadowNode->recalcStyle(Node::Force);
 }
-    
+
 bool MediaControlInputElement::hitTest(const IntPoint& absPoint)
 {
     if (renderer() && renderer()->style()->hasAppearance())
@@ -502,14 +482,14 @@ void MediaControlInputElement::setDisplayType(MediaControlElementType displayTyp
 
 // ----------------------------
 
-inline MediaControlMuteButtonElement::MediaControlMuteButtonElement(HTMLMediaElement* mediaElement, ButtonLocation location)
-    : MediaControlInputElement(mediaElement, location == Controller ? MEDIA_CONTROLS_MUTE_BUTTON : MEDIA_CONTROLS_VOLUME_SLIDER_MUTE_BUTTON)
+inline MediaControlMuteButtonElement::MediaControlMuteButtonElement(HTMLMediaElement* mediaElement, MediaControlElementType displayType)
+    : MediaControlInputElement(mediaElement, displayType)
 {
 }
 
-PassRefPtr<MediaControlMuteButtonElement> MediaControlMuteButtonElement::create(HTMLMediaElement* mediaElement, ButtonLocation location)
+PassRefPtr<MediaControlMuteButtonElement> MediaControlMuteButtonElement::create(HTMLMediaElement* mediaElement)
 {
-    RefPtr<MediaControlMuteButtonElement> button = adoptRef(new MediaControlMuteButtonElement(mediaElement, location));
+    RefPtr<MediaControlMuteButtonElement> button = adoptRef(new MediaControlMuteButtonElement(mediaElement, MediaMuteButton));
     button->setType("button");
     return button.release();
 }
@@ -523,15 +503,39 @@ void MediaControlMuteButtonElement::defaultEventHandler(Event* event)
     HTMLInputElement::defaultEventHandler(event);
 }
 
+const AtomicString& MediaControlMuteButtonElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-mute-button"));
+    return id;
+}
+
 void MediaControlMuteButtonElement::updateDisplayType()
 {
     setDisplayType(mediaElement()->muted() ? MediaUnMuteButton : MediaMuteButton);
 }
 
+inline MediaControlVolumeSliderMuteButtonElement::MediaControlVolumeSliderMuteButtonElement(HTMLMediaElement* mediaElement)
+    : MediaControlMuteButtonElement(mediaElement, MediaVolumeSliderMuteButton)
+{
+}
+
+PassRefPtr<MediaControlVolumeSliderMuteButtonElement> MediaControlVolumeSliderMuteButtonElement::create(HTMLMediaElement* mediaElement)
+{
+    RefPtr<MediaControlVolumeSliderMuteButtonElement> button = adoptRef(new MediaControlVolumeSliderMuteButtonElement(mediaElement));
+    button->setType("button");
+    return button.release();
+}
+
+const AtomicString& MediaControlVolumeSliderMuteButtonElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-volume-slider-mute-button"));
+    return id;
+}
+
 // ----------------------------
 
 inline MediaControlPlayButtonElement::MediaControlPlayButtonElement(HTMLMediaElement* mediaElement)
-    : MediaControlInputElement(mediaElement, MEDIA_CONTROLS_PLAY_BUTTON)
+    : MediaControlInputElement(mediaElement, MediaPlayButton)
 {
 }
 
@@ -556,28 +560,22 @@ void MediaControlPlayButtonElement::updateDisplayType()
     setDisplayType(mediaElement()->canPlay() ? MediaPlayButton : MediaPauseButton);
 }
 
+const AtomicString& MediaControlPlayButtonElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-play-button"));
+    return id;
+}
+
 // ----------------------------
 
-inline MediaControlSeekButtonElement::MediaControlSeekButtonElement(HTMLMediaElement* mediaElement, PseudoId pseudoId)
-    : MediaControlInputElement(mediaElement, pseudoId)
+inline MediaControlSeekButtonElement::MediaControlSeekButtonElement(HTMLMediaElement* mediaElement, MediaControlElementType displayType)
+    : MediaControlInputElement(mediaElement, displayType)
     , m_seeking(false)
     , m_capturing(false)
     , m_seekTimer(this, &MediaControlSeekButtonElement::seekTimerFired)
 {
 }
 
-PassRefPtr<MediaControlSeekButtonElement> MediaControlSeekButtonElement::create(HTMLMediaElement* mediaElement, PseudoId pseudoStyleId)
-{
-    RefPtr<MediaControlSeekButtonElement> button = adoptRef(new MediaControlSeekButtonElement(mediaElement, pseudoStyleId));
-    button->setType("button");
-    return button.release();
-}
-
-inline bool MediaControlSeekButtonElement::isForwardButton() const
-{
-    return pseudoStyleId() == MEDIA_CONTROLS_SEEK_FORWARD_BUTTON;
-}
-
 void MediaControlSeekButtonElement::defaultEventHandler(Event* event)
 {
     if (event->type() == eventNames().mousedownEvent) {
@@ -627,8 +625,48 @@ void MediaControlSeekButtonElement::detach()
 
 // ----------------------------
 
+inline MediaControlSeekForwardButtonElement::MediaControlSeekForwardButtonElement(HTMLMediaElement* mediaElement)
+    : MediaControlSeekButtonElement(mediaElement, MediaSeekForwardButton)
+{
+}
+
+PassRefPtr<MediaControlSeekForwardButtonElement> MediaControlSeekForwardButtonElement::create(HTMLMediaElement* mediaElement)
+{
+    RefPtr<MediaControlSeekForwardButtonElement> button = adoptRef(new MediaControlSeekForwardButtonElement(mediaElement));
+    button->setType("button");
+    return button.release();
+}
+
+const AtomicString& MediaControlSeekForwardButtonElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-seek-forward-button"));
+    return id;
+}
+
+// ----------------------------
+
+inline MediaControlSeekBackButtonElement::MediaControlSeekBackButtonElement(HTMLMediaElement* mediaElement)
+    : MediaControlSeekButtonElement(mediaElement, MediaSeekBackButton)
+{
+}
+
+PassRefPtr<MediaControlSeekBackButtonElement> MediaControlSeekBackButtonElement::create(HTMLMediaElement* mediaElement)
+{
+    RefPtr<MediaControlSeekBackButtonElement> button = adoptRef(new MediaControlSeekBackButtonElement(mediaElement));
+    button->setType("button");
+    return button.release();
+}
+
+const AtomicString& MediaControlSeekBackButtonElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-seek-back-button"));
+    return id;
+}
+
+// ----------------------------
+
 inline MediaControlRewindButtonElement::MediaControlRewindButtonElement(HTMLMediaElement* element)
-    : MediaControlInputElement(element, MEDIA_CONTROLS_REWIND_BUTTON)
+    : MediaControlInputElement(element, MediaRewindButton)
 {
 }
 
@@ -648,10 +686,16 @@ void MediaControlRewindButtonElement::defaultEventHandler(Event* event)
     HTMLInputElement::defaultEventHandler(event);
 }
 
+const AtomicString& MediaControlRewindButtonElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-rewind-button"));
+    return id;
+}
+
 // ----------------------------
 
 inline MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement(HTMLMediaElement* mediaElement)
-    : MediaControlInputElement(mediaElement, MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON)
+    : MediaControlInputElement(mediaElement, MediaReturnToRealtimeButton)
 {
 }
 
@@ -671,11 +715,16 @@ void MediaControlReturnToRealtimeButtonElement::defaultEventHandler(Event* event
     HTMLInputElement::defaultEventHandler(event);
 }
 
+const AtomicString& MediaControlReturnToRealtimeButtonElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-return-to-realtime-button"));
+    return id;
+}
 
 // ----------------------------
 
 inline MediaControlToggleClosedCaptionsButtonElement::MediaControlToggleClosedCaptionsButtonElement(HTMLMediaElement* mediaElement)
-    : MediaControlInputElement(mediaElement, MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON)
+    : MediaControlInputElement(mediaElement, MediaShowClosedCaptionsButton)
 {
 }
 
@@ -701,10 +750,16 @@ void MediaControlToggleClosedCaptionsButtonElement::updateDisplayType()
     setDisplayType(mediaElement()->closedCaptionsVisible() ? MediaHideClosedCaptionsButton : MediaShowClosedCaptionsButton);
 }
 
+const AtomicString& MediaControlToggleClosedCaptionsButtonElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-toggle-closed-captions-button"));
+    return id;
+}
+
 // ----------------------------
 
 MediaControlTimelineElement::MediaControlTimelineElement(HTMLMediaElement* mediaElement)
-    : MediaControlInputElement(mediaElement, MEDIA_CONTROLS_TIMELINE)
+    : MediaControlInputElement(mediaElement, MediaSlider)
 {
 }
 
@@ -739,12 +794,17 @@ void MediaControlTimelineElement::defaultEventHandler(Event* event)
     }
 
     RenderSlider* slider = toRenderSlider(renderer());
+<<<<<<< HEAD
     if (slider && slider->inDragMode()) {
         toRenderMedia(mediaElement()->renderer())->updateTimeDisplay();
 #if PLATFORM(ANDROID)
         toRenderMedia(mediaElement()->renderer())->updateLastTouch();
 #endif
     }
+=======
+    if (slider && slider->inDragMode())
+        toRenderMedia(mediaElement()->renderer())->controls()->updateTimeDisplay();
+>>>>>>> webkit.org at r78450
 
     if (event->type() == eventNames().mouseupEvent)
         mediaElement()->endScrubbing();
@@ -760,10 +820,16 @@ void MediaControlTimelineElement::update(bool updateDuration)
     MediaControlInputElement::update();
 }
 
+const AtomicString& MediaControlTimelineElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-timeline"));
+    return id;
+}
+
 // ----------------------------
 
 inline MediaControlVolumeSliderElement::MediaControlVolumeSliderElement(HTMLMediaElement* mediaElement)
-    : MediaControlInputElement(mediaElement, MEDIA_CONTROLS_VOLUME_SLIDER)
+    : MediaControlInputElement(mediaElement, MediaVolumeSlider)
 {
 }
 
@@ -804,10 +870,16 @@ void MediaControlVolumeSliderElement::update()
     MediaControlInputElement::update();
 }
 
+const AtomicString& MediaControlVolumeSliderElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-volume-slider"));
+    return id;
+}
+
 // ----------------------------
 
 inline MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement(HTMLMediaElement* mediaElement)
-    : MediaControlInputElement(mediaElement, MEDIA_CONTROLS_FULLSCREEN_BUTTON)
+    : MediaControlInputElement(mediaElement, MediaFullscreenButton)
 {
 }
 
@@ -840,20 +912,21 @@ void MediaControlFullscreenButtonElement::defaultEventHandler(Event* event)
     HTMLInputElement::defaultEventHandler(event);
 }
 
+const AtomicString& MediaControlFullscreenButtonElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-fullscreen-button"));
+    return id;
+}
+
 // ----------------------------
 
-inline MediaControlTimeDisplayElement::MediaControlTimeDisplayElement(HTMLMediaElement* mediaElement, PseudoId pseudo)
-    : MediaControlElement(mediaElement, pseudo)
+inline MediaControlTimeDisplayElement::MediaControlTimeDisplayElement(HTMLMediaElement* mediaElement)
+    : MediaControlElement(mediaElement)
     , m_currentValue(0)
     , m_isVisible(true)
 {
 }
 
-PassRefPtr<MediaControlTimeDisplayElement> MediaControlTimeDisplayElement::create(HTMLMediaElement* mediaElement, PseudoId pseudoStyleId)
-{
-    return adoptRef(new MediaControlTimeDisplayElement(mediaElement, pseudoStyleId));
-}
-
 PassRefPtr<RenderStyle> MediaControlTimeDisplayElement::styleForElement()
 {
     RefPtr<RenderStyle> style = MediaControlElement::styleForElement();
@@ -884,6 +957,52 @@ void MediaControlTimeDisplayElement::setCurrentValue(float time)
     m_currentValue = time;
 }
 
+// ----------------------------
+
+PassRefPtr<MediaControlTimeRemainingDisplayElement> MediaControlTimeRemainingDisplayElement::create(HTMLMediaElement* mediaElement)
+{
+    return adoptRef(new MediaControlTimeRemainingDisplayElement(mediaElement));
+}
+
+MediaControlTimeRemainingDisplayElement::MediaControlTimeRemainingDisplayElement(HTMLMediaElement* mediaElement)
+    : MediaControlTimeDisplayElement(mediaElement)
+{
+}
+
+MediaControlElementType MediaControlTimeRemainingDisplayElement::displayType() const
+{
+    return MediaTimeRemainingDisplay;
+}
+
+const AtomicString& MediaControlTimeRemainingDisplayElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-time-remaining-display"));
+    return id;
+}
+
+// ----------------------------
+
+PassRefPtr<MediaControlCurrentTimeDisplayElement> MediaControlCurrentTimeDisplayElement::create(HTMLMediaElement* mediaElement)
+{
+    return adoptRef(new MediaControlCurrentTimeDisplayElement(mediaElement));
+}
+
+MediaControlCurrentTimeDisplayElement::MediaControlCurrentTimeDisplayElement(HTMLMediaElement* mediaElement)
+    : MediaControlTimeDisplayElement(mediaElement)
+{
+}
+
+MediaControlElementType MediaControlCurrentTimeDisplayElement::displayType() const
+{
+    return MediaCurrentTimeDisplay;
+}
+
+const AtomicString& MediaControlCurrentTimeDisplayElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-current-time-display"));
+    return id;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(VIDEO)
diff --git a/Source/WebCore/rendering/MediaControlElements.h b/Source/WebCore/rendering/MediaControlElements.h
index b2d063d..ff9541d 100644
--- a/Source/WebCore/rendering/MediaControlElements.h
+++ b/Source/WebCore/rendering/MediaControlElements.h
@@ -75,7 +75,6 @@ class MediaControlShadowRootElement : public HTMLDivElement {
 public:
     static PassRefPtr<MediaControlShadowRootElement> create(HTMLMediaElement*);
 
-    void updateStyle();
     virtual void detach();
     
 private:
@@ -86,19 +85,17 @@ private:
 
 class MediaControlElement : public HTMLDivElement {
 public:
-    static PassRefPtr<MediaControlElement> create(HTMLMediaElement*, PseudoId);
-
     virtual void attach();
     void attachToParent(Element*);
     void update();
     void updateStyle();
 
-    MediaControlElementType displayType() const { return m_displayType; }
+    virtual MediaControlElementType displayType() const = 0;
 
     HTMLMediaElement* mediaElement() const { return m_mediaElement; }
 
 protected:
-    MediaControlElement(HTMLMediaElement*, PseudoId);
+    MediaControlElement(HTMLMediaElement*);
 
     virtual bool rendererIsNeeded(RenderStyle*);
 
@@ -108,19 +105,32 @@ private:
     virtual bool isMediaControlElement() const { return true; }
 
     HTMLMediaElement* m_mediaElement;   
-    PseudoId m_pseudoStyleId;
-    MediaControlElementType m_displayType;  // some elements can show multiple types (e.g. play/pause)
 };
 
 // ----------------------------
 
+class MediaControlPanelElement : public MediaControlElement {
+public:
+    static PassRefPtr<MediaControlPanelElement> create(HTMLMediaElement*);
+
+private:
+    MediaControlPanelElement(HTMLMediaElement*);
+    virtual MediaControlElementType displayType() const;
+    virtual const AtomicString& shadowPseudoId() const;
+};
+
+
+// ----------------------------
+
 class MediaControlTimelineContainerElement : public MediaControlElement {
 public:
     static PassRefPtr<MediaControlTimelineContainerElement> create(HTMLMediaElement*);
 
 private:
     MediaControlTimelineContainerElement(HTMLMediaElement*);
+    virtual MediaControlElementType displayType() const;
     virtual bool rendererIsNeeded(RenderStyle*);
+    virtual const AtomicString& shadowPseudoId() const;
 };
 
 // ----------------------------
@@ -137,6 +147,8 @@ public:
 
 private:
     MediaControlVolumeSliderContainerElement(HTMLMediaElement*);
+    virtual MediaControlElementType displayType() const;
+    virtual const AtomicString& shadowPseudoId() const;
 
     bool m_isVisible;
     int m_x, m_y;
@@ -153,7 +165,9 @@ public:
 private:
     MediaControlStatusDisplayElement(HTMLMediaElement*);
 
+    virtual MediaControlElementType displayType() const;
     virtual bool rendererIsNeeded(RenderStyle*);
+    virtual const AtomicString& shadowPseudoId() const;
 
     enum StateBeingDisplayed { Nothing, Loading, LiveBroadcast };
     StateBeingDisplayed m_stateBeingDisplayed;
@@ -174,12 +188,10 @@ public:
     HTMLMediaElement* mediaElement() const { return m_mediaElement; }
 
 protected:
-    MediaControlInputElement(HTMLMediaElement*, PseudoId);
+    MediaControlInputElement(HTMLMediaElement*, MediaControlElementType);
 
     void setDisplayType(MediaControlElementType);
 
-    PseudoId pseudoStyleId() const { return m_pseudoStyleId; }
-
 private:
     virtual void attach();
     virtual bool rendererIsNeeded(RenderStyle*);
@@ -190,8 +202,7 @@ private:
 
     virtual void updateDisplayType() { }
 
-    HTMLMediaElement* m_mediaElement;   
-    PseudoId m_pseudoStyleId;
+    HTMLMediaElement* m_mediaElement;
     MediaControlElementType m_displayType;
 };
 
@@ -199,17 +210,31 @@ private:
 
 class MediaControlMuteButtonElement : public MediaControlInputElement {
 public:
-    enum ButtonLocation { Controller, VolumeSlider };
-    static PassRefPtr<MediaControlMuteButtonElement> create(HTMLMediaElement*, ButtonLocation);
+    static PassRefPtr<MediaControlMuteButtonElement> create(HTMLMediaElement*);
 
     virtual void defaultEventHandler(Event*);
 
-private:
-    MediaControlMuteButtonElement(HTMLMediaElement*, ButtonLocation);
+protected:
+    MediaControlMuteButtonElement(HTMLMediaElement*, MediaControlElementType);
 
+private:
     virtual void updateDisplayType();
+    virtual const AtomicString& shadowPseudoId() const;
+};
+
+// ----------------------------
+
+class MediaControlVolumeSliderMuteButtonElement : public MediaControlMuteButtonElement {
+public:
+    static PassRefPtr<MediaControlVolumeSliderMuteButtonElement> create(HTMLMediaElement*);
+
+private:
+    MediaControlVolumeSliderMuteButtonElement(HTMLMediaElement*);
+
+    virtual const AtomicString& shadowPseudoId() const;
 };
 
+
 // ----------------------------
 
 class MediaControlPlayButtonElement : public MediaControlInputElement {
@@ -222,20 +247,20 @@ private:
     MediaControlPlayButtonElement(HTMLMediaElement*);
 
     virtual void updateDisplayType();
+    virtual const AtomicString& shadowPseudoId() const;
 };
 
 // ----------------------------
 
 class MediaControlSeekButtonElement : public MediaControlInputElement {
 public:
-    static PassRefPtr<MediaControlSeekButtonElement> create(HTMLMediaElement*, PseudoId);
-
     virtual void defaultEventHandler(Event*);
 
-private:
-    MediaControlSeekButtonElement(HTMLMediaElement*, PseudoId);
+protected:
+    MediaControlSeekButtonElement(HTMLMediaElement*, MediaControlElementType);
 
-    bool isForwardButton() const;
+private:
+    virtual bool isForwardButton() const = 0;
 
     virtual void detach();
     void seekTimerFired(Timer<MediaControlSeekButtonElement>*);
@@ -244,7 +269,33 @@ private:
     bool m_capturing;
     Timer<MediaControlSeekButtonElement> m_seekTimer;
 };
-    
+
+// ----------------------------
+
+class MediaControlSeekForwardButtonElement : public MediaControlSeekButtonElement {
+public:
+    static PassRefPtr<MediaControlSeekForwardButtonElement> create(HTMLMediaElement*);
+
+private:
+    MediaControlSeekForwardButtonElement(HTMLMediaElement*);
+
+    virtual bool isForwardButton() const { return true; }
+    virtual const AtomicString& shadowPseudoId() const;
+};
+
+// ----------------------------
+
+class MediaControlSeekBackButtonElement : public MediaControlSeekButtonElement {
+public:
+    static PassRefPtr<MediaControlSeekBackButtonElement> create(HTMLMediaElement*);
+
+private:
+    MediaControlSeekBackButtonElement(HTMLMediaElement*);
+
+    virtual bool isForwardButton() const { return false; }
+    virtual const AtomicString& shadowPseudoId() const;
+};
+
 // ----------------------------
 
 class MediaControlRewindButtonElement : public MediaControlInputElement {
@@ -255,6 +306,8 @@ public:
 
 private:
     MediaControlRewindButtonElement(HTMLMediaElement*);
+
+    virtual const AtomicString& shadowPseudoId() const;
 };
 
 // ----------------------------
@@ -267,6 +320,8 @@ public:
 
 private:
     MediaControlReturnToRealtimeButtonElement(HTMLMediaElement*);
+
+    virtual const AtomicString& shadowPseudoId() const;
 };    
 
 // ----------------------------
@@ -281,6 +336,7 @@ private:
     MediaControlToggleClosedCaptionsButtonElement(HTMLMediaElement*);
 
     virtual void updateDisplayType();
+    virtual const AtomicString& shadowPseudoId() const;
 };    
 
 // ----------------------------
@@ -294,6 +350,8 @@ public:
 
 private:
     MediaControlTimelineElement(HTMLMediaElement*);
+
+    virtual const AtomicString& shadowPseudoId() const;
 };
 
 // ----------------------------
@@ -307,6 +365,8 @@ public:
 
 private:
     MediaControlVolumeSliderElement(HTMLMediaElement*);
+
+    virtual const AtomicString& shadowPseudoId() const;
 };
 
 // ----------------------------
@@ -319,22 +379,23 @@ public:
 
 private:
     MediaControlFullscreenButtonElement(HTMLMediaElement*);
+
+    virtual const AtomicString& shadowPseudoId() const;
 };
 
 // ----------------------------
 
 class MediaControlTimeDisplayElement : public MediaControlElement {
 public:
-    static PassRefPtr<MediaControlTimeDisplayElement> create(HTMLMediaElement*, PseudoId);
-
     void setVisible(bool);
 
     void setCurrentValue(float);
     float currentValue() const { return m_currentValue; }
 
-private:
-    MediaControlTimeDisplayElement(HTMLMediaElement*, PseudoId);
+protected:
+    MediaControlTimeDisplayElement(HTMLMediaElement*);
 
+private:
     virtual PassRefPtr<RenderStyle> styleForElement();
     float m_currentValue;
     bool m_isVisible;
@@ -342,6 +403,32 @@ private:
 
 // ----------------------------
 
+class MediaControlTimeRemainingDisplayElement : public MediaControlTimeDisplayElement {
+public:
+    static PassRefPtr<MediaControlTimeRemainingDisplayElement> create(HTMLMediaElement*);
+
+private:
+    MediaControlTimeRemainingDisplayElement(HTMLMediaElement*);
+
+    virtual MediaControlElementType displayType() const;
+    virtual const AtomicString& shadowPseudoId() const;
+};
+
+// ----------------------------
+
+class MediaControlCurrentTimeDisplayElement : public MediaControlTimeDisplayElement {
+public:
+    static PassRefPtr<MediaControlCurrentTimeDisplayElement> create(HTMLMediaElement*);
+
+private:
+    MediaControlCurrentTimeDisplayElement(HTMLMediaElement*);
+
+    virtual MediaControlElementType displayType() const;
+    virtual const AtomicString& shadowPseudoId() const;
+};
+
+// ----------------------------
+
 class RenderMediaControlShadowRoot : public RenderBlock {
 public:
     RenderMediaControlShadowRoot(Element* e) : RenderBlock(e) { }
diff --git a/Source/WebCore/rendering/RenderBR.h b/Source/WebCore/rendering/RenderBR.h
index 7216b5a..72a4514 100644
--- a/Source/WebCore/rendering/RenderBR.h
+++ b/Source/WebCore/rendering/RenderBR.h
@@ -40,8 +40,8 @@ public:
  
     virtual IntRect selectionRectForRepaint(RenderBoxModelObject* /*repaintContainer*/, bool /*clipToVisibleContent*/) { return IntRect(); }
 
-    virtual unsigned width(unsigned /*from*/, unsigned /*len*/, const Font&, int /*xpos*/) const { return 0; }
-    virtual unsigned width(unsigned /*from*/, unsigned /*len*/, int /*xpos*/, bool /*firstLine = false*/) const { return 0; }
+    virtual unsigned width(unsigned /*from*/, unsigned /*len*/, const Font&, int /*xPos*/, HashSet<const SimpleFontData*>* = 0 /*fallbackFonts*/ , GlyphOverflow* = 0) const { return 0; }
+    virtual unsigned width(unsigned /*from*/, unsigned /*len*/, int /*xpos*/, bool = false /*firstLine*/, HashSet<const SimpleFontData*>* = 0 /*fallbackFonts*/, GlyphOverflow* = 0) const { return 0; }
 
     int lineHeight(bool firstLine) const;
 
diff --git a/Source/WebCore/rendering/RenderBlock.cpp b/Source/WebCore/rendering/RenderBlock.cpp
index 7275461..87aa630 100644
--- a/Source/WebCore/rendering/RenderBlock.cpp
+++ b/Source/WebCore/rendering/RenderBlock.cpp
@@ -36,6 +36,7 @@
 #include "HitTestResult.h"
 #include "InlineTextBox.h"
 #include "PaintInfo.h"
+#include "RenderCombineText.h"
 #include "RenderFlexibleBox.h"
 #include "RenderImage.h"
 #include "RenderInline.h"
@@ -1267,7 +1268,7 @@ void RenderBlock::layoutBlock(bool relayoutChildren, int pageLogicalHeight)
     statePusher.pop();
 
     if (view()->layoutState()->m_pageLogicalHeight)
-        setPageLogicalOffset(view()->layoutState()->pageLogicalOffset(y()));
+        setPageLogicalOffset(view()->layoutState()->pageLogicalOffset(logicalTop()));
 
     updateLayerTransform();
 
@@ -1330,10 +1331,18 @@ void RenderBlock::addOverflowFromChildren()
         ColumnInfo* colInfo = columnInfo();
         if (columnCount(colInfo)) {
             IntRect lastRect = columnRectAt(colInfo, columnCount(colInfo) - 1);
-            int overflowLeft = !style()->isLeftToRightDirection() ? min(0, lastRect.x()) : 0;
-            int overflowRight = style()->isLeftToRightDirection() ? max(width(), lastRect.x() + lastRect.width()) : 0;
-            int overflowHeight = borderTop() + paddingTop() + colInfo->columnHeight();
-            addLayoutOverflow(IntRect(overflowLeft, 0, overflowRight - overflowLeft, overflowHeight));
+            if (style()->isHorizontalWritingMode()) {
+                int overflowLeft = !style()->isLeftToRightDirection() ? min(0, lastRect.x()) : 0;
+                int overflowRight = style()->isLeftToRightDirection() ? max(width(), lastRect.maxX()) : 0;
+                int overflowHeight = borderBefore() + paddingBefore() + colInfo->columnHeight();
+                addLayoutOverflow(IntRect(overflowLeft, 0, overflowRight - overflowLeft, overflowHeight));
+            } else {
+                IntRect lastRect = columnRectAt(colInfo, columnCount(colInfo) - 1);
+                int overflowTop = !style()->isLeftToRightDirection() ? min(0, lastRect.y()) : 0;
+                int overflowBottom = style()->isLeftToRightDirection() ? max(height(), lastRect.maxY()) : 0;
+                int overflowWidth = borderBefore() + paddingBefore() + colInfo->columnHeight();
+                addLayoutOverflow(IntRect(0, overflowTop, overflowWidth, overflowBottom - overflowTop));
+            }
         }
     }
 }
@@ -1376,14 +1385,13 @@ void RenderBlock::addOverflowFromBlockChildren()
 
 void RenderBlock::addOverflowFromFloats()
 {
-    IntRect result;
     if (!m_floatingObjects)
         return;
     FloatingObject* r;
     DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
     for (; (r = it.current()); ++it) {
         if (r->m_isDescendant)
-            addOverflowFromChild(r->m_renderer, IntSize(r->left() + r->m_renderer->marginLeft(), r->top() + r->m_renderer->marginTop()));
+            addOverflowFromChild(r->m_renderer, IntSize(xPositionForFloatIncludingMargin(r), yPositionForFloatIncludingMargin(r)));
     }
     return;
 }
@@ -1649,7 +1657,7 @@ int RenderBlock::collapseMargins(RenderBox* child, MarginInfo& marginInfo)
     bool paginated = view()->layoutState()->isPaginated();
     if (paginated && logicalTop > beforeCollapseLogicalTop) {
         int oldLogicalTop = logicalTop;
-        logicalTop = min(logicalTop, nextPageTop(beforeCollapseLogicalTop));
+        logicalTop = min(logicalTop, nextPageLogicalTop(beforeCollapseLogicalTop));
         setLogicalHeight(logicalHeight() + (logicalTop - oldLogicalTop));
     }
     return logicalTop;
@@ -1719,7 +1727,7 @@ int RenderBlock::estimateLogicalTopPosition(RenderBox* child, const MarginInfo&
     // Adjust logicalTopEstimate down to the next page if the margins are so large that we don't fit on the current
     // page.
     if (paginated && logicalTopEstimate > logicalHeight())
-        logicalTopEstimate = min(logicalTopEstimate, nextPageTop(logicalHeight()));
+        logicalTopEstimate = min(logicalTopEstimate, nextPageLogicalTop(logicalHeight()));
 
     logicalTopEstimate += getClearDelta(child, logicalTopEstimate);
     
@@ -2062,7 +2070,7 @@ void RenderBlock::layoutBlockChild(RenderBox* child, MarginInfo& marginInfo, int
 
     if (paginated) {
         // Check for an after page/column break.
-        int newHeight = applyAfterBreak(child, height(), marginInfo);
+        int newHeight = applyAfterBreak(child, logicalHeight(), marginInfo);
         if (newHeight != height())
             setLogicalHeight(newHeight);
     }
@@ -2166,7 +2174,7 @@ void RenderBlock::markForPaginationRelayoutIfNeeded()
     if (needsLayout())
         return;
 
-    if (view()->layoutState()->pageLogicalHeightChanged() || (view()->layoutState()->pageLogicalHeight() && view()->layoutState()->pageLogicalOffset(y()) != pageLogicalOffset()))
+    if (view()->layoutState()->pageLogicalHeightChanged() || (view()->layoutState()->pageLogicalHeight() && view()->layoutState()->pageLogicalOffset(logicalTop()) != pageLogicalOffset()))
         setChildNeedsLayout(true, false);
 }
 
@@ -2243,32 +2251,34 @@ void RenderBlock::paintColumnRules(PaintInfo& paintInfo, int tx, int ty)
     // We need to do multiple passes, breaking up our child painting into strips.
     ColumnInfo* colInfo = columnInfo();
     unsigned colCount = columnCount(colInfo);
-    int currXOffset = style()->isLeftToRightDirection() ? 0 : contentWidth();
-    int ruleAdd = borderLeft() + paddingLeft();
-    int ruleX = style()->isLeftToRightDirection() ? 0 : contentWidth();
+    int currLogicalLeftOffset = style()->isLeftToRightDirection() ? 0 : contentLogicalWidth();
+    int ruleAdd = logicalLeftOffsetForContent();
+    int ruleLogicalLeft = style()->isLeftToRightDirection() ? 0 : contentLogicalWidth();
     for (unsigned i = 0; i < colCount; i++) {
         IntRect colRect = columnRectAt(colInfo, i);
 
+        int inlineDirectionSize = style()->isHorizontalWritingMode() ? colRect.width() : colRect.height();
+        
         // Move to the next position.
         if (style()->isLeftToRightDirection()) {
-            ruleX += colRect.width() + colGap / 2;
-            currXOffset += colRect.width() + colGap;
+            ruleLogicalLeft += inlineDirectionSize + colGap / 2;
+            currLogicalLeftOffset += inlineDirectionSize + colGap;
         } else {
-            ruleX -= (colRect.width() + colGap / 2);
-            currXOffset -= (colRect.width() + colGap);
+            ruleLogicalLeft -= (inlineDirectionSize + colGap / 2);
+            currLogicalLeftOffset -= (inlineDirectionSize + colGap);
         }
        
         // Now paint the column rule.
         if (i < colCount - 1) {
-            int ruleStart = tx + ruleX - ruleWidth / 2 + ruleAdd;
-            int ruleEnd = ruleStart + ruleWidth;
-            int ruleTop = ty + borderTop() + paddingTop();
-            int ruleBottom = ruleTop + contentHeight();
-            drawLineForBoxSide(paintInfo.context, ruleStart, ruleTop, ruleEnd, ruleBottom,
+            int ruleLeft = style()->isHorizontalWritingMode() ? tx + ruleLogicalLeft - ruleWidth / 2 + ruleAdd : tx + borderBefore() + paddingBefore();
+            int ruleRight = style()->isHorizontalWritingMode() ? ruleLeft + ruleWidth : ruleLeft + contentWidth();
+            int ruleTop = style()->isHorizontalWritingMode() ? ty + borderTop() + paddingTop() : ty + ruleLogicalLeft - ruleWidth / 2 + ruleAdd;
+            int ruleBottom = style()->isHorizontalWritingMode() ? ruleTop + contentHeight() : ruleTop + ruleWidth;
+            drawLineForBoxSide(paintInfo.context, ruleLeft, ruleTop, ruleRight, ruleBottom,
                                style()->isLeftToRightDirection() ? BSLeft : BSRight, ruleColor, ruleStyle, 0, 0);
         }
         
-        ruleX = currXOffset;
+        ruleLogicalLeft = currLogicalLeftOffset;
     }
 }
 
@@ -2276,16 +2286,17 @@ void RenderBlock::paintColumnContents(PaintInfo& paintInfo, int tx, int ty, bool
 {
     // We need to do multiple passes, breaking up our child painting into strips.
     GraphicsContext* context = paintInfo.context;
-    int colGap = columnGap();
     ColumnInfo* colInfo = columnInfo();
     unsigned colCount = columnCount(colInfo);
     if (!colCount)
         return;
-    int currXOffset = style()->isLeftToRightDirection() ? 0 : contentWidth() - columnRectAt(colInfo, 0).width();
-    int currYOffset = 0;
+    int currLogicalTopOffset = 0;
     for (unsigned i = 0; i < colCount; i++) {
         // For each rect, we clip to the rect, and then we adjust our coords.
         IntRect colRect = columnRectAt(colInfo, i);
+        flipForWritingMode(colRect);
+        int logicalLeftOffset = (style()->isHorizontalWritingMode() ? colRect.x() : colRect.y()) - logicalLeftOffsetForContent();
+        IntSize offset = style()->isHorizontalWritingMode() ? IntSize(logicalLeftOffset, currLogicalTopOffset) : IntSize(currLogicalTopOffset, logicalLeftOffset);
         colRect.move(tx, ty);
         PaintInfo info(paintInfo);
         info.rect.intersect(colRect);
@@ -2296,10 +2307,10 @@ void RenderBlock::paintColumnContents(PaintInfo& paintInfo, int tx, int ty, bool
             // Each strip pushes a clip, since column boxes are specified as being
             // like overflow:hidden.
             context->clip(colRect);
-            
+
             // Adjust our x and y when painting.
-            int finalX = tx + currXOffset;
-            int finalY = ty + currYOffset;
+            int finalX = tx + offset.width();
+            int finalY = ty + offset.height();
             if (paintingFloats)
                 paintFloats(info, finalX, finalY, paintInfo.phase == PaintPhaseSelection || paintInfo.phase == PaintPhaseTextClip);
             else
@@ -2307,14 +2318,12 @@ void RenderBlock::paintColumnContents(PaintInfo& paintInfo, int tx, int ty, bool
 
             context->restore();
         }
-        
-        // Move to the next position.
-        if (style()->isLeftToRightDirection())
-            currXOffset += colRect.width() + colGap;
+
+        int blockDelta = (style()->isHorizontalWritingMode() ? colRect.height() : colRect.width());
+        if (style()->isFlippedBlocksWritingMode())
+            currLogicalTopOffset += blockDelta;
         else
-            currXOffset -= (colRect.width() + colGap);
-        
-        currYOffset -= colRect.height();
+            currLogicalTopOffset -= blockDelta;
     }
 }
 
@@ -2352,14 +2361,14 @@ void RenderBlock::paintChildren(PaintInfo& paintInfo, int tx, int ty)
         bool checkBeforeAlways = !childrenInline() && (usePrintRect && child->style()->pageBreakBefore() == PBALWAYS);
         if (checkBeforeAlways
             && (ty + child->y()) > paintInfo.rect.y()
-            && (ty + child->y()) < paintInfo.rect.bottom()) {
+            && (ty + child->y()) < paintInfo.rect.maxY()) {
             view()->setBestTruncatedAt(ty + child->y(), this, true);
             return;
         }
 
         if (!child->isFloating() && child->isReplaced() && usePrintRect && child->height() <= renderView->printRect().height()) {
             // Paginate block-level replaced elements.
-            if (ty + child->y() + child->height() > renderView->printRect().bottom()) {
+            if (ty + child->y() + child->height() > renderView->printRect().maxY()) {
                 if (ty + child->y() < renderView->truncatedAt())
                     renderView->setBestTruncatedAt(ty + child->y(), child);
                 // If we were able to truncate, don't paint.
@@ -2376,7 +2385,7 @@ void RenderBlock::paintChildren(PaintInfo& paintInfo, int tx, int ty)
         bool checkAfterAlways = !childrenInline() && (usePrintRect && child->style()->pageBreakAfter() == PBALWAYS);
         if (checkAfterAlways
             && (ty + child->y() + child->height()) > paintInfo.rect.y()
-            && (ty + child->y() + child->height()) < paintInfo.rect.bottom()) {
+            && (ty + child->y() + child->height()) < paintInfo.rect.maxY()) {
             view()->setBestTruncatedAt(ty + child->y() + child->height() + max(0, child->collapsedMarginAfter()), this, true);
             return;
         }
@@ -2491,6 +2500,19 @@ void RenderBlock::paintObject(PaintInfo& paintInfo, int tx, int ty)
     }
 }
 
+IntPoint RenderBlock::flipFloatForWritingMode(const FloatingObject* child, const IntPoint& point) const
+{
+    if (!style()->isFlippedBlocksWritingMode())
+        return point;
+    
+    // This is similar to the ParentToChildFlippingAdjustment in RenderBox::flipForWritingMode.  We have to subtract out our left/top offsets twice, since
+    // it's going to get added back in.  We hide this complication here so that the calling code looks normal for the unflipped
+    // case.
+    if (style()->isHorizontalWritingMode())
+        return IntPoint(point.x(), point.y() + height() - child->renderer()->height() - 2 * yPositionForFloatIncludingMargin(child));
+    return IntPoint(point.x() + width() - child->width() - 2 * xPositionForFloatIncludingMargin(child), point.y());
+}
+
 void RenderBlock::paintFloats(PaintInfo& paintInfo, int tx, int ty, bool preservePhase)
 {
     if (!m_floatingObjects)
@@ -2503,7 +2525,7 @@ void RenderBlock::paintFloats(PaintInfo& paintInfo, int tx, int ty, bool preserv
         if (r->m_shouldPaint && !r->m_renderer->hasSelfPaintingLayer()) {
             PaintInfo currentPaintInfo(paintInfo);
             currentPaintInfo.phase = preservePhase ? paintInfo.phase : PaintPhaseBlockBackground;
-            IntPoint childPoint = flipForWritingMode(r->m_renderer, IntPoint(tx + r->left() + r->m_renderer->marginLeft() - r->m_renderer->x(), ty + r->top() + r->m_renderer->marginTop() - r->m_renderer->y()), ParentToChildFlippingAdjustment);
+            IntPoint childPoint = flipFloatForWritingMode(r, IntPoint(tx + xPositionForFloatIncludingMargin(r) - r->m_renderer->x(), ty + yPositionForFloatIncludingMargin(r) - r->m_renderer->y()));
             r->m_renderer->paint(currentPaintInfo, childPoint.x(), childPoint.y());
             if (!preservePhase) {
                 currentPaintInfo.phase = PaintPhaseChildBlockBackgrounds;
@@ -2529,7 +2551,7 @@ void RenderBlock::paintEllipsisBoxes(PaintInfo& paintInfo, int tx, int ty)
         // intersect.
         int yPos = ty + firstLineBox()->y();
         int h = lastLineBox()->y() + lastLineBox()->logicalHeight() - firstLineBox()->y();
-        if (yPos >= paintInfo.rect.bottom() || yPos + h <= paintInfo.rect.y())
+        if (yPos >= paintInfo.rect.maxY() || yPos + h <= paintInfo.rect.y())
             return;
 
         // See if our boxes intersect with the dirty rect.  If so, then we paint
@@ -2538,7 +2560,7 @@ void RenderBlock::paintEllipsisBoxes(PaintInfo& paintInfo, int tx, int ty)
         for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
             yPos = ty + curr->y();
             h = curr->logicalHeight();
-            if (curr->ellipsisBox() && yPos < paintInfo.rect.bottom() && yPos + h > paintInfo.rect.y())
+            if (curr->ellipsisBox() && yPos < paintInfo.rect.maxY() && yPos + h > paintInfo.rect.y())
                 curr->paintEllipsisBox(paintInfo, tx, ty);
         }
     }
@@ -2737,8 +2759,8 @@ GapRects RenderBlock::selectionGaps(RenderBlock* rootBlock, const IntPoint& root
         if (m_floatingObjects) {
             for (DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects); it.current(); ++it) {
                 FloatingObject* r = it.current();
-                IntRect floatBox = IntRect(offsetFromRootBlock.width() + r->left() + r->m_renderer->marginLeft(),
-                                           offsetFromRootBlock.height() + r->top() + r->m_renderer->marginTop(),
+                IntRect floatBox = IntRect(offsetFromRootBlock.width() + xPositionForFloatIncludingMargin(r),
+                                           offsetFromRootBlock.height() + yPositionForFloatIncludingMargin(r),
                                            r->m_renderer->width(), r->m_renderer->height());
                 rootBlock->flipForWritingMode(floatBox);
                 floatBox.move(rootBlockPhysicalPosition.x(), rootBlockPhysicalPosition.y());
@@ -2808,8 +2830,8 @@ GapRects RenderBlock::inlineSelectionGaps(RenderBlock* rootBlock, const IntPoint
         IntRect logicalRect(curr->logicalLeft(), selTop, curr->logicalWidth(), selTop + selHeight);
         logicalRect.move(style()->isHorizontalWritingMode() ? offsetFromRootBlock : IntSize(offsetFromRootBlock.height(), offsetFromRootBlock.width()));
         IntRect physicalRect = rootBlock->logicalRectToPhysicalRect(rootBlockPhysicalPosition, logicalRect);
-        if (!paintInfo || (style()->isHorizontalWritingMode() && physicalRect.y() < paintInfo->rect.bottom() && physicalRect.bottom() > paintInfo->rect.y())
-            || (!style()->isHorizontalWritingMode() && physicalRect.x() < paintInfo->rect.right() && physicalRect.right() > paintInfo->rect.x()))
+        if (!paintInfo || (style()->isHorizontalWritingMode() && physicalRect.y() < paintInfo->rect.maxY() && physicalRect.maxY() > paintInfo->rect.y())
+            || (!style()->isHorizontalWritingMode() && physicalRect.x() < paintInfo->rect.maxX() && physicalRect.maxX() > paintInfo->rect.x()))
             result.unite(curr->lineSelectionGap(rootBlock, rootBlockPhysicalPosition, offsetFromRootBlock, selTop, selHeight, paintInfo));
 
         lastSelectedLine = curr;
@@ -3098,7 +3120,7 @@ void RenderBlock::removeFloatingObject(RenderBox* o)
                     // Special-case zero- and less-than-zero-height floats: those don't touch
                     // the line that they're on, but it still needs to be dirtied. This is
                     // accomplished by pretending they have a height of 1.
-                    logicalBottom = max(logicalBottom, logicalTop + 1);
+                    logicalBottom = max(logicalBottom, logicalTop == numeric_limits<int>::max() ? logicalTop : logicalTop + 1);
                     markLinesDirtyInBlockRange(0, logicalBottom);
                 }
                 m_floatingObjects->removeRef(it.current());
@@ -3108,13 +3130,13 @@ void RenderBlock::removeFloatingObject(RenderBox* o)
     }
 }
 
-void RenderBlock::removeFloatingObjectsBelow(FloatingObject* lastFloat, int y)
+void RenderBlock::removeFloatingObjectsBelow(FloatingObject* lastFloat, int logicalOffset)
 {
     if (!m_floatingObjects)
         return;
     
     FloatingObject* curr = m_floatingObjects->last();
-    while (curr != lastFloat && (!curr->isPlaced() || curr->top() >= y)) {
+    while (curr != lastFloat && (!curr->isPlaced() || logicalTopForFloat(curr) >= logicalOffset)) {
         m_floatingObjects->removeLast();
         curr = m_floatingObjects->last();
     }
@@ -3460,7 +3482,7 @@ void RenderBlock::markLinesDirtyInBlockRange(int logicalTop, int logicalBottom,
 
     RootInlineBox* lowestDirtyLine = lastRootBox();
     RootInlineBox* afterLowest = lowestDirtyLine;
-    while (lowestDirtyLine && lowestDirtyLine->blockLogicalHeight() >= logicalBottom) {
+    while (lowestDirtyLine && lowestDirtyLine->blockLogicalHeight() >= logicalBottom && logicalBottom < numeric_limits<int>::max()) {
         afterLowest = lowestDirtyLine;
         lowestDirtyLine = lowestDirtyLine->prevRootBox();
     }
@@ -3591,7 +3613,7 @@ int RenderBlock::addOverhangingFloats(RenderBlock* child, int logicalLeftOffset,
             if (!containsFloat(r->m_renderer)) {
                 int leftOffset = style()->isHorizontalWritingMode() ? logicalLeftOffset : logicalTopOffset;
                 int topOffset = style()->isHorizontalWritingMode() ? logicalTopOffset : logicalLeftOffset;
-                FloatingObject* floatingObj = new FloatingObject(r->type(), IntRect(r->left() - leftOffset, r->top() - topOffset, r->width(), r->height()));
+                FloatingObject* floatingObj = new FloatingObject(r->type(), IntRect(r->x() - leftOffset, r->y() - topOffset, r->width(), r->height()));
                 floatingObj->m_renderer = r->m_renderer;
 
                 // The nearest enclosing layer always paints the float (so that zindex and stacking
@@ -3626,7 +3648,7 @@ int RenderBlock::addOverhangingFloats(RenderBlock* child, int logicalLeftOffset,
             // Since the float doesn't overhang, it didn't get put into our list.  We need to go ahead and add its overflow in to the
             // child now.
             if (r->m_isDescendant)
-                child->addOverflowFromChild(r->m_renderer, IntSize(r->left() + r->m_renderer->marginLeft(), r->top() + r->m_renderer->marginTop()));
+                child->addOverflowFromChild(r->m_renderer, IntSize(xPositionForFloatIncludingMargin(r), yPositionForFloatIncludingMargin(r)));
         }
     }
     return lowestFloatLogicalBottom;
@@ -3658,7 +3680,7 @@ void RenderBlock::addIntrudingFloats(RenderBlock* prev, int logicalLeftOffset, i
                 int leftOffset = style()->isHorizontalWritingMode() ? logicalLeftOffset : logicalTopOffset;
                 int topOffset = style()->isHorizontalWritingMode() ? logicalTopOffset : logicalLeftOffset;
                 
-                FloatingObject* floatingObj = new FloatingObject(r->type(), IntRect(r->left() - leftOffset, r->top() - topOffset, r->width(), r->height()));
+                FloatingObject* floatingObj = new FloatingObject(r->type(), IntRect(r->x() - leftOffset, r->y() - topOffset, r->width(), r->height()));
 
                 // Applying the child's margin makes no sense in the case where the child was passed in.
                 // since this margin was added already through the modification of the |logicalLeftOffset| variable
@@ -3667,9 +3689,9 @@ void RenderBlock::addIntrudingFloats(RenderBlock* prev, int logicalLeftOffset, i
                 // will get applied twice.
                 if (prev != parent()) {
                     if (style()->isHorizontalWritingMode())
-                        floatingObj->setLeft(floatingObj->left() + prev->marginLeft());
+                        floatingObj->setX(floatingObj->x() + prev->marginLeft());
                     else
-                        floatingObj->setTop(floatingObj->top() + prev->marginTop());
+                        floatingObj->setY(floatingObj->y() + prev->marginTop());
                 }
                
                 floatingObj->m_shouldPaint = false;  // We are not in the direct inheritance chain for this float. We will never paint it.
@@ -3864,9 +3886,9 @@ bool RenderBlock::hitTestFloats(const HitTestRequest& request, HitTestResult& re
     DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
     for (it.toLast(); (floatingObject = it.current()); --it) {
         if (floatingObject->m_shouldPaint && !floatingObject->m_renderer->hasSelfPaintingLayer()) {
-            int xOffset = floatingObject->left() + floatingObject->m_renderer->marginLeft() - floatingObject->m_renderer->x();
-            int yOffset = floatingObject->top() + floatingObject->m_renderer->marginTop() - floatingObject->m_renderer->y();
-            IntPoint childPoint = flipForWritingMode(floatingObject->m_renderer, IntPoint(tx + xOffset, ty + yOffset), ParentToChildFlippingAdjustment);
+            int xOffset = xPositionForFloatIncludingMargin(floatingObject) - floatingObject->m_renderer->x();
+            int yOffset = yPositionForFloatIncludingMargin(floatingObject) - floatingObject->m_renderer->y();
+            IntPoint childPoint = flipFloatForWritingMode(floatingObject, IntPoint(tx + xOffset, ty + yOffset));
             if (floatingObject->m_renderer->hitTest(request, result, IntPoint(x, y), childPoint.x(), childPoint.y())) {
                 updateHitTestResult(result, IntPoint(x - childPoint.x(), y - childPoint.y()));
                 return true;
@@ -3884,23 +3906,36 @@ bool RenderBlock::hitTestColumns(const HitTestRequest& request, HitTestResult& r
     int colCount = columnCount(colInfo);
     if (!colCount)
         return false;
-    int left = borderLeft() + paddingLeft();
-    int currYOffset = 0;
+    int logicalLeft = logicalLeftOffsetForContent();
+    int currLogicalTopOffset = 0;
     int i;
-    for (i = 0; i < colCount; i++)
-        currYOffset -= columnRectAt(colInfo, i).height();
+    bool isHorizontal = style()->isHorizontalWritingMode();
+    for (i = 0; i < colCount; i++) {
+        IntRect colRect = columnRectAt(colInfo, i);
+        int blockDelta =  (isHorizontal ? colRect.height() : colRect.width());
+        if (style()->isFlippedBlocksWritingMode())
+            currLogicalTopOffset += blockDelta;
+        else
+            currLogicalTopOffset -= blockDelta;
+    }
     for (i = colCount - 1; i >= 0; i--) {
         IntRect colRect = columnRectAt(colInfo, i);
-        int currXOffset = colRect.x() - left;
-        currYOffset += colRect.height();
+        flipForWritingMode(colRect);
+        int currLogicalLeftOffset = (isHorizontal ? colRect.x() : colRect.y()) - logicalLeft;
+        int blockDelta =  (isHorizontal ? colRect.height() : colRect.width());
+        if (style()->isFlippedBlocksWritingMode())
+            currLogicalTopOffset -= blockDelta;
+        else
+            currLogicalTopOffset += blockDelta;
         colRect.move(tx, ty);
         
         if (colRect.intersects(result.rectForPoint(x, y))) {
             // The point is inside this column.
             // Adjust tx and ty to change where we hit test.
         
-            int finalX = tx + currXOffset;
-            int finalY = ty + currYOffset;
+            IntSize offset = isHorizontal ? IntSize(currLogicalLeftOffset, currLogicalTopOffset) : IntSize(currLogicalTopOffset, currLogicalLeftOffset);
+            int finalX = tx + offset.width();
+            int finalY = ty + offset.height();
             if (result.isRectBasedTest() && !colRect.contains(result.rectForPoint(x, y)))
                 hitTestContents(request, result, x, y, finalX, finalY, hitTestAction);
             else
@@ -3947,25 +3982,6 @@ Position RenderBlock::positionForBox(InlineBox *box, bool start) const
     return Position(box->renderer()->node(), start ? textBox->start() : textBox->start() + textBox->len());
 }
 
-Position RenderBlock::positionForRenderer(RenderObject* renderer, bool start) const
-{
-    if (!renderer)
-        return Position(node(), 0);
-
-    Node* n = renderer->node() ? renderer->node() : node();
-    if (!n)
-        return Position();
-
-    ASSERT(renderer == n->renderer());
-
-    int offset = start ? renderer->caretMinOffset() : renderer->caretMaxOffset();
-
-    // FIXME: This was a runtime check that seemingly couldn't fail; changed it to an assertion for now.
-    ASSERT(!n->isCharacterDataNode() || renderer->isText());
-
-    return Position(n, offset);
-}
-
 // FIXME: This function should go on RenderObject as an instance method. Then
 // all cases in which positionForPoint recurs could call this instead to
 // prevent crossing editable boundaries. This would require many tests.
@@ -4139,7 +4155,7 @@ void RenderBlock::calcColumnWidth()
 {    
     // Calculate our column width and column count.
     unsigned desiredColumnCount = 1;
-    int desiredColumnWidth = contentWidth();
+    int desiredColumnWidth = contentLogicalWidth();
     
     // For now, we don't support multi-column layouts when printing, since we have to do a lot of work for proper pagination.
     if (document()->paginated() || (style()->hasAutoColumnCount() && style()->hasAutoColumnWidth())) {
@@ -4214,7 +4230,7 @@ void RenderBlock::setDesiredColumnCountAndWidth(int count, int width)
 int RenderBlock::desiredColumnWidth() const
 {
     if (!hasColumns())
-        return contentWidth();
+        return contentLogicalWidth();
     return gColumnInfoMap->get(this)->desiredColumnWidth();
 }
 
@@ -4243,14 +4259,17 @@ IntRect RenderBlock::columnRectAt(ColumnInfo* colInfo, unsigned index) const
     ASSERT(hasColumns() && gColumnInfoMap->get(this) == colInfo);
 
     // Compute the appropriate rect based off our information.
-    int colWidth = colInfo->desiredColumnWidth();
-    int colHeight = colInfo->columnHeight();
-    int colTop = borderTop() + paddingTop();
+    int colLogicalWidth = colInfo->desiredColumnWidth();
+    int colLogicalHeight = colInfo->columnHeight();
+    int colLogicalTop = borderBefore() + paddingBefore();
     int colGap = columnGap();
-    int colLeft = style()->isLeftToRightDirection() ? 
-                      borderLeft() + paddingLeft() + (index * (colWidth + colGap))
-                      : borderLeft() + paddingLeft() + contentWidth() - colWidth - (index * (colWidth + colGap));
-    return IntRect(colLeft, colTop, colWidth, colHeight);
+    int colLogicalLeft = style()->isLeftToRightDirection() ? 
+                          logicalLeftOffsetForContent() + (index * (colLogicalWidth + colGap))
+                        : logicalLeftOffsetForContent() + contentLogicalWidth() - colLogicalWidth - (index * (colLogicalWidth + colGap));
+    IntRect rect(colLogicalLeft, colLogicalTop, colLogicalWidth, colLogicalHeight);
+    if (style()->isHorizontalWritingMode())
+        return IntRect(colLogicalLeft, colLogicalTop, colLogicalWidth, colLogicalHeight);
+    return IntRect(colLogicalTop, colLogicalLeft, colLogicalHeight, colLogicalWidth);
 }
 
 bool RenderBlock::layoutColumns(bool hasSpecifiedPageLogicalHeight, int pageLogicalHeight, LayoutStateMaintainer& statePusher)
@@ -4270,12 +4289,12 @@ bool RenderBlock::layoutColumns(bool hasSpecifiedPageLogicalHeight, int pageLogi
             // maximum page break distance.
             if (!pageLogicalHeight) {
                 int distanceBetweenBreaks = max(colInfo->maximumDistanceBetweenForcedBreaks(),
-                                                view()->layoutState()->pageLogicalOffset(borderTop() + paddingTop() + contentHeight()) - colInfo->forcedBreakOffset());
+                                                view()->layoutState()->pageLogicalOffset(borderBefore() + paddingBefore() + contentLogicalHeight()) - colInfo->forcedBreakOffset());
                 columnHeight = max(colInfo->minimumColumnHeight(), distanceBetweenBreaks);
             }
-        } else if (contentHeight() > pageLogicalHeight * desiredColumnCount) {
+        } else if (contentLogicalHeight() > pageLogicalHeight * desiredColumnCount) {
             // Now that we know the intrinsic height of the columns, we have to rebalance them.
-            columnHeight = max(colInfo->minimumColumnHeight(), (int)ceilf((float)contentHeight() / desiredColumnCount));
+            columnHeight = max(colInfo->minimumColumnHeight(), (int)ceilf((float)contentLogicalHeight() / desiredColumnCount));
         }
         
         if (columnHeight && columnHeight != pageLogicalHeight) {
@@ -4287,10 +4306,10 @@ bool RenderBlock::layoutColumns(bool hasSpecifiedPageLogicalHeight, int pageLogi
     } 
     
     if (pageLogicalHeight)
-        colInfo->setColumnCountAndHeight(ceilf((float)contentHeight() / pageLogicalHeight), pageLogicalHeight);
+        colInfo->setColumnCountAndHeight(ceilf((float)contentLogicalHeight() / pageLogicalHeight), pageLogicalHeight);
 
     if (columnCount(colInfo)) {
-        setLogicalHeight(borderTop() + paddingTop() + colInfo->columnHeight() + borderBottom() + paddingBottom() + horizontalScrollbarHeight());
+        setLogicalHeight(borderBefore() + paddingBefore() + colInfo->columnHeight() + borderAfter() + paddingAfter() + scrollbarLogicalHeight());
         m_overflow.clear();
     }
     
@@ -4309,34 +4328,57 @@ void RenderBlock::adjustPointToColumnContents(IntPoint& point) const
 
     // Determine which columns we intersect.
     int colGap = columnGap();
-    int leftGap = colGap / 2;
+    int halfColGap = colGap / 2;
     IntPoint columnPoint(columnRectAt(colInfo, 0).location());
-    int yOffset = 0;
+    int logicalOffset = 0;
     for (unsigned i = 0; i < colInfo->columnCount(); i++) {
         // Add in half the column gap to the left and right of the rect.
         IntRect colRect = columnRectAt(colInfo, i);
-        IntRect gapAndColumnRect(colRect.x() - leftGap, colRect.y(), colRect.width() + colGap, colRect.height());
-
-        if (point.x() >= gapAndColumnRect.x() && point.x() < gapAndColumnRect.right()) {
-            // FIXME: The clamping that follows is not completely right for right-to-left
-            // content.
-            // Clamp everything above the column to its top left.
-            if (point.y() < gapAndColumnRect.y())
-                point = gapAndColumnRect.location();
-            // Clamp everything below the column to the next column's top left. If there is
-            // no next column, this still maps to just after this column.
-            else if (point.y() >= gapAndColumnRect.bottom()) {
-                point = gapAndColumnRect.location();
-                point.move(0, gapAndColumnRect.height());
+        if (style()->isHorizontalWritingMode()) {
+            IntRect gapAndColumnRect(colRect.x() - halfColGap, colRect.y(), colRect.width() + colGap, colRect.height());
+            if (point.x() >= gapAndColumnRect.x() && point.x() < gapAndColumnRect.maxX()) {
+                // FIXME: The clamping that follows is not completely right for right-to-left
+                // content.
+                // Clamp everything above the column to its top left.
+                if (point.y() < gapAndColumnRect.y())
+                    point = gapAndColumnRect.location();
+                // Clamp everything below the column to the next column's top left. If there is
+                // no next column, this still maps to just after this column.
+                else if (point.y() >= gapAndColumnRect.maxY()) {
+                    point = gapAndColumnRect.location();
+                    point.move(0, gapAndColumnRect.height());
+                }
+
+                // We're inside the column.  Translate the x and y into our column coordinate space.
+                point.move(columnPoint.x() - colRect.x(), logicalOffset);
+                return;
             }
+            
+            // Move to the next position.
+            logicalOffset += colRect.height();
+        } else {
+            IntRect gapAndColumnRect(colRect.x(), colRect.y() - halfColGap, colRect.width(), colRect.height() + colGap);
+            if (point.y() >= gapAndColumnRect.y() && point.y() < gapAndColumnRect.maxY()) {
+                // FIXME: The clamping that follows is not completely right for right-to-left
+                // content.
+                // Clamp everything above the column to its top left.
+                if (point.x() < gapAndColumnRect.x())
+                    point = gapAndColumnRect.location();
+                // Clamp everything below the column to the next column's top left. If there is
+                // no next column, this still maps to just after this column.
+                else if (point.x() >= gapAndColumnRect.maxX()) {
+                    point = gapAndColumnRect.location();
+                    point.move(gapAndColumnRect.width(), 0);
+                }
 
-            // We're inside the column.  Translate the x and y into our column coordinate space.
-            point.move(columnPoint.x() - colRect.x(), yOffset);
-            return;
+                // We're inside the column.  Translate the x and y into our column coordinate space.
+                point.move(logicalOffset, columnPoint.y() - colRect.y());
+                return;
+            }
+            
+            // Move to the next position.
+            logicalOffset += colRect.width();
         }
-
-        // Move to the next position.
-        yOffset += colRect.height();
     }
 }
 
@@ -4356,27 +4398,56 @@ void RenderBlock::adjustRectForColumns(IntRect& r) const
     if (!colCount)
         return;
     
-    int left = borderLeft() + paddingLeft();
-    
-    int currYOffset = 0;
+    int logicalLeft = logicalLeftOffsetForContent();
+    int currLogicalOffset = 0;
+
     for (unsigned i = 0; i < colCount; i++) {
         IntRect colRect = columnRectAt(colInfo, i);
-        int currXOffset = colRect.x() - left;
-        
         IntRect repaintRect = r;
-        repaintRect.move(currXOffset, currYOffset);
-        
+        if (style()->isHorizontalWritingMode()) {
+            int currXOffset = colRect.x() - logicalLeft;
+            repaintRect.move(currXOffset, currLogicalOffset);
+            currLogicalOffset -= colRect.height();
+        } else {
+            int currYOffset = colRect.y() - logicalLeft;
+            repaintRect.move(currLogicalOffset, currYOffset);
+            currLogicalOffset -= colRect.width();
+        }
         repaintRect.intersect(colRect);
-        
         result.unite(repaintRect);
-
-        // Move to the next position.
-        currYOffset -= colRect.height();
     }
 
     r = result;
 }
 
+IntPoint RenderBlock::flipForWritingModeIncludingColumns(const IntPoint& point) const
+{
+    ASSERT(hasColumns());
+    if (!hasColumns() || !style()->isFlippedBlocksWritingMode())
+        return point;
+    ColumnInfo* colInfo = columnInfo();
+    int columnLogicalHeight = colInfo->columnHeight();
+    int expandedLogicalHeight = borderBefore() + paddingBefore() + columnCount(colInfo) * columnLogicalHeight + borderAfter() + paddingAfter() + scrollbarLogicalHeight();
+    if (style()->isHorizontalWritingMode())
+        return IntPoint(point.x(), expandedLogicalHeight - point.y());
+    return IntPoint(expandedLogicalHeight - point.x(), point.y());
+}
+
+void RenderBlock::flipForWritingModeIncludingColumns(IntRect& rect) const
+{
+    ASSERT(hasColumns());
+    if (!hasColumns() || !style()->isFlippedBlocksWritingMode())
+        return;
+    
+    ColumnInfo* colInfo = columnInfo();
+    int columnLogicalHeight = colInfo->columnHeight();
+    int expandedLogicalHeight = borderBefore() + paddingBefore() + columnCount(colInfo) * columnLogicalHeight + borderAfter() + paddingAfter() + scrollbarLogicalHeight();
+    if (style()->isHorizontalWritingMode())
+        rect.setY(expandedLogicalHeight - rect.maxY());
+    else
+        rect.setX(expandedLogicalHeight - rect.maxX());
+}
+
 void RenderBlock::adjustForColumns(IntSize& offset, const IntPoint& point) const
 {
     if (!hasColumns())
@@ -4384,18 +4455,34 @@ void RenderBlock::adjustForColumns(IntSize& offset, const IntPoint& point) const
 
     ColumnInfo* colInfo = columnInfo();
 
-    int left = borderLeft() + paddingLeft();
-    int yOffset = 0;
+    int logicalLeft = logicalLeftOffsetForContent();
     size_t colCount = columnCount(colInfo);
+    int colLogicalWidth = colInfo->desiredColumnWidth();
+    int colLogicalHeight = colInfo->columnHeight();
+
     for (size_t i = 0; i < colCount; ++i) {
-        IntRect columnRect = columnRectAt(colInfo, i);
-        int xOffset = columnRect.x() - left;
-        if (point.y() < columnRect.bottom() + yOffset) {
-            offset.expand(xOffset, -yOffset);
-            return;
-        }
+        // Compute the edges for a given column in the block progression direction.
+        IntRect sliceRect = IntRect(logicalLeft, borderBefore() + paddingBefore() + i * colLogicalHeight, colLogicalWidth, colLogicalHeight);
+        if (!style()->isHorizontalWritingMode())
+            sliceRect = sliceRect.transposedRect();
+        
+        // If we have a flipped blocks writing mode, then convert the column so that it's coming from the after edge (either top or left edge).
+        flipForWritingModeIncludingColumns(sliceRect);
+        
+        int logicalOffset = style()->isFlippedBlocksWritingMode() ? (colCount - 1 - i) * colLogicalHeight : i * colLogicalHeight;
 
-        yOffset += columnRect.height();
+        // Now we're in the same coordinate space as the point.  See if it is inside the rectangle.
+        if (style()->isHorizontalWritingMode()) {
+            if (point.y() >= sliceRect.y() && point.y() < sliceRect.maxY()) {
+                offset.expand(columnRectAt(colInfo, i).x() - logicalLeft, -logicalOffset);
+                return;
+            }
+        } else {
+            if (point.x() >= sliceRect.x() && point.x() < sliceRect.maxX()) {
+                offset.expand(-logicalOffset, columnRectAt(colInfo, i).y() - logicalLeft);
+                return;
+            }
+        }
     }
 }
 
@@ -4535,16 +4622,13 @@ static int getBPMWidth(int childValue, Length cssUnit)
 static int getBorderPaddingMargin(const RenderBoxModelObject* child, bool endOfInline)
 {
     RenderStyle* cstyle = child->style();
-    int result = 0;
-    bool leftSide = (cstyle->isLeftToRightDirection()) ? !endOfInline : endOfInline;
-    result += getBPMWidth((leftSide ? child->marginLeft() : child->marginRight()),
-                          (leftSide ? cstyle->marginLeft() :
-                                      cstyle->marginRight()));
-    result += getBPMWidth((leftSide ? child->paddingLeft() : child->paddingRight()),
-                          (leftSide ? cstyle->paddingLeft() :
-                                      cstyle->paddingRight()));
-    result += leftSide ? child->borderLeft() : child->borderRight();
-    return result;
+    if (endOfInline)
+        return getBPMWidth(child->marginEnd(), cstyle->marginEnd()) + 
+               getBPMWidth(child->paddingEnd(), cstyle->paddingEnd()) +
+               child->borderEnd();
+    return getBPMWidth(child->marginStart(), cstyle->marginStart()) + 
+               getBPMWidth(child->paddingStart(), cstyle->paddingStart()) +
+               child->borderStart();
 }
 
 static inline void stripTrailingSpace(int& inlineMax, int& inlineMin,
@@ -4567,7 +4651,7 @@ void RenderBlock::computeInlinePreferredLogicalWidths()
     int inlineMax = 0;
     int inlineMin = 0;
 
-    int cw = containingBlock()->contentWidth();
+    int cw = containingBlock()->contentLogicalWidth();
 
     // If we are at the start of a line, we want to ignore all white-space.
     // Also strip spaces if we previously had text that ended in a trailing space.
@@ -4577,7 +4661,7 @@ void RenderBlock::computeInlinePreferredLogicalWidths()
     // Firefox and Opera will allow a table cell to grow to fit an image inside it under
     // very specific cirucumstances (in order to match common WinIE renderings). 
     // Not supporting the quirk has caused us to mis-render some real sites. (See Bugzilla 10517.) 
-    bool allowImagesToBreak = !document()->inQuirksMode() || !isTableCell() || !style()->width().isIntrinsicOrAuto();
+    bool allowImagesToBreak = !document()->inQuirksMode() || !isTableCell() || !style()->logicalWidth().isIntrinsicOrAuto();
 
     bool autoWrap, oldAutoWrap;
     autoWrap = oldAutoWrap = style()->autoWrap();
@@ -4645,12 +4729,12 @@ void RenderBlock::computeInlinePreferredLogicalWidths()
                 } else {
                     // Inline replaced elts add in their margins to their min/max values.
                     int margins = 0;
-                    Length leftMargin = cstyle->marginLeft();
-                    Length rightMargin = cstyle->marginRight();
-                    if (leftMargin.isFixed())
-                        margins += leftMargin.value();
-                    if (rightMargin.isFixed())
-                        margins += rightMargin.value();
+                    Length startMargin = cstyle->marginStart();
+                    Length endMargin = cstyle->marginEnd();
+                    if (startMargin.isFixed())
+                        margins += startMargin.value();
+                    if (endMargin.isFixed())
+                        margins += endMargin.value();
                     childMin += margins;
                     childMax += margins;
                 }
@@ -4689,8 +4773,8 @@ void RenderBlock::computeInlinePreferredLogicalWidths()
                 if (!addedTextIndent) {
                     addedTextIndent = true;
                     ti = style()->textIndent().calcMinValue(cw);
-                    childMin+=ti;
-                    childMax+=ti;
+                    childMin += ti;
+                    childMax += ti;
                 }
 
                 // Add our width to the max.
@@ -4725,6 +4809,9 @@ void RenderBlock::computeInlinePreferredLogicalWidths()
                     continue;
                 }
 
+                if (t->style()->hasTextCombine())
+                    toRenderCombineText(t)->combineText();
+
                 // Determine if we have a breakable character.  Pass in
                 // whether or not we should ignore any spaces at the front
                 // of the string.  If those are going to be stripped out,
@@ -4852,14 +4939,16 @@ void RenderBlock::computeBlockPreferredLogicalWidths()
         // A margin basically has three types: fixed, percentage, and auto (variable).
         // Auto and percentage margins simply become 0 when computing min/max width.
         // Fixed margins can be added in as is.
-        Length ml = child->style()->marginLeft();
-        Length mr = child->style()->marginRight();
-        int margin = 0, marginLeft = 0, marginRight = 0;
-        if (ml.isFixed())
-            marginLeft += ml.value();
-        if (mr.isFixed())
-            marginRight += mr.value();
-        margin = marginLeft + marginRight;
+        Length startMarginLength = child->style()->marginStart();
+        Length endMarginLength = child->style()->marginEnd();
+        int margin = 0;
+        int marginStart = 0;
+        int marginEnd = 0;
+        if (startMarginLength.isFixed())
+            marginStart += startMarginLength.value();
+        if (endMarginLength.isFixed())
+            marginEnd += endMarginLength.value();
+        margin = marginStart + marginEnd;
 
         int w = child->minPreferredLogicalWidth() + margin;
         m_minPreferredLogicalWidth = max(w, m_minPreferredLogicalWidth);
@@ -4875,8 +4964,11 @@ void RenderBlock::computeBlockPreferredLogicalWidths()
                 // Determine a left and right max value based off whether or not the floats can fit in the
                 // margins of the object.  For negative margins, we will attempt to overlap the float if the negative margin
                 // is smaller than the float width.
-                int maxLeft = marginLeft > 0 ? max(floatLeftWidth, marginLeft) : floatLeftWidth + marginLeft;
-                int maxRight = marginRight > 0 ? max(floatRightWidth, marginRight) : floatRightWidth + marginRight;
+                bool ltr = containingBlock()->style()->isLeftToRightDirection();
+                int marginLogicalLeft = ltr ? marginStart : marginEnd;
+                int marginLogicalRight = ltr ? marginEnd : marginStart;
+                int maxLeft = marginLogicalLeft > 0 ? max(floatLeftWidth, marginLogicalLeft) : floatLeftWidth + marginLogicalLeft;
+                int maxRight = marginLogicalRight > 0 ? max(floatRightWidth, marginLogicalRight) : floatRightWidth + marginLogicalRight;
                 w = child->maxPreferredLogicalWidth() + maxLeft + maxRight;
                 w = max(w, floatLeftWidth + floatRightWidth);
             }
@@ -4906,7 +4998,7 @@ void RenderBlock::computeBlockPreferredLogicalWidths()
         // of 100px because of the table.
         // We can achieve this effect by making the maxwidth of blocks that contain tables
         // with percentage widths be infinite (as long as they are not inside a table cell).
-        if (document()->inQuirksMode() && child->style()->width().isPercent() &&
+        if (document()->inQuirksMode() && child->style()->logicalWidth().isPercent() &&
             !isTableCell() && child->isTable() && m_maxPreferredLogicalWidth < BLOCK_MAX_WIDTH) {
             RenderBlock* cb = containingBlock();
             while (!cb->isRenderView() && !cb->isTableCell())
@@ -4992,8 +5084,8 @@ int RenderBlock::baselinePosition(FontBaseline baselineType, bool firstLine, Lin
         return RenderBox::baselinePosition(baselineType, firstLine, direction, linePositionMode);
     }
 
-    const Font& f = style(firstLine)->font();
-    return f.ascent(baselineType) + (lineHeight(firstLine, direction, linePositionMode) - f.height()) / 2;
+    const FontMetrics& fontMetrics = style(firstLine)->fontMetrics();
+    return fontMetrics.ascent(baselineType) + (lineHeight(firstLine, direction, linePositionMode) - fontMetrics.height()) / 2;
 }
 
 int RenderBlock::firstLineBoxBaseline() const
@@ -5003,7 +5095,7 @@ int RenderBlock::firstLineBoxBaseline() const
 
     if (childrenInline()) {
         if (firstLineBox())
-            return firstLineBox()->logicalTop() + style(true)->font().ascent(firstRootBox()->baselineType());
+            return firstLineBox()->logicalTop() + style(true)->fontMetrics().ascent(firstRootBox()->baselineType());
         else
             return -1;
     }
@@ -5029,11 +5121,13 @@ int RenderBlock::lastLineBoxBaseline() const
 
     if (childrenInline()) {
         if (!firstLineBox() && hasLineIfEmpty()) {
-            const Font& f = firstLineStyle()->font();
-            return f.ascent() + (lineHeight(true, lineDirection, PositionOfInteriorLineBoxes) - f.height()) / 2 + (lineDirection == HorizontalLine ? borderTop() + paddingTop() : borderRight() + paddingRight());
+            const FontMetrics& fontMetrics = firstLineStyle()->fontMetrics();
+            return fontMetrics.ascent()
+                 + (lineHeight(true, lineDirection, PositionOfInteriorLineBoxes) - fontMetrics.height()) / 2
+                 + (lineDirection == HorizontalLine ? borderTop() + paddingTop() : borderRight() + paddingRight());
         }
         if (lastLineBox())
-            return lastLineBox()->logicalTop() + style(lastLineBox() == firstLineBox())->font().ascent(lastRootBox()->baselineType());
+            return lastLineBox()->logicalTop() + style(lastLineBox() == firstLineBox())->fontMetrics().ascent(lastRootBox()->baselineType());
         return -1;
     } else {
         bool haveNormalFlowChild = false;
@@ -5046,8 +5140,10 @@ int RenderBlock::lastLineBoxBaseline() const
             }
         }
         if (!haveNormalFlowChild && hasLineIfEmpty()) {
-            const Font& f = firstLineStyle()->font();
-            return f.ascent() + (lineHeight(true, lineDirection, PositionOfInteriorLineBoxes) - f.height()) / 2 + (lineDirection == HorizontalLine ? borderTop() + paddingTop() : borderRight() + paddingRight());
+            const FontMetrics& fontMetrics = firstLineStyle()->fontMetrics();
+            return fontMetrics.ascent()
+                 + (lineHeight(true, lineDirection, PositionOfInteriorLineBoxes) - fontMetrics.height()) / 2
+                 + (lineDirection == HorizontalLine ? borderTop() + paddingTop() : borderRight() + paddingRight());
         }
     }
 
@@ -5400,7 +5496,7 @@ void RenderBlock::adjustForBorderFit(int x, int& left, int& right) const
             for (; (r = it.current()); ++it) {
                 // Only examine the object if our m_shouldPaint flag is set.
                 if (r->m_shouldPaint) {
-                    int floatLeft = r->left() - r->m_renderer->x() + r->m_renderer->marginLeft();
+                    int floatLeft = xPositionForFloatIncludingMargin(r) - r->m_renderer->x();
                     int floatRight = floatLeft + r->m_renderer->width();
                     left = min(left, floatLeft);
                     right = max(right, floatRight);
@@ -5755,16 +5851,18 @@ RenderBlock* RenderBlock::createAnonymousColumnSpanBlock() const
     return newBox;
 }
 
-int RenderBlock::nextPageTop(int yPos) const
+int RenderBlock::nextPageLogicalTop(int logicalOffset) const
 {
     LayoutState* layoutState = view()->layoutState();
     if (!layoutState->m_pageLogicalHeight)
-        return yPos;
+        return logicalOffset;
     
-    // The yPos is in our coordinate space.  We can add in our pushed offset.
+    // The logicalOffset is in our coordinate space.  We can add in our pushed offset.
     int pageLogicalHeight = layoutState->m_pageLogicalHeight;
-    int remainingHeight = (pageLogicalHeight - ((layoutState->m_layoutOffset - layoutState->m_pageOffset).height() + yPos) % pageLogicalHeight) % pageLogicalHeight;
-    return yPos + remainingHeight;
+    IntSize delta = layoutState->m_layoutOffset - layoutState->m_pageOffset;
+    int offset = style()->isHorizontalWritingMode() ? delta.height() : delta.width();
+    int remainingLogicalHeight = (pageLogicalHeight - (offset + logicalOffset) % pageLogicalHeight) % pageLogicalHeight;
+    return logicalOffset + remainingLogicalHeight;
 }
 
 static bool inNormalFlow(RenderBox* child)
@@ -5781,7 +5879,7 @@ static bool inNormalFlow(RenderBox* child)
     return true;
 }
 
-int RenderBlock::applyBeforeBreak(RenderBox* child, int yPos)
+int RenderBlock::applyBeforeBreak(RenderBox* child, int logicalOffset)
 {
     // FIXME: Add page break checking here when we support printing.
     bool checkColumnBreaks = view()->layoutState()->isPaginatingColumns();
@@ -5789,13 +5887,13 @@ int RenderBlock::applyBeforeBreak(RenderBox* child, int yPos)
     bool checkBeforeAlways = (checkColumnBreaks && child->style()->columnBreakBefore() == PBALWAYS) || (checkPageBreaks && child->style()->pageBreakBefore() == PBALWAYS);
     if (checkBeforeAlways && inNormalFlow(child)) {
         if (checkColumnBreaks)
-            view()->layoutState()->addForcedColumnBreak(yPos);
-        return nextPageTop(yPos);
+            view()->layoutState()->addForcedColumnBreak(logicalOffset);
+        return nextPageLogicalTop(logicalOffset);
     }
-    return yPos;
+    return logicalOffset;
 }
 
-int RenderBlock::applyAfterBreak(RenderBox* child, int yPos, MarginInfo& marginInfo)
+int RenderBlock::applyAfterBreak(RenderBox* child, int logicalOffset, MarginInfo& marginInfo)
 {
     // FIXME: Add page break checking here when we support printing.
     bool checkColumnBreaks = view()->layoutState()->isPaginatingColumns();
@@ -5804,28 +5902,30 @@ int RenderBlock::applyAfterBreak(RenderBox* child, int yPos, MarginInfo& marginI
     if (checkAfterAlways && inNormalFlow(child)) {
         marginInfo.setMarginAfterQuirk(true); // Cause margins to be discarded for any following content.
         if (checkColumnBreaks)
-            view()->layoutState()->addForcedColumnBreak(yPos);
-        return nextPageTop(yPos);
+            view()->layoutState()->addForcedColumnBreak(logicalOffset);
+        return nextPageLogicalTop(logicalOffset);
     }
-    return yPos;
+    return logicalOffset;
 }
 
-int RenderBlock::adjustForUnsplittableChild(RenderBox* child, int yPos, bool includeMargins)
+int RenderBlock::adjustForUnsplittableChild(RenderBox* child, int logicalOffset, bool includeMargins)
 {
     bool isUnsplittable = child->isReplaced() || child->scrollsOverflow();
     if (!isUnsplittable)
-        return yPos;
-    int childHeight = child->height() + (includeMargins ? child->marginTop() + child->marginBottom() : 0);
+        return logicalOffset;
+    int childLogicalHeight = logicalHeightForChild(child) + (includeMargins ? marginBeforeForChild(child) + marginAfterForChild(child) : 0);
     LayoutState* layoutState = view()->layoutState();
     if (layoutState->m_columnInfo)
-        layoutState->m_columnInfo->updateMinimumColumnHeight(childHeight);
+        layoutState->m_columnInfo->updateMinimumColumnHeight(childLogicalHeight);
     int pageLogicalHeight = layoutState->m_pageLogicalHeight;
-    if (!pageLogicalHeight || childHeight > pageLogicalHeight)
-        return yPos;
-    int remainingHeight = (pageLogicalHeight - ((layoutState->m_layoutOffset - layoutState->m_pageOffset).height() + yPos) % pageLogicalHeight) % pageLogicalHeight;
-    if (remainingHeight < childHeight)
-        return yPos + remainingHeight;
-    return yPos;
+    if (!pageLogicalHeight || childLogicalHeight > pageLogicalHeight)
+        return logicalOffset;
+    IntSize delta = layoutState->m_layoutOffset - layoutState->m_pageOffset;
+    int offset = style()->isHorizontalWritingMode() ? delta.height() : delta.width();
+    int remainingLogicalHeight = (pageLogicalHeight - (offset + logicalOffset) % pageLogicalHeight) % pageLogicalHeight;
+    if (remainingLogicalHeight < childLogicalHeight)
+        return logicalOffset + remainingLogicalHeight;
+    return logicalOffset;
 }
 
 void RenderBlock::adjustLinePositionForPagination(RootInlineBox* lineBox, int& delta)
@@ -5848,22 +5948,24 @@ void RenderBlock::adjustLinePositionForPagination(RootInlineBox* lineBox, int& d
     // line and all following lines.
     LayoutState* layoutState = view()->layoutState();
     int pageLogicalHeight = layoutState->m_pageLogicalHeight;
-    int yPos = lineBox->topVisualOverflow();
-    int lineHeight = lineBox->bottomVisualOverflow() - yPos;
+    int logicalOffset = lineBox->logicalTopVisualOverflow();
+    int lineHeight = lineBox->logicalBottomVisualOverflow() - logicalOffset;
     if (layoutState->m_columnInfo)
         layoutState->m_columnInfo->updateMinimumColumnHeight(lineHeight);
-    yPos += delta;
+    logicalOffset += delta;
     lineBox->setPaginationStrut(0);
     if (!pageLogicalHeight || lineHeight > pageLogicalHeight)
         return;
-    int remainingHeight = pageLogicalHeight - ((layoutState->m_layoutOffset - layoutState->m_pageOffset).height() + yPos) % pageLogicalHeight;
-    if (remainingHeight < lineHeight) {
-        int totalHeight = lineHeight + max(0, yPos);
-        if (lineBox == firstRootBox() && totalHeight < pageLogicalHeight && !isPositioned() && !isTableCell())
-            setPaginationStrut(remainingHeight + max(0, yPos));
+    IntSize offsetDelta = layoutState->m_layoutOffset - layoutState->m_pageOffset;
+    int offset = style()->isHorizontalWritingMode() ? offsetDelta.height() : offsetDelta.width();
+    int remainingLogicalHeight = pageLogicalHeight - (offset + logicalOffset) % pageLogicalHeight;
+    if (remainingLogicalHeight < lineHeight) {
+        int totalLogicalHeight = lineHeight + max(0, logicalOffset);
+        if (lineBox == firstRootBox() && totalLogicalHeight < pageLogicalHeight && !isPositioned() && !isTableCell())
+            setPaginationStrut(remainingLogicalHeight + max(0, logicalOffset));
         else {
-            delta += remainingHeight;
-            lineBox->setPaginationStrut(remainingHeight);
+            delta += remainingLogicalHeight;
+            lineBox->setPaginationStrut(remainingLogicalHeight);
         }
     }  
 }
diff --git a/Source/WebCore/rendering/RenderBlock.h b/Source/WebCore/rendering/RenderBlock.h
index f8829ee..2c61331 100644
--- a/Source/WebCore/rendering/RenderBlock.h
+++ b/Source/WebCore/rendering/RenderBlock.h
@@ -106,6 +106,9 @@ public:
     // Block flows subclass availableWidth to handle multi column layout (shrinking the width available to children when laying out.)
     virtual int availableLogicalWidth() const;
 
+    IntPoint flipForWritingModeIncludingColumns(const IntPoint&) const;
+    void flipForWritingModeIncludingColumns(IntRect&) const;
+
     RootInlineBox* firstRootBox() const { return static_cast<RootInlineBox*>(firstLineBox()); }
     RootInlineBox* lastRootBox() const { return static_cast<RootInlineBox*>(lastLineBox()); }
 
@@ -212,6 +215,9 @@ public:
 
     virtual void scrollbarsChanged(bool /*horizontalScrollbarChanged*/, bool /*verticalScrollbarChanged*/) { };
 
+    int logicalRightOffsetForContent() const { return style()->isHorizontalWritingMode() ? borderLeft() + paddingLeft() + availableLogicalWidth() : borderTop() + paddingTop() + availableLogicalWidth(); }
+    int logicalLeftOffsetForContent() const { return style()->isHorizontalWritingMode() ? borderLeft() + paddingLeft() : borderTop() + paddingTop(); }
+
 protected:
     // These functions are only used internally to manipulate the render tree structure via remove/insert/appendChildNode.
     // Since they are typically called only to move objects around within anonymous blocks (which only have layers in
@@ -261,8 +267,6 @@ protected:
     virtual void paint(PaintInfo&, int tx, int ty);
     virtual void paintObject(PaintInfo&, int tx, int ty);
 
-    int logicalRightOffsetForContent() const { return style()->isHorizontalWritingMode() ? borderLeft() + paddingLeft() + availableLogicalWidth() : borderTop() + paddingTop() + availableLogicalWidth(); }
-    int logicalLeftOffsetForContent() const { return style()->isHorizontalWritingMode() ? borderLeft() + paddingLeft() : borderTop() + paddingTop(); }
     int logicalRightOffsetForLine(int position, int fixedOffset, bool applyTextIndent = true, int* logicalHeightRemaining = 0) const;
     int logicalLeftOffsetForLine(int position, int fixedOffset, bool applyTextIndent = true, int* logicalHeightRemaining = 0) const;
 
@@ -393,15 +397,15 @@ private:
         bool isPlaced() const { return m_isPlaced; }
         void setIsPlaced(bool placed = true) { m_isPlaced = placed; }
 
-        int left() const { ASSERT(isPlaced()); return m_frameRect.x(); }
-        int right() const { ASSERT(isPlaced()); return m_frameRect.right(); }
-        int top() const { ASSERT(isPlaced()); return m_frameRect.y(); }
-        int bottom() const { ASSERT(isPlaced()); return m_frameRect.bottom(); }
+        int x() const { ASSERT(isPlaced()); return m_frameRect.x(); }
+        int maxX() const { ASSERT(isPlaced()); return m_frameRect.maxX(); }
+        int y() const { ASSERT(isPlaced()); return m_frameRect.y(); }
+        int maxY() const { ASSERT(isPlaced()); return m_frameRect.maxY(); }
         int width() const { return m_frameRect.width(); }
         int height() const { return m_frameRect.height(); }
-    
-        void setLeft(int left) { m_frameRect.setX(left); }
-        void setTop(int top) { m_frameRect.setY(top); }
+
+        void setX(int x) { m_frameRect.setX(x); }
+        void setY(int y) { m_frameRect.setY(y); }
         void setWidth(int width) { m_frameRect.setWidth(width); }
         void setHeight(int height) { m_frameRect.setHeight(height); }
 
@@ -417,24 +421,26 @@ private:
         bool m_isPlaced : 1;
     };
 
-    int logicalTopForFloat(FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->top() : child->left(); }
-    int logicalBottomForFloat(FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->bottom() : child->right(); }
-    int logicalLeftForFloat(FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->left() : child->top(); }
-    int logicalRightForFloat(FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->right() : child->bottom(); }
-    int logicalWidthForFloat(FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->width() : child->height(); }
+    IntPoint flipFloatForWritingMode(const FloatingObject*, const IntPoint&) const;
+
+    int logicalTopForFloat(const FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->y() : child->x(); }
+    int logicalBottomForFloat(const FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->maxY() : child->maxX(); }
+    int logicalLeftForFloat(const FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->x() : child->y(); }
+    int logicalRightForFloat(const FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->maxX() : child->maxY(); }
+    int logicalWidthForFloat(const FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->width() : child->height(); }
     void setLogicalTopForFloat(FloatingObject* child, int logicalTop)
     {
         if (style()->isHorizontalWritingMode())
-            child->setTop(logicalTop);
+            child->setY(logicalTop);
         else
-            child->setLeft(logicalTop);
+            child->setX(logicalTop);
     }
     void setLogicalLeftForFloat(FloatingObject* child, int logicalLeft)
     {
         if (style()->isHorizontalWritingMode())
-            child->setLeft(logicalLeft);
+            child->setX(logicalLeft);
         else
-            child->setTop(logicalLeft);
+            child->setY(logicalLeft);
     }
     void setLogicalHeightForFloat(FloatingObject* child, int logicalHeight)
     {
@@ -451,6 +457,22 @@ private:
             child->setHeight(logicalWidth);
     }
 
+    int xPositionForFloatIncludingMargin(const FloatingObject* child) const
+    {
+        if (style()->isHorizontalWritingMode())
+            return child->x() + child->renderer()->marginLeft();
+        else
+            return child->x() + marginBeforeForChild(child->renderer());
+    }
+        
+    int yPositionForFloatIncludingMargin(const FloatingObject* child) const
+    {
+        if (style()->isHorizontalWritingMode())
+            return child->y() + marginBeforeForChild(child->renderer());
+        else
+            return child->y() + child->renderer()->marginTop();
+    }
+
     // The following functions' implementations are in RenderBlockLineLayout.cpp.
     RootInlineBox* determineStartPosition(bool& firstLine, bool& fullLayout, bool& previousLineBrokeCleanly,
                                           InlineBidiResolver&, Vector<FloatWithRect>& floats, unsigned& numCleanFloats,
@@ -488,7 +510,7 @@ private:
 
     FloatingObject* insertFloatingObject(RenderBox*);
     void removeFloatingObject(RenderBox*);
-    void removeFloatingObjectsBelow(FloatingObject*, int y);
+    void removeFloatingObjectsBelow(FloatingObject*, int logicalOffset);
     
     // Called from lineWidth, to position the floats added in the last line.
     // Returns true if and only if it has positioned any floats.
@@ -568,7 +590,6 @@ private:
     void newLine(EClear);
 
     Position positionForBox(InlineBox*, bool start = true) const;
-    Position positionForRenderer(RenderObject*, bool start = true) const;
     VisiblePosition positionForPointWithInlineChildren(const IntPoint&);
 
     // Adjust tx and ty from painting offsets to the local coords of this renderer
@@ -668,11 +689,11 @@ private:
     // End helper functions and structs used by layoutBlockChildren.
 
     // Pagination routines.
-    int nextPageTop(int yPos) const; // Returns the top of the next page following yPos.
-    int applyBeforeBreak(RenderBox* child, int yPos); // If the child has a before break, then return a new yPos that shifts to the top of the next page/column.
-    int applyAfterBreak(RenderBox* child, int yPos, MarginInfo& marginInfo); // If the child has an after break, then return a new yPos that shifts to the top of the next page/column.
-    int adjustForUnsplittableChild(RenderBox* child, int yPos, bool includeMargins = false); // If the child is unsplittable and can't fit on the current page, return the top of the next page/column.
-    void adjustLinePositionForPagination(RootInlineBox*, int& deltaY); // Computes a deltaY value that put a line at the top of the next page if it doesn't fit on the current page.
+    int nextPageLogicalTop(int logicalOffset) const; // Returns the top of the next page following logicalOffset.
+    int applyBeforeBreak(RenderBox* child, int logicalOffset); // If the child has a before break, then return a new yPos that shifts to the top of the next page/column.
+    int applyAfterBreak(RenderBox* child, int logicalOffset, MarginInfo& marginInfo); // If the child has an after break, then return a new offset that shifts to the top of the next page/column.
+    int adjustForUnsplittableChild(RenderBox* child, int logicalOffset, bool includeMargins = false); // If the child is unsplittable and can't fit on the current page, return the top of the next page/column.
+    void adjustLinePositionForPagination(RootInlineBox*, int& deltaOffset); // Computes a deltaOffset value that put a line at the top of the next page if it doesn't fit on the current page.
 
     typedef PositionedObjectsListHashSet::const_iterator Iterator;
     DeprecatedPtrList<FloatingObject>* m_floatingObjects;
diff --git a/Source/WebCore/rendering/RenderBlockLineLayout.cpp b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
index 5e16931..00c2d86 100644
--- a/Source/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2003, 2004, 2006, 2007, 2008, 2009, 2010 Apple Inc. All right reserved.
+ * Copyright (C) 2003, 2004, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All right reserved.
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ -23,12 +23,12 @@
 #include "config.h"
 
 #include "BidiResolver.h"
-#include "CharacterNames.h"
 #include "Hyphenation.h"
 #include "InlineIterator.h"
 #include "InlineTextBox.h"
 #include "Logging.h"
 #include "RenderArena.h"
+#include "RenderCombineText.h"
 #include "RenderInline.h"
 #include "RenderLayer.h"
 #include "RenderListMarker.h"
@@ -42,6 +42,7 @@
 #include <wtf/RefCountedLeakCounter.h>
 #include <wtf/StdLibExtras.h>
 #include <wtf/Vector.h>
+<<<<<<< HEAD
 #ifdef ANDROID_LAYOUT
 #include "Frame.h"
 #include "FrameTree.h"
@@ -49,6 +50,9 @@
 #include "Text.h"
 #include "HTMLNames.h"
 #endif // ANDROID_LAYOUT
+=======
+#include <wtf/unicode/CharacterNames.h>
+>>>>>>> webkit.org at r78450
 
 #if ENABLE(SVG)
 #include "RenderSVGInlineText.h"
@@ -190,6 +194,16 @@ static inline void dirtyLineBoxesForRenderer(RenderObject* o, bool fullLayout)
         toRenderInline(o)->dirtyLineBoxes(fullLayout);
 }
 
+static bool parentIsConstructedOrHaveNext(InlineFlowBox* parentBox)
+{
+    do {
+        if (parentBox->isConstructed() || parentBox->nextOnLine())
+            return true;
+        parentBox = parentBox->parent();
+    } while (parentBox);
+    return false;
+}
+
 InlineFlowBox* RenderBlock::createLineBoxes(RenderObject* obj, bool firstLine)
 {
     // See if we have an unconstructed line box for this object that is also
@@ -204,13 +218,13 @@ InlineFlowBox* RenderBlock::createLineBoxes(RenderObject* obj, bool firstLine)
         // Get the last box we made for this render object.
         parentBox = obj->isRenderInline() ? toRenderInline(obj)->lastLineBox() : toRenderBlock(obj)->lastLineBox();
 
-        // If this box is constructed then it is from a previous line, and we need
-        // to make a new box for our line.  If this box is unconstructed but it has
+        // If this box or its ancestor is constructed then it is from a previous line, and we need
+        // to make a new box for our line.  If this box or its ancestor is unconstructed but it has
         // something following it on the line, then we know we have to make a new box
         // as well.  In this situation our inline has actually been split in two on
         // the same line (this can happen with very fancy language mixtures).
         bool constructedNewBox = false;
-        if (!parentBox || parentBox->isConstructed() || parentBox->nextOnLine()) {
+        if (!parentBox || parentIsConstructedOrHaveNext(parentBox)) {
             // We need to make a new box for this render object.  Once
             // made, we need to place it at the end of the current line.
             InlineBox* newBox = createInlineBoxForRenderer(obj, obj == this);
@@ -317,7 +331,9 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
     int availableLogicalWidth = availableLogicalWidthForLine(logicalHeight(), firstLine);
     int totalLogicalWidth = lineBox->getFlowSpacingLogicalWidth();
     bool needsWordSpacing = false;
-    unsigned numSpaces = 0;
+    unsigned expansionOpportunityCount = 0;
+    bool isAfterExpansion = true;
+    Vector<unsigned, 16> expansionOpportunities;
     ETextAlign textAlign = style()->textAlign();
 
     for (BidiRun* r = firstRun; r; r = r->next()) {
@@ -329,12 +345,9 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
             RenderText* rt = toRenderText(r->m_object);
 
             if (textAlign == JUSTIFY && r != trailingSpaceRun) {
-                const UChar* characters = rt->characters();
-                for (int i = r->m_start; i < r->m_stop; i++) {
-                    UChar c = characters[i];
-                    if (c == ' ' || c == '\n' || c == '\t')
-                        numSpaces++;
-                }
+                unsigned opportunitiesInRun = Font::expansionOpportunityCount(rt->characters() + r->m_start, r->m_stop - r->m_start, r->m_box->direction(), isAfterExpansion);
+                expansionOpportunities.append(opportunitiesInRun);
+                expansionOpportunityCount += opportunitiesInRun;
             }
 
             if (int length = rt->textLength()) {
@@ -361,16 +374,24 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
                 GlyphOverflowAndFallbackFontsMap::iterator it = textBoxDataMap.add(static_cast<InlineTextBox*>(r->m_box), make_pair(Vector<const SimpleFontData*>(), GlyphOverflow())).first;
                 it->second.second = glyphOverflow;
             }
-        } else if (!r->m_object->isRenderInline()) {
-            RenderBox* renderBox = toRenderBox(r->m_object);
-            renderBox->computeLogicalWidth();
-            r->m_box->setLogicalWidth(logicalWidthForChild(renderBox));
-            totalLogicalWidth += marginStartForChild(renderBox) + marginEndForChild(renderBox);
+        } else {
+            isAfterExpansion = false;
+            if (!r->m_object->isRenderInline()) {
+                RenderBox* renderBox = toRenderBox(r->m_object);
+                renderBox->computeLogicalWidth();
+                r->m_box->setLogicalWidth(logicalWidthForChild(renderBox));
+                totalLogicalWidth += marginStartForChild(renderBox) + marginEndForChild(renderBox);
+            }
         }
 
         totalLogicalWidth += r->m_box->logicalWidth();
     }
 
+    if (isAfterExpansion && !expansionOpportunities.isEmpty()) {
+        expansionOpportunities.last()--;
+        expansionOpportunityCount--;
+    }
+
     // Armed with the total width of the line (without justification),
     // we now examine our text-align property in order to determine where to position the
     // objects horizontally.  The total width of the line can be increased if we end up
@@ -392,7 +413,7 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
             }
             break;
         case JUSTIFY:
-            if (numSpaces && !reachedEnd && !lineBox->endsWithBreak()) {
+            if (expansionOpportunityCount && !reachedEnd && !lineBox->endsWithBreak()) {
                 if (trailingSpaceRun) {
                     totalLogicalWidth -= trailingSpaceRun->m_box->logicalWidth();
                     trailingSpaceRun->m_box->setLogicalWidth(0);
@@ -401,7 +422,7 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
             }
             // fall through
         case TAAUTO:
-            numSpaces = 0;
+            expansionOpportunityCount = 0;
             // for right to left fall through to right aligned
             if (style()->isLeftToRightDirection()) {
                 if (totalLogicalWidth > availableLogicalWidth && trailingSpaceRun)
@@ -443,31 +464,26 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
             break;
     }
 
-    if (numSpaces) {
+    if (expansionOpportunityCount) {
+        size_t i = 0;
         for (BidiRun* r = firstRun; r; r = r->next()) {
             if (!r->m_box || r == trailingSpaceRun)
                 continue;
 
-            int spaceAdd = 0;
             if (r->m_object->isText()) {
-                unsigned spaces = 0;
-                const UChar* characters = toRenderText(r->m_object)->characters();
-                for (int i = r->m_start; i < r->m_stop; i++) {
-                    UChar c = characters[i];
-                    if (c == ' ' || c == '\n' || c == '\t')
-                        spaces++;
-                }
+                unsigned opportunitiesInRun = expansionOpportunities[i++];
 
-                ASSERT(spaces <= numSpaces);
+                ASSERT(opportunitiesInRun <= expansionOpportunityCount);
 
                 // Only justify text if whitespace is collapsed.
                 if (r->m_object->style()->collapseWhiteSpace()) {
-                    spaceAdd = (availableLogicalWidth - totalLogicalWidth) * spaces / numSpaces;
-                    static_cast<InlineTextBox*>(r->m_box)->setSpaceAdd(spaceAdd);
-                    totalLogicalWidth += spaceAdd;
+                    InlineTextBox* textBox = static_cast<InlineTextBox*>(r->m_box);
+                    int expansion = (availableLogicalWidth - totalLogicalWidth) * opportunitiesInRun / expansionOpportunityCount;
+                    textBox->setExpansion(expansion);
+                    totalLogicalWidth += expansion;
                 }
-                numSpaces -= spaces;
-                if (!numSpaces)
+                expansionOpportunityCount -= opportunitiesInRun;
+                if (!expansionOpportunityCount)
                     break;
             }
         }
@@ -909,7 +925,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
                         adjustLinePositionForPagination(lineBox, adjustment);
                         if (adjustment) {
                             int oldLineWidth = availableLogicalWidthForLine(oldLogicalHeight, firstLine);
-                            lineBox->adjustPosition(0, adjustment);
+                            lineBox->adjustBlockDirectionPosition(adjustment);
                             if (useRepaintBounds) // This can only be a positive adjustment, so no need to update repaintTop.
                                 repaintLogicalBottom = max(repaintLogicalBottom, afterSideVisualOverflowForLine(lineBox));
                                 
@@ -967,7 +983,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
                     if (delta) {
                         repaintLogicalTop = min(repaintLogicalTop, beforeSideVisualOverflowForLine(line) + min(delta, 0));
                         repaintLogicalBottom = max(repaintLogicalBottom, afterSideVisualOverflowForLine(line) + max(delta, 0));
-                        line->adjustPosition(0, delta);
+                        line->adjustBlockDirectionPosition(delta);
                     }
                     if (Vector<RenderBox*>* cleanLineFloats = line->floatsPtr()) {
                         Vector<RenderBox*>::iterator end = cleanLineFloats->end();
@@ -1084,7 +1100,7 @@ RootInlineBox* RenderBlock::determineStartPosition(bool& firstLine, bool& fullLa
                         
                     repaintLogicalTop = min(repaintLogicalTop, beforeSideVisualOverflowForLine(curr) + min(paginationDelta, 0));
                     repaintLogicalBottom = max(repaintLogicalBottom, afterSideVisualOverflowForLine(curr) + max(paginationDelta, 0));
-                    curr->adjustPosition(0, paginationDelta);
+                    curr->adjustBlockDirectionPosition(paginationDelta);
                 }                
             }
             
@@ -1500,7 +1516,7 @@ void RenderBlock::fitBelowFloats(int widthToFit, bool firstLine, int& availableW
 
 static inline unsigned textWidth(RenderText* text, unsigned from, unsigned len, const Font& font, int xPos, bool isFixedPitch, bool collapseWhiteSpace)
 {
-    if (isFixedPitch || (!from && len == text->textLength()))
+    if (isFixedPitch || (!from && len == text->textLength()) || text->style()->hasTextCombine())
         return text->width(from, len, font, xPos);
     return font.width(TextRun(text->characters() + from, len, !collapseWhiteSpace, xPos));
 }
@@ -1752,11 +1768,14 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             bool isSVGText = t->isSVGInlineText();
 #endif
 
+            RenderStyle* style = t->style(firstLine);
+            if (style->hasTextCombine())
+                toRenderCombineText(o)->combineText();
+
             int strlen = t->textLength();
             int len = strlen - pos;
             const UChar* str = t->characters();
 
-            RenderStyle* style = t->style(firstLine);
             const Font& f = style->font();
             bool isFixedPitch = f.isFixedPitch();
             bool canHyphenate = style->hyphens() == HyphensAuto && WebCore::canHyphenate(style->hyphenationLocale());
@@ -2169,38 +2188,34 @@ void RenderBlock::addOverflowFromInlineChildren()
 
 int RenderBlock::beforeSideVisualOverflowForLine(RootInlineBox* line) const
 {
-    // Overflow is in the block's coordinate space, which means it isn't purely physical.  For flipped blocks (rl and bt),
-    // we continue to use top and left overflow even though physically it's bottom and right.
+    // Overflow is in the block's coordinate space, which means it isn't purely physical.
     if (style()->isHorizontalWritingMode())
-        return line->topVisualOverflow();
-    return line->leftVisualOverflow();
+        return line->minYVisualOverflow();
+    return line->minXVisualOverflow();
 }
 
 int RenderBlock::afterSideVisualOverflowForLine(RootInlineBox* line) const
 {
-    // Overflow is in the block's coordinate space, which means it isn't purely physical.  For flipped blocks (rl and bt),
-    // we continue to use bottom and right overflow even though physically it's top and left.
+    // Overflow is in the block's coordinate space, which means it isn't purely physical.
     if (style()->isHorizontalWritingMode())
-        return line->bottomVisualOverflow();
-    return line->rightVisualOverflow();
+        return line->maxYVisualOverflow();
+    return line->maxXVisualOverflow();
 }
 
 int RenderBlock::beforeSideLayoutOverflowForLine(RootInlineBox* line) const
 {
-    // Overflow is in the block's coordinate space, which means it isn't purely physical.  For flipped blocks (rl and bt),
-    // we continue to use top and left overflow even though physically it's bottom and right.
+    // Overflow is in the block's coordinate space, which means it isn't purely physical.
     if (style()->isHorizontalWritingMode())
-        return line->topLayoutOverflow();
-    return line->leftLayoutOverflow();
+        return line->minYLayoutOverflow();
+    return line->minXLayoutOverflow();
 }
 
 int RenderBlock::afterSideLayoutOverflowForLine(RootInlineBox* line) const
 {
-    // Overflow is in the block's coordinate space, which means it isn't purely physical.  For flipped blocks (rl and bt),
-    // we continue to use bottom and right overflow even though physically it's top and left.
+    // Overflow is in the block's coordinate space, which means it isn't purely physical.
     if (style()->isHorizontalWritingMode())
-        return line->bottomLayoutOverflow();
-    return line->rightLayoutOverflow();
+        return line->maxYLayoutOverflow();
+    return line->maxXLayoutOverflow();
 }
 
 void RenderBlock::deleteEllipsisLineBoxes()
diff --git a/Source/WebCore/rendering/RenderBox.cpp b/Source/WebCore/rendering/RenderBox.cpp
index 265c46a..39c80d4 100644
--- a/Source/WebCore/rendering/RenderBox.cpp
+++ b/Source/WebCore/rendering/RenderBox.cpp
@@ -425,8 +425,8 @@ int RenderBox::scrollWidth() const
     // For objects with visible overflow, this matches IE.
     // FIXME: Need to work right with writing modes.
     if (style()->isLeftToRightDirection())
-        return max(clientWidth(), rightLayoutOverflow() - borderLeft());
-    return clientWidth() - min(0, leftLayoutOverflow() - borderLeft());
+        return max(clientWidth(), maxXLayoutOverflow() - borderLeft());
+    return clientWidth() - min(0, minXLayoutOverflow() - borderLeft());
 }
 
 int RenderBox::scrollHeight() const
@@ -435,7 +435,7 @@ int RenderBox::scrollHeight() const
         return layer()->scrollHeight();
     // For objects with visible overflow, this matches IE.
     // FIXME: Need to work right with writing modes.
-    return max(clientHeight(), bottomLayoutOverflow() - borderTop());
+    return max(clientHeight(), maxYLayoutOverflow() - borderTop());
 }
 
 int RenderBox::scrollLeft() const
@@ -559,16 +559,16 @@ IntRect RenderBox::reflectedRect(const IntRect& r) const
     IntRect result = r;
     switch (style()->boxReflect()->direction()) {
         case ReflectionBelow:
-            result.setY(box.bottom() + reflectionOffset() + (box.bottom() - r.bottom()));
+            result.setY(box.maxY() + reflectionOffset() + (box.maxY() - r.maxY()));
             break;
         case ReflectionAbove:
-            result.setY(box.y() - reflectionOffset() - box.height() + (box.bottom() - r.bottom()));
+            result.setY(box.y() - reflectionOffset() - box.height() + (box.maxY() - r.maxY()));
             break;
         case ReflectionLeft:
-            result.setX(box.x() - reflectionOffset() - box.width() + (box.right() - r.right()));
+            result.setX(box.x() - reflectionOffset() - box.width() + (box.maxX() - r.maxX()));
             break;
         case ReflectionRight:
-            result.setX(box.right() + reflectionOffset() + (box.right() - r.right()));
+            result.setX(box.maxX() + reflectionOffset() + (box.maxX() - r.maxX()));
             break;
     }
     return result;
@@ -1279,8 +1279,14 @@ IntSize RenderBox::offsetFromContainer(RenderObject* o, const IntPoint& point) c
 
     if (!isInline() || isReplaced()) {
         if (style()->position() != AbsolutePosition && style()->position() != FixedPosition) {
-            o->adjustForColumns(offset, IntPoint(point.x() + x(), point.y() + y()));
-            offset += locationOffsetIncludingFlipping();
+            if (o->hasColumns()) {
+                IntRect columnRect(frameRect());
+                toRenderBlock(o)->flipForWritingModeIncludingColumns(columnRect);
+                offset += IntSize(columnRect.location().x(), columnRect.location().y());
+                columnRect.move(point.x(), point.y());
+                o->adjustForColumns(offset, columnRect.location());
+            } else
+                offset += locationOffsetIncludingFlipping();
         } else
             offset += locationOffset();
     }
@@ -3067,12 +3073,12 @@ IntRect RenderBox::localCaretRect(InlineBox* box, int caretOffset, int* extraWid
     // <rdar://problem/3777804> Deleting all content in a document can result in giant tall-as-window insertion point
     //
     // FIXME: ignoring :first-line, missing good reason to take care of
-    int fontHeight = style()->font().height();
+    int fontHeight = style()->fontMetrics().height();
     if (fontHeight > rect.height() || (!isReplaced() && !isTable()))
         rect.setHeight(fontHeight);
 
     if (extraWidthToEndOfLine)
-        *extraWidthToEndOfLine = x() + width() - rect.right();
+        *extraWidthToEndOfLine = x() + width() - rect.maxX();
 
     // Move to local coords
     rect.move(-x(), -y());
@@ -3193,9 +3199,9 @@ void RenderBox::addShadowOverflow()
     style()->getBoxShadowExtent(shadowTop, shadowRight, shadowBottom, shadowLeft);
     IntRect borderBox = borderBoxRect();
     int overflowLeft = borderBox.x() + shadowLeft;
-    int overflowRight = borderBox.right() + shadowRight;
+    int overflowRight = borderBox.maxX() + shadowRight;
     int overflowTop = borderBox.y() + shadowTop;
-    int overflowBottom = borderBox.bottom() + shadowBottom;
+    int overflowBottom = borderBox.maxY() + shadowBottom;
     addVisualOverflow(IntRect(overflowLeft, overflowTop, overflowRight - overflowLeft, overflowBottom - overflowTop));
 }
 
@@ -3234,13 +3240,13 @@ void RenderBox::addLayoutOverflow(const IntRect& rect)
         bool hasLeftOverflow = !style()->isLeftToRightDirection() && style()->isHorizontalWritingMode();
         
         if (!hasTopOverflow)
-            overflowRect.shiftTopEdgeTo(max(overflowRect.y(), clientBox.y()));
+            overflowRect.shiftYEdgeTo(max(overflowRect.y(), clientBox.y()));
         else
-            overflowRect.shiftBottomEdgeTo(min(overflowRect.bottom(), clientBox.bottom()));
+            overflowRect.shiftMaxYEdgeTo(min(overflowRect.maxY(), clientBox.maxY()));
         if (!hasLeftOverflow)
-            overflowRect.shiftLeftEdgeTo(max(overflowRect.x(), clientBox.x()));
+            overflowRect.shiftXEdgeTo(max(overflowRect.x(), clientBox.x()));
         else
-            overflowRect.shiftRightEdgeTo(min(overflowRect.right(), clientBox.right()));
+            overflowRect.shiftMaxXEdgeTo(min(overflowRect.maxX(), clientBox.maxX()));
         
         // Now re-test with the adjusted rectangle and see if it has become unreachable or fully
         // contained.
@@ -3329,9 +3335,9 @@ IntRect RenderBox::visualOverflowRectForPropagation(RenderStyle* parentStyle) co
     // We are putting ourselves into our parent's coordinate space.  If there is a flipped block mismatch
     // in a particular axis, then we have to flip the rect along that axis.
     if (style()->writingMode() == RightToLeftWritingMode || parentStyle->writingMode() == RightToLeftWritingMode)
-        rect.setX(width() - rect.right());
+        rect.setX(width() - rect.maxX());
     else if (style()->writingMode() == BottomToTopWritingMode || parentStyle->writingMode() == BottomToTopWritingMode)
-        rect.setY(height() - rect.bottom());
+        rect.setY(height() - rect.maxY());
 
     return rect;
 }
@@ -3375,9 +3381,9 @@ IntRect RenderBox::layoutOverflowRectForPropagation(RenderStyle* parentStyle) co
     // We are putting ourselves into our parent's coordinate space.  If there is a flipped block mismatch
     // in a particular axis, then we have to flip the rect along that axis.
     if (style()->writingMode() == RightToLeftWritingMode || parentStyle->writingMode() == RightToLeftWritingMode)
-        rect.setX(width() - rect.right());
+        rect.setX(width() - rect.maxX());
     else if (style()->writingMode() == BottomToTopWritingMode || parentStyle->writingMode() == BottomToTopWritingMode)
-        rect.setY(height() - rect.bottom());
+        rect.setY(height() - rect.maxY());
 
     return rect;
 }
@@ -3400,9 +3406,9 @@ void RenderBox::flipForWritingMode(IntRect& rect) const
         return;
 
     if (style()->isHorizontalWritingMode())
-        rect.setY(height() - rect.bottom());
+        rect.setY(height() - rect.maxY());
     else
-        rect.setX(width() - rect.right());
+        rect.setX(width() - rect.maxX());
 }
 
 int RenderBox::flipForWritingMode(int position) const
@@ -3419,6 +3425,13 @@ IntPoint RenderBox::flipForWritingMode(const IntPoint& position) const
     return style()->isHorizontalWritingMode() ? IntPoint(position.x(), height() - position.y()) : IntPoint(width() - position.x(), position.y());
 }
 
+IntPoint RenderBox::flipForWritingModeIncludingColumns(const IntPoint& point) const
+{
+    if (!hasColumns() || !style()->isFlippedBlocksWritingMode())
+        return flipForWritingMode(point);
+    return toRenderBlock(this)->flipForWritingModeIncludingColumns(point);
+}
+
 IntSize RenderBox::flipForWritingMode(const IntSize& offset) const
 {
     if (!style()->isFlippedBlocksWritingMode())
diff --git a/Source/WebCore/rendering/RenderBox.h b/Source/WebCore/rendering/RenderBox.h
index acbcc29..7241ed1 100644
--- a/Source/WebCore/rendering/RenderBox.h
+++ b/Source/WebCore/rendering/RenderBox.h
@@ -127,21 +127,25 @@ public:
     RenderBox* nextSiblingBox() const;
     RenderBox* parentBox() const;
 
+    // Visual and layout overflow are in the coordinate space of the box.  This means that they aren't purely physical directions.
+    // For horizontal-tb and vertical-lr they will match physical directions, but for horizontal-bt and vertical-rl, the top/bottom and left/right
+    // respectively are flipped when compared to their physical counterparts.  For example minX is on the left in vertical-lr,
+    // but it is on the right in vertical-rl.
     IntRect layoutOverflowRect() const { return m_overflow ? m_overflow->layoutOverflowRect() : clientBoxRect(); }
-    int topLayoutOverflow() const { return m_overflow? m_overflow->topLayoutOverflow() : borderTop(); }
-    int bottomLayoutOverflow() const { return m_overflow ? m_overflow->bottomLayoutOverflow() : borderTop() + clientHeight(); }
-    int leftLayoutOverflow() const { return m_overflow ? m_overflow->leftLayoutOverflow() : borderLeft(); }
-    int rightLayoutOverflow() const { return m_overflow ? m_overflow->rightLayoutOverflow() : borderLeft() + clientWidth(); }
-    int logicalLeftLayoutOverflow() const { return style()->isHorizontalWritingMode() ? leftLayoutOverflow() : topLayoutOverflow(); }
-    int logicalRightLayoutOverflow() const { return style()->isHorizontalWritingMode() ? rightLayoutOverflow() : bottomLayoutOverflow(); }
+    int minYLayoutOverflow() const { return m_overflow? m_overflow->minYLayoutOverflow() : borderTop(); }
+    int maxYLayoutOverflow() const { return m_overflow ? m_overflow->maxYLayoutOverflow() : borderTop() + clientHeight(); }
+    int minXLayoutOverflow() const { return m_overflow ? m_overflow->minXLayoutOverflow() : borderLeft(); }
+    int maxXLayoutOverflow() const { return m_overflow ? m_overflow->maxXLayoutOverflow() : borderLeft() + clientWidth(); }
+    int logicalLeftLayoutOverflow() const { return style()->isHorizontalWritingMode() ? minXLayoutOverflow() : minYLayoutOverflow(); }
+    int logicalRightLayoutOverflow() const { return style()->isHorizontalWritingMode() ? maxXLayoutOverflow() : maxYLayoutOverflow(); }
     
     IntRect visualOverflowRect() const { return m_overflow ? m_overflow->visualOverflowRect() : borderBoxRect(); }
-    int topVisualOverflow() const { return m_overflow? m_overflow->topVisualOverflow() : 0; }
-    int bottomVisualOverflow() const { return m_overflow ? m_overflow->bottomVisualOverflow() : height(); }
-    int leftVisualOverflow() const { return m_overflow ? m_overflow->leftVisualOverflow() : 0; }
-    int rightVisualOverflow() const { return m_overflow ? m_overflow->rightVisualOverflow() : width(); }
-    int logicalLeftVisualOverflow() const { return style()->isHorizontalWritingMode() ? leftVisualOverflow() : topVisualOverflow(); }
-    int logicalRightVisualOverflow() const { return style()->isHorizontalWritingMode() ? rightVisualOverflow() : bottomVisualOverflow(); }
+    int minYVisualOverflow() const { return m_overflow? m_overflow->minYVisualOverflow() : 0; }
+    int maxYVisualOverflow() const { return m_overflow ? m_overflow->maxYVisualOverflow() : height(); }
+    int minXVisualOverflow() const { return m_overflow ? m_overflow->minXVisualOverflow() : 0; }
+    int maxXVisualOverflow() const { return m_overflow ? m_overflow->maxXVisualOverflow() : width(); }
+    int logicalLeftVisualOverflow() const { return style()->isHorizontalWritingMode() ? minXVisualOverflow() : minYVisualOverflow(); }
+    int logicalRightVisualOverflow() const { return style()->isHorizontalWritingMode() ? maxXVisualOverflow() : maxYVisualOverflow(); }
     
     void addLayoutOverflow(const IntRect&);
     void addVisualOverflow(const IntRect&);
@@ -172,7 +176,7 @@ public:
     int clientTop() const { return borderTop(); }
     int clientWidth() const;
     int clientHeight() const;
-    int clientLogicalBottom() const { return style()->isHorizontalWritingMode() ? clientTop() + clientHeight() : clientLeft() + clientWidth(); }
+    int clientLogicalBottom() const { return borderBefore() + (style()->isHorizontalWritingMode() ? clientHeight() : clientWidth()); }
     IntRect clientBoxRect() const { return IntRect(clientLeft(), clientTop(), clientWidth(), clientHeight()); }
 
     // scrollWidth/scrollHeight will be the same as clientWidth/clientHeight unless the
@@ -378,6 +382,7 @@ public:
     IntPoint flipForWritingMode(const RenderBox* child, const IntPoint&, FlippingAdjustment) const;
     int flipForWritingMode(int position) const; // The offset is in the block direction (y for horizontal writing modes, x for vertical writing modes).
     IntPoint flipForWritingMode(const IntPoint&) const;
+    IntPoint flipForWritingModeIncludingColumns(const IntPoint&) const;
     IntSize flipForWritingMode(const IntSize&) const;
     void flipForWritingMode(IntRect&) const;
     IntSize locationOffsetIncludingFlipping() const;
diff --git a/Source/WebCore/rendering/RenderBoxModelObject.cpp b/Source/WebCore/rendering/RenderBoxModelObject.cpp
index f2412a1..ffbecce 100644
--- a/Source/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/Source/WebCore/rendering/RenderBoxModelObject.cpp
@@ -50,8 +50,8 @@ bool RenderBoxModelObject::s_layerWasSelfPainting = false;
 static const double cInterpolationCutoff = 800. * 800.;
 static const double cLowQualityTimeThreshold = 0.500; // 500 ms
 
-typedef pair<RenderBoxModelObject*, const void*> LastPaintSizeMapKey;
-typedef HashMap<LastPaintSizeMapKey, IntSize> LastPaintSizeMap;
+typedef HashMap<const void*, IntSize> LayerSizeMap;
+typedef HashMap<RenderBoxModelObject*, LayerSizeMap> ObjectLayerSizeMap;
 
 // The HashMap for storing continuation pointers.
 // An inline can be split with blocks occuring in between the inline content.
@@ -68,14 +68,16 @@ class ImageQualityController {
 public:
     ImageQualityController();
     bool shouldPaintAtLowQuality(GraphicsContext*, RenderBoxModelObject*, Image*, const void* layer, const IntSize&);
-    void keyDestroyed(LastPaintSizeMapKey key);
+    void removeLayer(RenderBoxModelObject*, LayerSizeMap* innerMap, const void* layer);
+    void set(RenderBoxModelObject*, LayerSizeMap* innerMap, const void* layer, const IntSize&);
     void objectDestroyed(RenderBoxModelObject*);
+    bool isEmpty() { return m_objectLayerSizeMap.isEmpty(); }
 
 private:
     void highQualityRepaintTimerFired(Timer<ImageQualityController>*);
     void restartTimer();
 
-    LastPaintSizeMap m_lastPaintSizeMap;
+    ObjectLayerSizeMap m_objectLayerSizeMap;
     Timer<ImageQualityController> m_timer;
     bool m_animatedResizeIsActive;
 };
@@ -86,31 +88,41 @@ ImageQualityController::ImageQualityController()
 {
 }
 
-void ImageQualityController::keyDestroyed(LastPaintSizeMapKey key)
+void ImageQualityController::removeLayer(RenderBoxModelObject* object, LayerSizeMap* innerMap, const void* layer)
 {
-    m_lastPaintSizeMap.remove(key);
-    if (m_lastPaintSizeMap.isEmpty()) {
-        m_animatedResizeIsActive = false;
-        m_timer.stop();
+    if (innerMap) {
+        innerMap->remove(layer);
+        if (innerMap->isEmpty())
+            objectDestroyed(object);
     }
 }
     
-void ImageQualityController::objectDestroyed(RenderBoxModelObject* object)
+void ImageQualityController::set(RenderBoxModelObject* object, LayerSizeMap* innerMap, const void* layer, const IntSize& size)
 {
-    Vector<LastPaintSizeMapKey> keysToDie;
-    for (LastPaintSizeMap::iterator it = m_lastPaintSizeMap.begin(); it != m_lastPaintSizeMap.end(); ++it)
-        if (it->first.first == object)
-            keysToDie.append(it->first);
-    for (Vector<LastPaintSizeMapKey>::iterator it = keysToDie.begin(); it != keysToDie.end(); ++it)
-        keyDestroyed(*it);
+    if (innerMap)
+        innerMap->set(layer, size);
+    else {
+        LayerSizeMap newInnerMap;
+        newInnerMap.set(layer, size);
+        m_objectLayerSizeMap.set(object, newInnerMap);
+    }
 }
     
+void ImageQualityController::objectDestroyed(RenderBoxModelObject* object)
+{
+    m_objectLayerSizeMap.remove(object);
+    if (m_objectLayerSizeMap.isEmpty()) {
+        m_animatedResizeIsActive = false;
+        m_timer.stop();
+    }
+}
+
 void ImageQualityController::highQualityRepaintTimerFired(Timer<ImageQualityController>*)
 {
     if (m_animatedResizeIsActive) {
         m_animatedResizeIsActive = false;
-        for (LastPaintSizeMap::iterator it = m_lastPaintSizeMap.begin(); it != m_lastPaintSizeMap.end(); ++it)
-            it->first.first->repaint();
+        for (ObjectLayerSizeMap::iterator it = m_objectLayerSizeMap.begin(); it != m_objectLayerSizeMap.end(); ++it)
+            it->first->repaint();
     }
 }
 
@@ -130,17 +142,24 @@ bool ImageQualityController::shouldPaintAtLowQuality(GraphicsContext* context, R
     // is actually being scaled.
     IntSize imageSize(image->width(), image->height());
 
-    // Look ourselves up in the hashtable.
-    LastPaintSizeMapKey key(object, layer);
-    LastPaintSizeMap::iterator i = m_lastPaintSizeMap.find(key);
+    // Look ourselves up in the hashtables.
+    ObjectLayerSizeMap::iterator i = m_objectLayerSizeMap.find(object);
+    LayerSizeMap* innerMap = i != m_objectLayerSizeMap.end() ? &i->second : 0;
+    IntSize oldSize;
+    bool isFirstResize = true;
+    if (innerMap) {
+        LayerSizeMap::iterator j = innerMap->find(layer);
+        if (j != innerMap->end()) {
+            isFirstResize = false;
+            oldSize = j->second;
+        }
+    }
 
     const AffineTransform& currentTransform = context->getCTM();
     bool contextIsScaled = !currentTransform.isIdentityOrTranslationOrFlipped();
     if (!contextIsScaled && imageSize == size) {
         // There is no scale in effect. If we had a scale in effect before, we can just remove this object from the list.
-        if (i != m_lastPaintSizeMap.end())
-            m_lastPaintSizeMap.remove(key);
-
+        removeLayer(object, innerMap, layer);
         return false;
     }
 
@@ -150,39 +169,44 @@ bool ImageQualityController::shouldPaintAtLowQuality(GraphicsContext* context, R
         if (totalPixels > cInterpolationCutoff)
             return true;
     }
+
     // If an animated resize is active, paint in low quality and kick the timer ahead.
     if (m_animatedResizeIsActive) {
-        m_lastPaintSizeMap.set(key, size);
+        set(object, innerMap, layer, size);
         restartTimer();
         return true;
     }
     // If this is the first time resizing this image, or its size is the
     // same as the last resize, draw at high res, but record the paint
     // size and set the timer.
-    if (i == m_lastPaintSizeMap.end() || size == i->second) {
+    if (isFirstResize || oldSize == size) {
         restartTimer();
-        m_lastPaintSizeMap.set(key, size);
+        set(object, innerMap, layer, size);
         return false;
     }
     // If the timer is no longer active, draw at high quality and don't
     // set the timer.
     if (!m_timer.isActive()) {
-        keyDestroyed(key);
+        removeLayer(object, innerMap, layer);
         return false;
     }
     // This object has been resized to two different sizes while the timer
     // is active, so draw at low quality, set the flag for animated resizes and
     // the object to the list for high quality redraw.
-    m_lastPaintSizeMap.set(key, size);
+    set(object, innerMap, layer, size);
     m_animatedResizeIsActive = true;
     restartTimer();
     return true;
 }
 
+static ImageQualityController* gImageQualityController = 0;
+
 static ImageQualityController* imageQualityController()
 {
-    static ImageQualityController* controller = new ImageQualityController;
-    return controller;
+    if (!gImageQualityController)
+        gImageQualityController = new ImageQualityController;
+
+    return gImageQualityController;
 }
 
 void RenderBoxModelObject::setSelectionState(SelectionState s)
@@ -223,7 +247,13 @@ RenderBoxModelObject::~RenderBoxModelObject()
     // Our layer should have been destroyed and cleared by now
     ASSERT(!hasLayer());
     ASSERT(!m_layer);
-    imageQualityController()->objectDestroyed(this);
+    if (gImageQualityController) {
+        gImageQualityController->objectDestroyed(this);
+        if (gImageQualityController->isEmpty()) {
+            delete gImageQualityController;
+            gImageQualityController = 0;
+        }
+    }
 }
 
 void RenderBoxModelObject::destroyLayer()
@@ -351,7 +381,7 @@ int RenderBoxModelObject::relativePositionOffsetX() const
     // call availableWidth on our containing block.
     if (!style()->left().isAuto()) {
         RenderBlock* cb = containingBlock();
-        if (!style()->right().isAuto() && !containingBlock()->style()->isLeftToRightDirection())
+        if (!style()->right().isAuto() && !cb->style()->isLeftToRightDirection())
             return -style()->right().calcValue(cb->availableWidth());
         return style()->left().calcValue(cb->availableWidth());
     }
@@ -693,9 +723,9 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
             phase += destRect.location() - destOrigin;
             CompositeOperator compositeOp = op == CompositeSourceOver ? bgLayer->composite() : op;
             RenderObject* clientForBackgroundImage = backgroundObject ? backgroundObject : this;
-            Image* image = bg->image(clientForBackgroundImage, tileSize);
-            bool useLowQualityScaling = shouldPaintAtLowQuality(context, image, bgLayer, tileSize);
-            context->drawTiledImage(image, style()->colorSpace(), destRect, phase, tileSize, compositeOp, useLowQualityScaling);
+            RefPtr<Image> image = bg->image(clientForBackgroundImage, tileSize);
+            bool useLowQualityScaling = shouldPaintAtLowQuality(context, image.get(), bgLayer, tileSize);
+            context->drawTiledImage(image.get(), style()->colorSpace(), destRect, phase, tileSize, compositeOp, useLowQualityScaling);
         }
     }
 
@@ -897,7 +927,7 @@ bool RenderBoxModelObject::paintNinePieceImage(GraphicsContext* graphicsContext,
     bool drawMiddle = (imageWidth - leftSlice - rightSlice) > 0 && (w - leftWidth - rightWidth) > 0 &&
                       (imageHeight - topSlice - bottomSlice) > 0 && (h - topWidth - bottomWidth) > 0;
 
-    Image* image = styleImage->image(this, imageSize);
+    RefPtr<Image> image = styleImage->image(this, imageSize);
     ColorSpace colorSpace = style->colorSpace();
 
     if (drawLeft) {
@@ -906,18 +936,18 @@ bool RenderBoxModelObject::paintNinePieceImage(GraphicsContext* graphicsContext,
         // The top left corner rect is (tx, ty, leftWidth, topWidth)
         // The rect to use from within the image is obtained from our slice, and is (0, 0, leftSlice, topSlice)
         if (drawTop)
-            graphicsContext->drawImage(image, colorSpace, IntRect(tx, ty, leftWidth, topWidth),
+            graphicsContext->drawImage(image.get(), colorSpace, IntRect(tx, ty, leftWidth, topWidth),
                                        IntRect(0, 0, leftSlice, topSlice), op);
 
         // The bottom left corner rect is (tx, ty + h - bottomWidth, leftWidth, bottomWidth)
         // The rect to use from within the image is (0, imageHeight - bottomSlice, leftSlice, botomSlice)
         if (drawBottom)
-            graphicsContext->drawImage(image, colorSpace, IntRect(tx, ty + h - bottomWidth, leftWidth, bottomWidth),
+            graphicsContext->drawImage(image.get(), colorSpace, IntRect(tx, ty + h - bottomWidth, leftWidth, bottomWidth),
                                        IntRect(0, imageHeight - bottomSlice, leftSlice, bottomSlice), op);
 
         // Paint the left edge.
         // Have to scale and tile into the border rect.
-        graphicsContext->drawTiledImage(image, colorSpace, IntRect(tx, ty + topWidth, leftWidth,
+        graphicsContext->drawTiledImage(image.get(), colorSpace, IntRect(tx, ty + topWidth, leftWidth,
                                         h - topWidth - bottomWidth),
                                         IntRect(0, topSlice, leftSlice, imageHeight - topSlice - bottomSlice),
                                         Image::StretchTile, (Image::TileRule)vRule, op);
@@ -928,17 +958,17 @@ bool RenderBoxModelObject::paintNinePieceImage(GraphicsContext* graphicsContext,
         // The top right corner rect is (tx + w - rightWidth, ty, rightWidth, topWidth)
         // The rect to use from within the image is obtained from our slice, and is (imageWidth - rightSlice, 0, rightSlice, topSlice)
         if (drawTop)
-            graphicsContext->drawImage(image, colorSpace, IntRect(tx + w - rightWidth, ty, rightWidth, topWidth),
+            graphicsContext->drawImage(image.get(), colorSpace, IntRect(tx + w - rightWidth, ty, rightWidth, topWidth),
                                        IntRect(imageWidth - rightSlice, 0, rightSlice, topSlice), op);
 
         // The bottom right corner rect is (tx + w - rightWidth, ty + h - bottomWidth, rightWidth, bottomWidth)
         // The rect to use from within the image is (imageWidth - rightSlice, imageHeight - bottomSlice, rightSlice, bottomSlice)
         if (drawBottom)
-            graphicsContext->drawImage(image, colorSpace, IntRect(tx + w - rightWidth, ty + h - bottomWidth, rightWidth, bottomWidth),
+            graphicsContext->drawImage(image.get(), colorSpace, IntRect(tx + w - rightWidth, ty + h - bottomWidth, rightWidth, bottomWidth),
                                        IntRect(imageWidth - rightSlice, imageHeight - bottomSlice, rightSlice, bottomSlice), op);
 
         // Paint the right edge.
-        graphicsContext->drawTiledImage(image, colorSpace, IntRect(tx + w - rightWidth, ty + topWidth, rightWidth,
+        graphicsContext->drawTiledImage(image.get(), colorSpace, IntRect(tx + w - rightWidth, ty + topWidth, rightWidth,
                                         h - topWidth - bottomWidth),
                                         IntRect(imageWidth - rightSlice, topSlice, rightSlice, imageHeight - topSlice - bottomSlice),
                                         Image::StretchTile, (Image::TileRule)vRule, op);
@@ -946,20 +976,20 @@ bool RenderBoxModelObject::paintNinePieceImage(GraphicsContext* graphicsContext,
 
     // Paint the top edge.
     if (drawTop)
-        graphicsContext->drawTiledImage(image, colorSpace, IntRect(tx + leftWidth, ty, w - leftWidth - rightWidth, topWidth),
+        graphicsContext->drawTiledImage(image.get(), colorSpace, IntRect(tx + leftWidth, ty, w - leftWidth - rightWidth, topWidth),
                                         IntRect(leftSlice, 0, imageWidth - rightSlice - leftSlice, topSlice),
                                         (Image::TileRule)hRule, Image::StretchTile, op);
 
     // Paint the bottom edge.
     if (drawBottom)
-        graphicsContext->drawTiledImage(image, colorSpace, IntRect(tx + leftWidth, ty + h - bottomWidth,
+        graphicsContext->drawTiledImage(image.get(), colorSpace, IntRect(tx + leftWidth, ty + h - bottomWidth,
                                         w - leftWidth - rightWidth, bottomWidth),
                                         IntRect(leftSlice, imageHeight - bottomSlice, imageWidth - rightSlice - leftSlice, bottomSlice),
                                         (Image::TileRule)hRule, Image::StretchTile, op);
 
     // Paint the middle.
     if (drawMiddle)
-        graphicsContext->drawTiledImage(image, colorSpace, IntRect(tx + leftWidth, ty + topWidth, w - leftWidth - rightWidth,
+        graphicsContext->drawTiledImage(image.get(), colorSpace, IntRect(tx + leftWidth, ty + topWidth, w - leftWidth - rightWidth,
                                         h - topWidth - bottomWidth),
                                         IntRect(leftSlice, topSlice, imageWidth - rightSlice - leftSlice, imageHeight - topSlice - bottomSlice),
                                         (Image::TileRule)hRule, (Image::TileRule)vRule, op);
@@ -1545,6 +1575,20 @@ void RenderBoxModelObject::clipBorderSidePolygon(GraphicsContext* graphicsContex
     graphicsContext->clipConvexPolygon(4, secondQuad, !secondEdgeMatches);
 }
 
+static inline IntRect areaCastingShadowInHole(const IntRect& holeRect, int shadowBlur, int shadowSpread, const IntSize& shadowOffset)
+{
+    IntRect bounds(holeRect);
+    
+    bounds.inflate(shadowBlur);
+
+    if (shadowSpread < 0)
+        bounds.inflate(-shadowSpread);
+    
+    IntRect offsetBounds = bounds;
+    offsetBounds.move(-shadowOffset);
+    return unionRect(bounds, offsetBounds);
+}
+
 void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int ty, int w, int h, const RenderStyle* s, ShadowStyle shadowStyle, bool includeLogicalLeftEdge, bool includeLogicalRightEdge)
 {
     // FIXME: Deal with border-image.  Would be great to use border-image as a mask.
@@ -1555,17 +1599,18 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
     RoundedIntRect border(tx, ty, w, h);
     bool hasBorderRadius = s->hasBorderRadius();
     bool isHorizontal = s->isHorizontalWritingMode();
-    if (hasBorderRadius && (includeLogicalLeftEdge || includeLogicalRightEdge)) {
-        RoundedIntRect::Radii radii = ((shadowStyle == Inset) ? s->getRoundedInnerBorderWithBorderWidths(border.rect(), borderTop(), borderBottom(), borderLeft(), borderRight()) : s->getRoundedBorderFor(border.rect())).radii();
-        border.includeLogicalEdges(radii, isHorizontal, includeLogicalLeftEdge, includeLogicalRightEdge);
-    }
-   
+
     if (shadowStyle == Inset)
         border.setRect(IntRect(border.rect().x() + (includeLogicalLeftEdge || !isHorizontal ? borderLeft() : 0),
                                border.rect().y() + (includeLogicalLeftEdge || isHorizontal ? borderTop() : 0),
                                border.rect().width() - ((includeLogicalLeftEdge || !isHorizontal) ? borderLeft() : 0) - ((includeLogicalRightEdge || !isHorizontal) ? borderRight() : 0),
                                border.rect().height() - ((includeLogicalLeftEdge || isHorizontal) ? borderTop() : 0) - ((includeLogicalRightEdge || isHorizontal) ? borderBottom() : 0)));
 
+    if (hasBorderRadius && (includeLogicalLeftEdge || includeLogicalRightEdge)) {
+        RoundedIntRect::Radii radii = ((shadowStyle == Inset) ? s->getRoundedInnerBorderWithBorderWidths(border.rect(), borderTop(), borderBottom(), borderLeft(), borderRight()) : s->getRoundedBorderFor(border.rect())).radii();
+        border.includeLogicalEdges(radii, isHorizontal, includeLogicalLeftEdge, includeLogicalRightEdge);
+    }
+
     bool hasOpaqueBackground = s->visitedDependentColor(CSSPropertyBackgroundColor).isValid() && s->visitedDependentColor(CSSPropertyBackgroundColor).alpha() == 255;
     for (const ShadowData* shadow = s->boxShadow(); shadow; shadow = shadow->next()) {
         if (shadow->style() != shadowStyle)
@@ -1595,7 +1640,11 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
             shadowOffset -= extraOffset;
             fillRect.move(extraOffset);
 
-            context->setShadow(shadowOffset, shadowBlur, shadowColor, s->colorSpace());
+            if (shadow->isWebkitBoxShadow())
+                context->setLegacyShadow(shadowOffset, shadowBlur, shadowColor, s->colorSpace());
+            else
+                context->setShadow(shadowOffset, shadowBlur, shadowColor, s->colorSpace());
+
             if (hasBorderRadius) {
                 RoundedIntRect rectToClipOut = border;
 
@@ -1611,6 +1660,7 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
 
                 if (shadowSpread < 0)
                     fillRect.expandRadii(shadowSpread);
+
                 context->fillRoundedRect(fillRect, Color::black, s->colorSpace());
             } else {
                 IntRect rectToClipOut = border.rect();
@@ -1663,17 +1713,14 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
 
             Color fillColor(shadowColor.red(), shadowColor.green(), shadowColor.blue(), 255);
 
-            IntRect outerRect(border.rect());
-            outerRect.inflateX(w - 2 * shadowSpread);
-            outerRect.inflateY(h - 2 * shadowSpread);
-
+            IntRect outerRect = areaCastingShadowInHole(border.rect(), shadowBlur, shadowSpread, shadowOffset);
             context->save();
 
             Path path;
             if (hasBorderRadius) {
+                Path path;
                 path.addRoundedRect(border.rect(), border.radii().topLeft(), border.radii().topRight(), border.radii().bottomLeft(), border.radii().bottomRight());
                 context->clip(path);
-                path.clear();
             } else
                 context->clip(border.rect());
 
@@ -1681,19 +1728,16 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
             context->translate(extraOffset.width(), extraOffset.height());
             shadowOffset -= extraOffset;
 
-            path.addRect(outerRect);
-
-            if (hasBorderRadius) {
-                if (shadowSpread > 0)
-                    border.shrinkRadii(shadowSpread);
-                path.addRoundedRect(holeRect, border.radii().topLeft(), border.radii().topRight(), border.radii().bottomLeft(), border.radii().bottomRight());
-            } else
-                path.addRect(holeRect);
+            if (hasBorderRadius && shadowSpread > 0)
+                border.shrinkRadii(shadowSpread);
+            
+            if (shadow->isWebkitBoxShadow())
+                context->setLegacyShadow(shadowOffset, shadowBlur, shadowColor, s->colorSpace());
+            else
+                context->setShadow(shadowOffset, shadowBlur, shadowColor, s->colorSpace());
 
-            context->setFillRule(RULE_EVENODD);
-            context->setFillColor(fillColor, s->colorSpace());
-            context->setShadow(shadowOffset, shadowBlur, shadowColor, s->colorSpace());
-            context->fillPath(path);
+            RoundedIntRect roundedHole(holeRect, border.radii());
+            context->fillRectWithRoundedHole(outerRect, roundedHole, fillColor, s->colorSpace());
 
             context->restore();
         }
diff --git a/Source/WebCore/rendering/RenderCombineText.cpp b/Source/WebCore/rendering/RenderCombineText.cpp
new file mode 100644
index 0000000..1b20bd8
--- /dev/null
+++ b/Source/WebCore/rendering/RenderCombineText.cpp
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "RenderCombineText.h"
+
+#include "TextRun.h"
+
+namespace WebCore {
+
+const float textCombineMargin = 1.1f; // Allow em + 10% margin
+
+RenderCombineText::RenderCombineText(Node* node, PassRefPtr<StringImpl> string)
+     : RenderText(node, string)
+     , m_combinedTextWidth(0)
+     , m_isCombined(false)
+     , m_needsFontUpdate(false)
+{
+}
+
+void RenderCombineText::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+{
+    RenderText::styleDidChange(diff, oldStyle);
+
+    if (m_isCombined)
+        RenderText::setTextInternal(originalText()); // This RenderCombineText has been combined once. Restore the original text for the next combineText().
+
+    m_needsFontUpdate = true;
+}
+
+void RenderCombineText::setTextInternal(PassRefPtr<StringImpl> text)
+{
+    RenderText::setTextInternal(text);
+
+    m_needsFontUpdate = true;
+}
+
+unsigned RenderCombineText::width(unsigned from, unsigned length, const Font& font, int xPosition, HashSet<const SimpleFontData*>* fallbackFonts, GlyphOverflow* glyphOverflow) const
+{
+    if (!characters())
+        return 0;
+
+    if (m_isCombined)
+        return font.size();
+
+    return RenderText::width(from, length, font, xPosition, fallbackFonts, glyphOverflow);
+}
+
+void RenderCombineText::adjustTextOrigin(IntPoint& textOrigin, const IntRect& boxRect) const
+{
+    if (m_isCombined)
+        textOrigin.move(boxRect.height() / 2 - ceilf(m_combinedTextWidth) / 2, style()->font().pixelSize());
+}
+
+void RenderCombineText::charactersToRender(int start, const UChar*& characters, int& length) const
+{
+    if (m_isCombined) {
+        length = originalText()->length();
+        characters = originalText()->characters();
+        return;
+    }
+ 
+    characters = text()->characters() + start;
+}
+
+void RenderCombineText::combineText()
+{
+    if (!m_needsFontUpdate)
+        return;
+
+    m_isCombined = false;
+    m_needsFontUpdate = false;
+
+    // CSS3 spec says text-combine works only in vertical writing mode.
+    if (style()->isHorizontalWritingMode())
+        return;
+
+    TextRun run = TextRun(String(text()));
+    FontDescription description = style()->font().fontDescription();
+    float emWidth = description.computedSize() * textCombineMargin;
+    bool shouldUpdateFont = false;
+
+    description.setOrientation(Horizontal); // We are going to draw combined text horizontally.
+    m_combinedTextWidth = style()->font().floatWidth(run);
+    m_isCombined = m_combinedTextWidth <= emWidth;
+
+    if (m_isCombined)
+        shouldUpdateFont = style()->setFontDescription(description); // Need to change font orientation to horizontal.
+    else {
+        // Need to try compressed glyphs.
+        static const FontWidthVariant widthVariants[] = { HalfWidth, ThirdWidth, QuarterWidth };
+        for (size_t i = 0 ; i < WTF_ARRAY_LENGTH(widthVariants) ; ++i) {
+            description.setWidthVariant(widthVariants[i]);
+            Font compressedFont = Font(description, style()->font().letterSpacing(), style()->font().wordSpacing());
+            compressedFont.update(style()->font().fontSelector());
+            float runWidth = compressedFont.floatWidth(run);
+            if (runWidth <= emWidth) {
+                m_combinedTextWidth = runWidth;
+                m_isCombined = true;
+
+                // Replace my font with the new one.
+                shouldUpdateFont = style()->setFontDescription(description);
+                break;
+            }
+        }
+    }
+
+    if (shouldUpdateFont)
+        style()->font().update(style()->font().fontSelector());
+
+    if (m_isCombined) {
+        static const UChar newCharacter = objectReplacementCharacter;
+        DEFINE_STATIC_LOCAL(String, objectReplacementCharacterString, (&newCharacter, 1));
+        RenderText::setTextInternal(objectReplacementCharacterString.impl());
+    }
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderCombineText.h b/Source/WebCore/rendering/RenderCombineText.h
new file mode 100644
index 0000000..582cbd6
--- /dev/null
+++ b/Source/WebCore/rendering/RenderCombineText.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef RenderCombineText_h
+#define RenderCombineText_h
+
+#include "RenderText.h"
+
+namespace WebCore {
+
+class RenderCombineText : public RenderText {
+public:
+    RenderCombineText(Node*, PassRefPtr<StringImpl>);
+
+    void combineText();
+    void adjustTextOrigin(IntPoint& textOrigin, const IntRect& boxRect) const;
+    void charactersToRender(int start, const UChar*& characters, int& length) const;
+    bool isCombined() const { return m_isCombined; }
+    int combinedTextWidth(const Font& font) const { return font.size(); }
+
+private:
+    virtual unsigned width(unsigned from, unsigned length, const Font&, int xPosition, HashSet<const SimpleFontData*>* fallbackFonts = 0, GlyphOverflow* = 0) const;
+    virtual const char* renderName() const { return "RenderCombineText"; }
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
+    virtual void setTextInternal(PassRefPtr<StringImpl>);
+
+    float m_combinedTextWidth;
+    bool m_isCombined : 1;
+    bool m_needsFontUpdate : 1;
+};
+
+inline RenderCombineText* toRenderCombineText(RenderObject* object)
+{ 
+    ASSERT(!object || object->isText());
+    return static_cast<RenderCombineText*>(object);
+}
+
+inline const RenderCombineText* toRenderCombineText(const RenderObject* object)
+{ 
+    ASSERT(!object || object->isText());
+    return static_cast<const RenderCombineText*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderCombineText(const RenderCombineText*);
+
+} // namespace WebCore
+
+#endif // RenderCombineText_h
diff --git a/Source/WebCore/rendering/RenderCounter.cpp b/Source/WebCore/rendering/RenderCounter.cpp
index 57c54f8..fbd5545 100644
--- a/Source/WebCore/rendering/RenderCounter.cpp
+++ b/Source/WebCore/rendering/RenderCounter.cpp
@@ -24,6 +24,7 @@
 
 #include "CounterNode.h"
 #include "Document.h"
+#include "Element.h"
 #include "HTMLNames.h"
 #include "HTMLOListElement.h"
 #include "RenderListItem.h"
@@ -46,11 +47,157 @@ static CounterMaps& counterMaps()
     return staticCounterMaps;
 }
 
-static inline RenderObject* previousSiblingOrParent(RenderObject* object)
+// This function processes the renderer tree in the order of the DOM tree
+// including pseudo elements as defined in CSS 2.1.
+// Anonymous renderers are skipped except for those representing pseudo elements.
+static RenderObject* previousInPreOrder(const RenderObject* object)
 {
-    if (RenderObject* sibling = object->previousSibling())
-        return sibling;
-    return object->parent();
+    Element* parent;
+    Element* sibling;
+    switch (object->style()->styleType()) {
+    case NOPSEUDO:
+        ASSERT(!object->isAnonymous());
+        parent = toElement(object->node());
+        sibling = parent->previousElementSibling();
+        parent = parent->parentElement();
+        break;
+    case BEFORE:
+        return object->generatingNode()->renderer(); // It is always the generating node's renderer
+    case AFTER:
+        parent = toElement(object->generatingNode());
+        sibling = parent->lastElementChild();
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    while (sibling) {
+        if (RenderObject* renderer = sibling->renderer()) {
+            if (RenderObject* after = renderer->afterPseudoElementRenderer())
+                return after;
+            parent = sibling;
+            sibling = sibling->lastElementChild();
+            if (!sibling) {
+                if (RenderObject* before = renderer->beforePseudoElementRenderer())
+                    return before;
+                return renderer;
+            }
+        } else
+            sibling = sibling->previousElementSibling();
+    }
+    if (!parent)
+        return 0;
+    RenderObject* renderer = parent->renderer(); // Should never be null
+    if (RenderObject* before = renderer->beforePseudoElementRenderer())
+        return before;
+    return renderer;
+}
+
+// This function processes the renderer tree in the order of the DOM tree
+// including pseudo elements as defined in CSS 2.1.
+// Anonymous renderers are skipped except for those representing pseudo elements.
+static RenderObject* previousSiblingOrParent(const RenderObject* object)
+{
+    Element* parent;
+    Element* sibling;
+    switch (object->style()->styleType()) {
+    case NOPSEUDO:
+        ASSERT(!object->isAnonymous());
+        parent = toElement(object->node());
+        sibling = parent->previousElementSibling();
+        parent = parent->parentElement();
+        break;
+    case BEFORE:
+        return object->generatingNode()->renderer(); // It is always the generating node's renderer
+    case AFTER:
+        parent = toElement(object->generatingNode());
+        sibling = parent->lastElementChild();
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    while (sibling) {
+        if (RenderObject* renderer = sibling->renderer()) // This skips invisible nodes
+            return renderer;
+        sibling = sibling->previousElementSibling();
+    }
+    if (parent) {
+        RenderObject* renderer = parent->renderer();
+        if (RenderObject* before = renderer->virtualChildren()->beforePseudoElementRenderer(renderer))
+            return before;
+        return renderer;
+    }
+    return 0;
+}
+
+static Element* parentElement(RenderObject* object)
+{
+    switch (object->style()->styleType()) {
+    case NOPSEUDO:
+        ASSERT(!object->isAnonymous());
+        return toElement(object->node())->parentElement();
+    case BEFORE:
+    case AFTER:
+        return toElement(object->generatingNode());
+    default:
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+}
+
+static inline bool areRenderersElementsSiblings(RenderObject* first, RenderObject* second)
+{
+    return parentElement(first) == parentElement(second);
+}
+
+// This function processes the renderer tree in the order of the DOM tree
+// including pseudo elements as defined in CSS 2.1.
+// Anonymous renderers are skipped except for those representing pseudo elements.
+static RenderObject* nextInPreOrder(const RenderObject* object, const Element* stayWithin, bool skipDescendants = false)
+{
+    Element* self;
+    Element* child;
+    RenderObject* result;
+    self = toElement(object->generatingNode());
+    if (skipDescendants)
+        goto nextsibling;
+    switch (object->style()->styleType()) {
+    case NOPSEUDO:
+        ASSERT(!object->isAnonymous());
+        result = object->beforePseudoElementRenderer();
+        if (result)
+            return result;
+        break;
+    case BEFORE:
+        break;
+    case AFTER:
+        goto nextsibling;
+    default:
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    child = self->firstElementChild();
+    while (true) {
+        while (child) {
+            result = child->renderer();
+            if (result)
+                return result;
+            child = child->nextElementSibling();
+        }
+        result = self->renderer()->afterPseudoElementRenderer();
+        if (result)
+            return result;
+nextsibling:
+        if (self == stayWithin)
+            return 0;
+        child = self->nextElementSibling();
+        self = self->parentElement();
+        if (!self) {
+            ASSERT(!child); // We can only reach this if we are searching beyond the root element
+            return 0; //  which cannot have siblings
+        }
+    }
 }
 
 static bool planCounter(RenderObject* object, const AtomicString& identifier, bool& isReset, int& value)
@@ -61,10 +208,27 @@ static bool planCounter(RenderObject* object, const AtomicString& identifier, bo
     // We can't even look at their styles or we'll see extra resets and increments!
     if (object->isText() && !object->isBR())
         return false;
-
+    Node* generatingNode = object->generatingNode();
+    // We must have a generating node or else we cannot have a counter.
+    if (!generatingNode)
+        return false;
     RenderStyle* style = object->style();
     ASSERT(style);
 
+    switch (style->styleType()) {
+    case NOPSEUDO:
+        // Sometimes nodes have more then one renderer. Only the first one gets the counter
+        // LayoutTests/http/tests/css/counter-crash.html
+        if (generatingNode->renderer() != object)
+            return false;
+        break;
+    case BEFORE:
+    case AFTER:
+        break;
+    default:
+        return false; // Counters are forbidden from all other pseudo elements.
+    }
+
     if (const CounterDirectiveMap* directivesMap = style->counterDirectives()) {
         CounterDirectives directives = directivesMap->get(identifier.impl());
         if (directives.m_reset) {
@@ -133,14 +297,9 @@ static bool findPlaceForCounter(RenderObject* counterOwner, const AtomicString&
     // We check renderers in preOrder from the renderer that our counter is attached to
     // towards the begining of the document for counters with the same identifier as the one
     // we are trying to find a place for. This is the next renderer to be checked.
-    RenderObject* currentRenderer = counterOwner->previousInPreOrder();
+    RenderObject* currentRenderer = previousInPreOrder(counterOwner);
     previousSibling = 0;
     while (currentRenderer) {
-        // A sibling without a parent means that the counter node tree was not constructed correctly so we stop 
-        // traversing. In the future RenderCounter should handle RenderObjects that are not connected to the 
-        // render tree at counter node creation. See bug 43812. 
-        if (previousSibling && !previousSibling->parent())
-            return false;
         CounterNode* currentCounter = makeCounterNode(currentRenderer, identifier, false);
         if (searchEndRenderer == currentRenderer) {
             // We may be at the end of our search.
@@ -149,7 +308,7 @@ static bool findPlaceForCounter(RenderObject* counterOwner, const AtomicString&
                 if (previousSibling) { // But we already found another counter that we come after.
                     if (currentCounter->actsAsReset()) {
                         // We found a reset counter that is on a renderer that is a sibling of ours or a parent.
-                        if (isReset && currentRenderer->parent() == counterOwner->parent()) {
+                        if (isReset && areRenderersElementsSiblings(currentRenderer, counterOwner)) {
                             // We are also a reset counter and the previous reset was on a sibling renderer
                             // hence we are the next sibling of that counter if that reset is not a root or
                             // we are a root node if that reset is a root.
@@ -164,7 +323,7 @@ static bool findPlaceForCounter(RenderObject* counterOwner, const AtomicString&
                         return true;
                     }
                     // CurrentCounter, the counter at the EndSearchRenderer, is not reset.
-                    if (!isReset || currentRenderer->parent() != counterOwner->parent()) {
+                    if (!isReset || !areRenderersElementsSiblings(currentRenderer, counterOwner)) {
                         // If the node we are placing is not reset or we have found a counter that is attached
                         // to an ancestor of the placed counter's renderer we know we are a sibling of that node.
                         ASSERT(currentCounter->parent() == previousSibling->parent());
@@ -177,7 +336,7 @@ static bool findPlaceForCounter(RenderObject* counterOwner, const AtomicString&
                     // previousSibling, and when we are a sibling of the end counter we must set previousSibling
                     // to currentCounter.
                     if (currentCounter->actsAsReset()) {
-                        if (isReset && currentRenderer->parent() == counterOwner->parent()) {
+                        if (isReset && areRenderersElementsSiblings(currentRenderer, counterOwner)) {
                             parent = currentCounter->parent();
                             previousSibling = currentCounter;
                             return parent;
@@ -185,7 +344,7 @@ static bool findPlaceForCounter(RenderObject* counterOwner, const AtomicString&
                         parent = currentCounter;
                         return true;
                     }
-                    if (!isReset || currentRenderer->parent() != counterOwner->parent()) {
+                    if (!isReset || !areRenderersElementsSiblings(currentRenderer, counterOwner)) {
                         parent = currentCounter->parent();
                         previousSibling = currentCounter;
                         return true;
@@ -210,7 +369,7 @@ static bool findPlaceForCounter(RenderObject* counterOwner, const AtomicString&
                         previousSibling = currentCounter;
                         // We are no longer interested in previous siblings of the currentRenderer or their children
                         // as counters they may have attached cannot be the previous sibling of the counter we are placing.
-                        currentRenderer = currentRenderer->parent();
+                        currentRenderer = parentElement(currentRenderer)->renderer();
                         continue;
                     }
                 } else
@@ -261,28 +420,28 @@ static CounterNode* makeCounterNode(RenderObject* object, const AtomicString& id
         object->m_hasCounterNodeMap = true;
     }
     nodeMap->set(identifier.impl(), newNode);
-    if (newNode->parent() || !object->nextInPreOrder(object->parent()))
+    if (newNode->parent())
         return newNode.get();
     // Checking if some nodes that were previously counter tree root nodes
     // should become children of this node now.
     CounterMaps& maps = counterMaps();
-    RenderObject* stayWithin = object->parent();
-    for (RenderObject* currentRenderer = object->nextInPreOrder(stayWithin); currentRenderer; currentRenderer = currentRenderer->nextInPreOrder(stayWithin)) {
+    Element* stayWithin = parentElement(object);
+    bool skipDescendants;
+    for (RenderObject* currentRenderer = nextInPreOrder(object, stayWithin); currentRenderer; currentRenderer = nextInPreOrder(currentRenderer, stayWithin, skipDescendants)) {
+        skipDescendants = false;
         if (!currentRenderer->m_hasCounterNodeMap)
             continue;
         CounterNode* currentCounter = maps.get(currentRenderer)->get(identifier.impl()).get();
         if (!currentCounter)
             continue;
+        skipDescendants = true;
         if (currentCounter->parent()) {
             ASSERT(newNode->firstChild());
-            if (currentRenderer->lastChild())
-                currentRenderer = currentRenderer->lastChild();
             continue;
         }
-        if (stayWithin != currentRenderer->parent() || !currentCounter->hasResetType())
-            newNode->insertAfter(currentCounter, newNode->lastChild(), identifier);
-        if (currentRenderer->lastChild())
-            currentRenderer = currentRenderer->lastChild();
+        if (stayWithin == parentElement(currentRenderer) && currentCounter->hasResetType())
+            break;
+        newNode->insertAfter(currentCounter, newNode->lastChild(), identifier);
     }
     return newNode.get();
 }
@@ -449,12 +608,22 @@ static void updateCounters(RenderObject* renderer)
 
 void RenderCounter::rendererSubtreeAttached(RenderObject* renderer)
 {
+    Node* node = renderer->node();
+    if (node)
+        node = node->parentNode();
+    else
+        node = renderer->generatingNode();
+    if (node && !node->attached())
+        return; // No need to update if the parent is not attached yet
     for (RenderObject* descendant = renderer; descendant; descendant = descendant->nextInPreOrder(renderer))
         updateCounters(descendant);
 }
 
 void RenderCounter::rendererStyleChanged(RenderObject* renderer, const RenderStyle* oldStyle, const RenderStyle* newStyle)
 {
+    Node* node = renderer->generatingNode();
+    if (!node || !node->attached())
+        return; // cannot have generated content or if it can have, it will be handled during attaching
     const CounterDirectiveMap* newCounterDirectives;
     const CounterDirectiveMap* oldCounterDirectives;
     if (oldStyle && (oldCounterDirectives = oldStyle->counterDirectives())) {
@@ -494,3 +663,27 @@ void RenderCounter::rendererStyleChanged(RenderObject* renderer, const RenderSty
 }
 
 } // namespace WebCore
+
+#ifndef NDEBUG
+
+void showCounterRendererTree(const WebCore::RenderObject* renderer, const char* counterName)
+{
+    if (!renderer)
+        return;
+    const WebCore::RenderObject* root = renderer;
+    while (root->parent())
+        root = root->parent();
+
+    AtomicString identifier(counterName);
+    for (const WebCore::RenderObject* current = root; current; current = current->nextInPreOrder()) {
+        fprintf(stderr, "%c", (current == renderer) ? '*' : ' ');
+        for (const WebCore::RenderObject* parent = current; parent && parent != root; parent = parent->parent())
+            fprintf(stderr, "    ");
+        fprintf(stderr, "%p N:%p P:%p PS:%p NS:%p C:%p\n",
+            current, current->node(), current->parent(), current->previousSibling(),
+            current->nextSibling(), current->m_hasCounterNodeMap?
+            counterName ? WebCore::counterMaps().get(current)->get(identifier.impl()).get() : (WebCore::CounterNode*)1 : (WebCore::CounterNode*)0);
+    }
+}
+
+#endif // NDEBUG
diff --git a/Source/WebCore/rendering/RenderCounter.h b/Source/WebCore/rendering/RenderCounter.h
index 9373193..de0ee1b 100644
--- a/Source/WebCore/rendering/RenderCounter.h
+++ b/Source/WebCore/rendering/RenderCounter.h
@@ -67,4 +67,9 @@ void toRenderCounter(const RenderCounter*);
 
 } // namespace WebCore
 
+#ifndef NDEBUG
+// Outside the WebCore namespace for ease of invocation from gdb.
+void showCounterRendererTree(const WebCore::RenderObject*, const char* counterName = 0);
+#endif
+
 #endif // RenderCounter_h
diff --git a/Source/WebCore/rendering/RenderEmbeddedObject.cpp b/Source/WebCore/rendering/RenderEmbeddedObject.cpp
index 5486d51..cdd6c55 100644
--- a/Source/WebCore/rendering/RenderEmbeddedObject.cpp
+++ b/Source/WebCore/rendering/RenderEmbeddedObject.cpp
@@ -172,8 +172,9 @@ void RenderEmbeddedObject::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
     context->setFillColor(m_missingPluginIndicatorIsPressed ? replacementTextRoundedRectPressedColor() : Color::white, style()->colorSpace());
     context->fillPath(path);
 
+    const FontMetrics& fontMetrics = font.fontMetrics();
     float labelX = roundf(replacementTextRect.location().x() + (replacementTextRect.size().width() - textWidth) / 2);
-    float labelY = roundf(replacementTextRect.location().y() + (replacementTextRect.size().height() - font.height()) / 2 + font.ascent());
+    float labelY = roundf(replacementTextRect.location().y() + (replacementTextRect.size().height() - fontMetrics.height()) / 2 + fontMetrics.ascent());
     context->setAlpha(m_missingPluginIndicatorIsPressed ? replacementTextPressedTextOpacity : replacementTextTextOpacity);
     context->setFillColor(Color::black, style()->colorSpace());
     context->drawBidiText(font, run, FloatPoint(labelX, labelY));
diff --git a/Source/WebCore/rendering/RenderFileUploadControl.cpp b/Source/WebCore/rendering/RenderFileUploadControl.cpp
index aec55a8..f72edad 100644
--- a/Source/WebCore/rendering/RenderFileUploadControl.cpp
+++ b/Source/WebCore/rendering/RenderFileUploadControl.cpp
@@ -216,7 +216,7 @@ void RenderFileUploadControl::paintObject(PaintInfo& paintInfo, int tx, int ty)
         const String& displayedFilename = fileTextValue();
         unsigned length = displayedFilename.length();
         const UChar* string = displayedFilename.characters();
-        TextRun textRun(string, length, false, 0, 0, !style()->isLeftToRightDirection(), style()->unicodeBidi() == Override);
+        TextRun textRun(string, length, false, 0, 0, TextRun::AllowTrailingExpansion, !style()->isLeftToRightDirection(), style()->unicodeBidi() == Override);
         
         // Determine where the filename should be placed
         int contentLeft = tx + borderLeft() + paddingLeft();
@@ -273,7 +273,7 @@ void RenderFileUploadControl::computePreferredLogicalWidths()
         // Figure out how big the filename space needs to be for a given number of characters
         // (using "0" as the nominal character).
         const UChar ch = '0';
-        float charWidth = style()->font().floatWidth(TextRun(&ch, 1, false, 0, 0, false, false, false));
+        float charWidth = style()->font().floatWidth(TextRun(&ch, 1, false, 0, 0, TextRun::AllowTrailingExpansion, false, false, false));
         m_maxPreferredLogicalWidth = (int)ceilf(charWidth * defaultWidthNumChars);
     }
 
@@ -297,6 +297,11 @@ void RenderFileUploadControl::computePreferredLogicalWidths()
     setPreferredLogicalWidthsDirty(false);
 }
 
+VisiblePosition RenderFileUploadControl::positionForPoint(const IntPoint&)
+{
+    return VisiblePosition();
+}
+
 void RenderFileUploadControl::receiveDroppedFiles(const Vector<String>& paths)
 {
     if (allowsMultipleFiles())
diff --git a/Source/WebCore/rendering/RenderFileUploadControl.h b/Source/WebCore/rendering/RenderFileUploadControl.h
index c96800c..22974fe 100644
--- a/Source/WebCore/rendering/RenderFileUploadControl.h
+++ b/Source/WebCore/rendering/RenderFileUploadControl.h
@@ -28,7 +28,7 @@ namespace WebCore {
 
 class Chrome;
 class HTMLInputElement;
-    
+
 // Each RenderFileUploadControl contains a RenderButton (for opening the file chooser), and
 // sufficient space to draw a file icon and filename. The RenderButton has a shadow node
 // associated with it to receive click/hover events.
@@ -71,6 +71,8 @@ private:
     Chrome* chrome() const;
     int maxFilenameWidth() const;
     PassRefPtr<RenderStyle> createButtonStyle(const RenderStyle* parentStyle) const;
+    
+    virtual VisiblePosition positionForPoint(const IntPoint&);
 
     RefPtr<HTMLInputElement> m_button;
     RefPtr<FileChooser> m_fileChooser;
diff --git a/Source/WebCore/rendering/RenderFlexibleBox.cpp b/Source/WebCore/rendering/RenderFlexibleBox.cpp
index 5af5733..9ab3c3f 100644
--- a/Source/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/Source/WebCore/rendering/RenderFlexibleBox.cpp
@@ -25,11 +25,11 @@
 #include "config.h"
 #include "RenderFlexibleBox.h"
 
-#include "CharacterNames.h"
 #include "RenderLayer.h"
 #include "RenderView.h"
 #include "TextRun.h"
 #include <wtf/StdLibExtras.h>
+#include <wtf/unicode/CharacterNames.h>
 
 #ifdef ANDROID_LAYOUT
 #include "Document.h"
@@ -288,7 +288,7 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren, int /*pageHeight FIXM
     updateLayerTransform();
 
     if (view()->layoutState()->pageLogicalHeight())
-        setPageLogicalOffset(view()->layoutState()->pageLogicalOffset(y()));
+        setPageLogicalOffset(view()->layoutState()->pageLogicalOffset(logicalTop()));
 
     // Update our scrollbars if we're overflow:auto/scroll/hidden now that we know if
     // we overflow or not.
diff --git a/Source/WebCore/rendering/RenderFrameSet.cpp b/Source/WebCore/rendering/RenderFrameSet.cpp
index 06b2a7a..e4eee6e 100644
--- a/Source/WebCore/rendering/RenderFrameSet.cpp
+++ b/Source/WebCore/rendering/RenderFrameSet.cpp
@@ -96,8 +96,8 @@ void RenderFrameSet::paintColumnBorder(const PaintInfo& paintInfo, const IntRect
     // Now stroke the edges but only if we have enough room to paint both edges with a little
     // bit of the fill color showing through.
     if (borderRect.width() >= 3) {
-        context->fillRect(IntRect(borderRect.topLeft(), IntSize(1, height())), borderStartEdgeColor(), colorSpace);
-        context->fillRect(IntRect(borderRect.topRight(), IntSize(1, height())), borderEndEdgeColor(), colorSpace);
+        context->fillRect(IntRect(borderRect.location(), IntSize(1, height())), borderStartEdgeColor(), colorSpace);
+        context->fillRect(IntRect(IntPoint(borderRect.maxX() - 1, borderRect.y()), IntSize(1, height())), borderEndEdgeColor(), colorSpace);
     }
 }
 
@@ -116,8 +116,8 @@ void RenderFrameSet::paintRowBorder(const PaintInfo& paintInfo, const IntRect& b
     // Now stroke the edges but only if we have enough room to paint both edges with a little
     // bit of the fill color showing through.
     if (borderRect.height() >= 3) {
-        context->fillRect(IntRect(borderRect.topLeft(), IntSize(width(), 1)), borderStartEdgeColor(), colorSpace);
-        context->fillRect(IntRect(borderRect.bottomLeft(), IntSize(width(), 1)), borderEndEdgeColor(), colorSpace);
+        context->fillRect(IntRect(borderRect.location(), IntSize(width(), 1)), borderStartEdgeColor(), colorSpace);
+        context->fillRect(IntRect(IntPoint(borderRect.x(), borderRect.maxY() - 1), IntSize(width(), 1)), borderEndEdgeColor(), colorSpace);
     }
 }
 
diff --git a/Source/WebCore/rendering/RenderImage.cpp b/Source/WebCore/rendering/RenderImage.cpp
index 839328e..7369f4e 100644
--- a/Source/WebCore/rendering/RenderImage.cpp
+++ b/Source/WebCore/rendering/RenderImage.cpp
@@ -4,7 +4,7 @@
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Allan Sandfeld Jensen (kde@carewolf.com)
  *           (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
- * Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ -30,7 +30,6 @@
 #include "Frame.h"
 #include "GraphicsContext.h"
 #include "HTMLAreaElement.h"
-#include "HTMLCollection.h"
 #include "HTMLImageElement.h"
 #include "HTMLInputElement.h"
 #include "HTMLMapElement.h"
@@ -38,11 +37,9 @@
 #include "HitTestResult.h"
 #include "Page.h"
 #include "RenderLayer.h"
-#include "RenderTheme.h"
 #include "RenderView.h"
 #include "SelectionController.h"
 #include "TextRun.h"
-#include <wtf/CurrentTime.h>
 #include <wtf/UnusedParam.h>
 
 #ifdef ANDROID_LAYOUT
@@ -116,7 +113,7 @@ bool RenderImage::setImageSizeForAltText(CachedImage* newImage /* = 0 */)
     // we have an alt and the user meant it (its not a text we invented)
     if (!m_altText.isEmpty()) {
         const Font& font = style()->font();
-        IntSize textSize(min(font.width(TextRun(m_altText.characters(), m_altText.length())), maxAltTextWidth), min(font.height(), maxAltTextHeight));
+        IntSize textSize(min(font.width(TextRun(m_altText.characters(), m_altText.length())), maxAltTextWidth), min(font.fontMetrics().height(), maxAltTextHeight));
         imageSize = imageSize.expandedTo(textSize);
     }
 
@@ -277,7 +274,7 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
             int usableWidth = cWidth - 2;
             int usableHeight = cHeight - 2;
 
-            Image* image = m_imageResource->image();
+            RefPtr<Image> image = m_imageResource->image();
 
             if (m_imageResource->errorOccurred() && !image->isNull() && usableWidth >= image->width() && usableHeight >= image->height()) {
                 // Center the error image, accounting for border and padding.
@@ -289,7 +286,7 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
                     centerY = 0;
                 imageX = leftBorder + leftPad + centerX + 1;
                 imageY = topBorder + topPad + centerY + 1;
-                context->drawImage(image, style()->colorSpace(), IntPoint(tx + imageX, ty + imageY));
+                context->drawImage(image.get(), style()->colorSpace(), IntPoint(tx + imageX, ty + imageY));
                 errorPictureDrawn = true;
             }
 
@@ -299,21 +296,22 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
                 int ax = tx + leftBorder + leftPad;
                 int ay = ty + topBorder + topPad;
                 const Font& font = style()->font();
-                int ascent = font.ascent();
+                const FontMetrics& fontMetrics = font.fontMetrics();
+                int ascent = fontMetrics.ascent();
 
                 // Only draw the alt text if it'll fit within the content box,
                 // and only if it fits above the error image.
                 TextRun textRun(text.characters(), text.length());
                 int textWidth = font.width(textRun);
                 if (errorPictureDrawn) {
-                    if (usableWidth >= textWidth && font.height() <= imageY)
-                        context->drawText(style()->font(), textRun, IntPoint(ax, ay + ascent));
-                } else if (usableWidth >= textWidth && cHeight >= font.height())
-                    context->drawText(style()->font(), textRun, IntPoint(ax, ay + ascent));
+                    if (usableWidth >= textWidth && fontMetrics.height() <= imageY)
+                        context->drawText(font, textRun, IntPoint(ax, ay + ascent));
+                } else if (usableWidth >= textWidth && cHeight >= fontMetrics.height())
+                    context->drawText(font, textRun, IntPoint(ax, ay + ascent));
             }
         }
     } else if (m_imageResource->hasImage() && cWidth > 0 && cHeight > 0) {
-        Image* img = m_imageResource->image(cWidth, cHeight);
+        RefPtr<Image> img = m_imageResource->image(cWidth, cHeight);
         if (!img || img->isNull())
             return;
 
@@ -333,60 +331,65 @@ void RenderImage::paint(PaintInfo& paintInfo, int tx, int ty)
     RenderReplaced::paint(paintInfo, tx, ty);
     
     if (paintInfo.phase == PaintPhaseOutline)
-        paintFocusRing(paintInfo, style());
+        paintAreaElementFocusRing(paintInfo);
 }
     
-void RenderImage::paintFocusRing(PaintInfo& paintInfo, const RenderStyle*)
+void RenderImage::paintAreaElementFocusRing(PaintInfo& paintInfo)
 {
-    // Don't draw focus rings if printing.
-    if (document()->printing() || !frame()->selection()->isFocusedAndActive())
+    Document* document = this->document();
+    
+    if (document->printing() || !document->frame()->selection()->isFocusedAndActive())
         return;
     
     if (paintInfo.context->paintingDisabled() && !paintInfo.context->updatingControlTints())
         return;
 
-    HTMLMapElement* mapElement = imageMap();
-    if (!mapElement)
+    Node* focusedNode = document->focusedNode();
+    if (!focusedNode || !focusedNode->hasTagName(areaTag))
         return;
-    
-    Document* document = mapElement->document();
-    if (!document)
+
+    HTMLAreaElement* areaElement = static_cast<HTMLAreaElement*>(focusedNode);
+    if (areaElement->imageElement() != node())
         return;
-    
-    Node* focusedNode = document->focusedNode();
-    if (!focusedNode)
+
+    // Even if the theme handles focus ring drawing for entire elements, it won't do it for
+    // an area within an image, so we don't call RenderTheme::supportsFocusRing here.
+
+    Path path = areaElement->computePath(this);
+    if (path.isEmpty())
         return;
-    
-    RefPtr<HTMLCollection> areas = mapElement->areas();
-    unsigned numAreas = areas->length();
-    
-    // FIXME: Clip the paths to the image bounding box.
-    for (unsigned k = 0; k < numAreas; ++k) {
-        HTMLAreaElement* areaElement = static_cast<HTMLAreaElement*>(areas->item(k));
-        if (focusedNode != areaElement)
-            continue;
-
-        RenderStyle* styleToUse = areaElement->computedStyle();
-        if (theme()->supportsFocusRing(styleToUse))
-            return; // The theme draws the focus ring.
-        paintInfo.context->drawFocusRing(areaElement->getPath(this), styleToUse->outlineWidth(), styleToUse->outlineOffset(), styleToUse->visitedDependentColor(CSSPropertyOutlineColor));
-        break;
-    }
+
+    // FIXME: Do we need additional code to clip the path to the image's bounding box?
+
+    RenderStyle* areaElementStyle = areaElement->computedStyle();
+    paintInfo.context->drawFocusRing(path, areaElementStyle->outlineWidth(), areaElementStyle->outlineOffset(),
+        areaElementStyle->visitedDependentColor(CSSPropertyOutlineColor));
 }
-    
+
+void RenderImage::areaElementFocusChanged(HTMLAreaElement* element)
+{
+    ASSERT_UNUSED(element, element->imageElement() == node());
+
+    // It would be more efficient to only repaint the focus ring rectangle
+    // for the passed-in area element. That would require adding functions
+    // to the area element class.
+    repaint();
+}
+
 void RenderImage::paintIntoRect(GraphicsContext* context, const IntRect& rect)
 {
     if (!m_imageResource->hasImage() || m_imageResource->errorOccurred() || rect.width() <= 0 || rect.height() <= 0)
         return;
 
-    Image* img = m_imageResource->image(rect.width(), rect.height());
+    RefPtr<Image> img = m_imageResource->image(rect.width(), rect.height());
     if (!img || img->isNull())
         return;
 
     HTMLImageElement* imageElt = (node() && node()->hasTagName(imgTag)) ? static_cast<HTMLImageElement*>(node()) : 0;
     CompositeOperator compositeOperator = imageElt ? imageElt->compositeOperator() : CompositeSourceOver;
-    bool useLowQualityScaling = shouldPaintAtLowQuality(context, m_imageResource->image(), 0, rect.size());
-    context->drawImage(m_imageResource->image(rect.width(), rect.height()), style()->colorSpace(), rect, compositeOperator, useLowQualityScaling);
+    Image* image = m_imageResource->image().get();
+    bool useLowQualityScaling = shouldPaintAtLowQuality(context, image, image, rect.size());
+    context->drawImage(m_imageResource->image(rect.width(), rect.height()).get(), style()->colorSpace(), rect, compositeOperator, useLowQualityScaling);
 }
 
 int RenderImage::minimumReplacedHeight() const
diff --git a/Source/WebCore/rendering/RenderImage.h b/Source/WebCore/rendering/RenderImage.h
index 16ae7ec..e3f743c 100644
--- a/Source/WebCore/rendering/RenderImage.h
+++ b/Source/WebCore/rendering/RenderImage.h
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2006 Allan Sandfeld Jensen (kde@carewolf.com) 
  *           (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
- * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -30,6 +30,7 @@
 
 namespace WebCore {
 
+class HTMLAreaElement;
 class HTMLMapElement;
 
 class RenderImage : public RenderReplaced {
@@ -48,6 +49,7 @@ public:
     void updateAltText();
 
     HTMLMapElement* imageMap() const;
+    void areaElementFocusChanged(HTMLAreaElement*);
 
     void highQualityRepaintTimerFired(Timer<RenderImage>*);
 
@@ -57,7 +59,6 @@ protected:
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
 
     virtual void paintIntoRect(GraphicsContext*, const IntRect&);
-    void paintFocusRing(PaintInfo&, const RenderStyle*);
     virtual void paint(PaintInfo&, int tx, int ty);
 
     bool isLogicalWidthSpecified() const;
@@ -91,6 +92,8 @@ private:
     int calcAspectRatioLogicalWidth() const;
     int calcAspectRatioLogicalHeight() const;
 
+    void paintAreaElementFocusRing(PaintInfo&);
+
     // Text to display as long as the image isn't available.
     String m_altText;
     OwnPtr<RenderImageResource> m_imageResource;
diff --git a/Source/WebCore/rendering/RenderImageResource.h b/Source/WebCore/rendering/RenderImageResource.h
index a20c55a..f1ec75b 100644
--- a/Source/WebCore/rendering/RenderImageResource.h
+++ b/Source/WebCore/rendering/RenderImageResource.h
@@ -28,6 +28,7 @@
 
 #include "CachedImage.h"
 #include "CachedResourceHandle.h"
+#include "Image.h"
 #include "StyleImage.h"
 
 namespace WebCore {
@@ -53,7 +54,7 @@ public:
 
     void resetAnimation();
 
-    virtual Image* image(int /* width */ = 0, int /* height */ = 0) { return m_cachedImage ? m_cachedImage->image() : nullImage(); }
+    virtual PassRefPtr<Image> image(int /* width */ = 0, int /* height */ = 0) const { return m_cachedImage ? m_cachedImage->image() : nullImage(); }
     virtual bool errorOccurred() const { return m_cachedImage && m_cachedImage->errorOccurred(); }
 
     virtual void setImageContainerSize(const IntSize& size) const;
diff --git a/Source/WebCore/rendering/RenderImageResourceStyleImage.h b/Source/WebCore/rendering/RenderImageResourceStyleImage.h
index d91aaa8..278a82c 100644
--- a/Source/WebCore/rendering/RenderImageResourceStyleImage.h
+++ b/Source/WebCore/rendering/RenderImageResourceStyleImage.h
@@ -46,7 +46,7 @@ public:
     virtual void shutdown();
 
     virtual bool hasImage() const { return true; }
-    virtual Image* image(int width = 0, int height = 0) { return m_styleImage->image(m_renderer, IntSize(width, height)); }
+    virtual PassRefPtr<Image> image(int width = 0, int height = 0) const { return m_styleImage->image(m_renderer, IntSize(width, height)); }
     virtual bool errorOccurred() const { return m_styleImage->errorOccurred(); }
 
     virtual void setImageContainerSize(const IntSize& size) const { m_styleImage->setImageContainerSize(size); }
diff --git a/Source/WebCore/rendering/RenderIndicator.cpp b/Source/WebCore/rendering/RenderIndicator.cpp
index b03dfba..8f34a40 100644
--- a/Source/WebCore/rendering/RenderIndicator.cpp
+++ b/Source/WebCore/rendering/RenderIndicator.cpp
@@ -25,12 +25,51 @@
 #include "RenderIndicator.h"
 
 #include "RenderTheme.h"
-#include "ShadowElement.h"
+#include "RenderView.h"
 
 using namespace std;
 
 namespace WebCore {
 
+RenderIndicatorPart::RenderIndicatorPart(Node* node)
+    : RenderBlock(node)
+    , m_originalVisibility(HIDDEN)
+{
+}
+
+RenderIndicatorPart::~RenderIndicatorPart()
+{
+}
+
+void RenderIndicatorPart::layout()
+{
+    RenderBox* parentRenderer = toRenderBox(parent());
+    IntRect oldRect = frameRect();
+    IntRect newRect = preferredFrameRect();
+
+    LayoutStateMaintainer statePusher(parentRenderer->view(), parentRenderer, parentRenderer->size(), parentRenderer->style()->isFlippedBlocksWritingMode());
+
+    if (oldRect.size() != newRect.size())
+        setChildNeedsLayout(true, false);
+    if (needsLayout())
+        RenderBlock::layout();
+    setFrameRect(newRect);
+
+    if (checkForRepaintDuringLayout())
+        repaintDuringLayoutIfMoved(oldRect);
+        
+    statePusher.pop();
+    parentRenderer->addOverflowFromChild(this);
+    style()->setVisibility(shouldBeHidden() ? HIDDEN : originalVisibility());
+}
+
+void RenderIndicatorPart::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+{
+    m_originalVisibility = style()->visibility();
+    RenderBlock::styleDidChange(diff, oldStyle);
+}
+
+
 RenderIndicator::RenderIndicator(Node* node)
     : RenderBlock(node)
 {
diff --git a/Source/WebCore/rendering/RenderIndicator.h b/Source/WebCore/rendering/RenderIndicator.h
index 50d819d..7c2a346 100644
--- a/Source/WebCore/rendering/RenderIndicator.h
+++ b/Source/WebCore/rendering/RenderIndicator.h
@@ -26,6 +26,24 @@
 
 namespace WebCore {
 
+class RenderIndicatorPart : public RenderBlock {
+public:
+    RenderIndicatorPart(Node*);
+    virtual ~RenderIndicatorPart();
+
+protected:
+    EVisibility originalVisibility() const { return m_originalVisibility; }
+    virtual IntRect preferredFrameRect() = 0;
+    virtual bool shouldBeHidden() = 0;
+private:
+    virtual void layout();
+    virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
+    virtual bool canHaveChildren() const { return false; }
+    virtual void styleDidChange(StyleDifference, const RenderStyle*);
+
+    EVisibility m_originalVisibility;
+};
+
 class RenderIndicator : public RenderBlock {
 public:
     RenderIndicator(Node*);
diff --git a/Source/WebCore/rendering/RenderInline.cpp b/Source/WebCore/rendering/RenderInline.cpp
index 7466ace..3768774 100644
--- a/Source/WebCore/rendering/RenderInline.cpp
+++ b/Source/WebCore/rendering/RenderInline.cpp
@@ -595,10 +595,10 @@ IntRect RenderInline::linesVisualOverflowBoundingBox() const
 
     bool isHorizontal = style()->isHorizontalWritingMode();
         
-    int x = isHorizontal ? logicalLeftSide : firstLineBox()->leftVisualOverflow();
-    int y = isHorizontal ? firstLineBox()->topVisualOverflow() : logicalLeftSide;
-    int width = isHorizontal ? logicalRightSide - logicalLeftSide : lastLineBox()->rightVisualOverflow() - firstLineBox()->leftVisualOverflow();
-    int height = isHorizontal ? lastLineBox()->bottomVisualOverflow() - firstLineBox()->topVisualOverflow() : logicalRightSide - logicalLeftSide;
+    int x = isHorizontal ? logicalLeftSide : firstLineBox()->minXVisualOverflow();
+    int y = isHorizontal ? firstLineBox()->minYVisualOverflow() : logicalLeftSide;
+    int width = isHorizontal ? logicalRightSide - logicalLeftSide : lastLineBox()->maxXVisualOverflow() - firstLineBox()->minXVisualOverflow();
+    int height = isHorizontal ? lastLineBox()->maxYVisualOverflow() - firstLineBox()->minYVisualOverflow() : logicalRightSide - logicalLeftSide;
     return IntRect(x, y, width, height);
 }
 
@@ -749,7 +749,7 @@ void RenderInline::computeRectForRepaint(RenderBoxModelObject* repaintContainer,
 IntSize RenderInline::offsetFromContainer(RenderObject* container, const IntPoint& point) const
 {
     ASSERT(container == this->container());
-
+    
     IntSize offset;    
     if (isRelPositioned())
         offset += relativePositionOffset();
@@ -783,6 +783,10 @@ void RenderInline::mapLocalToContainer(RenderBoxModelObject* repaintContainer, b
     if (!o)
         return;
 
+    IntPoint centerPoint = roundedIntPoint(transformState.mappedPoint());
+    if (o->isBox() && o->style()->isFlippedBlocksWritingMode())
+        transformState.move(toRenderBox(o)->flipForWritingModeIncludingColumns(roundedIntPoint(transformState.mappedPoint())) - centerPoint);
+
     IntSize containerOffset = offsetFromContainer(o, roundedIntPoint(transformState.mappedPoint()));
 
     bool preserve3D = useTransforms && (o->style()->preserves3D() || style()->preserves3D());
@@ -905,8 +909,8 @@ int RenderInline::lineHeight(bool firstLine, LineDirectionMode /*direction*/, Li
 
 int RenderInline::baselinePosition(FontBaseline baselineType, bool firstLine, LineDirectionMode direction, LinePositionMode linePositionMode) const
 {
-    const Font& f = style(firstLine)->font();
-    return f.ascent(baselineType) + (lineHeight(firstLine, direction, linePositionMode) - f.height()) / 2;
+    const FontMetrics& fontMetrics = style(firstLine)->fontMetrics();
+    return fontMetrics.ascent(baselineType) + (lineHeight(firstLine, direction, linePositionMode) - fontMetrics.height()) / 2;
 }
 
 IntSize RenderInline::relativePositionedInlineOffset(const RenderBox* child) const
@@ -1033,30 +1037,30 @@ void RenderInline::paintOutlineForLine(GraphicsContext* graphicsContext, int tx,
 
     int t = ty + thisline.y() - offset;
     int l = tx + thisline.x() - offset;
-    int b = ty + thisline.bottom() + offset;
-    int r = tx + thisline.right() + offset;
+    int b = ty + thisline.maxY() + offset;
+    int r = tx + thisline.maxX() + offset;
     
     // left edge
     drawLineForBoxSide(graphicsContext,
                l - ow,
-               t - (lastline.isEmpty() || thisline.x() < lastline.x() || (lastline.right() - 1) <= thisline.x() ? ow : 0),
+               t - (lastline.isEmpty() || thisline.x() < lastline.x() || (lastline.maxX() - 1) <= thisline.x() ? ow : 0),
                l,
-               b + (nextline.isEmpty() || thisline.x() <= nextline.x() || (nextline.right() - 1) <= thisline.x() ? ow : 0),
+               b + (nextline.isEmpty() || thisline.x() <= nextline.x() || (nextline.maxX() - 1) <= thisline.x() ? ow : 0),
                BSLeft,
                oc, os,
-               (lastline.isEmpty() || thisline.x() < lastline.x() || (lastline.right() - 1) <= thisline.x() ? ow : -ow),
-               (nextline.isEmpty() || thisline.x() <= nextline.x() || (nextline.right() - 1) <= thisline.x() ? ow : -ow));
+               (lastline.isEmpty() || thisline.x() < lastline.x() || (lastline.maxX() - 1) <= thisline.x() ? ow : -ow),
+               (nextline.isEmpty() || thisline.x() <= nextline.x() || (nextline.maxX() - 1) <= thisline.x() ? ow : -ow));
     
     // right edge
     drawLineForBoxSide(graphicsContext,
                r,
-               t - (lastline.isEmpty() || lastline.right() < thisline.right() || (thisline.right() - 1) <= lastline.x() ? ow : 0),
+               t - (lastline.isEmpty() || lastline.maxX() < thisline.maxX() || (thisline.maxX() - 1) <= lastline.x() ? ow : 0),
                r + ow,
-               b + (nextline.isEmpty() || nextline.right() <= thisline.right() || (thisline.right() - 1) <= nextline.x() ? ow : 0),
+               b + (nextline.isEmpty() || nextline.maxX() <= thisline.maxX() || (thisline.maxX() - 1) <= nextline.x() ? ow : 0),
                BSRight,
                oc, os,
-               (lastline.isEmpty() || lastline.right() < thisline.right() || (thisline.right() - 1) <= lastline.x() ? ow : -ow),
-               (nextline.isEmpty() || nextline.right() <= thisline.right() || (thisline.right() - 1) <= nextline.x() ? ow : -ow));
+               (lastline.isEmpty() || lastline.maxX() < thisline.maxX() || (thisline.maxX() - 1) <= lastline.x() ? ow : -ow),
+               (nextline.isEmpty() || nextline.maxX() <= thisline.maxX() || (thisline.maxX() - 1) <= nextline.x() ? ow : -ow));
     // upper edge
     if (thisline.x() < lastline.x())
         drawLineForBoxSide(graphicsContext,
@@ -1068,14 +1072,14 @@ void RenderInline::paintOutlineForLine(GraphicsContext* graphicsContext, int tx,
                    ow,
                    (!lastline.isEmpty() && tx + lastline.x() + 1 < r + ow) ? -ow : ow);
     
-    if (lastline.right() < thisline.right())
+    if (lastline.maxX() < thisline.maxX())
         drawLineForBoxSide(graphicsContext,
-                   max(lastline.isEmpty() ? -1000000 : tx + lastline.right(), l - ow),
+                   max(lastline.isEmpty() ? -1000000 : tx + lastline.maxX(), l - ow),
                    t - ow,
                    r + ow,
                    t ,
                    BSTop, oc, os,
-                   (!lastline.isEmpty() && l - ow < tx + lastline.right()) ? -ow : ow,
+                   (!lastline.isEmpty() && l - ow < tx + lastline.maxX()) ? -ow : ow,
                    ow);
     
     // lower edge
@@ -1089,14 +1093,14 @@ void RenderInline::paintOutlineForLine(GraphicsContext* graphicsContext, int tx,
                    ow,
                    (!nextline.isEmpty() && tx + nextline.x() + 1 < r + ow) ? -ow : ow);
     
-    if (nextline.right() < thisline.right())
+    if (nextline.maxX() < thisline.maxX())
         drawLineForBoxSide(graphicsContext,
-                   max(!nextline.isEmpty() ? tx + nextline.right() : -1000000, l - ow),
+                   max(!nextline.isEmpty() ? tx + nextline.maxX() : -1000000, l - ow),
                    b,
                    r + ow,
                    b + ow,
                    BSBottom, oc, os,
-                   (!nextline.isEmpty() && l - ow < tx + nextline.right()) ? -ow : ow,
+                   (!nextline.isEmpty() && l - ow < tx + nextline.maxX()) ? -ow : ow,
                    ow);
 }
 
diff --git a/Source/WebCore/rendering/RenderLayer.cpp b/Source/WebCore/rendering/RenderLayer.cpp
index 29a6fc9..e278c75 100644
--- a/Source/WebCore/rendering/RenderLayer.cpp
+++ b/Source/WebCore/rendering/RenderLayer.cpp
@@ -188,6 +188,8 @@ RenderLayer::RenderLayer(RenderBoxModelObject* renderer)
     , m_scrollCorner(0)
     , m_resizer(0)
 {
+    ScrollableArea::setConstrainsScrollingToContentEdge(false);
+
     if (!renderer->firstChild() && renderer->style()) {
         m_visibleContentStatusDirty = false;
         m_hasVisibleContent = renderer->style()->visibility() == VISIBLE;
@@ -960,7 +962,7 @@ static IntRect transparencyClipBox(const RenderLayer* l, const RenderLayer* root
 
         TransformationMatrix transform;
         transform.translate(x, y);
-        transform = *l->transform() * transform;
+        transform = transform * *l->transform();
 
         IntRect clipRect = l->boundingBox(l);
         expandClipRectForDescendantsAndReflection(clipRect, l, l, paintBehavior);
@@ -1532,7 +1534,7 @@ IntRect RenderLayer::getRectToExpose(const IntRect &visibleRect, const IntRect &
         scrollX = ScrollAlignment::getHiddenBehavior(alignX);
     // If we're trying to align to the closest edge, and the exposeRect is further right
     // than the visibleRect, and not bigger than the visible area, then align with the right.
-    if (scrollX == alignToClosestEdge && exposeRect.right() > visibleRect.right() && exposeRect.width() < visibleRect.width())
+    if (scrollX == alignToClosestEdge && exposeRect.maxX() > visibleRect.maxX() && exposeRect.width() < visibleRect.width())
         scrollX = alignRight;
 
     // Given the X behavior, compute the X coordinate.
@@ -1540,7 +1542,7 @@ IntRect RenderLayer::getRectToExpose(const IntRect &visibleRect, const IntRect &
     if (scrollX == noScroll) 
         x = visibleRect.x();
     else if (scrollX == alignRight)
-        x = exposeRect.right() - visibleRect.width();
+        x = exposeRect.maxX() - visibleRect.width();
     else if (scrollX == alignCenter)
         x = exposeRect.x() + (exposeRect.width() - visibleRect.width()) / 2;
     else
@@ -1565,7 +1567,7 @@ IntRect RenderLayer::getRectToExpose(const IntRect &visibleRect, const IntRect &
         scrollY = ScrollAlignment::getHiddenBehavior(alignY);
     // If we're trying to align to the closest edge, and the exposeRect is further down
     // than the visibleRect, and not bigger than the visible area, then align with the bottom.
-    if (scrollY == alignToClosestEdge && exposeRect.bottom() > visibleRect.bottom() && exposeRect.height() < visibleRect.height())
+    if (scrollY == alignToClosestEdge && exposeRect.maxY() > visibleRect.maxY() && exposeRect.height() < visibleRect.height())
         scrollY = alignBottom;
 
     // Given the Y behavior, compute the Y coordinate.
@@ -1573,7 +1575,7 @@ IntRect RenderLayer::getRectToExpose(const IntRect &visibleRect, const IntRect &
     if (scrollY == noScroll) 
         y = visibleRect.y();
     else if (scrollY == alignBottom)
-        y = exposeRect.bottom() - visibleRect.height();
+        y = exposeRect.maxY() - visibleRect.height();
     else if (scrollY == alignCenter)
         y = exposeRect.y() + (exposeRect.height() - visibleRect.height()) / 2;
     else
@@ -1681,7 +1683,7 @@ int RenderLayer::scrollPosition(Scrollbar* scrollbar) const
     if (scrollbar->orientation() == HorizontalScrollbar)
         return scrollXOffset();
     if (scrollbar->orientation() == VerticalScrollbar)
-        return m_scrollY;
+        return scrollYOffset();
     return 0;
 }
 
@@ -1710,8 +1712,8 @@ static IntRect cornerRect(const RenderLayer* layer, const IntRect& bounds)
         horizontalThickness = layer->verticalScrollbar()->width();
         verticalThickness = layer->horizontalScrollbar()->height();
     }
-    return IntRect(bounds.right() - horizontalThickness - layer->renderer()->style()->borderRightWidth(), 
-                   bounds.bottom() - verticalThickness - layer->renderer()->style()->borderBottomWidth(),
+    return IntRect(bounds.maxX() - horizontalThickness - layer->renderer()->style()->borderRightWidth(), 
+                   bounds.maxY() - verticalThickness - layer->renderer()->style()->borderBottomWidth(),
                    horizontalThickness, verticalThickness);
 }
 
@@ -1789,6 +1791,21 @@ IntPoint RenderLayer::convertFromContainingViewToScrollbar(const Scrollbar* scro
     return point;
 }
 
+IntSize RenderLayer::contentsSize() const
+{
+    return IntSize(const_cast<RenderLayer*>(this)->scrollWidth(), const_cast<RenderLayer*>(this)->scrollHeight());
+}
+
+int RenderLayer::visibleHeight() const
+{
+    return m_height;
+}
+
+int RenderLayer::visibleWidth() const
+{
+    return m_width;
+}
+
 IntSize RenderLayer::scrollbarOffset(const Scrollbar* scrollbar) const
 {
     RenderBox* box = renderBox();
@@ -1846,10 +1863,13 @@ void RenderLayer::setHasHorizontalScrollbar(bool hasScrollbar)
     if (hasScrollbar == (m_hBar != 0))
         return;
 
-    if (hasScrollbar)
+    if (hasScrollbar) {
         m_hBar = createScrollbar(HorizontalScrollbar);
-    else
+        ScrollableArea::didAddHorizontalScrollbar(m_hBar.get());
+    } else {
+        ScrollableArea::willRemoveHorizontalScrollbar(m_hBar.get());
         destroyScrollbar(HorizontalScrollbar);
+    }
 
     // Destroying or creating one bar can cause our scrollbar corner to come and go.  We need to update the opposite scrollbar's style.
     if (m_hBar)
@@ -1869,10 +1889,13 @@ void RenderLayer::setHasVerticalScrollbar(bool hasScrollbar)
     if (hasScrollbar == (m_vBar != 0))
         return;
 
-    if (hasScrollbar)
+    if (hasScrollbar) {
         m_vBar = createScrollbar(VerticalScrollbar);
-    else
+        ScrollableArea::didAddVerticalScrollbar(m_vBar.get());
+    } else {
+        ScrollableArea::willRemoveVerticalScrollbar(m_vBar.get());
         destroyScrollbar(VerticalScrollbar);
+    }
 
      // Destroying or creating one bar can cause our scrollbar corner to come and go.  We need to update the opposite scrollbar's style.
     if (m_hBar)
@@ -1936,14 +1959,14 @@ void RenderLayer::positionOverflowControls(int tx, int ty)
     IntRect scrollCorner(scrollCornerRect(this, borderBox));
     IntRect absBounds(borderBox.x() + tx, borderBox.y() + ty, borderBox.width(), borderBox.height());
     if (m_vBar)
-        m_vBar->setFrameRect(IntRect(absBounds.right() - box->borderRight() - m_vBar->width(),
+        m_vBar->setFrameRect(IntRect(absBounds.maxX() - box->borderRight() - m_vBar->width(),
                                      absBounds.y() + box->borderTop(),
                                      m_vBar->width(),
                                      absBounds.height() - (box->borderTop() + box->borderBottom()) - scrollCorner.height()));
 
     if (m_hBar)
         m_hBar->setFrameRect(IntRect(absBounds.x() + box->borderLeft(),
-                                     absBounds.bottom() - box->borderBottom() - m_hBar->height(),
+                                     absBounds.maxY() - box->borderBottom() - m_hBar->height(),
                                      absBounds.width() - (box->borderLeft() + box->borderRight()) - scrollCorner.width(),
                                      m_hBar->height()));
     
@@ -2000,7 +2023,7 @@ int RenderLayer::overflowBottom() const
     RenderBox* box = renderBox();
     IntRect overflowRect(box->layoutOverflowRect());
     box->flipForWritingMode(overflowRect);
-    return overflowRect.bottom();
+    return overflowRect.maxY();
 }
 
 int RenderLayer::overflowLeft() const
@@ -2016,7 +2039,7 @@ int RenderLayer::overflowRight() const
     RenderBox* box = renderBox();
     IntRect overflowRect(box->layoutOverflowRect());
     box->flipForWritingMode(overflowRect);
-    return overflowRect.right();
+    return overflowRect.maxX();
 }
 
 void RenderLayer::computeScrollDimensions(bool* needHBar, bool* needVBar)
@@ -2078,8 +2101,8 @@ void RenderLayer::updateScrollInfoAfterLayout()
         // Layout may cause us to be in an invalid scroll position.  In this case we need
         // to pull our scroll offsets back to the max (or push them up to the min).
         int newX = max(0, min(scrollXOffset(), scrollWidth() - box->clientWidth()));
-        int newY = max(0, min(m_scrollY, scrollHeight() - box->clientHeight()));
-        if (newX != scrollXOffset() || newY != m_scrollY) {
+        int newY = max(0, min(scrollYOffset(), scrollHeight() - box->clientHeight()));
+        if (newX != scrollXOffset() || newY != scrollYOffset()) {
             RenderView* view = renderer()->view();
             ASSERT(view);
             // scrollToOffset() may call updateLayerPositions(), which doesn't work
@@ -2163,7 +2186,10 @@ void RenderLayer::updateScrollInfoAfterLayout()
         m_vBar->setProportion(clientHeight, m_scrollHeight);
     }
  
+    RenderView* view = renderer()->view();
+    view->disableLayoutState();
     scrollToOffset(scrollXOffset(), scrollYOffset());
+    view->enableLayoutState();
  
     if (renderer()->node() && renderer()->document()->hasListenerType(Document::OVERFLOWCHANGED_LISTENER))
         updateOverflowStatus(horizontalOverflow, verticalOverflow);
@@ -2256,7 +2282,7 @@ void RenderLayer::paintResizer(GraphicsContext* context, int tx, int ty, const I
 
     // Paint the resizer control.
     DEFINE_STATIC_LOCAL(RefPtr<Image>, resizeCornerImage, (Image::loadPlatformResource("textAreaResizeCorner")));
-    IntPoint imagePoint(absRect.right() - resizeCornerImage->width(), absRect.bottom() - resizeCornerImage->height());
+    IntPoint imagePoint(absRect.maxX() - resizeCornerImage->width(), absRect.maxY() - resizeCornerImage->height());
     context->drawImage(resizeCornerImage.get(), box->style()->colorSpace(), imagePoint);
 
     // Draw a frame around the resizer (1px grey line) if there are any scrollbars present.
@@ -2634,13 +2660,18 @@ void RenderLayer::paintChildLayerIntoColumns(RenderLayer* childLayer, RenderLaye
     int layerY = 0;
     columnBlock->layer()->convertToLayerCoords(rootLayer, layerX, layerY);
     
+    bool isHorizontal = columnBlock->style()->isHorizontalWritingMode();
+
     ColumnInfo* colInfo = columnBlock->columnInfo();
     unsigned colCount = columnBlock->columnCount(colInfo);
-    int currYOffset = 0;
+    int currLogicalTopOffset = 0;
     for (unsigned i = 0; i < colCount; i++) {
         // For each rect, we clip to the rect, and then we adjust our coords.
         IntRect colRect = columnBlock->columnRectAt(colInfo, i);
-        int currXOffset = colRect.x() - (columnBlock->borderLeft() + columnBlock->paddingLeft());
+        columnBlock->flipForWritingMode(colRect);
+        int logicalLeftOffset = (isHorizontal ? colRect.x() : colRect.y()) - columnBlock->logicalLeftOffsetForContent();
+        IntSize offset = isHorizontal ? IntSize(logicalLeftOffset, currLogicalTopOffset) : IntSize(currLogicalTopOffset, logicalLeftOffset);
+
         colRect.move(layerX, layerY);
 
         IntRect localDirtyRect(paintDirtyRect);
@@ -2660,7 +2691,7 @@ void RenderLayer::paintChildLayerIntoColumns(RenderLayer* childLayer, RenderLaye
                 if (oldHasTransform)
                     oldTransform = *childLayer->transform();
                 TransformationMatrix newTransform(oldTransform);
-                newTransform.translateRight(currXOffset, currYOffset);
+                newTransform.translateRight(offset.width(), offset.height());
                 
                 childLayer->m_transform.set(new TransformationMatrix(newTransform));
                 childLayer->paintLayer(rootLayer, context, localDirtyRect, paintBehavior, paintingRoot, overlapTestRequests, paintFlags);
@@ -2675,7 +2706,7 @@ void RenderLayer::paintChildLayerIntoColumns(RenderLayer* childLayer, RenderLaye
                 int childY = 0;
                 columnLayers[colIndex - 1]->convertToLayerCoords(rootLayer, childX, childY);
                 TransformationMatrix transform;
-                transform.translateRight(childX + currXOffset, childY + currYOffset);
+                transform.translateRight(childX + offset.width(), childY + offset.height());
                 
                 // Apply the transform.
                 context->concatCTM(transform.toAffineTransform());
@@ -2690,7 +2721,11 @@ void RenderLayer::paintChildLayerIntoColumns(RenderLayer* childLayer, RenderLaye
         }
 
         // Move to the next position.
-        currYOffset -= colRect.height();
+        int blockDelta = isHorizontal ? colRect.height() : colRect.width();
+        if (columnBlock->style()->isFlippedBlocksWritingMode())
+            currLogicalTopOffset += blockDelta;
+        else
+            currLogicalTopOffset -= blockDelta;
     }
 }
 
@@ -3111,21 +3146,35 @@ RenderLayer* RenderLayer::hitTestChildLayerColumns(RenderLayer* childLayer, Rend
     int colCount = columnBlock->columnCount(colInfo);
     
     // We have to go backwards from the last column to the first.
-    int left = columnBlock->borderLeft() + columnBlock->paddingLeft();
-    int currYOffset = 0;
+    bool isHorizontal = columnBlock->style()->isHorizontalWritingMode();
+    int logicalLeft = columnBlock->logicalLeftOffsetForContent();
+    int currLogicalTopOffset = 0;
     int i;
-    for (i = 0; i < colCount; i++)
-        currYOffset -= columnBlock->columnRectAt(colInfo, i).height();
+    for (i = 0; i < colCount; i++) {
+        IntRect colRect = columnBlock->columnRectAt(colInfo, i);
+        int blockDelta =  (isHorizontal ? colRect.height() : colRect.width());
+        if (columnBlock->style()->isFlippedBlocksWritingMode())
+            currLogicalTopOffset += blockDelta;
+        else
+            currLogicalTopOffset -= blockDelta;
+    }
     for (i = colCount - 1; i >= 0; i--) {
         // For each rect, we clip to the rect, and then we adjust our coords.
         IntRect colRect = columnBlock->columnRectAt(colInfo, i);
-        int currXOffset = colRect.x() - left;
-        currYOffset += colRect.height();
+        columnBlock->flipForWritingMode(colRect);
+        int currLogicalLeftOffset = (isHorizontal ? colRect.x() : colRect.y()) - logicalLeft;
+        int blockDelta =  (isHorizontal ? colRect.height() : colRect.width());
+        if (columnBlock->style()->isFlippedBlocksWritingMode())
+            currLogicalTopOffset -= blockDelta;
+        else
+            currLogicalTopOffset += blockDelta;
         colRect.move(layerX, layerY);
 
         IntRect localClipRect(hitTestRect);
         localClipRect.intersect(colRect);
         
+        IntSize offset = isHorizontal ? IntSize(currLogicalLeftOffset, currLogicalTopOffset) : IntSize(currLogicalTopOffset, currLogicalLeftOffset);
+
         if (!localClipRect.isEmpty() && localClipRect.intersects(result.rectForPoint(hitTestPoint))) {
             RenderLayer* hitLayer = 0;
             if (!columnIndex) {
@@ -3135,7 +3184,7 @@ RenderLayer* RenderLayer::hitTestChildLayerColumns(RenderLayer* childLayer, Rend
                 if (oldHasTransform)
                     oldTransform = *childLayer->transform();
                 TransformationMatrix newTransform(oldTransform);
-                newTransform.translateRight(currXOffset, currYOffset);
+                newTransform.translateRight(offset.width(), offset.height());
                 
                 childLayer->m_transform.set(new TransformationMatrix(newTransform));
                 hitLayer = childLayer->hitTestLayer(rootLayer, columnLayers[0], request, result, localClipRect, hitTestPoint, false, transformState, zOffset);
@@ -3148,7 +3197,7 @@ RenderLayer* RenderLayer::hitTestChildLayerColumns(RenderLayer* childLayer, Rend
                 // This involves subtracting out the position of the layer in our current coordinate space.
                 RenderLayer* nextLayer = columnLayers[columnIndex - 1];
                 RefPtr<HitTestingTransformState> newTransformState = nextLayer->createLocalTransformState(rootLayer, nextLayer, localClipRect, hitTestPoint, transformState);
-                newTransformState->translate(currXOffset, currYOffset, HitTestingTransformState::AccumulateTransform);
+                newTransformState->translate(offset.width(), offset.height(), HitTestingTransformState::AccumulateTransform);
                 IntPoint localPoint = roundedIntPoint(newTransformState->mappedPoint());
                 IntRect localHitTestRect = newTransformState->mappedQuad().enclosingBoundingBox();
                 newTransformState->flatten();
@@ -3437,19 +3486,9 @@ IntRect RenderLayer::localBoundingBox() const
     // as part of our bounding box.  We do this because we are the responsible layer for both hit testing and painting those
     // floats.
     IntRect result;
-    if (renderer()->isRenderInline()) {
-        // Go from our first line box to our last line box.
-        RenderInline* inlineFlow = toRenderInline(renderer());
-        InlineFlowBox* firstBox = inlineFlow->firstLineBox();
-        if (!firstBox)
-            return result;
-        int top = firstBox->topVisualOverflow();
-        int bottom = inlineFlow->lastLineBox()->bottomVisualOverflow();
-        int left = firstBox->x();
-        for (InlineFlowBox* curr = firstBox->nextLineBox(); curr; curr = curr->nextLineBox())
-            left = min(left, curr->x());
-        result = IntRect(left, top, width(), bottom - top);
-    } else if (renderer()->isTableRow()) {
+    if (renderer()->isRenderInline())
+        result = toRenderInline(renderer())->linesVisualOverflowBoundingBox();
+    else if (renderer()->isTableRow()) {
         // Our bounding box is just the union of all of our cells' border/overflow rects.
         for (RenderObject* child = renderer()->firstChild(); child; child = child->nextSibling()) {
             if (child->isTableCell()) {
@@ -3485,7 +3524,10 @@ IntRect RenderLayer::localBoundingBox() const
 IntRect RenderLayer::boundingBox(const RenderLayer* ancestorLayer) const
 {    
     IntRect result = localBoundingBox();
-
+    if (renderer()->isBox())
+        renderBox()->flipForWritingMode(result);
+    else
+        renderer()->containingBlock()->flipForWritingMode(result);
     int deltaX = 0, deltaY = 0;
     convertToLayerCoords(ancestorLayer, deltaX, deltaY);
     result.move(deltaX, deltaY);
@@ -3538,6 +3580,26 @@ bool RenderLayer::hasCompositedMask() const
 }
 #endif
 
+bool RenderLayer::scrollbarWillRenderIntoCompositingLayer() const
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (enclosingCompositingLayer())
+        return true;
+
+    RenderView* view = renderer()->view();
+    if (!view)
+        return false;
+
+    FrameView* frameView = view->frameView();
+    if (!frameView)
+        return false;
+
+    return frameView->isEnclosedInCompositingLayer();
+#else
+    return false;
+#endif
+}
+
 bool RenderLayer::paintsWithTransform(PaintBehavior paintBehavior) const
 {
 #if USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/rendering/RenderLayer.h b/Source/WebCore/rendering/RenderLayer.h
index 57cb4de..66281ce 100644
--- a/Source/WebCore/rendering/RenderLayer.h
+++ b/Source/WebCore/rendering/RenderLayer.h
@@ -483,6 +483,7 @@ public:
     bool isComposited() const { return false; }
     bool hasCompositedMask() const { return false; }
 #endif
+    virtual bool scrollbarWillRenderIntoCompositingLayer() const;
 
     bool paintsWithTransparency(PaintBehavior paintBehavior) const
     {
@@ -495,7 +496,6 @@ private:
     // The normal operator new is disallowed on all render objects.
     void* operator new(size_t) throw();
 
-private:
     void setNextSibling(RenderLayer* next) { m_next = next; }
     void setPreviousSibling(RenderLayer* prev) { m_previous = prev; }
     void setParent(RenderLayer* parent);
@@ -571,6 +571,9 @@ private:
     virtual IntRect convertFromContainingViewToScrollbar(const Scrollbar*, const IntRect&) const;
     virtual IntPoint convertFromScrollbarToContainingView(const Scrollbar*, const IntPoint&) const;
     virtual IntPoint convertFromContainingViewToScrollbar(const Scrollbar*, const IntPoint&) const;
+    virtual IntSize contentsSize() const;
+    virtual int visibleHeight() const;
+    virtual int visibleWidth() const;
 
     // NOTE: This should only be called by the overriden setScrollOffset from ScrollableArea.
     void scrollTo(int x, int y);
@@ -624,7 +627,6 @@ private:
 
     void updateContentsScale(float);
 
-private:
     friend class RenderLayerBacking;
     friend class RenderLayerCompositor;
     friend class RenderBoxModelObject;
diff --git a/Source/WebCore/rendering/RenderLayerBacking.cpp b/Source/WebCore/rendering/RenderLayerBacking.cpp
index 8001c42..d0a36c7 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.cpp
+++ b/Source/WebCore/rendering/RenderLayerBacking.cpp
@@ -70,7 +70,7 @@ static IntRect clipBox(RenderBox* renderer);
 
 static inline bool isAcceleratedCanvas(RenderObject* renderer)
 {
-#if ENABLE(3D_CANVAS) || ENABLE(ACCELERATED_2D_CANVAS)
+#if ENABLE(WEBGL) || ENABLE(ACCELERATED_2D_CANVAS)
     if (renderer->isCanvas()) {
         HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(renderer->node());
         if (CanvasRenderingContext* context = canvas->renderingContext())
@@ -287,7 +287,7 @@ bool RenderLayerBacking::updateGraphicsLayerConfiguration()
         m_graphicsLayer->setContentsToMedia(mediaElement->platformLayer());
     }
 #endif
-#if ENABLE(3D_CANVAS) || ENABLE(ACCELERATED_2D_CANVAS)
+#if ENABLE(WEBGL) || ENABLE(ACCELERATED_2D_CANVAS)
     else if (isAcceleratedCanvas(renderer)) {
         HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(renderer->node());
         if (CanvasRenderingContext* context = canvas->renderingContext())
@@ -803,7 +803,7 @@ bool RenderLayerBacking::containsPaintedContent() const
         return hasBoxDecorationsOrBackground(renderer());
 #endif
 #if PLATFORM(MAC) && PLATFORM(CA) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-#elif ENABLE(3D_CANVAS) || ENABLE(ACCELERATED_2D_CANVAS)
+#elif ENABLE(WEBGL) || ENABLE(ACCELERATED_2D_CANVAS)
     if (isAcceleratedCanvas(renderer()))
         return hasBoxDecorationsOrBackground(renderer());
 #endif
@@ -843,7 +843,7 @@ void RenderLayerBacking::contentChanged(RenderLayer::ContentChangeType changeTyp
         updateAfterLayout(CompositingChildren, isUpdateRoot);
     }
 
-#if ENABLE(3D_CANVAS) || ENABLE(ACCELERATED_2D_CANVAS)
+#if ENABLE(WEBGL) || ENABLE(ACCELERATED_2D_CANVAS)
     if ((changeType == RenderLayer::CanvasChanged) && isAcceleratedCanvas(renderer())) {
         m_graphicsLayer->setContentsNeedsDisplay();
         return;
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.cpp b/Source/WebCore/rendering/RenderLayerCompositor.cpp
index 9a5dda7..f9c0f32 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/Source/WebCore/rendering/RenderLayerCompositor.cpp
@@ -1483,7 +1483,7 @@ void RenderLayerCompositor::ensureRootPlatformLayer()
 #ifndef NDEBUG
         m_rootPlatformLayer->setName("Root platform");
 #endif
-        m_rootPlatformLayer->setSize(FloatSize(m_renderView->rightLayoutOverflow(), m_renderView->bottomLayoutOverflow()));
+        m_rootPlatformLayer->setSize(FloatSize(m_renderView->maxXLayoutOverflow(), m_renderView->maxYLayoutOverflow()));
         m_rootPlatformLayer->setPosition(FloatPoint());
 
         // Need to clip to prevent transformed content showing outside this frame
diff --git a/Source/WebCore/rendering/RenderLineBoxList.cpp b/Source/WebCore/rendering/RenderLineBoxList.cpp
index 1488ecc..274905e 100644
--- a/Source/WebCore/rendering/RenderLineBoxList.cpp
+++ b/Source/WebCore/rendering/RenderLineBoxList.cpp
@@ -160,11 +160,11 @@ bool RenderLineBoxList::rangeIntersectsRect(RenderBoxModelObject* renderer, int
     
     if (renderer->style()->isHorizontalWritingMode()) {
         physicalStart += ty;
-        if (physicalStart >= rect.bottom() || physicalStart + physicalExtent <= rect.y())
+        if (physicalStart >= rect.maxY() || physicalStart + physicalExtent <= rect.y())
             return false;
     } else {
         physicalStart += tx;
-        if (physicalStart >= rect.right() || physicalStart + physicalExtent <= rect.x())
+        if (physicalStart >= rect.maxX() || physicalStart + physicalExtent <= rect.x())
             return false;
     }
     
@@ -231,19 +231,19 @@ void RenderLineBoxList::paint(RenderBoxModelObject* renderer, PaintInfo& paintIn
             // FIXME: This is the deprecated pagination model that is still needed
             // for embedded views inside AppKit.  AppKit is incapable of paginating vertical
             // text pages, so we don't have to deal with vertical lines at all here.
-            int topForPaginationCheck = curr->topVisualOverflow();
-            int bottomForPaginationCheck = curr->bottomVisualOverflow();
+            int topForPaginationCheck = curr->minYVisualOverflow();
+            int bottomForPaginationCheck = curr->maxYVisualOverflow();
             if (!curr->parent()) {
                 // We're a root box.  Use lineTop and lineBottom as well here.
                 topForPaginationCheck = min(topForPaginationCheck, curr->root()->lineTop());
                 bottomForPaginationCheck = max(bottomForPaginationCheck, curr->root()->lineBottom());
             }
             if (bottomForPaginationCheck - topForPaginationCheck <= v->printRect().height()) {
-                if (ty + bottomForPaginationCheck > v->printRect().bottom()) {
+                if (ty + bottomForPaginationCheck > v->printRect().maxY()) {
                     if (RootInlineBox* nextRootBox = curr->root()->nextRootBox())
-                        bottomForPaginationCheck = min(bottomForPaginationCheck, min(nextRootBox->topVisualOverflow(), nextRootBox->lineTop()));
+                        bottomForPaginationCheck = min(bottomForPaginationCheck, min(nextRootBox->minYVisualOverflow(), nextRootBox->lineTop()));
                 }
-                if (ty + bottomForPaginationCheck > v->printRect().bottom()) {
+                if (ty + bottomForPaginationCheck > v->printRect().maxY()) {
                     if (ty + topForPaginationCheck < v->truncatedAt())
                         v->setBestTruncatedAt(ty + topForPaginationCheck, renderer);
                     // If we were able to truncate, don't paint.
diff --git a/Source/WebCore/rendering/RenderListBox.cpp b/Source/WebCore/rendering/RenderListBox.cpp
index 90f13da..13e8e58 100644
--- a/Source/WebCore/rendering/RenderListBox.cpp
+++ b/Source/WebCore/rendering/RenderListBox.cpp
@@ -1,7 +1,5 @@
 /*
- * This file is part of the select element renderer in WebCore.
- *
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2011 Apple Inc. All rights reserved.
  *               2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -48,6 +46,7 @@
 #include "OptionElement.h"
 #include "Page.h"
 #include "PaintInfo.h"
+#include "RenderLayer.h"
 #include "RenderScrollbar.h"
 #include "RenderTheme.h"
 #include "RenderView.h"
@@ -112,7 +111,7 @@ void RenderListBox::updateFromElement()
             }
                 
             if (!text.isEmpty()) {
-                float textWidth = itemFont.floatWidth(TextRun(text.impl(), 0, 0, 0, false, false, false, false));
+                float textWidth = itemFont.floatWidth(TextRun(text.impl(), false, 0, 0, TextRun::AllowTrailingExpansion, false, false, false, false));
                 width = max(width, textWidth);
             }
         }
@@ -142,8 +141,11 @@ void RenderListBox::selectionChanged()
 void RenderListBox::layout()
 {
     RenderBlock::layout();
-    if (m_scrollToRevealSelectionAfterLayout)
+    if (m_scrollToRevealSelectionAfterLayout) {
+        view()->disableLayoutState();
         scrollToRevealSelection();
+        view()->enableLayoutState();
+    }
 }
 
 void RenderListBox::scrollToRevealSelection()
@@ -303,7 +305,7 @@ void RenderListBox::paintItemForeground(PaintInfo& paintInfo, int tx, int ty, in
 
     // Determine where the item text should be placed
     IntRect r = itemBoundingBoxRect(tx, ty, listIndex);
-    r.move(optionsSpacingHorizontal, style()->font().ascent());
+    r.move(optionsSpacingHorizontal, style()->fontMetrics().ascent());
 
     RenderStyle* itemStyle = element->renderStyle();
     if (!itemStyle)
@@ -331,7 +333,7 @@ void RenderListBox::paintItemForeground(PaintInfo& paintInfo, int tx, int ty, in
 
     unsigned length = itemText.length();
     const UChar* string = itemText.characters();
-    TextRun textRun(string, length, 0, 0, 0, !itemStyle->isLeftToRightDirection(), itemStyle->unicodeBidi() == Override, false, false);
+    TextRun textRun(string, length, false, 0, 0, TextRun::AllowTrailingExpansion, !itemStyle->isLeftToRightDirection(), itemStyle->unicodeBidi() == Override, false, false);
 
     // Draw the item text
     if (itemStyle->visibility() != HIDDEN)
@@ -550,7 +552,7 @@ void RenderListBox::scrollTo(int newOffset)
 
 int RenderListBox::itemHeight() const
 {
-    return style()->font().height() + rowSpacing;
+    return style()->fontMetrics().height() + rowSpacing;
 }
 
 int RenderListBox::verticalScrollbarWidth() const
@@ -696,6 +698,37 @@ IntPoint RenderListBox::convertFromContainingViewToScrollbar(const Scrollbar* sc
     return point;
 }
 
+IntSize RenderListBox::contentsSize() const
+{
+    return IntSize(scrollWidth(), scrollHeight());
+}
+
+int RenderListBox::visibleHeight() const
+{
+    return height();
+}
+
+int RenderListBox::visibleWidth() const
+{
+    return width();
+}
+
+IntPoint RenderListBox::currentMousePosition() const
+{
+    RenderView* view = this->view();
+    if (!view)
+        return IntPoint();
+    return view->frameView()->currentMousePosition();
+}
+
+bool RenderListBox::scrollbarWillRenderIntoCompositingLayer() const
+{
+    RenderLayer* layer = this->enclosingLayer();
+    if (!layer)
+        return false;
+    return layer->scrollbarWillRenderIntoCompositingLayer();
+}
+
 PassRefPtr<Scrollbar> RenderListBox::createScrollbar()
 {
     RefPtr<Scrollbar> widget;
@@ -723,10 +756,13 @@ void RenderListBox::setHasVerticalScrollbar(bool hasScrollbar)
     if (hasScrollbar == (m_vBar != 0))
         return;
 
-    if (hasScrollbar)
+    if (hasScrollbar) {
         m_vBar = createScrollbar();
-    else
+        ScrollableArea::didAddVerticalScrollbar(m_vBar.get());
+    } else {
+        ScrollableArea::willRemoveVerticalScrollbar(m_vBar.get());
         destroyScrollbar();
+    }
 
     if (m_vBar)
         m_vBar->styleChanged();
diff --git a/Source/WebCore/rendering/RenderListBox.h b/Source/WebCore/rendering/RenderListBox.h
index 1ba2b94..1eb2036 100644
--- a/Source/WebCore/rendering/RenderListBox.h
+++ b/Source/WebCore/rendering/RenderListBox.h
@@ -106,6 +106,11 @@ private:
     virtual IntPoint convertFromScrollbarToContainingView(const Scrollbar*, const IntPoint&) const;
     virtual IntPoint convertFromContainingViewToScrollbar(const Scrollbar*, const IntPoint&) const;
     virtual Scrollbar* verticalScrollbar() const { return m_vBar.get(); }
+    virtual IntSize contentsSize() const;
+    virtual int visibleHeight() const;
+    virtual int visibleWidth() const;
+    virtual IntPoint currentMousePosition() const;
+    virtual bool scrollbarWillRenderIntoCompositingLayer() const;
 
     // NOTE: This should only be called by the overriden setScrollOffset from ScrollableArea.
     void scrollTo(int newOffset);
diff --git a/Source/WebCore/rendering/RenderListItem.cpp b/Source/WebCore/rendering/RenderListItem.cpp
index 65606f3..5cfb522 100644
--- a/Source/WebCore/rendering/RenderListItem.cpp
+++ b/Source/WebCore/rendering/RenderListItem.cpp
@@ -297,12 +297,12 @@ void RenderListItem::positionListMarker()
             for (InlineFlowBox* box = m_marker->inlineBoxWrapper()->parent(); box; box = box->parent()) {
                 IntRect newLogicalVisualOverflowRect = box->logicalVisualOverflowRect();
                 IntRect newLogicalLayoutOverflowRect = box->logicalLayoutOverflowRect();
-                if (markerLogicalLeft + m_marker->logicalWidth() > newLogicalVisualOverflowRect.right() && !hitSelfPaintingLayer) {
+                if (markerLogicalLeft + m_marker->logicalWidth() > newLogicalVisualOverflowRect.maxX() && !hitSelfPaintingLayer) {
                     newLogicalVisualOverflowRect.setWidth(markerLogicalLeft + m_marker->logicalWidth() - box->logicalLeftVisualOverflow());
                     if (box == root)
                         adjustOverflow = true;
                 }
-                if (markerLogicalLeft + m_marker->logicalWidth() > newLogicalLayoutOverflowRect.right()) {
+                if (markerLogicalLeft + m_marker->logicalWidth() > newLogicalLayoutOverflowRect.maxX()) {
                     newLogicalLayoutOverflowRect.setWidth(markerLogicalLeft + m_marker->logicalWidth() - box->logicalLeftLayoutOverflow());
                     if (box == root)
                         adjustOverflow = true;
diff --git a/Source/WebCore/rendering/RenderListMarker.cpp b/Source/WebCore/rendering/RenderListMarker.cpp
index cd41c75..c1c7245 100644
--- a/Source/WebCore/rendering/RenderListMarker.cpp
+++ b/Source/WebCore/rendering/RenderListMarker.cpp
@@ -26,13 +26,13 @@
 #include "RenderListMarker.h"
 
 #include "CachedImage.h"
-#include "CharacterNames.h"
 #include "Document.h"
 #include "GraphicsContext.h"
 #include "RenderLayer.h"
 #include "RenderListItem.h"
 #include "RenderView.h"
 #include "TextRun.h"
+#include <wtf/unicode/CharacterNames.h>
 
 using namespace std;
 using namespace WTF;
@@ -1130,7 +1130,7 @@ void RenderListMarker::paint(PaintInfo& paintInfo, int tx, int ty)
         if (style()->highlight() != nullAtom && !paintInfo.context->paintingDisabled())
             paintCustomHighlight(tx, ty, style()->highlight(), true);
 #endif
-        context->drawImage(m_image->image(this, marker.size()), style()->colorSpace(), marker);
+        context->drawImage(m_image->image(this, marker.size()).get(), style()->colorSpace(), marker);
         if (selectionState() != SelectionNone) {
             IntRect selRect = localSelectionRect();
             selRect.move(boxOrigin.x(), boxOrigin.y());
@@ -1260,12 +1260,12 @@ void RenderListMarker::paint(PaintInfo& paintInfo, int tx, int ty)
         marker = marker.transposedRect();
         marker.move(box.x(), box.y() - logicalHeight());
         context->save();
-        context->translate(marker.x(), marker.bottom());
+        context->translate(marker.x(), marker.maxY());
         context->rotate(static_cast<float>(deg2rad(90.)));
-        context->translate(-marker.x(), -marker.bottom());
+        context->translate(-marker.x(), -marker.maxY());
     }
 
-    IntPoint textOrigin = IntPoint(marker.x(), marker.y() + style()->font().ascent());
+    IntPoint textOrigin = IntPoint(marker.x(), marker.y() + style()->fontMetrics().ascent());
 
     if (type == Asterisks || type == Footnotes)
         context->drawText(style()->font(), textRun, textOrigin);
@@ -1311,7 +1311,7 @@ void RenderListMarker::layout()
         setHeight(m_image->imageSize(this, style()->effectiveZoom()).height());
     } else {
         setLogicalWidth(minPreferredLogicalWidth());
-        setLogicalHeight(style()->font().height());
+        setLogicalHeight(style()->fontMetrics().height());
     }
 
     setMarginStart(0);
@@ -1346,11 +1346,12 @@ void RenderListMarker::computePreferredLogicalWidths()
     m_text = "";
 
     const Font& font = style()->font();
+    const FontMetrics& fontMetrics = font.fontMetrics();
 
     if (isImage()) {
         // FIXME: This is a somewhat arbitrary width.  Generated images for markers really won't become particularly useful
         // until we support the CSS3 marker pseudoclass to allow control over the width and height of the marker box.
-        int bulletWidth = font.ascent() / 2;
+        int bulletWidth = fontMetrics.ascent() / 2;
         m_image->setImageContainerSize(IntSize(bulletWidth, bulletWidth));
         IntSize imageSize = m_image->imageSize(this, style()->effectiveZoom());
         m_minPreferredLogicalWidth = m_maxPreferredLogicalWidth = style()->isHorizontalWritingMode() ? imageSize.width() : imageSize.height();
@@ -1373,7 +1374,7 @@ void RenderListMarker::computePreferredLogicalWidths()
         case Disc:
         case Square:
             m_text = listMarkerText(type, 0); // value is ignored for these types
-            logicalWidth = (font.ascent() * 2 / 3 + 1) / 2 + 2;
+            logicalWidth = (fontMetrics.ascent() * 2 / 3 + 1) / 2 + 2;
             break;
         case Afar:
         case Amharic:
@@ -1472,7 +1473,7 @@ void RenderListMarker::computePreferredLogicalWidths()
 
 void RenderListMarker::updateMargins()
 {
-    const Font& font = style()->font();
+    const FontMetrics& fontMetrics = style()->fontMetrics();
 
     int marginStart = 0;
     int marginEnd = 0;
@@ -1485,7 +1486,7 @@ void RenderListMarker::updateMargins()
             case Circle:
             case Square:
                 marginStart = -1;
-                marginEnd = font.ascent() - minPreferredLogicalWidth() + 1;
+                marginEnd = fontMetrics.ascent() - minPreferredLogicalWidth() + 1;
                 break;
             default:
                 break;
@@ -1495,7 +1496,7 @@ void RenderListMarker::updateMargins()
             if (isImage())
                 marginStart = -minPreferredLogicalWidth() - cMarkerPadding;
             else {
-                int offset = font.ascent() * 2 / 3;
+                int offset = fontMetrics.ascent() * 2 / 3;
                 switch (style()->listStyleType()) {
                     case Disc:
                     case Circle:
@@ -1513,7 +1514,7 @@ void RenderListMarker::updateMargins()
             if (isImage())
                 marginEnd = cMarkerPadding;
             else {
-                int offset = font.ascent() * 2 / 3;
+                int offset = fontMetrics.ascent() * 2 / 3;
                 switch (style()->listStyleType()) {
                     case Disc:
                     case Circle:
@@ -1584,15 +1585,15 @@ IntRect RenderListMarker::getRelativeMarkerRect()
         case Asterisks:
         case Footnotes: {
             const Font& font = style()->font();
-            relativeRect = IntRect(0, 0, font.width(m_text), font.height());
+            relativeRect = IntRect(0, 0, font.width(m_text), font.fontMetrics().height());
             break;
         }
         case Disc:
         case Circle:
         case Square: {
             // FIXME: Are these particular rounding rules necessary?
-            const Font& font = style()->font();
-            int ascent = font.ascent();
+            const FontMetrics& fontMetrics = style()->fontMetrics();
+            int ascent = fontMetrics.ascent();
             int bulletWidth = (ascent * 2 / 3 + 1) / 2;
             relativeRect = IntRect(1, 3 * (ascent - ascent * 2 / 3) / 2, bulletWidth, bulletWidth);
             break;
@@ -1680,7 +1681,7 @@ IntRect RenderListMarker::getRelativeMarkerRect()
             int itemWidth = font.width(m_text);
             UChar suffixSpace[2] = { listMarkerSuffix(type, m_listItem->value()), ' ' };
             int suffixSpaceWidth = font.width(TextRun(suffixSpace, 2));
-            relativeRect = IntRect(0, 0, itemWidth + suffixSpaceWidth, font.height());
+            relativeRect = IntRect(0, 0, itemWidth + suffixSpaceWidth, font.fontMetrics().height());
     }
 
     if (!style()->isHorizontalWritingMode()) {
diff --git a/Source/WebCore/rendering/RenderMarquee.cpp b/Source/WebCore/rendering/RenderMarquee.cpp
index 9b58118..6f59340 100644
--- a/Source/WebCore/rendering/RenderMarquee.cpp
+++ b/Source/WebCore/rendering/RenderMarquee.cpp
@@ -116,7 +116,7 @@ int RenderMarquee::computePosition(EMarqueeDirection dir, bool stopAtContentEdge
     if (isHorizontal()) {
         bool ltr = s->isLeftToRightDirection();
         int clientWidth = box->clientWidth();
-        int contentWidth = ltr ? box->rightLayoutOverflow() : box->leftLayoutOverflow();
+        int contentWidth = ltr ? box->maxXLayoutOverflow() : box->minXLayoutOverflow();
         if (ltr)
             contentWidth += (box->paddingRight() - box->borderLeft());
         else {
@@ -137,7 +137,7 @@ int RenderMarquee::computePosition(EMarqueeDirection dir, bool stopAtContentEdge
         }
     }
     else {
-        int contentHeight = box->bottomLayoutOverflow() - box->borderTop() + box->paddingBottom();
+        int contentHeight = box->maxYLayoutOverflow() - box->borderTop() + box->paddingBottom();
         int clientHeight = box->clientHeight();
         if (dir == MUP) {
             if (stopAtContentEdge)
diff --git a/Source/WebCore/rendering/RenderMedia.cpp b/Source/WebCore/rendering/RenderMedia.cpp
index 0b913ee..d10c593 100644
--- a/Source/WebCore/rendering/RenderMedia.cpp
+++ b/Source/WebCore/rendering/RenderMedia.cpp
@@ -28,10 +28,9 @@
 #if ENABLE(VIDEO)
 #include "RenderMedia.h"
 
-#include "EventNames.h"
-#include "FloatConversion.h"
-#include "HTMLNames.h"
+#include "HTMLMediaElement.h"
 #include "MediaControlElements.h"
+<<<<<<< HEAD
 #include "MouseEvent.h"
 #include "Page.h"
 #include "RenderLayer.h"
@@ -45,16 +44,15 @@
 #endif
 
 using namespace std;
+=======
+#include "MediaControls.h"
+>>>>>>> webkit.org at r78450
 
 namespace WebCore {
 
-using namespace HTMLNames;
-
-static const double cTimeUpdateRepeatDelay = 0.2;
-static const double cOpacityAnimationRepeatDelay = 0.05;
-
 RenderMedia::RenderMedia(HTMLMediaElement* video)
     : RenderImage(video)
+<<<<<<< HEAD
     , m_timeUpdateTimer(this, &RenderMedia::timeUpdateTimerFired)
     , m_opacityAnimationTimer(this, &RenderMedia::opacityAnimationTimerFired)
     , m_mouseOver(false)
@@ -65,12 +63,16 @@ RenderMedia::RenderMedia(HTMLMediaElement* video)
 #if PLATFORM(ANDROID)
     , m_lastTouch(0)
 #endif
+=======
+    , m_controls(new MediaControls(video))
+>>>>>>> webkit.org at r78450
 {
     setImageResource(RenderImageResource::create());
 }
 
 RenderMedia::RenderMedia(HTMLMediaElement* video, const IntSize& intrinsicSize)
     : RenderImage(video)
+<<<<<<< HEAD
     , m_timeUpdateTimer(this, &RenderMedia::timeUpdateTimerFired)
     , m_opacityAnimationTimer(this, &RenderMedia::opacityAnimationTimerFired)
     , m_mouseOver(false)
@@ -81,6 +83,9 @@ RenderMedia::RenderMedia(HTMLMediaElement* video, const IntSize& intrinsicSize)
 #if PLATFORM(ANDROID)
     , m_lastTouch(0)
 #endif
+=======
+    , m_controls(new MediaControls(video))
+>>>>>>> webkit.org at r78450
 {
     setImageResource(RenderImageResource::create());
     setIntrinsicSize(intrinsicSize);
@@ -92,16 +97,7 @@ RenderMedia::~RenderMedia()
 
 void RenderMedia::destroy()
 {
-    if (m_controlsShadowRoot && m_controlsShadowRoot->renderer()) {
-
-        // detach the panel before removing the shadow renderer to prevent a crash in m_controlsShadowRoot->detach() 
-        //  when display: style changes
-        m_panel->detach();
-
-        removeChild(m_controlsShadowRoot->renderer());
-        m_controlsShadowRoot->detach();
-        m_controlsShadowRoot = 0;
-    }
+    m_controls->destroy();
     RenderImage::destroy();
 }
 
@@ -110,51 +106,10 @@ HTMLMediaElement* RenderMedia::mediaElement() const
     return static_cast<HTMLMediaElement*>(node()); 
 }
 
-MediaPlayer* RenderMedia::player() const
-{
-    return mediaElement()->player();
-}
-
 void RenderMedia::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderImage::styleDidChange(diff, oldStyle);
-
-    if (m_controlsShadowRoot) {
-        if (m_panel)
-            m_panel->updateStyle();
-        if (m_muteButton)
-            m_muteButton->updateStyle();
-        if (m_playButton)
-            m_playButton->updateStyle();
-        if (m_seekBackButton)
-            m_seekBackButton->updateStyle();
-        if (m_seekForwardButton)
-            m_seekForwardButton->updateStyle();
-        if (m_rewindButton)
-            m_rewindButton->updateStyle();
-        if (m_returnToRealtimeButton)
-            m_returnToRealtimeButton->updateStyle();
-        if (m_toggleClosedCaptionsButton)
-            m_toggleClosedCaptionsButton->updateStyle();
-        if (m_statusDisplay)
-            m_statusDisplay->updateStyle();
-        if (m_timelineContainer)
-            m_timelineContainer->updateStyle();
-        if (m_timeline)
-            m_timeline->updateStyle();
-        if (m_fullscreenButton)
-            m_fullscreenButton->updateStyle();
-        if (m_currentTimeDisplay)
-            m_currentTimeDisplay->updateStyle();
-        if (m_timeRemainingDisplay)
-            m_timeRemainingDisplay->updateStyle();
-        if (m_volumeSliderContainer)
-            m_volumeSliderContainer->updateStyle();
-        if (m_volumeSliderMuteButton)
-            m_volumeSliderMuteButton->updateStyle();
-        if (m_volumeSlider)
-            m_volumeSlider->updateStyle();
-    }
+    m_controls->updateStyle();
 }
 
 void RenderMedia::layout()
@@ -163,17 +118,13 @@ void RenderMedia::layout()
 
     RenderImage::layout();
 
-    RenderBox* controlsRenderer = m_controlsShadowRoot ? m_controlsShadowRoot->renderBox() : 0;
+    RenderBox* controlsRenderer = m_controls->renderBox();
     if (!controlsRenderer)
         return;
     IntSize newSize = contentBoxRect().size();
     if (newSize != oldSize || controlsRenderer->needsLayout()) {
 
-        if (m_currentTimeDisplay && m_timeRemainingDisplay) {
-            bool shouldShowTimeDisplays = shouldShowTimeDisplayControls();
-            m_currentTimeDisplay->setVisible(shouldShowTimeDisplays);
-            m_timeRemainingDisplay->setVisible(shouldShowTimeDisplays);
-        }
+        m_controls->updateTimeDisplayVisibility();
 
         controlsRenderer->setLocation(borderLeft() + paddingLeft(), borderTop() + paddingTop());
         controlsRenderer->style()->setHeight(Length(newSize.height(), Fixed));
@@ -184,139 +135,9 @@ void RenderMedia::layout()
     }
 }
 
-void RenderMedia::createControlsShadowRoot()
-{
-    ASSERT(!m_controlsShadowRoot);
-    m_controlsShadowRoot = MediaControlShadowRootElement::create(mediaElement());
-    addChild(m_controlsShadowRoot->renderer());
-}
-
-void RenderMedia::createPanel()
-{
-    ASSERT(!m_panel);
-    m_panel = MediaControlElement::create(mediaElement(), MEDIA_CONTROLS_PANEL);
-    m_panel->attachToParent(m_controlsShadowRoot.get());
-}
-
-void RenderMedia::createMuteButton()
-{
-    ASSERT(!m_muteButton);
-    m_muteButton = MediaControlMuteButtonElement::create(mediaElement(), MediaControlMuteButtonElement::Controller);
-    m_muteButton->attachToParent(m_panel.get());
-}
-
-void RenderMedia::createPlayButton()
-{
-    ASSERT(!m_playButton);
-    m_playButton = MediaControlPlayButtonElement::create(mediaElement());
-    m_playButton->attachToParent(m_panel.get());
-}
-
-void RenderMedia::createSeekBackButton()
-{
-    ASSERT(!m_seekBackButton);
-    m_seekBackButton = MediaControlSeekButtonElement::create(mediaElement(), MEDIA_CONTROLS_SEEK_BACK_BUTTON);
-    m_seekBackButton->attachToParent(m_panel.get());
-}
-
-void RenderMedia::createSeekForwardButton()
-{
-    ASSERT(!m_seekForwardButton);
-    m_seekForwardButton = MediaControlSeekButtonElement::create(mediaElement(), MEDIA_CONTROLS_SEEK_FORWARD_BUTTON);
-    m_seekForwardButton->attachToParent(m_panel.get());
-}
-
-void RenderMedia::createRewindButton()
-{
-    ASSERT(!m_rewindButton);
-    m_rewindButton = MediaControlRewindButtonElement::create(mediaElement());
-    m_rewindButton->attachToParent(m_panel.get());
-}
-
-void RenderMedia::createReturnToRealtimeButton()
-{
-    ASSERT(!m_returnToRealtimeButton);
-    m_returnToRealtimeButton = MediaControlReturnToRealtimeButtonElement::create(mediaElement());
-    m_returnToRealtimeButton->attachToParent(m_panel.get());
-}
-
-void RenderMedia::createToggleClosedCaptionsButton()
-{
-    ASSERT(!m_toggleClosedCaptionsButton);
-    m_toggleClosedCaptionsButton = MediaControlToggleClosedCaptionsButtonElement::create(mediaElement());
-    m_toggleClosedCaptionsButton->attachToParent(m_panel.get());
-}
-
-void RenderMedia::createStatusDisplay()
-{
-    ASSERT(!m_statusDisplay);
-    m_statusDisplay = MediaControlStatusDisplayElement::create(mediaElement());
-    m_statusDisplay->attachToParent(m_panel.get());
-}
-
-void RenderMedia::createTimelineContainer()
-{
-    ASSERT(!m_timelineContainer);
-    m_timelineContainer = MediaControlTimelineContainerElement::create(mediaElement());
-    m_timelineContainer->attachToParent(m_panel.get());
-}
-
-void RenderMedia::createTimeline()
-{
-    ASSERT(!m_timeline);
-    m_timeline = MediaControlTimelineElement::create(mediaElement());
-    m_timeline->setAttribute(precisionAttr, "float");
-    m_timeline->attachToParent(m_timelineContainer.get());
-}
-
-void RenderMedia::createVolumeSliderContainer()
-{
-    ASSERT(!m_volumeSliderContainer);
-    m_volumeSliderContainer = MediaControlVolumeSliderContainerElement::create(mediaElement());
-    m_volumeSliderContainer->attachToParent(m_panel.get());
-}
-
-void RenderMedia::createVolumeSlider()
-{
-    ASSERT(!m_volumeSlider);
-    m_volumeSlider = MediaControlVolumeSliderElement::create(mediaElement());
-    m_volumeSlider->setAttribute(precisionAttr, "float");
-    m_volumeSlider->setAttribute(maxAttr, "1");
-    m_volumeSlider->setAttribute(valueAttr, String::number(mediaElement()->volume()));
-    m_volumeSlider->attachToParent(m_volumeSliderContainer.get());
-}
-
-void RenderMedia::createVolumeSliderMuteButton()
-{
-    ASSERT(!m_volumeSliderMuteButton);
-    m_volumeSliderMuteButton = MediaControlMuteButtonElement::create(mediaElement(), MediaControlMuteButtonElement::VolumeSlider);
-    m_volumeSliderMuteButton->attachToParent(m_volumeSliderContainer.get());
-    
-}
-
-void RenderMedia::createCurrentTimeDisplay()
-{
-    ASSERT(!m_currentTimeDisplay);
-    m_currentTimeDisplay = MediaControlTimeDisplayElement::create(mediaElement(), MEDIA_CONTROLS_CURRENT_TIME_DISPLAY);
-    m_currentTimeDisplay->attachToParent(m_timelineContainer.get());
-}
-
-void RenderMedia::createTimeRemainingDisplay()
-{
-    ASSERT(!m_timeRemainingDisplay);
-    m_timeRemainingDisplay = MediaControlTimeDisplayElement::create(mediaElement(), MEDIA_CONTROLS_TIME_REMAINING_DISPLAY);
-    m_timeRemainingDisplay->attachToParent(m_timelineContainer.get());
-}
-
-void RenderMedia::createFullscreenButton()
-{
-    ASSERT(!m_fullscreenButton);
-    m_fullscreenButton = MediaControlFullscreenButtonElement::create(mediaElement());
-    m_fullscreenButton->attachToParent(m_panel.get());
-}
-    
 void RenderMedia::updateFromElement()
 {
+<<<<<<< HEAD
     updateControls();
 }
             
@@ -658,6 +479,9 @@ bool RenderMedia::shouldShowTimeDisplayControls() const
 
     int width = mediaElement()->renderBox()->width();
     return width >= minWidthToDisplayTimeDisplays * style()->effectiveZoom();
+=======
+    m_controls->update();
+>>>>>>> webkit.org at r78450
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderMedia.h b/Source/WebCore/rendering/RenderMedia.h
index 817252d..1772766 100644
--- a/Source/WebCore/rendering/RenderMedia.h
+++ b/Source/WebCore/rendering/RenderMedia.h
@@ -29,27 +29,11 @@
 #if ENABLE(VIDEO)
 
 #include "RenderImage.h"
-#include "Timer.h"
 
 namespace WebCore {
-    
-class HTMLInputElement;
+
 class HTMLMediaElement;
-class MediaControlMuteButtonElement;
-class MediaControlPlayButtonElement;
-class MediaControlSeekButtonElement;
-class MediaControlRewindButtonElement;
-class MediaControlReturnToRealtimeButtonElement;
-class MediaControlToggleClosedCaptionsButtonElement;
-class MediaControlTimelineElement;
-class MediaControlVolumeSliderElement;
-class MediaControlFullscreenButtonElement;
-class MediaControlTimeDisplayElement;
-class MediaControlStatusDisplayElement;
-class MediaControlTimelineContainerElement;
-class MediaControlVolumeSliderContainerElement;
-class MediaControlElement;
-class MediaPlayer;
+class MediaControls;
 
 class RenderMedia : public RenderImage {
 public:
@@ -61,10 +45,9 @@ public:
     RenderObjectChildList* children() { return &m_children; }
 
     HTMLMediaElement* mediaElement() const;
-    MediaPlayer* player() const;
-
-    bool shouldShowTimeDisplayControls() const;
+    MediaControls* controls() const;
 
+<<<<<<< HEAD
     void updateFromElement();
     void updatePlayer();
     void updateControls();
@@ -74,6 +57,9 @@ public:
 #if PLATFORM(ANDROID)
     void updateLastTouch();
 #endif
+=======
+    virtual void updateFromElement();
+>>>>>>> webkit.org at r78450
 
 protected:
     virtual void layout();
@@ -88,57 +74,14 @@ private:
     virtual bool isMedia() const { return true; }
     virtual bool isImage() const { return false; }
 
-    void createControlsShadowRoot();
-    void destroyControlsShadowRoot();
-    void createPanel();
-    void createMuteButton();
-    void createPlayButton();
-    void createSeekBackButton();
-    void createSeekForwardButton();
-    void createRewindButton();
-    void createReturnToRealtimeButton();
-    void createToggleClosedCaptionsButton();
-    void createStatusDisplay();
-    void createTimelineContainer();
-    void createTimeline();
-    void createVolumeSliderContainer();
-    void createVolumeSlider();
-    void createVolumeSliderMuteButton();
-    void createCurrentTimeDisplay();
-    void createTimeRemainingDisplay();
-    void createFullscreenButton();
-    
-    void timeUpdateTimerFired(Timer<RenderMedia>*);
-    
-    void updateControlVisibility();
-    void changeOpacity(HTMLElement*, float opacity);
-    void opacityAnimationTimerFired(Timer<RenderMedia>*);
-
-    void updateVolumeSliderContainer(bool visible);
 
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
     virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
 
-    RefPtr<HTMLElement> m_controlsShadowRoot;
-    RefPtr<MediaControlElement> m_panel;
-    RefPtr<MediaControlMuteButtonElement> m_muteButton;
-    RefPtr<MediaControlPlayButtonElement> m_playButton;
-    RefPtr<MediaControlSeekButtonElement> m_seekBackButton;
-    RefPtr<MediaControlSeekButtonElement> m_seekForwardButton;
-    RefPtr<MediaControlRewindButtonElement> m_rewindButton;
-    RefPtr<MediaControlReturnToRealtimeButtonElement> m_returnToRealtimeButton;
-    RefPtr<MediaControlToggleClosedCaptionsButtonElement> m_toggleClosedCaptionsButton;
-    RefPtr<MediaControlTimelineElement> m_timeline;
-    RefPtr<MediaControlVolumeSliderElement> m_volumeSlider;
-    RefPtr<MediaControlMuteButtonElement> m_volumeSliderMuteButton;
-    RefPtr<MediaControlFullscreenButtonElement> m_fullscreenButton;
-    RefPtr<MediaControlTimelineContainerElement> m_timelineContainer;
-    RefPtr<MediaControlVolumeSliderContainerElement> m_volumeSliderContainer;
-    RefPtr<MediaControlTimeDisplayElement> m_currentTimeDisplay;
-    RefPtr<MediaControlTimeDisplayElement> m_timeRemainingDisplay;
-    RefPtr<MediaControlStatusDisplayElement> m_statusDisplay;
+    OwnPtr<MediaControls> m_controls;
     RenderObjectChildList m_children;
+<<<<<<< HEAD
     Node* m_lastUnderNode;
     Node* m_nodeUnderMouse;
     
@@ -152,6 +95,8 @@ private:
 #if PLATFORM(ANDROID)
     double m_lastTouch;
 #endif
+=======
+>>>>>>> webkit.org at r78450
 };
 
 inline RenderMedia* toRenderMedia(RenderObject* object)
@@ -160,6 +105,11 @@ inline RenderMedia* toRenderMedia(RenderObject* object)
     return static_cast<RenderMedia*>(object);
 }
 
+inline MediaControls* RenderMedia::controls() const
+{
+    return m_controls.get();
+}
+
 // This will catch anyone doing an unnecessary cast.
 void toRenderMedia(const RenderMedia*);
 
diff --git a/Source/WebCore/rendering/RenderMenuList.cpp b/Source/WebCore/rendering/RenderMenuList.cpp
index e55b5ca..3e9d198 100644
--- a/Source/WebCore/rendering/RenderMenuList.cpp
+++ b/Source/WebCore/rendering/RenderMenuList.cpp
@@ -2,7 +2,7 @@
  * This file is part of the select element renderer in WebCore.
  *
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
- * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *               2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ -55,7 +55,6 @@ RenderMenuList::RenderMenuList(Element* element)
     , m_optionsChanged(true)
     , m_optionsWidth(0)
     , m_lastSelectedIndex(-1)
-    , m_popup(0)
     , m_popupIsVisible(false)
 {
 }
@@ -84,19 +83,26 @@ void RenderMenuList::createInnerBlock()
 
 void RenderMenuList::adjustInnerStyle()
 {
-    m_innerBlock->style()->setBoxFlex(1.0f);
+    RenderStyle* innerStyle = m_innerBlock->style();
+    innerStyle->setBoxFlex(1);
     
-    m_innerBlock->style()->setPaddingLeft(Length(theme()->popupInternalPaddingLeft(style()), Fixed));
-    m_innerBlock->style()->setPaddingRight(Length(theme()->popupInternalPaddingRight(style()), Fixed));
-    m_innerBlock->style()->setPaddingTop(Length(theme()->popupInternalPaddingTop(style()), Fixed));
-    m_innerBlock->style()->setPaddingBottom(Length(theme()->popupInternalPaddingBottom(style()), Fixed));
+    innerStyle->setPaddingLeft(Length(theme()->popupInternalPaddingLeft(style()), Fixed));
+    innerStyle->setPaddingRight(Length(theme()->popupInternalPaddingRight(style()), Fixed));
+    innerStyle->setPaddingTop(Length(theme()->popupInternalPaddingTop(style()), Fixed));
+    innerStyle->setPaddingBottom(Length(theme()->popupInternalPaddingBottom(style()), Fixed));
 
     if (document()->page()->chrome()->selectItemWritingDirectionIsNatural()) {
         // Items in the popup will not respect the CSS text-align and direction properties,
         // so we must adjust our own style to match.
-        m_innerBlock->style()->setTextAlign(LEFT);
+        innerStyle->setTextAlign(LEFT);
         TextDirection direction = (m_buttonText && m_buttonText->text()->defaultWritingDirection() == WTF::Unicode::RightToLeft) ? RTL : LTR;
-        m_innerBlock->style()->setDirection(direction);
+        innerStyle->setDirection(direction);
+    } else if (m_optionStyle && document()->page()->chrome()->selectItemAlignmentFollowsMenuWritingDirection()) {
+        if ((m_optionStyle->direction() != innerStyle->direction() || m_optionStyle->unicodeBidi() != innerStyle->unicodeBidi()))
+            m_innerBlock->setNeedsLayoutAndPrefWidthsRecalc();
+        innerStyle->setTextAlign(style()->isLeftToRightDirection() ? LEFT : RIGHT);
+        innerStyle->setDirection(m_optionStyle->direction());
+        innerStyle->setUnicodeBidi(m_optionStyle->unicodeBidi());
     }
 }
 
@@ -184,8 +190,11 @@ void RenderMenuList::setTextFromOption(int optionIndex)
     int i = select->optionToListIndex(optionIndex);
     String text = "";
     if (i >= 0 && i < size) {
-        if (OptionElement* optionElement = toOptionElement(listItems[i]))
+        Element* element = listItems[i];
+        if (OptionElement* optionElement = toOptionElement(element)) {
             text = optionElement->textIndentedToRespectGroupLabel();
+            m_optionStyle = element->renderStyle();
+        }
     }
 
     setText(text.stripWhiteSpace());
@@ -418,7 +427,7 @@ PopupMenuStyle RenderMenuList::itemStyle(unsigned listIndex) const
     Element* element = listItems[listIndex];
     
     RenderStyle* style = element->renderStyle() ? element->renderStyle() : element->computedStyle();
-    return style ? PopupMenuStyle(style->visitedDependentColor(CSSPropertyColor), itemBackgroundColor(listIndex), style->font(), style->visibility() == VISIBLE, style->display() == NONE, style->textIndent(), style->direction()) : menuStyle();
+    return style ? PopupMenuStyle(style->visitedDependentColor(CSSPropertyColor), itemBackgroundColor(listIndex), style->font(), style->visibility() == VISIBLE, style->display() == NONE, style->textIndent(), style->direction(), style->unicodeBidi() == Override) : menuStyle();
 }
 
 Color RenderMenuList::itemBackgroundColor(unsigned listIndex) const
@@ -448,7 +457,7 @@ Color RenderMenuList::itemBackgroundColor(unsigned listIndex) const
 PopupMenuStyle RenderMenuList::menuStyle() const
 {
     RenderStyle* s = m_innerBlock ? m_innerBlock->style() : style();
-    return PopupMenuStyle(s->visitedDependentColor(CSSPropertyColor), s->visitedDependentColor(CSSPropertyBackgroundColor), s->font(), s->visibility() == VISIBLE, s->display() == NONE, s->textIndent(), s->direction());
+    return PopupMenuStyle(s->visitedDependentColor(CSSPropertyColor), s->visitedDependentColor(CSSPropertyBackgroundColor), s->font(), s->visibility() == VISIBLE, s->display() == NONE, s->textIndent(), style()->direction(), style()->unicodeBidi() == Override);
 }
 
 HostWindow* RenderMenuList::hostWindow() const
@@ -479,7 +488,7 @@ int RenderMenuList::clientInsetRight() const
 
 int RenderMenuList::clientPaddingLeft() const
 {
-    return paddingLeft();
+    return paddingLeft() + m_innerBlock->paddingLeft();
 }
 
 const int endOfLinePadding = 2;
@@ -495,7 +504,7 @@ int RenderMenuList::clientPaddingRight() const
 
     // If the appearance isn't MenulistPart, then the select is styled (non-native), so
     // we want to return the user specified padding.
-    return paddingRight();
+    return paddingRight() + m_innerBlock->paddingRight();
 }
 
 int RenderMenuList::listSize() const
diff --git a/Source/WebCore/rendering/RenderMenuList.h b/Source/WebCore/rendering/RenderMenuList.h
index b84b799..cd6e561 100644
--- a/Source/WebCore/rendering/RenderMenuList.h
+++ b/Source/WebCore/rendering/RenderMenuList.h
@@ -2,7 +2,7 @@
  * This file is part of the select element renderer in WebCore.
  *
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
- * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -132,6 +132,8 @@ private:
 
     int m_lastSelectedIndex;
 
+    RefPtr<RenderStyle> m_optionStyle;
+
     RefPtr<PopupMenu> m_popup;
     bool m_popupIsVisible;
 };
diff --git a/Source/WebCore/rendering/RenderMeter.cpp b/Source/WebCore/rendering/RenderMeter.cpp
index 6439651..f3ada0b 100644
--- a/Source/WebCore/rendering/RenderMeter.cpp
+++ b/Source/WebCore/rendering/RenderMeter.cpp
@@ -107,7 +107,7 @@ RenderMeter::~RenderMeter()
 
 PassRefPtr<MeterPartElement> RenderMeter::createPart(PseudoId pseudoId)
 {
-    RefPtr<MeterPartElement> element = MeterPartElement::createForPart(static_cast<HTMLElement*>(node()), pseudoId);
+    RefPtr<MeterPartElement> element = MeterPartElement::createForPart(toHTMLElement(node()), pseudoId);
     if (element->renderer())
         addChild(element->renderer());
     return element;
diff --git a/Source/WebCore/rendering/RenderObject.cpp b/Source/WebCore/rendering/RenderObject.cpp
index 9a1233e..ebab355 100644
--- a/Source/WebCore/rendering/RenderObject.cpp
+++ b/Source/WebCore/rendering/RenderObject.cpp
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
@@ -31,6 +31,7 @@
 #include "CSSStyleSelector.h"
 #include "Chrome.h"
 #include "ContentData.h"
+#include "CursorList.h"
 #include "DashArray.h"
 #include "EditingBoundary.h"
 #include "FloatQuad.h"
@@ -319,7 +320,6 @@ void RenderObject::addChild(RenderObject* newChild, RenderObject* beforeChild)
         // Just add it...
         children->insertChildNode(this, newChild, beforeChild);
     }
-    RenderCounter::rendererSubtreeAttached(newChild); 
     if (newChild->isText() && newChild->style()->textTransform() == CAPITALIZE) {
         RefPtr<StringImpl> textToTransform = toRenderText(newChild)->originalText();
         if (textToTransform)
@@ -1381,11 +1381,11 @@ bool RenderObject::repaintAfterLayoutIfNeeded(RenderBoxModelObject* repaintConta
     else if (deltaLeft < 0)
         repaintUsingContainer(repaintContainer, IntRect(newBounds.x(), newBounds.y(), -deltaLeft, newBounds.height()));
 
-    int deltaRight = newBounds.right() - oldBounds.right();
+    int deltaRight = newBounds.maxX() - oldBounds.maxX();
     if (deltaRight > 0)
-        repaintUsingContainer(repaintContainer, IntRect(oldBounds.right(), newBounds.y(), deltaRight, newBounds.height()));
+        repaintUsingContainer(repaintContainer, IntRect(oldBounds.maxX(), newBounds.y(), deltaRight, newBounds.height()));
     else if (deltaRight < 0)
-        repaintUsingContainer(repaintContainer, IntRect(newBounds.right(), oldBounds.y(), -deltaRight, oldBounds.height()));
+        repaintUsingContainer(repaintContainer, IntRect(newBounds.maxX(), oldBounds.y(), -deltaRight, oldBounds.height()));
 
     int deltaTop = newBounds.y() - oldBounds.y();
     if (deltaTop > 0)
@@ -1393,11 +1393,11 @@ bool RenderObject::repaintAfterLayoutIfNeeded(RenderBoxModelObject* repaintConta
     else if (deltaTop < 0)
         repaintUsingContainer(repaintContainer, IntRect(newBounds.x(), newBounds.y(), newBounds.width(), -deltaTop));
 
-    int deltaBottom = newBounds.bottom() - oldBounds.bottom();
+    int deltaBottom = newBounds.maxY() - oldBounds.maxY();
     if (deltaBottom > 0)
-        repaintUsingContainer(repaintContainer, IntRect(newBounds.x(), oldBounds.bottom(), newBounds.width(), deltaBottom));
+        repaintUsingContainer(repaintContainer, IntRect(newBounds.x(), oldBounds.maxY(), newBounds.width(), deltaBottom));
     else if (deltaBottom < 0)
-        repaintUsingContainer(repaintContainer, IntRect(oldBounds.x(), newBounds.bottom(), oldBounds.width(), -deltaBottom));
+        repaintUsingContainer(repaintContainer, IntRect(oldBounds.x(), newBounds.maxY(), oldBounds.width(), -deltaBottom));
 
     if (newOutlineBox == oldOutlineBox)
         return false;
@@ -1419,7 +1419,7 @@ bool RenderObject::repaintAfterLayoutIfNeeded(RenderBoxModelObject* repaintConta
             newOutlineBox.y(),
             width + borderWidth,
             max(newOutlineBox.height(), oldOutlineBox.height()));
-        int right = min(newBounds.right(), oldBounds.right());
+        int right = min(newBounds.maxX(), oldBounds.maxX());
         if (rightRect.x() < right) {
             rightRect.setWidth(min(rightRect.width(), right - rightRect.x()));
             repaintUsingContainer(repaintContainer, rightRect);
@@ -1435,10 +1435,10 @@ bool RenderObject::repaintAfterLayoutIfNeeded(RenderBoxModelObject* repaintConta
         int boxHeight = isBox() ? toRenderBox(this)->height() : 0;
         int borderHeight = max(-outlineStyle->outlineOffset(), max(borderBottom, max(style()->borderBottomLeftRadius().height().calcValue(boxHeight), style()->borderBottomRightRadius().height().calcValue(boxHeight)))) + max(ow, shadowBottom);
         IntRect bottomRect(newOutlineBox.x(),
-            min(newOutlineBox.bottom(), oldOutlineBox.bottom()) - borderHeight,
+            min(newOutlineBox.maxY(), oldOutlineBox.maxY()) - borderHeight,
             max(newOutlineBox.width(), oldOutlineBox.width()),
             height + borderHeight);
-        int bottom = min(newBounds.bottom(), oldBounds.bottom());
+        int bottom = min(newBounds.maxY(), oldBounds.maxY());
         if (bottomRect.y() < bottom) {
             bottomRect.setHeight(min(bottomRect.height(), bottom - bottomRect.y()));
             repaintUsingContainer(repaintContainer, bottomRect);
@@ -1863,6 +1863,17 @@ void RenderObject::styleWillChange(StyleDifference diff, const RenderStyle* newS
     }
 }
 
+static bool areNonIdenticalCursorListsEqual(const RenderStyle* a, const RenderStyle* b)
+{
+    ASSERT(a->cursors() != b->cursors());
+    return a->cursors() && b->cursors() && *a->cursors() == *b->cursors();
+}
+
+static inline bool areCursorsEqual(const RenderStyle* a, const RenderStyle* b)
+{
+    return a->cursor() == b->cursor() && (a->cursors() == b->cursors() || areNonIdenticalCursorListsEqual(a, b));
+}
+
 void RenderObject::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     if (s_affectsParentBlock)
@@ -1888,6 +1899,11 @@ void RenderObject::styleDidChange(StyleDifference diff, const RenderStyle* oldSt
 
     // Don't check for repaint here; we need to wait until the layer has been
     // updated by subclasses before we know if we have to repaint (in setStyle()).
+
+    if (oldStyle && !areCursorsEqual(oldStyle, style())) {
+        if (Frame* frame = this->frame())
+            frame->eventHandler()->dispatchFakeMouseMoveEventSoon();
+    }
 }
 
 void RenderObject::updateFillImages(const FillLayer* oldLayers, const FillLayer* newLayers)
@@ -1950,6 +1966,10 @@ void RenderObject::mapLocalToContainer(RenderBoxModelObject* repaintContainer, b
     if (!o)
         return;
 
+    IntPoint centerPoint = roundedIntPoint(transformState.mappedPoint());
+    if (o->isBox() && o->style()->isFlippedBlocksWritingMode())
+        transformState.move(toRenderBox(o)->flipForWritingModeIncludingColumns(roundedIntPoint(transformState.mappedPoint())) - centerPoint);
+
     IntSize columnOffset;
     o->adjustForColumns(columnOffset, roundedIntPoint(transformState.mappedPoint()));
     if (!columnOffset.isZero())
@@ -1989,7 +2009,7 @@ void RenderObject::getTransformFromContainer(const RenderObject* containerObject
     transform.translate(offsetInContainer.width(), offsetInContainer.height());
     RenderLayer* layer;
     if (hasLayer() && (layer = toRenderBoxModelObject(this)->layer()) && layer->transform())
-        transform.multLeft(layer->currentTransform());
+        transform.multiply(layer->currentTransform());
     
 #if ENABLE(3D_RENDERING)
     if (containerObject && containerObject->hasLayer() && containerObject->style()->hasPerspective()) {
@@ -2001,7 +2021,7 @@ void RenderObject::getTransformFromContainer(const RenderObject* containerObject
         perspectiveMatrix.applyPerspective(containerObject->style()->perspective());
         
         transform.translateRight3d(-perspectiveOrigin.x(), -perspectiveOrigin.y(), 0);
-        transform.multiply(perspectiveMatrix);
+        transform = perspectiveMatrix * transform;
         transform.translateRight3d(perspectiveOrigin.x(), perspectiveOrigin.y(), 0);
     }
 #else
@@ -2157,9 +2177,6 @@ void RenderObject::destroy()
     if (frame() && frame()->eventHandler()->autoscrollRenderer() == this)
         frame()->eventHandler()->stopAutoscrollTimer(true);
 
-    if (m_hasCounterNodeMap)
-        RenderCounter::destroyCounterNodes(this);
-
     if (AXObjectCache::accessibilityEnabled()) {
         document()->axObjectCache()->childrenChanged(this->parent());
         document()->axObjectCache()->remove(this);
@@ -2172,6 +2189,14 @@ void RenderObject::destroy()
 
     remove();
 
+    // If this renderer had a parent, remove should have destroyed any counters
+    // attached to this renderer and marked the affected other counters for
+    // reevaluation. This apparently redundant check is here for the case when
+    // this renderer had no parent at the time remove() was called.
+
+    if (m_hasCounterNodeMap)
+        RenderCounter::destroyCounterNodes(this);
+
     // FIXME: Would like to do this in RenderBoxModelObject, but the timing is so complicated that this can't easily
     // be moved into RenderBoxModelObject::destroy.
     if (hasLayer()) {
diff --git a/Source/WebCore/rendering/RenderObject.h b/Source/WebCore/rendering/RenderObject.h
index f2e7f13..43e6bea 100644
--- a/Source/WebCore/rendering/RenderObject.h
+++ b/Source/WebCore/rendering/RenderObject.h
@@ -143,6 +143,18 @@ public:
             return children->lastChild();
         return 0;
     }
+    RenderObject* beforePseudoElementRenderer() const
+    {
+        if (const RenderObjectChildList* children = virtualChildren())
+            return children->beforePseudoElementRenderer(this);
+        return 0;
+    }
+    RenderObject* afterPseudoElementRenderer() const
+    {
+        if (const RenderObjectChildList* children = virtualChildren())
+            return children->afterPseudoElementRenderer(this);
+        return 0;
+    }
     virtual RenderObjectChildList* virtualChildren() { return 0; }
     virtual const RenderObjectChildList* virtualChildren() const { return 0; }
 
@@ -332,6 +344,7 @@ public:
     virtual bool isSVGImage() const { return false; }
     virtual bool isSVGForeignObject() const { return false; }
     virtual bool isSVGResourceContainer() const { return false; }
+    virtual bool isSVGResourceFilter() const { return false; }
     virtual bool isSVGResourceFilterPrimitive() const { return false; }
     virtual bool isSVGShadowTreeRootContainer() const { return false; }
 
@@ -444,6 +457,11 @@ public:
     bool isRooted(RenderView** = 0);
 
     Node* node() const { return m_isAnonymous ? 0 : m_node; }
+
+    // Returns the styled node that caused the generation of this renderer.
+    // This is the same as node() except for renderers of :before and :after
+    // pseudo elements for which their parent node is returned.
+    Node* generatingNode() const { return m_node == document() ? 0 : m_node; }
     void setNode(Node* node) { m_node = node; }
 
     Document* document() const { return m_node->document(); }
diff --git a/Source/WebCore/rendering/RenderObjectChildList.cpp b/Source/WebCore/rendering/RenderObjectChildList.cpp
index fa4f902..6a773dc 100644
--- a/Source/WebCore/rendering/RenderObjectChildList.cpp
+++ b/Source/WebCore/rendering/RenderObjectChildList.cpp
@@ -128,6 +128,9 @@ RenderObject* RenderObjectChildList::removeChildNode(RenderObject* owner, Render
     oldChild->setNextSibling(0);
     oldChild->setParent(0);
 
+    if (oldChild->m_hasCounterNodeMap)
+        RenderCounter::destroyCounterNodes(oldChild);
+
     if (AXObjectCache::accessibilityEnabled())
         owner->document()->axObjectCache()->childrenChanged(owner);
 
@@ -175,6 +178,7 @@ void RenderObjectChildList::appendChildNode(RenderObject* owner, RenderObject* n
             owner->dirtyLinesFromChangedChild(newChild);
     }
 
+    RenderCounter::rendererSubtreeAttached(newChild);
     newChild->setNeedsLayoutAndPrefWidthsRecalc(); // Goes up the containing block hierarchy.
     if (!owner->normalChildNeedsLayout())
         owner->setChildNeedsLayout(true); // We may supply the static position for an absolute positioned child.
@@ -234,6 +238,7 @@ void RenderObjectChildList::insertChildNode(RenderObject* owner, RenderObject* c
             owner->dirtyLinesFromChangedChild(child);
     }
 
+    RenderCounter::rendererSubtreeAttached(child);
     child->setNeedsLayoutAndPrefWidthsRecalc();
     if (!owner->normalChildNeedsLayout())
         owner->setChildNeedsLayout(true); // We may supply the static position for an absolute positioned child.
@@ -242,59 +247,6 @@ void RenderObjectChildList::insertChildNode(RenderObject* owner, RenderObject* c
         owner->document()->axObjectCache()->childrenChanged(owner);
 }
 
-static RenderObject* beforeAfterContainer(RenderObject* container, PseudoId type)
-{
-    if (type == BEFORE) {
-        // An anonymous (generated) inline run-in that has PseudoId BEFORE must come from a grandparent.
-        // Therefore we should skip these generated run-ins when checking our immediate children.
-        // If we don't find our :before child immediately, then we should check if we own a
-        // generated inline run-in in the next level of children.
-        RenderObject* first = container;
-        do {
-            // Skip list markers and generated run-ins
-            first = first->firstChild();
-            while (first && (first->isListMarker() || (first->isRenderInline() && first->isRunIn() && first->isAnonymous())))
-                first = first->nextSibling();
-        } while (first && first->isAnonymous() && first->style()->styleType() == NOPSEUDO);
-
-        if (!first)
-            return 0;
-
-        if (first->style()->styleType() == type)
-            return first;
-
-        // Check for a possible generated run-in, using run-in positioning rules.
-        // Skip inlines and floating / positioned blocks, and place as the first child.
-        first = container->firstChild();
-        if (!first->isRenderBlock())
-            return 0;
-        while (first && first->isFloatingOrPositioned())
-            first = first->nextSibling();
-        if (first) {
-            first = first->firstChild();
-            // We still need to skip any list markers that could exist before the run-in.
-            while (first && first->isListMarker())
-                first = first->nextSibling();
-            if (first && first->style()->styleType() == type && first->isRenderInline() && first->isRunIn() && first->isAnonymous())
-                return first;
-        }
-        return 0;
-    }
-
-    if (type == AFTER) {
-        RenderObject* last = container;
-        do {
-            last = last->lastChild();
-        } while (last && last->isAnonymous() && last->style()->styleType() == NOPSEUDO && !last->isListMarker());
-        if (last && last->style()->styleType() != type)
-            return 0;
-        return last;
-    }
-
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
 static RenderObject* findBeforeAfterParent(RenderObject* object)
 {
     // Only table parts need to search for the :before or :after parent
@@ -325,14 +277,63 @@ static void invalidateCountersInContainer(RenderObject* container, const AtomicS
     }
 }
 
-void RenderObjectChildList::invalidateCounters(RenderObject* owner, const AtomicString& identifier)
+void RenderObjectChildList::invalidateCounters(const RenderObject* owner, const AtomicString& identifier)
 {
     ASSERT(!owner->documentBeingDestroyed());
-    invalidateCountersInContainer(beforeAfterContainer(owner, BEFORE), identifier);
-    invalidateCountersInContainer(beforeAfterContainer(owner, AFTER), identifier);
+    invalidateCountersInContainer(beforePseudoElementRenderer(owner), identifier);
+    invalidateCountersInContainer(afterPseudoElementRenderer(owner), identifier);
 }
 
-void RenderObjectChildList::updateBeforeAfterContent(RenderObject* owner, PseudoId type, RenderObject* styledObject)
+RenderObject* RenderObjectChildList::beforePseudoElementRenderer(const RenderObject* owner) const
+{
+    // An anonymous (generated) inline run-in that has PseudoId BEFORE must come from a grandparent.
+    // Therefore we should skip these generated run-ins when checking our immediate children.
+    // If we don't find our :before child immediately, then we should check if we own a
+    // generated inline run-in in the next level of children.
+    RenderObject* first = const_cast<RenderObject*>(owner);
+    do {
+        // Skip list markers and generated run-ins
+        first = first->firstChild();
+        while (first && (first->isListMarker() || (first->isRenderInline() && first->isRunIn() && first->isAnonymous())))
+            first = first->nextSibling();
+    } while (first && first->isAnonymous() && first->style()->styleType() == NOPSEUDO);
+
+    if (!first)
+        return 0;
+
+    if (first->style()->styleType() == BEFORE)
+        return first;
+
+    // Check for a possible generated run-in, using run-in positioning rules.
+    // Skip inlines and floating / positioned blocks, and place as the first child.
+    first = owner->firstChild();
+    if (!first->isRenderBlock())
+        return 0;
+    while (first && first->isFloatingOrPositioned())
+        first = first->nextSibling();
+    if (first) {
+        first = first->firstChild();
+        // We still need to skip any list markers that could exist before the run-in.
+        while (first && first->isListMarker())
+            first = first->nextSibling();
+        if (first && first->style()->styleType() == BEFORE && first->isRenderInline() && first->isRunIn() && first->isAnonymous())
+            return first;
+    }
+    return 0;
+}
+
+RenderObject* RenderObjectChildList::afterPseudoElementRenderer(const RenderObject* owner) const
+{
+    RenderObject* last = const_cast<RenderObject*>(owner);
+    do {
+        last = last->lastChild();
+    } while (last && last->isAnonymous() && last->style()->styleType() == NOPSEUDO && !last->isListMarker());
+    if (last && last->style()->styleType() != AFTER)
+        return 0;
+    return last;
+}
+
+void RenderObjectChildList::updateBeforeAfterContent(RenderObject* owner, PseudoId type, const RenderObject* styledObject)
 {
     // Double check that the document did in fact use generated content rules.  Otherwise we should not have been called.
     ASSERT(owner->document()->usesBeforeAfterRules());
@@ -345,7 +346,18 @@ void RenderObjectChildList::updateBeforeAfterContent(RenderObject* owner, Pseudo
         styledObject = owner;
 
     RenderStyle* pseudoElementStyle = styledObject->getCachedPseudoStyle(type);
-    RenderObject* child = beforeAfterContainer(owner, type);
+    RenderObject* child;
+    switch (type) {
+    case BEFORE:
+        child = beforePseudoElementRenderer(owner);
+        break;
+    case AFTER:
+        child = afterPseudoElementRenderer(owner);
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        return;
+    }
 
     // Whether or not we currently have generated content attached.
     bool oldContentPresent = child;
@@ -459,6 +471,8 @@ void RenderObjectChildList::updateBeforeAfterContent(RenderObject* owner, Pseudo
                 // Make a generated box that might be any display type now that we are able to drill down into children
                 // to find the original content properly.
                 generatedContentContainer = RenderObject::createObject(owner->document(), pseudoElementStyle);
+                ASSERT(styledObject->node()); // The styled object cannot be anonymous or else it could not have ':before' or ':after' pseudo elements.
+                generatedContentContainer->setNode(styledObject->node()); // This allows access to the generatingNode.
                 generatedContentContainer->setStyle(pseudoElementStyle);
                 owner->addChild(generatedContentContainer, insertBefore);
             }
diff --git a/Source/WebCore/rendering/RenderObjectChildList.h b/Source/WebCore/rendering/RenderObjectChildList.h
index 8b80f37..087adfb 100644
--- a/Source/WebCore/rendering/RenderObjectChildList.h
+++ b/Source/WebCore/rendering/RenderObjectChildList.h
@@ -55,8 +55,10 @@ public:
     void appendChildNode(RenderObject* owner, RenderObject*, bool fullAppend = true);
     void insertChildNode(RenderObject* owner, RenderObject* child, RenderObject* before, bool fullInsert = true);
 
-    void updateBeforeAfterContent(RenderObject* owner, PseudoId type, RenderObject* styledObject = 0);
-    void invalidateCounters(RenderObject* owner, const AtomicString& identifier);
+    void updateBeforeAfterContent(RenderObject* owner, PseudoId type, const RenderObject* styledObject = 0);
+    RenderObject* beforePseudoElementRenderer(const RenderObject* owner) const;
+    RenderObject* afterPseudoElementRenderer(const RenderObject* owner) const;
+    void invalidateCounters(const RenderObject* owner, const AtomicString& identifier);
 
 private:
     RenderObject* m_firstChild;
diff --git a/Source/WebCore/rendering/RenderOverflow.h b/Source/WebCore/rendering/RenderOverflow.h
index 33e8cff..48fe2bb 100644
--- a/Source/WebCore/rendering/RenderOverflow.h
+++ b/Source/WebCore/rendering/RenderOverflow.h
@@ -41,38 +41,38 @@ class RenderOverflow {
     WTF_MAKE_NONCOPYABLE(RenderOverflow); WTF_MAKE_FAST_ALLOCATED;
 public:
     RenderOverflow(const IntRect& layoutRect, const IntRect& visualRect) 
-        : m_topLayoutOverflow(layoutRect.y())
-        , m_bottomLayoutOverflow(layoutRect.bottom())
-        , m_leftLayoutOverflow(layoutRect.x())
-        , m_rightLayoutOverflow(layoutRect.right())
-        , m_topVisualOverflow(visualRect.y())
-        , m_bottomVisualOverflow(visualRect.bottom())
-        , m_leftVisualOverflow(visualRect.x())
-        , m_rightVisualOverflow(visualRect.right())
+        : m_minYLayoutOverflow(layoutRect.y())
+        , m_maxYLayoutOverflow(layoutRect.maxY())
+        , m_minXLayoutOverflow(layoutRect.x())
+        , m_maxXLayoutOverflow(layoutRect.maxX())
+        , m_minYVisualOverflow(visualRect.y())
+        , m_maxYVisualOverflow(visualRect.maxY())
+        , m_minXVisualOverflow(visualRect.x())
+        , m_maxXVisualOverflow(visualRect.maxX())
     {
     }
    
-    int topLayoutOverflow() const { return m_topLayoutOverflow; }
-    int bottomLayoutOverflow() const { return m_bottomLayoutOverflow; }
-    int leftLayoutOverflow() const { return m_leftLayoutOverflow; }
-    int rightLayoutOverflow() const { return m_rightLayoutOverflow; }
+    int minYLayoutOverflow() const { return m_minYLayoutOverflow; }
+    int maxYLayoutOverflow() const { return m_maxYLayoutOverflow; }
+    int minXLayoutOverflow() const { return m_minXLayoutOverflow; }
+    int maxXLayoutOverflow() const { return m_maxXLayoutOverflow; }
     IntRect layoutOverflowRect() const;
 
-    int topVisualOverflow() const { return m_topVisualOverflow; }
-    int bottomVisualOverflow() const { return m_bottomVisualOverflow; }
-    int leftVisualOverflow() const { return m_leftVisualOverflow; }
-    int rightVisualOverflow() const { return m_rightVisualOverflow; }
+    int minYVisualOverflow() const { return m_minYVisualOverflow; }
+    int maxYVisualOverflow() const { return m_maxYVisualOverflow; }
+    int minXVisualOverflow() const { return m_minXVisualOverflow; }
+    int maxXVisualOverflow() const { return m_maxXVisualOverflow; }
     IntRect visualOverflowRect() const;
 
-    void setTopLayoutOverflow(int overflow) { m_topLayoutOverflow = overflow; }
-    void setBottomLayoutOverflow(int overflow) { m_bottomLayoutOverflow = overflow; }
-    void setLeftLayoutOverflow(int overflow) { m_leftLayoutOverflow = overflow; }
-    void setRightLayoutOverflow(int overflow) { m_rightLayoutOverflow = overflow; }
+    void setMinYLayoutOverflow(int overflow) { m_minYLayoutOverflow = overflow; }
+    void setMaxYLayoutOverflow(int overflow) { m_maxYLayoutOverflow = overflow; }
+    void setMinXLayoutOverflow(int overflow) { m_minXLayoutOverflow = overflow; }
+    void setMaxXLayoutOverflow(int overflow) { m_maxXLayoutOverflow = overflow; }
     
-    void setTopVisualOverflow(int overflow) { m_topVisualOverflow = overflow; }
-    void setBottomVisualOverflow(int overflow) { m_bottomVisualOverflow = overflow; }
-    void setLeftVisualOverflow(int overflow) { m_leftVisualOverflow = overflow; }
-    void setRightVisualOverflow(int overflow) { m_rightVisualOverflow = overflow; }
+    void setMinYVisualOverflow(int overflow) { m_minYVisualOverflow = overflow; }
+    void setMaxYVisualOverflow(int overflow) { m_maxYVisualOverflow = overflow; }
+    void setMinXVisualOverflow(int overflow) { m_minXVisualOverflow = overflow; }
+    void setMaxXVisualOverflow(int overflow) { m_maxXVisualOverflow = overflow; }
     
     void move(int dx, int dy);
     
@@ -85,78 +85,78 @@ public:
     void resetLayoutOverflow(const IntRect& defaultRect);
 
 private:
-    int m_topLayoutOverflow;
-    int m_bottomLayoutOverflow;
-    int m_leftLayoutOverflow;
-    int m_rightLayoutOverflow;
-
-    int m_topVisualOverflow;
-    int m_bottomVisualOverflow;
-    int m_leftVisualOverflow;
-    int m_rightVisualOverflow;
+    int m_minYLayoutOverflow;
+    int m_maxYLayoutOverflow;
+    int m_minXLayoutOverflow;
+    int m_maxXLayoutOverflow;
+
+    int m_minYVisualOverflow;
+    int m_maxYVisualOverflow;
+    int m_minXVisualOverflow;
+    int m_maxXVisualOverflow;
 };
 
 inline IntRect RenderOverflow::layoutOverflowRect() const
 {
-    return IntRect(m_leftLayoutOverflow, m_topLayoutOverflow, m_rightLayoutOverflow - m_leftLayoutOverflow, m_bottomLayoutOverflow - m_topLayoutOverflow);
+    return IntRect(m_minXLayoutOverflow, m_minYLayoutOverflow, m_maxXLayoutOverflow - m_minXLayoutOverflow, m_maxYLayoutOverflow - m_minYLayoutOverflow);
 }
 
 inline IntRect RenderOverflow::visualOverflowRect() const
 {
-    return IntRect(m_leftVisualOverflow, m_topVisualOverflow, m_rightVisualOverflow - m_leftVisualOverflow, m_bottomVisualOverflow - m_topVisualOverflow);
+    return IntRect(m_minXVisualOverflow, m_minYVisualOverflow, m_maxXVisualOverflow - m_minXVisualOverflow, m_maxYVisualOverflow - m_minYVisualOverflow);
 }
 
 inline void RenderOverflow::move(int dx, int dy)
 {
-    m_topLayoutOverflow += dy;
-    m_bottomLayoutOverflow += dy;
-    m_leftLayoutOverflow += dx;
-    m_rightLayoutOverflow += dx;
+    m_minYLayoutOverflow += dy;
+    m_maxYLayoutOverflow += dy;
+    m_minXLayoutOverflow += dx;
+    m_maxXLayoutOverflow += dx;
     
-    m_topVisualOverflow += dy;
-    m_bottomVisualOverflow += dy;
-    m_leftVisualOverflow += dx;
-    m_rightVisualOverflow += dx;
+    m_minYVisualOverflow += dy;
+    m_maxYVisualOverflow += dy;
+    m_minXVisualOverflow += dx;
+    m_maxXVisualOverflow += dx;
 }
 
 inline void RenderOverflow::addLayoutOverflow(const IntRect& rect)
 {
-    m_topLayoutOverflow = std::min(rect.y(), m_topLayoutOverflow);
-    m_bottomLayoutOverflow = std::max(rect.bottom(), m_bottomLayoutOverflow);
-    m_leftLayoutOverflow = std::min(rect.x(), m_leftLayoutOverflow);
-    m_rightLayoutOverflow = std::max(rect.right(), m_rightLayoutOverflow);
+    m_minYLayoutOverflow = std::min(rect.y(), m_minYLayoutOverflow);
+    m_maxYLayoutOverflow = std::max(rect.maxY(), m_maxYLayoutOverflow);
+    m_minXLayoutOverflow = std::min(rect.x(), m_minXLayoutOverflow);
+    m_maxXLayoutOverflow = std::max(rect.maxX(), m_maxXLayoutOverflow);
 }
 
 inline void RenderOverflow::addVisualOverflow(const IntRect& rect)
 {
-    m_topVisualOverflow = std::min(rect.y(), m_topVisualOverflow);
-    m_bottomVisualOverflow = std::max(rect.bottom(), m_bottomVisualOverflow);
-    m_leftVisualOverflow = std::min(rect.x(), m_leftVisualOverflow);
-    m_rightVisualOverflow = std::max(rect.right(), m_rightVisualOverflow);
+    m_minYVisualOverflow = std::min(rect.y(), m_minYVisualOverflow);
+    m_maxYVisualOverflow = std::max(rect.maxY(), m_maxYVisualOverflow);
+    m_minXVisualOverflow = std::min(rect.x(), m_minXVisualOverflow);
+    m_maxXVisualOverflow = std::max(rect.maxX(), m_maxXVisualOverflow);
 }
 
 inline void RenderOverflow::setLayoutOverflow(const IntRect& rect)
 {
-    m_topLayoutOverflow = rect.y();
-    m_bottomLayoutOverflow = rect.bottom();
-    m_leftLayoutOverflow = rect.x();
-    m_rightLayoutOverflow = rect.right();
+    m_minYLayoutOverflow = rect.y();
+    m_maxYLayoutOverflow = rect.maxY();
+    m_minXLayoutOverflow = rect.x();
+    m_maxXLayoutOverflow = rect.maxX();
 }
 
 inline void RenderOverflow::setVisualOverflow(const IntRect& rect)
 {
-    m_topVisualOverflow = rect.y();
-    m_bottomVisualOverflow = rect.bottom();
-    m_leftVisualOverflow = rect.x();
-    m_rightVisualOverflow = rect.right();
+    m_minYVisualOverflow = rect.y();
+    m_maxYVisualOverflow = rect.maxY();
+    m_minXVisualOverflow = rect.x();
+    m_maxXVisualOverflow = rect.maxX();
 }
 
 inline void RenderOverflow::resetLayoutOverflow(const IntRect& rect)
 {
-    m_topLayoutOverflow = rect.y();
-    m_bottomLayoutOverflow = rect.bottom();
-    m_leftLayoutOverflow = rect.x();
-    m_rightLayoutOverflow = rect.right();
+    m_minYLayoutOverflow = rect.y();
+    m_maxYLayoutOverflow = rect.maxY();
+    m_minXLayoutOverflow = rect.x();
+    m_maxXLayoutOverflow = rect.maxX();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderProgress.cpp b/Source/WebCore/rendering/RenderProgress.cpp
index 4194e2b..2a8e6f3 100644
--- a/Source/WebCore/rendering/RenderProgress.cpp
+++ b/Source/WebCore/rendering/RenderProgress.cpp
@@ -36,6 +36,16 @@ using namespace std;
 
 namespace WebCore {
 
+IntRect RenderProgressBarValuePart::preferredFrameRect()
+{
+    return toRenderProgress(parent())->valuePartRect();
+}
+
+bool RenderProgressBarValuePart::shouldBeHidden()
+{
+    return !toRenderProgress(parent())->shouldHaveParts();
+}
+
 RenderProgress::RenderProgress(HTMLProgressElement* element)
     : RenderIndicator(element)
     , m_position(-1)
@@ -49,23 +59,10 @@ RenderProgress::RenderProgress(HTMLProgressElement* element)
 
 RenderProgress::~RenderProgress()
 {
-    if (m_valuePart)
-        m_valuePart->detach();
 }
 
 void RenderProgress::updateFromElement()
 {
-    if (!m_valuePart) {
-        m_valuePart = ShadowBlockElement::createForPart(static_cast<HTMLElement*>(node()), PROGRESS_BAR_VALUE);
-        if (m_valuePart->renderer())
-            addChild(m_valuePart->renderer());
-    }
-
-    if (shouldHaveParts())
-        style()->setAppearance(NoControlPart);
-    else if (m_valuePart->renderer())
-        m_valuePart->renderer()->style()->setVisibility(HIDDEN);
-
     HTMLProgressElement* element = progressElement();
     if (m_position == element->position())
         return;
@@ -102,7 +99,8 @@ void RenderProgress::paint(PaintInfo& paintInfo, int tx, int ty)
 
 void RenderProgress::layoutParts()
 {
-    m_valuePart->layoutAsPart(valuePartRect());
+    for (RenderObject* child = firstChild(); child; child = child->nextSibling())
+        child->layout();
     updateAnimationState();
 }
 
@@ -110,8 +108,6 @@ bool RenderProgress::shouldHaveParts() const
 {
     if (!style()->hasAppearance())
         return true;
-    if (ShadowBlockElement::partShouldHaveStyle(this, PROGRESS_BAR_VALUE))
-        return true;
     return false;
 }
 
diff --git a/Source/WebCore/rendering/RenderProgress.h b/Source/WebCore/rendering/RenderProgress.h
index 9ed5741..78cf359 100644
--- a/Source/WebCore/rendering/RenderProgress.h
+++ b/Source/WebCore/rendering/RenderProgress.h
@@ -28,7 +28,14 @@
 namespace WebCore {
 
 class HTMLProgressElement;
-class ShadowBlockElement;
+
+class RenderProgressBarValuePart : public RenderIndicatorPart {
+public:
+    RenderProgressBarValuePart(Node* node) : RenderIndicatorPart(node) {}
+private:
+    virtual IntRect preferredFrameRect();
+    virtual bool shouldBeHidden();
+};
 
 class RenderProgress : public RenderIndicator {
 public:
@@ -40,6 +47,8 @@ public:
     double animationStartTime() const { return m_animationStartTime; }
 
     bool isDeterminate() const;
+    IntRect valuePartRect() const;
+    bool shouldHaveParts() const;
 
     HTMLProgressElement* progressElement() const;
 
@@ -48,12 +57,8 @@ private:
     virtual bool isProgress() const { return true; }
     virtual void updateFromElement();
     virtual void paint(PaintInfo&, int tx, int ty);
-
     virtual void layoutParts();
 
-    IntRect valuePartRect() const;
-    bool shouldHaveParts() const;
-
     void animationTimerFired(Timer<RenderProgress>*);
     void updateAnimationState();
 
@@ -63,7 +68,6 @@ private:
     double m_animationDuration;
     bool m_animating;
     Timer<RenderProgress> m_animationTimer;
-    RefPtr<ShadowBlockElement> m_valuePart;
 };
 
 inline RenderProgress* toRenderProgress(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderReplaced.cpp b/Source/WebCore/rendering/RenderReplaced.cpp
index 0d72f95..c27d336 100644
--- a/Source/WebCore/rendering/RenderReplaced.cpp
+++ b/Source/WebCore/rendering/RenderReplaced.cpp
@@ -172,8 +172,8 @@ bool RenderReplaced::shouldPaint(PaintInfo& paintInfo, int& tx, int& ty)
     int currentTY = ty + y();
 
     // Early exit if the element touches the edges.
-    int top = currentTY + topVisualOverflow();
-    int bottom = currentTY + bottomVisualOverflow();
+    int top = currentTY + minYVisualOverflow();
+    int bottom = currentTY + maxYVisualOverflow();
     if (isSelected() && m_inlineBoxWrapper) {
         int selTop = ty + m_inlineBoxWrapper->root()->selectionTop();
         int selBottom = ty + selTop + m_inlineBoxWrapper->root()->selectionHeight();
@@ -182,9 +182,9 @@ bool RenderReplaced::shouldPaint(PaintInfo& paintInfo, int& tx, int& ty)
     }
     
     int os = 2 * maximalOutlineSize(paintInfo.phase);
-    if (currentTX + leftVisualOverflow() >= paintInfo.rect.right() + os || currentTX + rightVisualOverflow() <= paintInfo.rect.x() - os)
+    if (currentTX + minXVisualOverflow() >= paintInfo.rect.maxX() + os || currentTX + maxXVisualOverflow() <= paintInfo.rect.x() - os)
         return false;
-    if (top >= paintInfo.rect.bottom() + os || bottom <= paintInfo.rect.y() - os)
+    if (top >= paintInfo.rect.maxY() + os || bottom <= paintInfo.rect.y() - os)
         return false;
 
     return true;
diff --git a/Source/WebCore/rendering/RenderRubyRun.cpp b/Source/WebCore/rendering/RenderRubyRun.cpp
index c12e543..f2e30eb 100644
--- a/Source/WebCore/rendering/RenderRubyRun.cpp
+++ b/Source/WebCore/rendering/RenderRubyRun.cpp
@@ -42,7 +42,6 @@ namespace WebCore {
 
 RenderRubyRun::RenderRubyRun(Node* node)
     : RenderBlock(node)
-    , m_beingDestroyed(false)
 {
     setReplaced(true);
     setInline(true);
@@ -52,13 +51,6 @@ RenderRubyRun::~RenderRubyRun()
 {
 }
 
-void RenderRubyRun::destroy()
-{
-    // Mark if the run is being destroyed to avoid trouble in removeChild().
-    m_beingDestroyed = true;
-    RenderBlock::destroy();
-}
-
 bool RenderRubyRun::hasRubyText() const
 {
     // The only place where a ruby text can be is in the first position
@@ -165,7 +157,7 @@ void RenderRubyRun::removeChild(RenderObject* child)
 {
     // If the child is a ruby text, then merge the ruby base with the base of
     // the right sibling run, if possible.
-    if (!m_beingDestroyed && !documentBeingDestroyed() && child->isRubyText()) {
+    if (!beingDestroyed() && !documentBeingDestroyed() && child->isRubyText()) {
         RenderRubyBase* base = rubyBase();
         RenderObject* rightNeighbour = nextSibling();
         if (base && rightNeighbour && rightNeighbour->isRubyRun()) {
@@ -184,7 +176,7 @@ void RenderRubyRun::removeChild(RenderObject* child)
 
     RenderBlock::removeChild(child);
 
-    if (!m_beingDestroyed && !documentBeingDestroyed()) {
+    if (!beingDestroyed() && !documentBeingDestroyed()) {
         // Check if our base (if any) is now empty. If so, destroy it.
         RenderBlock* base = rubyBase();
         if (base && !base->firstChild()) {
diff --git a/Source/WebCore/rendering/RenderRubyRun.h b/Source/WebCore/rendering/RenderRubyRun.h
index d844bff..53209bc 100644
--- a/Source/WebCore/rendering/RenderRubyRun.h
+++ b/Source/WebCore/rendering/RenderRubyRun.h
@@ -46,8 +46,6 @@ public:
     RenderRubyRun(Node*);
     virtual ~RenderRubyRun();
 
-    virtual void destroy();
-
     bool hasRubyText() const;
     bool hasRubyBase() const;
     bool isEmpty() const;
@@ -75,8 +73,6 @@ private:
     virtual const char* renderName() const { return "RenderRubyRun (anonymous)"; }
     virtual bool createsAnonymousWrapper() const { return true; }
     virtual void removeLeftoverAnonymousBlock(RenderBlock*) { }
-
-    bool m_beingDestroyed;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderScrollbarTheme.cpp b/Source/WebCore/rendering/RenderScrollbarTheme.cpp
index e32d87a..87309d4 100644
--- a/Source/WebCore/rendering/RenderScrollbarTheme.cpp
+++ b/Source/WebCore/rendering/RenderScrollbarTheme.cpp
@@ -98,10 +98,10 @@ IntRect RenderScrollbarTheme::constrainTrackRectToTrackPieces(Scrollbar* scrollb
     IntRect result = rect;
     if (scrollbar->orientation() == HorizontalScrollbar) {
         result.setX(backRect.x());
-        result.setWidth(forwardRect.right() - backRect.x());
+        result.setWidth(forwardRect.maxX() - backRect.x());
     } else {
         result.setY(backRect.y());
-        result.setHeight(forwardRect.bottom() - backRect.y());
+        result.setHeight(forwardRect.maxY() - backRect.y());
     }
     return result;
 }
diff --git a/Source/WebCore/rendering/RenderTable.cpp b/Source/WebCore/rendering/RenderTable.cpp
index 3fc1c72..bb90e97 100644
--- a/Source/WebCore/rendering/RenderTable.cpp
+++ b/Source/WebCore/rendering/RenderTable.cpp
@@ -168,7 +168,7 @@ void RenderTable::addChild(RenderObject* child, RenderObject* beforeChild)
 
     if (!wrapInAnonymousSection) {
         // If the next renderer is actually wrapped in an anonymous table section, we need to go up and find that.
-        while (beforeChild && !beforeChild->isTableSection() && !beforeChild->isTableCol() && beforeChild->style()->display() != TABLE_CAPTION)
+        while (beforeChild && beforeChild->parent() != this)
             beforeChild = beforeChild->parent();
 
         RenderBox::addChild(child, beforeChild);
@@ -419,7 +419,7 @@ void RenderTable::layout()
     while (section) {
         if (!sectionMoved && section->logicalTop() != logicalHeight()) {
             sectionMoved = true;
-            movedSectionLogicalTop = min(logicalHeight(), section->logicalTop()) + (style()->isHorizontalWritingMode() ? section->topVisualOverflow() : section->leftVisualOverflow());
+            movedSectionLogicalTop = min(logicalHeight(), section->logicalTop()) + (style()->isHorizontalWritingMode() ? section->minYVisualOverflow() : section->minXVisualOverflow());
         }
         section->setLogicalLocation(sectionLogicalLeft, logicalHeight());
 
@@ -453,15 +453,15 @@ void RenderTable::layout()
     statePusher.pop();
 
     if (view()->layoutState()->pageLogicalHeight())
-        setPageLogicalOffset(view()->layoutState()->pageLogicalOffset(y()));
+        setPageLogicalOffset(view()->layoutState()->pageLogicalOffset(logicalTop()));
 
     bool didFullRepaint = repainter.repaintAfterLayout();
     // Repaint with our new bounds if they are different from our old bounds.
     if (!didFullRepaint && sectionMoved) {
         if (style()->isHorizontalWritingMode())
-            repaintRectangle(IntRect(leftVisualOverflow(), movedSectionLogicalTop, rightVisualOverflow() - leftVisualOverflow(), bottomVisualOverflow() - movedSectionLogicalTop));
+            repaintRectangle(IntRect(minXVisualOverflow(), movedSectionLogicalTop, maxXVisualOverflow() - minXVisualOverflow(), maxYVisualOverflow() - movedSectionLogicalTop));
         else
-            repaintRectangle(IntRect(movedSectionLogicalTop, topVisualOverflow(), rightVisualOverflow() - movedSectionLogicalTop, bottomVisualOverflow() - topVisualOverflow()));
+            repaintRectangle(IntRect(movedSectionLogicalTop, minYVisualOverflow(), maxXVisualOverflow() - movedSectionLogicalTop, maxYVisualOverflow() - minYVisualOverflow()));
     }
 
     setNeedsLayout(false);
@@ -513,9 +513,9 @@ void RenderTable::paint(PaintInfo& paintInfo, int tx, int ty)
     PaintPhase paintPhase = paintInfo.phase;
 
     int os = 2 * maximalOutlineSize(paintPhase);
-    if (ty + topVisualOverflow() >= paintInfo.rect.bottom() + os || ty + bottomVisualOverflow() <= paintInfo.rect.y() - os)
+    if (ty + minYVisualOverflow() >= paintInfo.rect.maxY() + os || ty + maxYVisualOverflow() <= paintInfo.rect.y() - os)
         return;
-    if (tx + leftVisualOverflow() >= paintInfo.rect.right() + os || tx + rightVisualOverflow() <= paintInfo.rect.x() - os)
+    if (tx + minXVisualOverflow() >= paintInfo.rect.maxX() + os || tx + maxXVisualOverflow() <= paintInfo.rect.x() - os)
         return;
 
     bool pushedClip = pushContentsClip(paintInfo, tx, ty);    
@@ -1185,6 +1185,8 @@ int RenderTable::firstLineBoxBaseline() const
     if (isWritingModeRoot())
         return -1;
 
+    recalcSectionsIfNeeded();
+
     RenderTableSection* firstNonEmptySection = m_head ? m_head : (m_firstBody ? m_firstBody : m_foot);
     if (firstNonEmptySection && !firstNonEmptySection->numRows())
         firstNonEmptySection = sectionBelow(firstNonEmptySection, true);
diff --git a/Source/WebCore/rendering/RenderTableCell.cpp b/Source/WebCore/rendering/RenderTableCell.cpp
index 8549f49..1593a5c 100644
--- a/Source/WebCore/rendering/RenderTableCell.cpp
+++ b/Source/WebCore/rendering/RenderTableCell.cpp
@@ -276,9 +276,9 @@ IntRect RenderTableCell::clippedOverflowRectForRepaint(RenderBoxModelObject* rep
             right = max(right, below->borderHalfRight(true));
         }
     }
-    left = max(left, -leftVisualOverflow());
-    top = max(top, -topVisualOverflow());
-    IntRect r(-left, - top, left + max(width() + right, rightVisualOverflow()), top + max(height() + bottom, bottomVisualOverflow()));
+    left = max(left, -minXVisualOverflow());
+    top = max(top, -minYVisualOverflow());
+    IntRect r(-left, - top, left + max(width() + right, maxXVisualOverflow()), top + max(height() + bottom, maxYVisualOverflow()));
 
     if (RenderView* v = view()) {
         // FIXME: layoutDelta needs to be applied in parts before/after transforms and
@@ -812,8 +812,8 @@ void RenderTableCell::paint(PaintInfo& paintInfo, int tx, int ty)
         tx += x();
         ty += y();
         int os = 2 * maximalOutlineSize(paintInfo.phase);
-        if (ty - table()->outerBorderTop() < paintInfo.rect.bottom() + os &&
-            ty + height() + table()->outerBorderBottom() > paintInfo.rect.y() - os)
+        if (ty - table()->outerBorderTop() < paintInfo.rect.maxY() + os
+            && ty + height() + table()->outerBorderBottom() > paintInfo.rect.y() - os)
             paintCollapsedBorder(paintInfo.context, tx, ty, width(), height());
         return;
     } 
diff --git a/Source/WebCore/rendering/RenderTableRow.cpp b/Source/WebCore/rendering/RenderTableRow.cpp
index 595e156..7300c19 100644
--- a/Source/WebCore/rendering/RenderTableRow.cpp
+++ b/Source/WebCore/rendering/RenderTableRow.cpp
@@ -125,7 +125,7 @@ void RenderTableRow::layout()
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (child->isTableCell()) {
             RenderTableCell* cell = toRenderTableCell(child);
-            if (!cell->needsLayout() && paginated && view()->layoutState()->pageLogicalHeight() && view()->layoutState()->pageLogicalOffset(cell->y()) != cell->pageLogicalOffset())
+            if (!cell->needsLayout() && paginated && view()->layoutState()->pageLogicalHeight() && view()->layoutState()->pageLogicalOffset(cell->logicalTop()) != cell->pageLogicalOffset())
                 cell->setChildNeedsLayout(true, false);
 
             if (child->needsLayout()) {
diff --git a/Source/WebCore/rendering/RenderTableSection.cpp b/Source/WebCore/rendering/RenderTableSection.cpp
index 265d2ef..f20c236 100644
--- a/Source/WebCore/rendering/RenderTableSection.cpp
+++ b/Source/WebCore/rendering/RenderTableSection.cpp
@@ -704,7 +704,7 @@ int RenderTableSection::layoutRows(int toAdd)
             if (intrinsicPaddingBefore != oldIntrinsicPaddingBefore || intrinsicPaddingAfter != oldIntrinsicPaddingAfter)
                 cell->setNeedsLayout(true, false);
 
-            if (!cell->needsLayout() && view()->layoutState()->pageLogicalHeight() && view()->layoutState()->pageLogicalOffset(cell->y()) != cell->pageLogicalOffset())
+            if (!cell->needsLayout() && view()->layoutState()->pageLogicalHeight() && view()->layoutState()->pageLogicalOffset(cell->logicalTop()) != cell->pageLogicalOffset())
                 cell->setChildNeedsLayout(true, false);
 
             cell->layoutIfNeeded();
@@ -1068,9 +1068,9 @@ void RenderTableSection::paintObject(PaintInfo& paintInfo, int tx, int ty)
     localRepaintRect.move(-tx, -ty);
     if (style()->isFlippedBlocksWritingMode()) {
         if (style()->isHorizontalWritingMode())
-            localRepaintRect.setY(height() - localRepaintRect.bottom());
+            localRepaintRect.setY(height() - localRepaintRect.maxY());
         else
-            localRepaintRect.setX(width() - localRepaintRect.right());
+            localRepaintRect.setX(width() - localRepaintRect.maxX());
     }
 
     // If some cell overflows, just paint all of them.
@@ -1085,7 +1085,7 @@ void RenderTableSection::paintObject(PaintInfo& paintInfo, int tx, int ty)
         if (startrow == m_rowPos.size() || (startrow > 0 && (m_rowPos[startrow] >  before)))
           --startrow;
 
-        int after = (style()->isHorizontalWritingMode() ? localRepaintRect.bottom() : localRepaintRect.right()) + os;
+        int after = (style()->isHorizontalWritingMode() ? localRepaintRect.maxY() : localRepaintRect.maxX()) + os;
         endrow = std::lower_bound(m_rowPos.begin(), m_rowPos.end(), after) - m_rowPos.begin();
         if (endrow == m_rowPos.size())
           --endrow;
@@ -1104,7 +1104,7 @@ void RenderTableSection::paintObject(PaintInfo& paintInfo, int tx, int ty)
         if ((startcol == columnPos.size()) || (startcol > 0 && (columnPos[startcol] > start)))
             --startcol;
 
-        int end = (style()->isHorizontalWritingMode() ? localRepaintRect.right() : localRepaintRect.bottom()) + os;
+        int end = (style()->isHorizontalWritingMode() ? localRepaintRect.maxX() : localRepaintRect.maxY()) + os;
         endcol = std::lower_bound(columnPos.begin(), columnPos.end(), end) - columnPos.begin();
         if (endcol == columnPos.size())
             --endcol;
diff --git a/Source/WebCore/rendering/RenderText.cpp b/Source/WebCore/rendering/RenderText.cpp
index 86b32d5..1b05af2 100644
--- a/Source/WebCore/rendering/RenderText.cpp
+++ b/Source/WebCore/rendering/RenderText.cpp
@@ -26,7 +26,6 @@
 #include "RenderText.h"
 
 #include "AXObjectCache.h"
-#include "CharacterNames.h"
 #include "EllipsisBox.h"
 #include "FloatQuad.h"
 #include "FontTranscoder.h"
@@ -35,6 +34,7 @@
 #include "Range.h"
 #include "RenderArena.h"
 #include "RenderBlock.h"
+#include "RenderCombineText.h"
 #include "RenderLayer.h"
 #include "RenderView.h"
 #include "Text.h"
@@ -45,6 +45,7 @@
 #include "break_lines.h"
 #include <wtf/AlwaysInline.h>
 #include <wtf/text/StringBuffer.h>
+#include <wtf/unicode/CharacterNames.h>
 
 using namespace std;
 using namespace WTF;
@@ -345,8 +346,12 @@ void RenderText::absoluteQuads(Vector<FloatQuad>& quads, ClippingOption option)
 
         // Shorten the width of this text box if it ends in an ellipsis.
         IntRect ellipsisRect = (option == ClipToEllipsis) ? ellipsisRectForBox(box, 0, textLength()) : IntRect();
-        if (!ellipsisRect.isEmpty())
-            boundaries.setWidth(ellipsisRect.right() - boundaries.x());
+        if (!ellipsisRect.isEmpty()) {
+            if (style()->isHorizontalWritingMode())
+                boundaries.setWidth(ellipsisRect.maxX() - boundaries.x());
+            else
+                boundaries.setHeight(ellipsisRect.maxY() - boundaries.y());
+        }
         quads.append(localToAbsoluteQuad(FloatRect(boundaries)));
     }
 }
@@ -374,8 +379,13 @@ void RenderText::absoluteQuadsForRange(Vector<FloatQuad>& quads, unsigned start,
             IntRect r(box->calculateBoundaries());
             if (useSelectionHeight) {
                 IntRect selectionRect = box->selectionRect(0, 0, start, end);
-                r.setHeight(selectionRect.height());
-                r.setY(selectionRect.y());
+                if (box->isHorizontal()) {
+                    r.setHeight(selectionRect.height());
+                    r.setY(selectionRect.y());
+                } else {
+                    r.setWidth(selectionRect.width());
+                    r.setX(selectionRect.x());
+                }
             }
             quads.append(localToAbsoluteQuad(FloatRect(r)));
         } else {
@@ -384,8 +394,13 @@ void RenderText::absoluteQuadsForRange(Vector<FloatQuad>& quads, unsigned start,
             if (r.height()) {
                 if (!useSelectionHeight) {
                     // change the height and y position because selectionRect uses selection-specific values
-                    r.setHeight(box->logicalHeight());
-                    r.setY(box->y());
+                    if (box->isHorizontal()) {
+                        r.setHeight(box->logicalHeight());
+                        r.setY(box->y());
+                    } else {
+                        r.setWidth(box->logicalHeight());
+                        r.setX(box->x());
+                    }
                 }
                 quads.append(localToAbsoluteQuad(FloatRect(r)));
             }
@@ -547,6 +562,12 @@ IntRect RenderText::localCaretRect(InlineBox* inlineBox, int caretOffset, int* e
 
 ALWAYS_INLINE int RenderText::widthFromCache(const Font& f, int start, int len, int xPos, HashSet<const SimpleFontData*>* fallbackFonts, GlyphOverflow* glyphOverflow) const
 {
+    if (style()->hasTextCombine()) {
+        const RenderCombineText* combineText = toRenderCombineText(this);
+        if (combineText->isCombined())
+            return combineText->combinedTextWidth(f);
+    }
+
     if (f.isFixedPitch() && !f.isSmallCaps() && m_isAllASCII) {
         int monospaceCharacterWidth = f.spaceWidth();
         int tabWidth = allowTabs() ? monospaceCharacterWidth * 8 : 0;
diff --git a/Source/WebCore/rendering/RenderTextControl.cpp b/Source/WebCore/rendering/RenderTextControl.cpp
index cac8113..72b20ec 100644
--- a/Source/WebCore/rendering/RenderTextControl.cpp
+++ b/Source/WebCore/rendering/RenderTextControl.cpp
@@ -23,7 +23,6 @@
 #include "RenderTextControl.h"
 
 #include "AXObjectCache.h"
-#include "CharacterNames.h"
 #include "Editor.h"
 #include "Event.h"
 #include "EventNames.h"
@@ -42,6 +41,7 @@
 #include "TextControlInnerElements.h"
 #include "TextIterator.h"
 #include "TextRun.h"
+#include <wtf/unicode/CharacterNames.h>
 
 using namespace std;
 
@@ -146,7 +146,7 @@ void RenderTextControl::createSubtreeIfNeeded(TextControlInnerElement* innerBloc
         // For non-search fields, there is no intermediate innerBlock as the shadow node.
         // m_innerText will be the shadow node in that case.        
         RenderStyle* parentStyle = innerBlock ? innerBlock->renderer()->style() : style();
-        m_innerText = TextControlInnerTextElement::create(document(), innerBlock ? 0 : static_cast<HTMLElement*>(node()));
+        m_innerText = TextControlInnerTextElement::create(document(), innerBlock ? 0 : toHTMLElement(node()));
         m_innerText->attachInnerElement(innerBlock ? innerBlock : node(), createInnerTextStyle(parentStyle), renderArena());
     }
 }
@@ -544,7 +544,7 @@ float RenderTextControl::getAvgCharWidth(AtomicString family)
         return roundf(style()->font().primaryFont()->avgCharWidth());
 
     const UChar ch = '0'; 
-    return style()->font().floatWidth(TextRun(&ch, 1, false, 0, 0, false, false, false));
+    return style()->font().floatWidth(TextRun(&ch, 1, false, 0, 0, TextRun::AllowTrailingExpansion, false, false, false));
 }
 
 float RenderTextControl::scaleEmToUnits(int x) const
@@ -639,12 +639,12 @@ void RenderTextControl::paintPlaceholder(PaintInfo& paintInfo, int tx, int ty)
     paintInfo.context->setFillColor(placeholderStyle->visitedDependentColor(CSSPropertyColor), placeholderStyle->colorSpace());
     
     String placeholderText = static_cast<HTMLTextFormControlElement*>(node())->strippedPlaceholder();
-    TextRun textRun(placeholderText.characters(), placeholderText.length(), 0, 0, 0, !placeholderStyle->isLeftToRightDirection(), placeholderStyle->unicodeBidi() == Override, false, false);
+    TextRun textRun(placeholderText.characters(), placeholderText.length(), false, 0, 0, TextRun::AllowTrailingExpansion, !placeholderStyle->isLeftToRightDirection(), placeholderStyle->unicodeBidi() == Override, false, false);
     
     RenderBox* textRenderer = innerTextElement() ? innerTextElement()->renderBox() : 0;
     if (textRenderer) {
         IntPoint textPoint;
-        textPoint.setY(ty + textBlockInsetTop() + placeholderStyle->font().ascent());
+        textPoint.setY(ty + textBlockInsetTop() + placeholderStyle->fontMetrics().ascent());
         if (placeholderStyle->isLeftToRightDirection())
             textPoint.setX(tx + textBlockInsetLeft());
         else
diff --git a/Source/WebCore/rendering/RenderTextControlMultiLine.cpp b/Source/WebCore/rendering/RenderTextControlMultiLine.cpp
index d0b0cbc..cf32f68 100644
--- a/Source/WebCore/rendering/RenderTextControlMultiLine.cpp
+++ b/Source/WebCore/rendering/RenderTextControlMultiLine.cpp
@@ -41,7 +41,7 @@ RenderTextControlMultiLine::RenderTextControlMultiLine(Node* node, bool placehol
 
 RenderTextControlMultiLine::~RenderTextControlMultiLine()
 {
-    if (node())
+    if (node() && node()->inDocument())
         static_cast<HTMLTextAreaElement*>(node())->rendererWillBeDestroyed();
 }
 
diff --git a/Source/WebCore/rendering/RenderTextControlSingleLine.cpp b/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
index 95f209a..de8fb0d 100644
--- a/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -397,7 +397,7 @@ void RenderTextControlSingleLine::forwardEvent(Event* event)
 #endif
 
     FloatPoint localPoint = innerTextRenderer->absoluteToLocal(static_cast<MouseEvent*>(event)->absoluteLocation(), false, true);
-    int textRight = innerTextRenderer->borderBoxRect().right();
+    int textRight = innerTextRenderer->borderBoxRect().maxX();
 
     if (m_resultsButton && localPoint.x() < innerTextRenderer->borderBoxRect().x())
         m_resultsButton->defaultEventHandler(event);
@@ -564,9 +564,6 @@ int RenderTextControlSingleLine::preferredContentWidth(float charWidth) const
         result += cancelRenderer->borderLeft() + cancelRenderer->borderRight() +
                   cancelRenderer->paddingLeft() + cancelRenderer->paddingRight();
 
-    if (RenderBox* spinRenderer = m_innerSpinButton ? m_innerSpinButton->renderBox() : 0)
-        result += spinRenderer->minPreferredLogicalWidth();
-
 #if ENABLE(INPUT_SPEECH)
     if (RenderBox* speechRenderer = m_speechButton ? m_speechButton->renderBox() : 0) {
         result += speechRenderer->borderLeft() + speechRenderer->borderRight() +
@@ -618,17 +615,17 @@ void RenderTextControlSingleLine::createSubtreeIfNeeded()
 #if ENABLE(INPUT_SPEECH)
         if (inputElement()->isSpeechEnabled() && !m_speechButton) {
             // Create the speech button element.
-            m_speechButton = InputFieldSpeechButtonElement::create(static_cast<HTMLElement*>(node()));
+            m_speechButton = InputFieldSpeechButtonElement::create(toHTMLElement(node()));
             m_speechButton->attachInnerElement(node(), createSpeechButtonStyle(), renderArena());
         }
 #endif
         bool hasSpinButton = inputElement()->hasSpinButton();
         if (hasSpinButton && !m_innerSpinButton) {
-            m_innerSpinButton = SpinButtonElement::create(static_cast<HTMLElement*>(node()));
+            m_innerSpinButton = SpinButtonElement::create(toHTMLElement(node()));
             m_innerSpinButton->attachInnerElement(node(), createInnerSpinButtonStyle(), renderArena());
         }
         if (hasSpinButton && !m_outerSpinButton) {
-            m_outerSpinButton = SpinButtonElement::create(static_cast<HTMLElement*>(node()));
+            m_outerSpinButton = SpinButtonElement::create(toHTMLElement(node()));
             m_outerSpinButton->attachInnerElement(node(), createOuterSpinButtonStyle(), renderArena());
         }
         return;
@@ -636,18 +633,18 @@ void RenderTextControlSingleLine::createSubtreeIfNeeded()
 
     if (!m_innerBlock) {
         // Create the inner block element
-        m_innerBlock = TextControlInnerElement::create(static_cast<HTMLElement*>(node()));
+        m_innerBlock = TextControlInnerElement::create(toHTMLElement(node()));
         m_innerBlock->attachInnerElement(node(), createInnerBlockStyle(style()), renderArena());
     }
 #if ENABLE(INPUT_SPEECH)
     if (inputElement()->isSpeechEnabled() && !m_speechButton) {
         // Create the speech button element.
-        m_speechButton = InputFieldSpeechButtonElement::create(static_cast<HTMLElement*>(node()));
+        m_speechButton = InputFieldSpeechButtonElement::create(toHTMLElement(node()));
         m_speechButton->attachInnerElement(node(), createSpeechButtonStyle(), renderArena());
     }
 #endif
     if (inputElement()->hasSpinButton() && !m_outerSpinButton) {
-        m_outerSpinButton = SpinButtonElement::create(static_cast<HTMLElement*>(node()));
+        m_outerSpinButton = SpinButtonElement::create(toHTMLElement(node()));
         m_outerSpinButton->attachInnerElement(node(), createOuterSpinButtonStyle(), renderArena());
     }
 
@@ -687,7 +684,7 @@ void RenderTextControlSingleLine::updateFromElement()
             // flag is false. It protects an unacceptable renderer value from
             // being overwritten with the DOM value.
             if (!static_cast<HTMLInputElement*>(node())->formControlValueMatchesRenderer())
-                setInnerTextValue(inputElement()->value());
+                setInnerTextValue(inputElement()->visibleValue());
         }
     }
 
@@ -712,7 +709,7 @@ PassRefPtr<RenderStyle> RenderTextControlSingleLine::createInnerTextStyle(const
     textBlockStyle->setOverflowY(OHIDDEN);
 
     // Do not allow line-height to be smaller than our default.
-    if (textBlockStyle->font().lineSpacing() > lineHeight(true, HorizontalLine, PositionOfInteriorLineBoxes))
+    if (textBlockStyle->fontMetrics().lineSpacing() > lineHeight(true, HorizontalLine, PositionOfInteriorLineBoxes))
         textBlockStyle->setLineHeight(Length(-100.0f, Percent));
 
     WebCore::EDisplay display = (m_innerBlock || inputElement()->hasSpinButton() ? INLINE_BLOCK : BLOCK);
@@ -931,7 +928,7 @@ PopupMenuStyle RenderTextControlSingleLine::itemStyle(unsigned) const
 
 PopupMenuStyle RenderTextControlSingleLine::menuStyle() const
 {
-    return PopupMenuStyle(style()->visitedDependentColor(CSSPropertyColor), style()->visitedDependentColor(CSSPropertyBackgroundColor), style()->font(), style()->visibility() == VISIBLE, style()->display() == NONE, style()->textIndent(), style()->direction());
+    return PopupMenuStyle(style()->visitedDependentColor(CSSPropertyColor), style()->visitedDependentColor(CSSPropertyBackgroundColor), style()->font(), style()->visibility() == VISIBLE, style()->display() == NONE, style()->textIndent(), style()->direction(), style()->unicodeBidi() == Override);
 }
 
 int RenderTextControlSingleLine::clientInsetLeft() const
diff --git a/Source/WebCore/rendering/RenderTheme.h b/Source/WebCore/rendering/RenderTheme.h
index 13c69e6..e2b9c78 100644
--- a/Source/WebCore/rendering/RenderTheme.h
+++ b/Source/WebCore/rendering/RenderTheme.h
@@ -180,6 +180,7 @@ public:
     // Media controls
     virtual bool hitTestMediaControlPart(RenderObject*, const IntPoint& absPoint);
     virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
+    virtual bool usesMediaControlStatusDisplay() { return false; }
     virtual double mediaControlsFadeInDuration() { return 0.1; }
     virtual double mediaControlsFadeOutDuration() { return 0.3; }
     virtual String formatMediaControlsTime(float time) const;
@@ -194,6 +195,8 @@ public:
     virtual IntSize meterSizeForBounds(const RenderMeter*, const IntRect&) const;
     virtual bool supportsMeter(ControlPart, bool isHorizontal) const;
 #endif
+    
+    virtual bool shouldShowPlaceholderWhenFocused() const { return false; }
 
 protected:
     // The platform selection color.
diff --git a/Source/WebCore/rendering/RenderThemeChromiumMac.h b/Source/WebCore/rendering/RenderThemeChromiumMac.h
index d1875fc..80bbae4 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumMac.h
+++ b/Source/WebCore/rendering/RenderThemeChromiumMac.h
@@ -46,6 +46,7 @@ protected:
     virtual bool paintMediaVolumeSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
     virtual bool paintMediaVolumeSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
     virtual IntPoint volumeSliderOffsetFromMuteButton(Node*, const IntSize&) const;
+    virtual bool usesMediaControlStatusDisplay() { return false; }
 
 #endif
 
diff --git a/Source/WebCore/rendering/RenderThemeChromiumWin.cpp b/Source/WebCore/rendering/RenderThemeChromiumWin.cpp
index bba0520..d538050 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumWin.cpp
+++ b/Source/WebCore/rendering/RenderThemeChromiumWin.cpp
@@ -479,15 +479,15 @@ bool RenderThemeChromiumWin::paintMenuList(RenderObject* o, const PaintInfo& i,
     int spacingBottom = borderBottom + box->paddingBottom();
 
     int buttonX;
-    if (r.right() - r.x() < buttonWidth)
+    if (r.maxX() - r.x() < buttonWidth)
         buttonX = r.x();
     else
-        buttonX = o->style()->direction() == LTR ? r.right() - spacingRight - buttonWidth : r.x() + spacingLeft;
+        buttonX = o->style()->direction() == LTR ? r.maxX() - spacingRight - buttonWidth : r.x() + spacingLeft;
 
     // Compute the rectangle of the button in the destination image.
     IntRect rect(buttonX,
                  r.y() + spacingTop,
-                 std::min(buttonWidth, r.right() - r.x()),
+                 std::min(buttonWidth, r.maxX() - r.x()),
                  r.height() - (spacingTop + spacingBottom));
 
     // Get the correct theme data for a textfield and paint the menu.
diff --git a/Source/WebCore/rendering/RenderThemeMac.h b/Source/WebCore/rendering/RenderThemeMac.h
index 95661b8..9837c2a 100644
--- a/Source/WebCore/rendering/RenderThemeMac.h
+++ b/Source/WebCore/rendering/RenderThemeMac.h
@@ -164,9 +164,12 @@ protected:
     virtual String extraMediaControlsStyleSheet();
 
     virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
+    virtual bool usesMediaControlStatusDisplay();
     virtual void adjustMediaSliderThumbSize(RenderObject*) const;
     virtual IntPoint volumeSliderOffsetFromMuteButton(Node*, const IntSize&) const;
 #endif
+    
+    virtual bool shouldShowPlaceholderWhenFocused() const;
 
 private:
 
diff --git a/Source/WebCore/rendering/RenderThemeMac.mm b/Source/WebCore/rendering/RenderThemeMac.mm
index 605e958..e3c75c5 100644
--- a/Source/WebCore/rendering/RenderThemeMac.mm
+++ b/Source/WebCore/rendering/RenderThemeMac.mm
@@ -1041,20 +1041,20 @@ void RenderThemeMac::paintMenuListButtonGradients(RenderObject* o, const PaintIn
     FloatRect topGradient(r.x(), r.y(), r.width(), r.height() / 2.0f);
     struct CGFunctionCallbacks topCallbacks = { 0, TopGradientInterpolate, NULL };
     RetainPtr<CGFunctionRef> topFunction(AdoptCF, CGFunctionCreate(NULL, 1, NULL, 4, NULL, &topCallbacks));
-    RetainPtr<CGShadingRef> topShading(AdoptCF, CGShadingCreateAxial(cspace, CGPointMake(topGradient.x(), topGradient.y()), CGPointMake(topGradient.x(), topGradient.bottom()), topFunction.get(), false, false));
+    RetainPtr<CGShadingRef> topShading(AdoptCF, CGShadingCreateAxial(cspace, CGPointMake(topGradient.x(), topGradient.y()), CGPointMake(topGradient.x(), topGradient.maxY()), topFunction.get(), false, false));
 
     FloatRect bottomGradient(r.x() + radius, r.y() + r.height() / 2.0f, r.width() - 2.0f * radius, r.height() / 2.0f);
     struct CGFunctionCallbacks bottomCallbacks = { 0, BottomGradientInterpolate, NULL };
     RetainPtr<CGFunctionRef> bottomFunction(AdoptCF, CGFunctionCreate(NULL, 1, NULL, 4, NULL, &bottomCallbacks));
-    RetainPtr<CGShadingRef> bottomShading(AdoptCF, CGShadingCreateAxial(cspace, CGPointMake(bottomGradient.x(),  bottomGradient.y()), CGPointMake(bottomGradient.x(), bottomGradient.bottom()), bottomFunction.get(), false, false));
+    RetainPtr<CGShadingRef> bottomShading(AdoptCF, CGShadingCreateAxial(cspace, CGPointMake(bottomGradient.x(),  bottomGradient.y()), CGPointMake(bottomGradient.x(), bottomGradient.maxY()), bottomFunction.get(), false, false));
 
     struct CGFunctionCallbacks mainCallbacks = { 0, MainGradientInterpolate, NULL };
     RetainPtr<CGFunctionRef> mainFunction(AdoptCF, CGFunctionCreate(NULL, 1, NULL, 4, NULL, &mainCallbacks));
-    RetainPtr<CGShadingRef> mainShading(AdoptCF, CGShadingCreateAxial(cspace, CGPointMake(r.x(),  r.y()), CGPointMake(r.x(), r.bottom()), mainFunction.get(), false, false));
+    RetainPtr<CGShadingRef> mainShading(AdoptCF, CGShadingCreateAxial(cspace, CGPointMake(r.x(),  r.y()), CGPointMake(r.x(), r.maxY()), mainFunction.get(), false, false));
 
     RetainPtr<CGShadingRef> leftShading(AdoptCF, CGShadingCreateAxial(cspace, CGPointMake(r.x(),  r.y()), CGPointMake(r.x() + radius, r.y()), mainFunction.get(), false, false));
 
-    RetainPtr<CGShadingRef> rightShading(AdoptCF, CGShadingCreateAxial(cspace, CGPointMake(r.right(),  r.y()), CGPointMake(r.right() - radius, r.y()), mainFunction.get(), false, false));
+    RetainPtr<CGShadingRef> rightShading(AdoptCF, CGShadingCreateAxial(cspace, CGPointMake(r.maxX(),  r.y()), CGPointMake(r.maxX() - radius, r.y()), mainFunction.get(), false, false));
     paintInfo.context->save();
     CGContextClipToRect(context, r);
     paintInfo.context->addRoundedRectClip(border);
@@ -1099,7 +1099,7 @@ bool RenderThemeMac::paintMenuListButton(RenderObject* o, const PaintInfo& paint
     float centerY = bounds.y() + bounds.height() / 2.0f;
     float arrowHeight = baseArrowHeight * fontScale;
     float arrowWidth = baseArrowWidth * fontScale;
-    float leftEdge = bounds.right() - arrowPaddingRight * o->style()->effectiveZoom() - arrowWidth;
+    float leftEdge = bounds.maxX() - arrowPaddingRight * o->style()->effectiveZoom() - arrowWidth;
     float spaceBetweenArrows = baseSpaceBetweenArrows * fontScale;
 
     if (bounds.width() < arrowWidth + arrowPaddingLeft * o->style()->effectiveZoom())
@@ -1138,11 +1138,11 @@ bool RenderThemeMac::paintMenuListButton(RenderObject* o, const PaintInfo& paint
     paintInfo.context->setStrokeStyle(SolidStroke);
     paintInfo.context->setStrokeColor(leftSeparatorColor, ColorSpaceDeviceRGB);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator, bounds.y()),
-                                IntPoint(leftEdgeOfSeparator, bounds.bottom()));
+                                IntPoint(leftEdgeOfSeparator, bounds.maxY()));
 
     paintInfo.context->setStrokeColor(rightSeparatorColor, ColorSpaceDeviceRGB);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.y()),
-                                IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.bottom()));
+                                IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.maxY()));
 
     paintInfo.context->restore();
     return false;
@@ -1293,9 +1293,9 @@ bool RenderThemeMac::paintSliderTrack(RenderObject* o, const PaintInfo& paintInf
     RetainPtr<CGFunctionRef> mainFunction(AdoptCF, CGFunctionCreate(NULL, 1, NULL, 4, NULL, &mainCallbacks));
     RetainPtr<CGShadingRef> mainShading;
     if (o->style()->appearance() == SliderVerticalPart)
-        mainShading.adoptCF(CGShadingCreateAxial(cspace, CGPointMake(bounds.x(),  bounds.bottom()), CGPointMake(bounds.right(), bounds.bottom()), mainFunction.get(), false, false));
+        mainShading.adoptCF(CGShadingCreateAxial(cspace, CGPointMake(bounds.x(),  bounds.maxY()), CGPointMake(bounds.maxX(), bounds.maxY()), mainFunction.get(), false, false));
     else
-        mainShading.adoptCF(CGShadingCreateAxial(cspace, CGPointMake(bounds.x(),  bounds.y()), CGPointMake(bounds.x(), bounds.bottom()), mainFunction.get(), false, false));
+        mainShading.adoptCF(CGShadingCreateAxial(cspace, CGPointMake(bounds.x(),  bounds.y()), CGPointMake(bounds.x(), bounds.maxY()), mainFunction.get(), false, false));
 
     IntSize radius(trackRadius, trackRadius);
     paintInfo.context->addRoundedRectClip(RoundedIntRect(bounds, radius, radius, radius, radius));
@@ -1981,6 +1981,11 @@ bool RenderThemeMac::shouldRenderMediaControlPart(ControlPart part, Element* ele
     return RenderTheme::shouldRenderMediaControlPart(part, element);
 }
 
+bool RenderThemeMac::usesMediaControlStatusDisplay()
+{
+    return mediaControllerTheme() == MediaControllerThemeQuickTime;
+}
+
 IntPoint RenderThemeMac::volumeSliderOffsetFromMuteButton(Node* muteButton, const IntSize& size) const
 {
     static const int xOffset = -4;
@@ -1994,6 +1999,15 @@ IntPoint RenderThemeMac::volumeSliderOffsetFromMuteButton(Node* muteButton, cons
     return IntPoint(xOffset * zoomLevel, y);
 }
 
+bool RenderThemeMac::shouldShowPlaceholderWhenFocused() const
+{
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    return true;
+#else
+    return false;
+#endif
+}
+
 #endif // ENABLE(VIDEO)
 
 NSPopUpButtonCell* RenderThemeMac::popupButton() const
diff --git a/Source/WebCore/rendering/RenderThemeSafari.cpp b/Source/WebCore/rendering/RenderThemeSafari.cpp
index 47f627e..a2f9ed1 100644
--- a/Source/WebCore/rendering/RenderThemeSafari.cpp
+++ b/Source/WebCore/rendering/RenderThemeSafari.cpp
@@ -760,20 +760,20 @@ void RenderThemeSafari::paintMenuListButtonGradients(RenderObject* o, const Pain
     FloatRect topGradient(r.x(), r.y(), r.width(), r.height() / 2.0f);
     struct CGFunctionCallbacks topCallbacks = { 0, TopGradientInterpolate, NULL };
     RetainPtr<CGFunctionRef> topFunction(AdoptCF, CGFunctionCreate(NULL, 1, NULL, 4, NULL, &topCallbacks));
-    RetainPtr<CGShadingRef> topShading(AdoptCF, CGShadingCreateAxial(cspace, CGPointMake(topGradient.x(), topGradient.y()), CGPointMake(topGradient.x(), topGradient.bottom()), topFunction.get(), false, false));
+    RetainPtr<CGShadingRef> topShading(AdoptCF, CGShadingCreateAxial(cspace, CGPointMake(topGradient.x(), topGradient.y()), CGPointMake(topGradient.x(), topGradient.maxY()), topFunction.get(), false, false));
 
     FloatRect bottomGradient(r.x() + radius, r.y() + r.height() / 2.0f, r.width() - 2.0f * radius, r.height() / 2.0f);
     struct CGFunctionCallbacks bottomCallbacks = { 0, BottomGradientInterpolate, NULL };
     RetainPtr<CGFunctionRef> bottomFunction(AdoptCF, CGFunctionCreate(NULL, 1, NULL, 4, NULL, &bottomCallbacks));
-    RetainPtr<CGShadingRef> bottomShading(AdoptCF, CGShadingCreateAxial(cspace, CGPointMake(bottomGradient.x(),  bottomGradient.y()), CGPointMake(bottomGradient.x(), bottomGradient.bottom()), bottomFunction.get(), false, false));
+    RetainPtr<CGShadingRef> bottomShading(AdoptCF, CGShadingCreateAxial(cspace, CGPointMake(bottomGradient.x(),  bottomGradient.y()), CGPointMake(bottomGradient.x(), bottomGradient.maxY()), bottomFunction.get(), false, false));
 
     struct CGFunctionCallbacks mainCallbacks = { 0, MainGradientInterpolate, NULL };
     RetainPtr<CGFunctionRef> mainFunction(AdoptCF, CGFunctionCreate(NULL, 1, NULL, 4, NULL, &mainCallbacks));
-    RetainPtr<CGShadingRef> mainShading(AdoptCF, CGShadingCreateAxial(cspace, CGPointMake(r.x(),  r.y()), CGPointMake(r.x(), r.bottom()), mainFunction.get(), false, false));
+    RetainPtr<CGShadingRef> mainShading(AdoptCF, CGShadingCreateAxial(cspace, CGPointMake(r.x(),  r.y()), CGPointMake(r.x(), r.maxY()), mainFunction.get(), false, false));
 
     RetainPtr<CGShadingRef> leftShading(AdoptCF, CGShadingCreateAxial(cspace, CGPointMake(r.x(),  r.y()), CGPointMake(r.x() + radius, r.y()), mainFunction.get(), false, false));
 
-    RetainPtr<CGShadingRef> rightShading(AdoptCF, CGShadingCreateAxial(cspace, CGPointMake(r.right(),  r.y()), CGPointMake(r.right() - radius, r.y()), mainFunction.get(), false, false));
+    RetainPtr<CGShadingRef> rightShading(AdoptCF, CGShadingCreateAxial(cspace, CGPointMake(r.maxX(),  r.y()), CGPointMake(r.maxX() - radius, r.y()), mainFunction.get(), false, false));
     paintInfo.context->save();
     CGContextClipToRect(context, bound.rect());
     paintInfo.context->addRoundedRectClip(bound);
@@ -818,7 +818,7 @@ bool RenderThemeSafari::paintMenuListButton(RenderObject* o, const PaintInfo& pa
     float centerY = bounds.y() + bounds.height() / 2.0f;
     float arrowHeight = baseArrowHeight * fontScale;
     float arrowWidth = baseArrowWidth * fontScale;
-    float leftEdge = bounds.right() - arrowPaddingRight - arrowWidth;
+    float leftEdge = bounds.maxX() - arrowPaddingRight - arrowWidth;
 
     if (bounds.width() < arrowWidth + arrowPaddingLeft)
         return false;
@@ -848,11 +848,11 @@ bool RenderThemeSafari::paintMenuListButton(RenderObject* o, const PaintInfo& pa
     paintInfo.context->setStrokeStyle(SolidStroke);
     paintInfo.context->setStrokeColor(leftSeparatorColor, ColorSpaceDeviceRGB);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator, bounds.y()),
-                                IntPoint(leftEdgeOfSeparator, bounds.bottom()));
+                                IntPoint(leftEdgeOfSeparator, bounds.maxY()));
 
     paintInfo.context->setStrokeColor(rightSeparatorColor, ColorSpaceDeviceRGB);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.y()),
-                                IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.bottom()));
+                                IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.maxY()));
 
     paintInfo.context->restore();
     return false;
@@ -976,9 +976,9 @@ bool RenderThemeSafari::paintSliderTrack(RenderObject* o, const PaintInfo& paint
     RetainPtr<CGFunctionRef> mainFunction(AdoptCF, CGFunctionCreate(NULL, 1, NULL, 4, NULL, &mainCallbacks));
     RetainPtr<CGShadingRef> mainShading;
     if (o->style()->appearance() == SliderVerticalPart)
-        mainShading.adoptCF(CGShadingCreateAxial(cspace, CGPointMake(bounds.rect().x(),  bounds.rect().bottom()), CGPointMake(bounds.rect().right(), bounds.rect().bottom()), mainFunction.get(), false, false));
+        mainShading.adoptCF(CGShadingCreateAxial(cspace, CGPointMake(bounds.rect().x(),  bounds.rect().maxY()), CGPointMake(bounds.rect().maxX(), bounds.rect().maxY()), mainFunction.get(), false, false));
     else
-        mainShading.adoptCF(CGShadingCreateAxial(cspace, CGPointMake(bounds.rect().x(),  bounds.rect().y()), CGPointMake(bounds.rect().x(), bounds.rect().bottom()), mainFunction.get(), false, false));
+        mainShading.adoptCF(CGShadingCreateAxial(cspace, CGPointMake(bounds.rect().x(),  bounds.rect().y()), CGPointMake(bounds.rect().x(), bounds.rect().maxY()), mainFunction.get(), false, false));
 
     paintInfo.context->addRoundedRectClip(bounds);
     CGContextDrawShading(context, mainShading.get());
diff --git a/Source/WebCore/rendering/RenderThemeWin.cpp b/Source/WebCore/rendering/RenderThemeWin.cpp
index f0f8268..5581db8 100644
--- a/Source/WebCore/rendering/RenderThemeWin.cpp
+++ b/Source/WebCore/rendering/RenderThemeWin.cpp
@@ -27,6 +27,7 @@
 #include "Frame.h"
 #include "GraphicsContext.h"
 #include "LocalWindowsContext.h"
+#include "PaintInfo.h"
 #include "RenderSlider.h"
 #include "Settings.h"
 #include "SoftLinking.h"
@@ -694,7 +695,7 @@ bool RenderThemeWin::paintInnerSpinButton(RenderObject* o, const PaintInfo& i, c
     IntRect upRect(r);
     upRect.setHeight(r.height() / 2);
     IntRect downRect(r);
-    downRect.setY(upRect.bottom());
+    downRect.setY(upRect.maxY());
     downRect.setHeight(r.height() - upRect.height());
     drawControl(i.context, o, spinButtonTheme(), getThemeData(o, SpinButtonUp), upRect);
     drawControl(i.context, o, spinButtonTheme(), getThemeData(o, SpinButtonDown), downRect);
@@ -769,7 +770,7 @@ void RenderThemeWin::adjustMenuListButtonStyle(CSSStyleSelector* selector, Rende
     style->setHeight(Length(Auto));
 
     // Calculate our min-height
-    int minHeight = style->font().height();
+    int minHeight = style->fontMetrics().height();
     minHeight = max(minHeight, dropDownBoxMinHeight);
 
     style->setMinHeight(Length(minHeight, Fixed));
@@ -788,7 +789,7 @@ bool RenderThemeWin::paintMenuListButton(RenderObject* o, const PaintInfo& i, co
     IntRect buttonRect(r);
     buttonRect.inflate(-borderThickness);
     if (o->style()->direction() == LTR)
-        buttonRect.setX(buttonRect.right() - dropDownButtonWidth);
+        buttonRect.setX(buttonRect.maxX() - dropDownButtonWidth);
     buttonRect.setWidth(dropDownButtonWidth);
 
     if (isRunningOnVistaOrLater()) {
diff --git a/Source/WebCore/rendering/RenderThemeWinCE.cpp b/Source/WebCore/rendering/RenderThemeWinCE.cpp
index d4bff96..a56ab3e 100644
--- a/Source/WebCore/rendering/RenderThemeWinCE.cpp
+++ b/Source/WebCore/rendering/RenderThemeWinCE.cpp
@@ -250,7 +250,7 @@ bool RenderThemeWinCE::paintMenuList(RenderObject* o, const PaintInfo& i, const
 
 bool RenderThemeWinCE::paintMenuListButton(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
-    IntRect buttonRect(r.right() - dropDownButtonWidth - 1, r.y(), dropDownButtonWidth, r.height());
+    IntRect buttonRect(r.maxX() - dropDownButtonWidth - 1, r.y(), dropDownButtonWidth, r.height());
     buttonRect.inflateY(-1);
     i.context->drawFrameControl(buttonRect, DFC_SCROLL, DFCS_SCROLLCOMBOBOX | determineClassicState(o));
     return true;
@@ -386,7 +386,7 @@ bool RenderThemeWinCE::paintSearchFieldCancelButton(RenderObject* o, const Paint
     IntRect xBounds(cancelBounds.location() + IntSize(3, 3), xSize);
     paintInfo.context->setStrokeColor(Color::white, ColorSpaceDeviceRGB);
     paintInfo.context->drawLine(xBounds.location(),  xBounds.location() + xBounds.size());
-    paintInfo.context->drawLine(IntPoint(xBounds.right(), xBounds.y()),  IntPoint(xBounds.x(), xBounds.bottom()));
+    paintInfo.context->drawLine(IntPoint(xBounds.maxX(), xBounds.y()),  IntPoint(xBounds.x(), xBounds.maxY()));
 
     paintInfo.context->restore();
     return false;
@@ -452,7 +452,7 @@ void RenderThemeWinCE::adjustMenuListButtonStyle(CSSStyleSelector* selector, Ren
     style->setHeight(Length(Auto));
 
     // Calculate our min-height
-    int minHeight = style->font().height();
+    int minHeight = style->fontMetrics().height();
     minHeight = max(minHeight, dropDownBoxMinHeight);
 
     style->setMinHeight(Length(minHeight, Fixed));
@@ -489,7 +489,7 @@ static HTMLMediaElement* mediaElementParent(Node* node)
 bool RenderThemeWinCE::paintSliderTrack(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     bool rc = RenderTheme::paintSliderTrack(o, i, r);
-    IntPoint left = IntPoint(r.x() + 2, (r.y() + r.bottom()) / 2);
+    IntPoint left = IntPoint(r.x() + 2, (r.y() + r.maxY()) / 2);
     i.context->save();
     i.context->setStrokeColor(Color::gray, ColorSpaceDeviceRGB);
     i.context->setFillColor(Color::gray, ColorSpaceDeviceRGB);
@@ -498,13 +498,13 @@ bool RenderThemeWinCE::paintSliderTrack(RenderObject* o, const PaintInfo& i, con
     HTMLMediaElement* mediaElement = mediaElementParent(o->node());
     if (mediaElement) {
         i.context->setStrokeColor(Color(0, 0xff, 0));
-        IntPoint right = IntPoint(left.x() + mediaElement->percentLoaded() * (r.right() - r.x() - 4), (r.y() + r.bottom()) / 2);
+        IntPoint right = IntPoint(left.x() + mediaElement->percentLoaded() * (r.maxX() - r.x() - 4), (r.y() + r.maxY()) / 2);
         i.context->drawLine(left, right);
         left = right;
     }
 #endif
     i.context->setStrokeColor(Color::black, ColorSpaceDeviceRGB);
-    i.context->drawLine(left, IntPoint(r.right() - 2, left.y()));
+    i.context->drawLine(left, IntPoint(r.maxX() - 2, left.y()));
     i.context->restore();
     return rc;
 }
@@ -566,14 +566,14 @@ bool RenderThemeWinCE::paintMediaMuteButton(RenderObject* o, const PaintInfo& pa
     FloatPoint pts[6] = {
         FloatPoint(imRect.x() + 1, imRect.y() + imRect.height() / 3.0),
         FloatPoint(imRect.x() + 1 + imRect.width() / 2.0, imRect.y() + imRect.height() / 3.0),
-        FloatPoint(imRect.right() - 1, imRect.y()),
-        FloatPoint(imRect.right() - 1, imRect.bottom()),
+        FloatPoint(imRect.maxX() - 1, imRect.y()),
+        FloatPoint(imRect.maxX() - 1, imRect.maxY()),
         FloatPoint(imRect.x() + 1 + imRect.width() / 2.0, imRect.y() + 2.0 * imRect.height() / 3.0),
         FloatPoint(imRect.x() + 1, imRect.y() + 2.0 * imRect.height() / 3.0)
     };
     paintInfo.context->drawConvexPolygon(6, pts);
     if (muted)
-        paintInfo.context->drawLine(IntPoint(imRect.right(), imRect.y()), IntPoint(imRect.x(), imRect.bottom()));
+        paintInfo.context->drawLine(IntPoint(imRect.maxX(), imRect.y()), IntPoint(imRect.x(), imRect.maxY()));
     paintInfo.context->restore();
     return rc;
 }
@@ -595,7 +595,7 @@ bool RenderThemeWinCE::paintMediaPlayButton(RenderObject* o, const PaintInfo& pa
         imRect.move(2.0 * width / 3.0, 0);
         paintInfo.context->fillRect(imRect);
     } else {
-        FloatPoint pts[3] = { FloatPoint(imRect.x(), imRect.y()), FloatPoint(imRect.right(), (imRect.y() + imRect.bottom()) / 2.0), FloatPoint(imRect.x(), imRect.bottom()) };
+        FloatPoint pts[3] = { FloatPoint(imRect.x(), imRect.y()), FloatPoint(imRect.maxX(), (imRect.y() + imRect.maxY()) / 2.0), FloatPoint(imRect.x(), imRect.maxY()) };
         paintInfo.context->drawConvexPolygon(3, pts);
     }
     paintInfo.context->restore();
@@ -607,8 +607,8 @@ bool RenderThemeWinCE::paintMediaSeekBackButton(RenderObject* o, const PaintInfo
     bool rc = paintButton(o, paintInfo, r);
     FloatRect imRect = r;
     imRect.inflate(-3);
-    FloatPoint pts[3] = { FloatPoint((imRect.x() + imRect.right()) / 2.0, imRect.y()), FloatPoint(imRect.x(), (imRect.y() + imRect.bottom()) / 2.0), FloatPoint((imRect.x() + imRect.right()) / 2.0, imRect.bottom()) };
-    FloatPoint pts2[3] = { FloatPoint(imRect.right(), imRect.y()), FloatPoint((imRect.x() + imRect.right()) / 2.0, (imRect.y() + imRect.bottom()) / 2.0), FloatPoint(imRect.right(), imRect.bottom()) };
+    FloatPoint pts[3] = { FloatPoint((imRect.x() + imRect.maxX()) / 2.0, imRect.y()), FloatPoint(imRect.x(), (imRect.y() + imRect.maxY()) / 2.0), FloatPoint((imRect.x() + imRect.maxX()) / 2.0, imRect.maxY()) };
+    FloatPoint pts2[3] = { FloatPoint(imRect.maxX(), imRect.y()), FloatPoint((imRect.x() + imRect.maxX()) / 2.0, (imRect.y() + imRect.maxY()) / 2.0), FloatPoint(imRect.maxX(), imRect.maxY()) };
     paintInfo.context->save();
     paintInfo.context->setStrokeColor(Color::black);
     paintInfo.context->setFillColor(Color::black);
@@ -623,8 +623,8 @@ bool RenderThemeWinCE::paintMediaSeekForwardButton(RenderObject* o, const PaintI
     bool rc = paintButton(o, paintInfo, r);
     FloatRect imRect = r;
     imRect.inflate(-3);
-    FloatPoint pts[3] = { FloatPoint(imRect.x(), imRect.y()), FloatPoint((imRect.x() + imRect.right()) / 2.0, (imRect.y() + imRect.bottom()) / 2.0), FloatPoint(imRect.x(), imRect.bottom()) };
-    FloatPoint pts2[3] = { FloatPoint((imRect.x() + imRect.right()) / 2.0, imRect.y()), FloatPoint(imRect.right(), (imRect.y() + imRect.bottom()) / 2.0), FloatPoint((imRect.x() + imRect.right()) / 2.0, imRect.bottom()) };
+    FloatPoint pts[3] = { FloatPoint(imRect.x(), imRect.y()), FloatPoint((imRect.x() + imRect.maxX()) / 2.0, (imRect.y() + imRect.maxY()) / 2.0), FloatPoint(imRect.x(), imRect.maxY()) };
+    FloatPoint pts2[3] = { FloatPoint((imRect.x() + imRect.maxX()) / 2.0, imRect.y()), FloatPoint(imRect.maxX(), (imRect.y() + imRect.maxY()) / 2.0), FloatPoint((imRect.x() + imRect.maxX()) / 2.0, imRect.maxY()) };
     paintInfo.context->save();
     paintInfo.context->setStrokeColor(Color::black);
     paintInfo.context->setFillColor(Color::black);
diff --git a/Source/WebCore/rendering/RenderTreeAsText.cpp b/Source/WebCore/rendering/RenderTreeAsText.cpp
index 2e64999..a81163b 100644
--- a/Source/WebCore/rendering/RenderTreeAsText.cpp
+++ b/Source/WebCore/rendering/RenderTreeAsText.cpp
@@ -27,7 +27,6 @@
 #include "RenderTreeAsText.h"
 
 #include "CSSMutableStyleDeclaration.h"
-#include "CharacterNames.h"
 #include "Document.h"
 #include "Frame.h"
 #include "FrameView.h"
@@ -48,6 +47,7 @@
 #include "SelectionController.h"
 #include <wtf/UnusedParam.h>
 #include <wtf/Vector.h>
+#include <wtf/unicode/CharacterNames.h>
 
 #if ENABLE(SVG)
 #include "RenderSVGContainer.h"
@@ -621,10 +621,10 @@ static void writeLayers(TextStream& ts, const RenderLayer* rootLayer, RenderLaye
     // FIXME: Apply overflow to the root layer to not break every test.  Complete hack.  Sigh.
     IntRect paintDirtyRect(paintRect);
     if (rootLayer == l) {
-        paintDirtyRect.setWidth(max(paintDirtyRect.width(), rootLayer->renderBox()->rightLayoutOverflow()));
-        paintDirtyRect.setHeight(max(paintDirtyRect.height(), rootLayer->renderBox()->bottomLayoutOverflow()));
-        l->setWidth(max(l->width(), l->renderBox()->rightLayoutOverflow()));
-        l->setHeight(max(l->height(), l->renderBox()->bottomLayoutOverflow()));
+        paintDirtyRect.setWidth(max(paintDirtyRect.width(), rootLayer->renderBox()->maxXLayoutOverflow()));
+        paintDirtyRect.setHeight(max(paintDirtyRect.height(), rootLayer->renderBox()->maxYLayoutOverflow()));
+        l->setWidth(max(l->width(), l->renderBox()->maxXLayoutOverflow()));
+        l->setHeight(max(l->height(), l->renderBox()->maxYLayoutOverflow()));
     }
     
     // Calculate the clip rects we should use.
@@ -769,13 +769,12 @@ String counterValueForElement(Element* element)
     element->document()->updateLayout();
     TextStream stream;
     bool isFirstCounter = true;
-    // The counter renderers should be children of anonymous children
-    // (i.e., :before or :after pseudo-elements).
+    // The counter renderers should be children of :before or :after pseudo-elements.
     if (RenderObject* renderer = element->renderer()) {
-        for (RenderObject* child = renderer->firstChild(); child; child = child->nextSibling()) {
-            if (child->isAnonymous())
-                writeCounterValuesFromChildren(stream, child, isFirstCounter);
-        }
+        if (RenderObject* pseudoElement = renderer->beforePseudoElementRenderer())
+            writeCounterValuesFromChildren(stream, pseudoElement, isFirstCounter);
+        if (RenderObject* pseudoElement = renderer->afterPseudoElementRenderer())
+            writeCounterValuesFromChildren(stream, pseudoElement, isFirstCounter);
     }
     return stream.release();
 }
diff --git a/Source/WebCore/rendering/RenderVideo.cpp b/Source/WebCore/rendering/RenderVideo.cpp
index 0f3b551..1ae736b 100644
--- a/Source/WebCore/rendering/RenderVideo.cpp
+++ b/Source/WebCore/rendering/RenderVideo.cpp
@@ -56,7 +56,7 @@ RenderVideo::RenderVideo(HTMLVideoElement* video)
 
 RenderVideo::~RenderVideo()
 {
-    if (MediaPlayer* p = player()) {
+    if (MediaPlayer* p = mediaElement()->player()) {
         p->setVisible(false);
         p->setFrameView(0);
     }
@@ -108,9 +108,9 @@ IntSize RenderVideo::calculateIntrinsicSize()
     // The intrinsic height of a video element's playback area is the intrinsic height 
     // of the video resource, if that is available; otherwise it is the intrinsic 
     // height of the poster frame, if that is available; otherwise it is 150 CSS pixels.
-    
-    if (player() && video->readyState() >= HTMLVideoElement::HAVE_METADATA)
-        return player()->naturalSize();
+    MediaPlayer* player = mediaElement()->player();
+    if (player && video->readyState() >= HTMLVideoElement::HAVE_METADATA)
+        return player->naturalSize();
 
     if (video->shouldDisplayPosterImage() && !m_cachedImageSize.isEmpty() && !imageResource()->errorOccurred())
         return m_cachedImageSize;
@@ -186,7 +186,7 @@ bool RenderVideo::shouldDisplayVideo() const
 
 void RenderVideo::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
 {
-    MediaPlayer* mediaPlayer = player();
+    MediaPlayer* mediaPlayer = mediaElement()->player();
     bool displayingPoster = videoElement()->shouldDisplayPosterImage();
 
     if (!displayingPoster) {
@@ -228,7 +228,7 @@ void RenderVideo::updatePlayer()
 {
     updateIntrinsicSize();
 
-    MediaPlayer* mediaPlayer = player();
+    MediaPlayer* mediaPlayer = mediaElement()->player();
     if (!mediaPlayer)
         return;
 
@@ -265,7 +265,7 @@ int RenderVideo::minimumReplacedHeight() const
 #if USE(ACCELERATED_COMPOSITING)
 bool RenderVideo::supportsAcceleratedRendering() const
 {
-    MediaPlayer* p = player();
+    MediaPlayer* p = mediaElement()->player();
     if (p)
         return p->supportsAcceleratedRendering();
 
@@ -274,7 +274,7 @@ bool RenderVideo::supportsAcceleratedRendering() const
 
 void RenderVideo::acceleratedRenderingStateChanged()
 {
-    MediaPlayer* p = player();
+    MediaPlayer* p = mediaElement()->player();
     if (p)
         p->acceleratedRenderingStateChanged();
 }
diff --git a/Source/WebCore/rendering/RenderView.cpp b/Source/WebCore/rendering/RenderView.cpp
index 687ba85..2fd441d 100644
--- a/Source/WebCore/rendering/RenderView.cpp
+++ b/Source/WebCore/rendering/RenderView.cpp
@@ -116,7 +116,7 @@ void RenderView::layout()
         setPageLogicalHeight(0);
 
     if (printing())
-        m_minPreferredLogicalWidth = m_maxPreferredLogicalWidth = width();
+        m_minPreferredLogicalWidth = m_maxPreferredLogicalWidth = logicalWidth();
 
     // Use calcWidth/Height to get the new width/height, since this will take the full page zoom factor into account.
     bool relayoutChildren = !printing() && (!m_frameView || width() != viewWidth() || height() != viewHeight());
@@ -160,13 +160,13 @@ void RenderView::mapLocalToContainer(RenderBoxModelObject* repaintContainer, boo
     }
     
     if (fixed && m_frameView)
-        transformState.move(m_frameView->scrollOffset());
+        transformState.move(m_frameView->scrollOffsetForFixedPosition());
 }
 
 void RenderView::mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState& transformState) const
 {
     if (fixed && m_frameView)
-        transformState.move(-m_frameView->scrollOffset());
+        transformState.move(-m_frameView->scrollOffsetForFixedPosition());
 
     if (useTransforms && shouldUseTransformFromContainer(0)) {
         TransformationMatrix t;
@@ -315,13 +315,13 @@ void RenderView::computeRectForRepaint(RenderBoxModelObject* repaintContainer, I
         // We have to flip by hand since the view's logical height has not been determined.  We
         // can use the viewport width and height.
         if (style()->isHorizontalWritingMode())
-            rect.setY(viewHeight() - rect.bottom());
+            rect.setY(viewHeight() - rect.maxY());
         else
-            rect.setX(viewWidth() - rect.right());
+            rect.setX(viewWidth() - rect.maxX());
     }
 
     if (fixed && m_frameView)
-        rect.move(m_frameView->scrollX(), m_frameView->scrollY());
+        rect.move(m_frameView->scrollXForFixedPosition(), m_frameView->scrollYForFixedPosition());
         
     // Apply our transform if we have one (because of full page zooming).
     if (m_layer && m_layer->transform())
@@ -662,7 +662,7 @@ IntRect RenderView::viewRect() const
 
 int RenderView::docTop() const
 {
-    IntRect overflowRect(0, topLayoutOverflow(), 0, bottomLayoutOverflow() - topLayoutOverflow());
+    IntRect overflowRect(0, minYLayoutOverflow(), 0, maxYLayoutOverflow() - minYLayoutOverflow());
     flipForWritingMode(overflowRect);
     if (hasTransform())
         overflowRect = layer()->currentTransform().mapRect(overflowRect);
@@ -675,7 +675,7 @@ int RenderView::docBottom() const
     flipForWritingMode(overflowRect);
     if (hasTransform())
         overflowRect = layer()->currentTransform().mapRect(overflowRect);
-    return overflowRect.bottom();
+    return overflowRect.maxY();
 }
 
 int RenderView::docLeft() const
@@ -693,7 +693,7 @@ int RenderView::docRight() const
     flipForWritingMode(overflowRect);
     if (hasTransform())
         overflowRect = layer()->currentTransform().mapRect(overflowRect);
-    return overflowRect.right();
+    return overflowRect.maxX();
 }
 
 int RenderView::viewHeight() const
diff --git a/Source/WebCore/rendering/RenderWidget.cpp b/Source/WebCore/rendering/RenderWidget.cpp
index d4b8ba6..13b572d 100644
--- a/Source/WebCore/rendering/RenderWidget.cpp
+++ b/Source/WebCore/rendering/RenderWidget.cpp
@@ -120,8 +120,6 @@ void RenderWidget::destroy()
     if (RenderView* v = view())
         v->removeWidget(this);
 
-    if (m_hasCounterNodeMap)
-        RenderCounter::destroyCounterNodes(this);
     
     if (AXObjectCache::accessibilityEnabled()) {
         document()->axObjectCache()->childrenChanged(this->parent());
@@ -129,6 +127,9 @@ void RenderWidget::destroy()
     }
     remove();
 
+    if (m_hasCounterNodeMap)
+        RenderCounter::destroyCounterNodes(this);
+
     setWidget(0);
 
     // removes from override size map
diff --git a/Source/WebCore/rendering/RenderingAllInOne.cpp b/Source/WebCore/rendering/RenderingAllInOne.cpp
index faa3566..760f02d 100644
--- a/Source/WebCore/rendering/RenderingAllInOne.cpp
+++ b/Source/WebCore/rendering/RenderingAllInOne.cpp
@@ -45,6 +45,7 @@
 #include "RenderBox.cpp"
 #include "RenderBoxModelObject.cpp"
 #include "RenderButton.cpp"
+#include "RenderCombineText.cpp"
 #include "RenderCounter.cpp"
 #include "RenderDataGrid.cpp"
 #include "RenderDetails.cpp"
diff --git a/Source/WebCore/rendering/RootInlineBox.cpp b/Source/WebCore/rendering/RootInlineBox.cpp
index e9e2029..aa87683 100644
--- a/Source/WebCore/rendering/RootInlineBox.cpp
+++ b/Source/WebCore/rendering/RootInlineBox.cpp
@@ -544,14 +544,14 @@ IntRect RootInlineBox::paddedLayoutOverflowRect(int endPadding) const
     
     if (isHorizontal()) {
         if (isLeftToRightDirection())
-            lineLayoutOverflow.shiftRightEdgeTo(max(lineLayoutOverflow.right(), logicalRight() + endPadding));
+            lineLayoutOverflow.shiftMaxXEdgeTo(max(lineLayoutOverflow.maxX(), logicalRight() + endPadding));
         else
-            lineLayoutOverflow.shiftLeftEdgeTo(min(lineLayoutOverflow.x(), logicalLeft() - endPadding));
+            lineLayoutOverflow.shiftXEdgeTo(min(lineLayoutOverflow.x(), logicalLeft() - endPadding));
     } else {
         if (isLeftToRightDirection())
-            lineLayoutOverflow.shiftBottomEdgeTo(max(lineLayoutOverflow.bottom(), logicalRight() + endPadding));
+            lineLayoutOverflow.shiftMaxYEdgeTo(max(lineLayoutOverflow.maxY(), logicalRight() + endPadding));
         else
-            lineLayoutOverflow.shiftTopEdgeTo(min(lineLayoutOverflow.y(), logicalRight() - endPadding));
+            lineLayoutOverflow.shiftYEdgeTo(min(lineLayoutOverflow.y(), logicalRight() - endPadding));
     }
     
     return lineLayoutOverflow;
diff --git a/Source/WebCore/rendering/ShadowElement.cpp b/Source/WebCore/rendering/ShadowElement.cpp
index e1b247c..5b1a962 100644
--- a/Source/WebCore/rendering/ShadowElement.cpp
+++ b/Source/WebCore/rendering/ShadowElement.cpp
@@ -114,7 +114,7 @@ PassRefPtr<ShadowInputElement> ShadowInputElement::create(HTMLElement* shadowPar
 }
 
 ShadowInputElement::ShadowInputElement(HTMLElement* shadowParent)
-    : ShadowElement<HTMLInputElement>(inputTag, shadowParent)
+    : ShadowElement<HTMLInputElement>(inputTag, shadowParent, 0, false)
 {
 }
 
diff --git a/Source/WebCore/rendering/ShadowElement.h b/Source/WebCore/rendering/ShadowElement.h
index 8bcb34e..9a5d118 100644
--- a/Source/WebCore/rendering/ShadowElement.h
+++ b/Source/WebCore/rendering/ShadowElement.h
@@ -43,6 +43,12 @@ protected:
         BaseElement::setShadowHost(shadowParent);
     }
 
+    ShadowElement(const QualifiedName& name, HTMLElement* shadowParent, HTMLFormElement* form, bool createdByParser)
+        : BaseElement(name, shadowParent->document(), form, createdByParser)
+    {
+        BaseElement::setShadowHost(shadowParent);
+    }
+
 public:
     virtual void detach();
 };
diff --git a/Source/WebCore/rendering/TextControlInnerElements.cpp b/Source/WebCore/rendering/TextControlInnerElements.cpp
index 7b1b36f..1162999 100644
--- a/Source/WebCore/rendering/TextControlInnerElements.cpp
+++ b/Source/WebCore/rendering/TextControlInnerElements.cpp
@@ -77,7 +77,6 @@ VisiblePosition RenderTextControlInnerBlock::positionForPoint(const IntPoint& po
 
 TextControlInnerElement::TextControlInnerElement(Document* document, HTMLElement* shadowParent)
     : HTMLDivElement(divTag, document)
-    , m_shadowParent(shadowParent)
 {
     setShadowHost(shadowParent);
 }
@@ -220,7 +219,7 @@ void SearchFieldCancelButtonElement::detach()
 void SearchFieldCancelButtonElement::defaultEventHandler(Event* event)
 {
     // If the element is visible, on mouseup, clear the value, and set selection
-    HTMLInputElement* input = static_cast<HTMLInputElement*>(shadowAncestorNode());
+    RefPtr<HTMLInputElement> input(static_cast<HTMLInputElement*>(shadowAncestorNode()));
     if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
         if (renderer() && renderer()->visibleToHitTesting()) {
             if (Frame* frame = document()->frame()) {
@@ -233,13 +232,12 @@ void SearchFieldCancelButtonElement::defaultEventHandler(Event* event)
         event->setDefaultHandled();
     }
     if (event->type() == eventNames().mouseupEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
-        if (m_capturing && renderer() && renderer()->visibleToHitTesting()) {
+        if (m_capturing) {
             if (Frame* frame = document()->frame()) {
                 frame->eventHandler()->setCapturingMouseEventsNode(0);
                 m_capturing = false;
             }
             if (hovered()) {
-                RefPtr<HTMLInputElement> protector(input);
                 String oldValue = input->value();
                 input->setValue("");
                 if (!oldValue.isEmpty()) {
@@ -272,6 +270,18 @@ PassRefPtr<SpinButtonElement> SpinButtonElement::create(HTMLElement* shadowParen
     return adoptRef(new SpinButtonElement(shadowParent));
 }
 
+void SpinButtonElement::detach()
+{
+    stopRepeatingTimer();
+    if (m_capturing) {
+        if (Frame* frame = document()->frame()) {
+            frame->eventHandler()->setCapturingMouseEventsNode(0);
+            m_capturing = false;
+        }
+    }
+    TextControlInnerElement::detach();
+}
+
 void SpinButtonElement::defaultEventHandler(Event* event)
 {
     if (!event->isMouseEvent()) {
@@ -287,7 +297,7 @@ void SpinButtonElement::defaultEventHandler(Event* event)
         return;
     }
 
-    HTMLInputElement* input = static_cast<HTMLInputElement*>(shadowAncestorNode());
+    RefPtr<HTMLInputElement> input(static_cast<HTMLInputElement*>(shadowAncestorNode()));
     if (input->disabled() || input->isReadOnlyFormControl()) {
         if (!event->defaultHandled())
             HTMLDivElement::defaultEventHandler(event);
@@ -298,12 +308,18 @@ void SpinButtonElement::defaultEventHandler(Event* event)
     IntPoint local = roundedIntPoint(box->absoluteToLocal(mouseEvent->absoluteLocation(), false, true));
     if (mouseEvent->type() == eventNames().mousedownEvent && mouseEvent->button() == LeftButton) {
         if (box->borderBoxRect().contains(local)) {
-            RefPtr<Node> protector(input);
+            // The following functions of HTMLInputElement may run JavaScript
+            // code which detaches this shadow node. We need to take a reference
+            // and check renderer() after such function calls.
+            RefPtr<Node> protector(this);
             input->focus();
             input->select();
-            input->stepUpFromRenderer(m_upDownState == Up ? 1 : -1);
+            if (renderer()) {
+                input->stepUpFromRenderer(m_upDownState == Up ? 1 : -1);
+                if (renderer())
+                    startRepeatingTimer();
+            }
             event->setDefaultHandled();
-            startRepeatingTimer();
         }
     } else if (mouseEvent->type() == eventNames().mouseupEvent && mouseEvent->button() == LeftButton)
         stopRepeatingTimer();
@@ -404,8 +420,12 @@ void InputFieldSpeechButtonElement::defaultEventHandler(Event* event)
         return;
     }
 
+    // The call to focus() below dispatches a focus event, and an event handler in the page might
+    // remove the input element from DOM. To make sure it remains valid until we finish our work
+    // here, we take a temporary reference.
+    RefPtr<HTMLInputElement> input(static_cast<HTMLInputElement*>(shadowAncestorNode()));
+
     // On mouse down, select the text and set focus.
-    HTMLInputElement* input = static_cast<HTMLInputElement*>(shadowAncestorNode());
     if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
         if (renderer() && renderer()->visibleToHitTesting()) {
             if (Frame* frame = document()->frame()) {
@@ -413,10 +433,6 @@ void InputFieldSpeechButtonElement::defaultEventHandler(Event* event)
                 m_capturing = true;
             }
         }
-        // The call to focus() below dispatches a focus event, and an event handler in the page might
-        // remove the input element from DOM. To make sure it remains valid until we finish our work
-        // here, we take a temporary reference.
-        RefPtr<HTMLInputElement> holdRef(input);
         RefPtr<InputFieldSpeechButtonElement> holdRefButton(this);
         input->focus();
         input->select();
@@ -483,11 +499,10 @@ void InputFieldSpeechButtonElement::setRecognitionResult(int, const SpeechInputR
 {
     m_results = results;
 
-    HTMLInputElement* input = static_cast<HTMLInputElement*>(shadowAncestorNode());
     // The call to setValue() below dispatches an event, and an event handler in the page might
     // remove the input element from DOM. To make sure it remains valid until we finish our work
     // here, we take a temporary reference.
-    RefPtr<HTMLInputElement> holdRef(input);
+    RefPtr<HTMLInputElement> input(static_cast<HTMLInputElement*>(shadowAncestorNode()));
     RefPtr<InputFieldSpeechButtonElement> holdRefButton(this);
     input->setValue(results.isEmpty() ? "" : results[0]->utterance());
     input->dispatchEvent(SpeechInputEvent::create(eventNames().webkitspeechchangeEvent, results));
diff --git a/Source/WebCore/rendering/TextControlInnerElements.h b/Source/WebCore/rendering/TextControlInnerElements.h
index bb77dcd..4ba7857 100644
--- a/Source/WebCore/rendering/TextControlInnerElements.h
+++ b/Source/WebCore/rendering/TextControlInnerElements.h
@@ -48,8 +48,6 @@ protected:
 
 private:
     virtual bool isMouseFocusable() const { return false; }
-
-    RefPtr<HTMLElement> m_shadowParent;
 };
 
 class TextControlInnerTextElement : public TextControlInnerElement {
@@ -101,6 +99,7 @@ public:
 private:
     SpinButtonElement(HTMLElement*);
 
+    virtual void detach();
     virtual bool isSpinButtonElement() const { return true; }
     // FIXME: shadowAncestorNode() should be const.
     virtual bool isEnabledFormControl() const { return static_cast<Element*>(const_cast<SpinButtonElement*>(this)->shadowAncestorNode())->isEnabledFormControl(); }
diff --git a/Source/WebCore/rendering/TransformState.cpp b/Source/WebCore/rendering/TransformState.cpp
index ecc614e..9f177ea 100644
--- a/Source/WebCore/rendering/TransformState.cpp
+++ b/Source/WebCore/rendering/TransformState.cpp
@@ -60,9 +60,9 @@ void TransformState::applyTransform(const TransformationMatrix& transformFromCon
     // If we have an accumulated transform from last time, multiply in this transform
     if (m_accumulatedTransform) {
         if (m_direction == ApplyTransformDirection)
-            m_accumulatedTransform->multiply(transformFromContainer);
+            m_accumulatedTransform.set(new TransformationMatrix(transformFromContainer * *m_accumulatedTransform));
         else
-            m_accumulatedTransform->multLeft(transformFromContainer);
+            m_accumulatedTransform->multiply(transformFromContainer);
     } else if (accumulate == AccumulateTransform) {
         // Make one if we started to accumulate
         m_accumulatedTransform.set(new TransformationMatrix(transformFromContainer));
@@ -140,7 +140,7 @@ void HitTestingTransformState::translate(int x, int y, TransformAccumulation acc
 
 void HitTestingTransformState::applyTransform(const TransformationMatrix& transformFromContainer, TransformAccumulation accumulate)
 {
-    m_accumulatedTransform.multLeft(transformFromContainer);    
+    m_accumulatedTransform.multiply(transformFromContainer);
     if (accumulate == FlattenTransform)
         flattenWithTransform(m_accumulatedTransform);
 
diff --git a/Source/WebCore/rendering/break_lines.cpp b/Source/WebCore/rendering/break_lines.cpp
index 16bfcc2..b888fb8 100644
--- a/Source/WebCore/rendering/break_lines.cpp
+++ b/Source/WebCore/rendering/break_lines.cpp
@@ -26,9 +26,9 @@
 #include "config.h"
 #include "break_lines.h"
 
-#include "CharacterNames.h"
 #include "TextBreakIterator.h"
 #include <wtf/StdLibExtras.h>
+#include <wtf/unicode/CharacterNames.h>
 
 #if PLATFORM(MAC)
 #include <CoreServices/CoreServices.h>
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp b/Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp
index 9d80fbe..48d3f39 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp
@@ -176,7 +176,7 @@ int RenderMathMLFraction::baselinePosition(FontBaseline, bool firstLine, LineDir
             refStyle = previousSibling()->style();
         else if (nextSibling())
             refStyle = nextSibling()->style();
-        int shift = int(ceil((refStyle->font().xHeight() + 1) / 2));
+        int shift = int(ceil((refStyle->fontMetrics().xHeight() + 1) / 2));
         return numerator->offsetHeight() + shift;
     }
     return RenderBlock::baselinePosition(AlphabeticBaseline, firstLine, lineDirection, linePositionMode);
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLOperator.h b/Source/WebCore/rendering/mathml/RenderMathMLOperator.h
index 6501494..3ef15c5 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLOperator.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLOperator.h
@@ -28,8 +28,8 @@
 
 #if ENABLE(MATHML)
 
-#include "CharacterNames.h"
 #include "RenderMathMLBlock.h"
+#include <wtf/unicode/CharacterNames.h>
 
 namespace WebCore {
     
diff --git a/Source/WebCore/rendering/style/RenderStyle.cpp b/Source/WebCore/rendering/style/RenderStyle.cpp
index 2836fb9..b76a350 100644
--- a/Source/WebCore/rendering/style/RenderStyle.cpp
+++ b/Source/WebCore/rendering/style/RenderStyle.cpp
@@ -462,7 +462,8 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
         inherited_flags._text_transform != other->inherited_flags._text_transform ||
         inherited_flags._direction != other->inherited_flags._direction ||
         inherited_flags._white_space != other->inherited_flags._white_space ||
-        noninherited_flags._clear != other->noninherited_flags._clear)
+        noninherited_flags._clear != other->noninherited_flags._clear ||
+        noninherited_flags._unicodeBidi != other->noninherited_flags._unicodeBidi)
         return StyleDifferenceLayout;
 
     // Check block flow direction.
diff --git a/Source/WebCore/rendering/style/RenderStyle.h b/Source/WebCore/rendering/style/RenderStyle.h
index 9d5239b..7b79db1 100644
--- a/Source/WebCore/rendering/style/RenderStyle.h
+++ b/Source/WebCore/rendering/style/RenderStyle.h
@@ -165,7 +165,6 @@ protected:
                    (_text_align == other._text_align) &&
                    (_text_transform == other._text_transform) &&
                    (_text_decorations == other._text_decorations) &&
-                   (_text_transform == other._text_transform) &&
                    (_cursor_style == other._cursor_style) &&
                    (_direction == other._direction) &&
                    (_border_collapse == other._border_collapse) &&
@@ -463,6 +462,7 @@ public:
     ETableLayout tableLayout() const { return static_cast<ETableLayout>(noninherited_flags._table_layout); }
 
     const Font& font() const { return inherited->font; }
+    const FontMetrics& fontMetrics() const { return inherited->font.fontMetrics(); }
     const FontDescription& fontDescription() const { return inherited->font.fontDescription(); }
     int fontSize() const { return inherited->font.pixelSize(); }
 
@@ -487,7 +487,7 @@ public:
 
         // Negative value means the line height is not set.  Use the font's built-in spacing.
         if (lh.isNegative())
-            return font().lineSpacing();
+            return fontMetrics().lineSpacing();
 
         if (lh.isPercent())
             return lh.calcMinValue(fontSize());
@@ -727,6 +727,7 @@ public:
     bool hasMask() const { return rareNonInheritedData->m_mask.hasImage() || rareNonInheritedData->m_maskBoxImage.hasImage(); }
 
     TextCombine textCombine() const { return static_cast<TextCombine>(rareNonInheritedData->m_textCombine); }
+    bool hasTextCombine() const { return textCombine() != TextCombineNone; }
     // End CSS3 Getters
 
     // Apple-specific property getter methods
diff --git a/Source/WebCore/rendering/style/RenderStyleConstants.h b/Source/WebCore/rendering/style/RenderStyleConstants.h
index 7cd4903..44cd3f5 100644
--- a/Source/WebCore/rendering/style/RenderStyleConstants.h
+++ b/Source/WebCore/rendering/style/RenderStyleConstants.h
@@ -68,14 +68,9 @@ enum StyleDifferenceContextSensitiveProperty {
 enum PseudoId {
     // The order must be NOP ID, public IDs, and then internal IDs.
     NOPSEUDO, FIRST_LINE, FIRST_LETTER, BEFORE, AFTER, SELECTION, FIRST_LINE_INHERITED, SCROLLBAR, FILE_UPLOAD_BUTTON, INPUT_PLACEHOLDER,
-    SEARCH_CANCEL_BUTTON, SEARCH_DECORATION, SEARCH_RESULTS_DECORATION, SEARCH_RESULTS_BUTTON, MEDIA_CONTROLS_PANEL,
-    MEDIA_CONTROLS_PLAY_BUTTON, MEDIA_CONTROLS_MUTE_BUTTON, MEDIA_CONTROLS_TIMELINE, MEDIA_CONTROLS_TIMELINE_CONTAINER,
-    MEDIA_CONTROLS_VOLUME_SLIDER, MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER, MEDIA_CONTROLS_VOLUME_SLIDER_MUTE_BUTTON, 
-    MEDIA_CONTROLS_CURRENT_TIME_DISPLAY, MEDIA_CONTROLS_TIME_REMAINING_DISPLAY, 
-    MEDIA_CONTROLS_SEEK_BACK_BUTTON, MEDIA_CONTROLS_SEEK_FORWARD_BUTTON, MEDIA_CONTROLS_FULLSCREEN_BUTTON, MEDIA_CONTROLS_REWIND_BUTTON, 
-    MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON, MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON,
-    MEDIA_CONTROLS_STATUS_DISPLAY, SCROLLBAR_THUMB, SCROLLBAR_BUTTON, SCROLLBAR_TRACK, SCROLLBAR_TRACK_PIECE, SCROLLBAR_CORNER, RESIZER,
-    INPUT_LIST_BUTTON, INPUT_SPEECH_BUTTON, INNER_SPIN_BUTTON, OUTER_SPIN_BUTTON, VISITED_LINK, PROGRESS_BAR_VALUE,
+    SEARCH_CANCEL_BUTTON, SEARCH_DECORATION, SEARCH_RESULTS_DECORATION, SEARCH_RESULTS_BUTTON,
+    SCROLLBAR_THUMB, SCROLLBAR_BUTTON, SCROLLBAR_TRACK, SCROLLBAR_TRACK_PIECE, SCROLLBAR_CORNER, RESIZER,
+    INPUT_LIST_BUTTON, INPUT_SPEECH_BUTTON, INNER_SPIN_BUTTON, OUTER_SPIN_BUTTON, VISITED_LINK,
     METER_HORIZONTAL_BAR, METER_HORIZONTAL_OPTIMUM, METER_HORIZONTAL_SUBOPTIMAL, METER_HORIZONTAL_EVEN_LESS_GOOD,
     METER_VERTICAL_BAR, METER_VERTICAL_OPTIMUM, METER_VERTICAL_SUBOPTIMAL, METER_VERTICAL_EVEN_LESS_GOOD, 
     AFTER_LAST_INTERNAL_PSEUDOID,
diff --git a/Source/WebCore/rendering/style/StyleCachedImage.cpp b/Source/WebCore/rendering/style/StyleCachedImage.cpp
index 1d7aba8..05cb0ea 100644
--- a/Source/WebCore/rendering/style/StyleCachedImage.cpp
+++ b/Source/WebCore/rendering/style/StyleCachedImage.cpp
@@ -84,7 +84,7 @@ void StyleCachedImage::removeClient(RenderObject* renderer)
     return m_image->removeClient(renderer);
 }
 
-Image* StyleCachedImage::image(RenderObject*, const IntSize&) const
+PassRefPtr<Image> StyleCachedImage::image(RenderObject*, const IntSize&) const
 {
     return m_image->image();
 }
diff --git a/Source/WebCore/rendering/style/StyleCachedImage.h b/Source/WebCore/rendering/style/StyleCachedImage.h
index 3d6e1a2..2be6f4c 100644
--- a/Source/WebCore/rendering/style/StyleCachedImage.h
+++ b/Source/WebCore/rendering/style/StyleCachedImage.h
@@ -52,7 +52,7 @@ public:
     virtual void setImageContainerSize(const IntSize&);
     virtual void addClient(RenderObject*);
     virtual void removeClient(RenderObject*);
-    virtual Image* image(RenderObject*, const IntSize&) const;
+    virtual PassRefPtr<Image> image(RenderObject*, const IntSize&) const;
     
 private:
     StyleCachedImage(CachedImage* image)
diff --git a/Source/WebCore/rendering/style/StyleGeneratedImage.cpp b/Source/WebCore/rendering/style/StyleGeneratedImage.cpp
index 2322f5f..fa0aad7 100644
--- a/Source/WebCore/rendering/style/StyleGeneratedImage.cpp
+++ b/Source/WebCore/rendering/style/StyleGeneratedImage.cpp
@@ -72,7 +72,7 @@ void StyleGeneratedImage::removeClient(RenderObject* renderer)
     m_generator->removeClient(renderer);
 }
 
-Image* StyleGeneratedImage::image(RenderObject* renderer, const IntSize& size) const
+PassRefPtr<Image> StyleGeneratedImage::image(RenderObject* renderer, const IntSize& size) const
 {
     return m_generator->image(renderer, size);
 }
diff --git a/Source/WebCore/rendering/style/StyleGeneratedImage.h b/Source/WebCore/rendering/style/StyleGeneratedImage.h
index 7be1f6a..8e6076a 100644
--- a/Source/WebCore/rendering/style/StyleGeneratedImage.h
+++ b/Source/WebCore/rendering/style/StyleGeneratedImage.h
@@ -51,7 +51,7 @@ public:
     virtual void setImageContainerSize(const IntSize&);
     virtual void addClient(RenderObject*);
     virtual void removeClient(RenderObject*);
-    virtual Image* image(RenderObject*, const IntSize&) const;
+    virtual PassRefPtr<Image> image(RenderObject*, const IntSize&) const;
     
 private:
     StyleGeneratedImage(CSSImageGeneratorValue* val, bool fixedSize)
diff --git a/Source/WebCore/rendering/style/StyleImage.h b/Source/WebCore/rendering/style/StyleImage.h
index ead8d4a..2c844f6 100644
--- a/Source/WebCore/rendering/style/StyleImage.h
+++ b/Source/WebCore/rendering/style/StyleImage.h
@@ -25,6 +25,7 @@
 #define StyleImage_h
 
 #include "CSSValue.h"
+#include "Image.h"
 #include "IntSize.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -33,7 +34,6 @@
 namespace WebCore {
 
 class CSSValue;
-class Image;
 class RenderObject;
 
 typedef void* WrappedImagePtr;
@@ -59,7 +59,7 @@ public:
     virtual void setImageContainerSize(const IntSize&) = 0;
     virtual void addClient(RenderObject*) = 0;
     virtual void removeClient(RenderObject*) = 0;
-    virtual Image* image(RenderObject*, const IntSize&) const = 0;
+    virtual PassRefPtr<Image> image(RenderObject*, const IntSize&) const = 0;
     virtual WrappedImagePtr data() const = 0;
 
     virtual bool isCachedImage() const { return false; }
diff --git a/Source/WebCore/rendering/style/StylePendingImage.h b/Source/WebCore/rendering/style/StylePendingImage.h
index b0c9b01..60c993c 100644
--- a/Source/WebCore/rendering/style/StylePendingImage.h
+++ b/Source/WebCore/rendering/style/StylePendingImage.h
@@ -26,6 +26,7 @@
 #ifndef StylePendingImage_h
 #define StylePendingImage_h
 
+#include "Image.h"
 #include "StyleImage.h"
 
 namespace WebCore {
@@ -52,7 +53,7 @@ public:
     virtual void setImageContainerSize(const IntSize&) { }
     virtual void addClient(RenderObject*) { }
     virtual void removeClient(RenderObject*) { }
-    virtual Image* image(RenderObject*, const IntSize&) const
+    virtual PassRefPtr<Image> image(RenderObject*, const IntSize&) const
     {
         ASSERT_NOT_REACHED();
         return 0;
diff --git a/Source/WebCore/rendering/svg/RenderSVGImage.cpp b/Source/WebCore/rendering/svg/RenderSVGImage.cpp
index 0f5a55e..81a5cea 100644
--- a/Source/WebCore/rendering/svg/RenderSVGImage.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGImage.cpp
@@ -122,7 +122,7 @@ void RenderSVGImage::paint(PaintInfo& paintInfo, int, int)
             PaintInfo savedInfo(childPaintInfo);
 
             if (SVGRenderSupport::prepareToRenderSVGContent(this, childPaintInfo)) {
-                Image* image = m_imageResource->image();
+                RefPtr<Image> image = m_imageResource->image();
                 FloatRect destRect = m_objectBoundingBox;
                 FloatRect srcRect(0, 0, image->width(), image->height());
 
@@ -130,7 +130,7 @@ void RenderSVGImage::paint(PaintInfo& paintInfo, int, int)
                 if (imageElement->preserveAspectRatio().align() != SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_NONE)
                     imageElement->preserveAspectRatio().transformRect(destRect, srcRect);
 
-                childPaintInfo.context->drawImage(image, ColorSpaceDeviceRGB, destRect, srcRect);
+                childPaintInfo.context->drawImage(image.get(), ColorSpaceDeviceRGB, destRect, srcRect);
             }
 
             SVGRenderSupport::finishRenderSVGContent(this, childPaintInfo, savedInfo.context);
diff --git a/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp b/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp
index 91ffb5c..a8aa0c8 100644
--- a/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp
@@ -26,11 +26,14 @@
 #if ENABLE(SVG)
 #include "RenderSVGInlineText.h"
 
+#include "CSSStyleSelector.h"
 #include "FloatConversion.h"
 #include "FloatQuad.h"
 #include "RenderBlock.h"
 #include "RenderSVGRoot.h"
 #include "RenderSVGText.h"
+#include "Settings.h"
+#include "SVGImageBufferTools.h"
 #include "SVGInlineTextBox.h"
 #include "SVGRootInlineBox.h"
 #include "VisiblePosition.h"
@@ -63,6 +66,7 @@ static PassRefPtr<StringImpl> applySVGWhitespaceRules(PassRefPtr<StringImpl> str
 
 RenderSVGInlineText::RenderSVGInlineText(Node* n, PassRefPtr<StringImpl> string)
     : RenderText(n, applySVGWhitespaceRules(string, false))
+    , m_scalingFactor(1)
 {
 }
 
@@ -74,6 +78,8 @@ void RenderSVGInlineText::styleDidChange(StyleDifference diff, const RenderStyle
         // The text metrics may be influenced by style changes.
         if (RenderSVGText* textRenderer = RenderSVGText::locateRenderSVGTextAncestor(this))
             textRenderer->setNeedsPositioningValuesUpdate();
+
+        updateScaledFont();
     }
 
     const RenderStyle* newStyle = style();
@@ -103,12 +109,12 @@ IntRect RenderSVGInlineText::localCaretRect(InlineBox* box, int caretOffset, int
     // Use the edge of the selection rect to determine the caret rect.
     if (static_cast<unsigned>(caretOffset) < textBox->start() + textBox->len()) {
         IntRect rect = textBox->selectionRect(0, 0, caretOffset, caretOffset + 1);
-        int x = box->isLeftToRightDirection() ? rect.x() : rect.right();
+        int x = box->isLeftToRightDirection() ? rect.x() : rect.maxX();
         return IntRect(x, rect.y(), caretWidth, rect.height());
     }
 
     IntRect rect = textBox->selectionRect(0, 0, caretOffset - 1, caretOffset);
-    int x = box->isLeftToRightDirection() ? rect.right() : rect.x();
+    int x = box->isLeftToRightDirection() ? rect.maxX() : rect.x();
     return IntRect(x, rect.y(), caretWidth, rect.height());
 }
 
@@ -159,9 +165,7 @@ VisiblePosition RenderSVGInlineText::positionForPoint(const IntPoint& point)
     if (!firstTextBox() || !textLength())
         return createVisiblePosition(0, DOWNSTREAM);
 
-    RenderStyle* style = this->style();
-    ASSERT(style);
-    int baseline = style->font().ascent();
+    float baseline = m_scaledFont.fontMetrics().floatAscent();
 
     RenderBlock* containingBlock = this->containingBlock();
     ASSERT(containingBlock);
@@ -206,6 +210,39 @@ VisiblePosition RenderSVGInlineText::positionForPoint(const IntPoint& point)
     return createVisiblePosition(offset + closestDistanceBox->start(), offset > 0 ? VP_UPSTREAM_IF_POSSIBLE : DOWNSTREAM);
 }
 
+void RenderSVGInlineText::updateScaledFont()
+{
+    computeNewScaledFontForStyle(this, style(), m_scalingFactor, m_scaledFont);
+}
+
+void RenderSVGInlineText::computeNewScaledFontForStyle(RenderObject* renderer, const RenderStyle* style, float& scalingFactor, Font& scaledFont)
+{
+    ASSERT(style);
+    ASSERT(renderer);
+
+    Document* document = renderer->document();
+    ASSERT(document);
+
+    CSSStyleSelector* styleSelector = document->styleSelector();
+    ASSERT(styleSelector);
+
+    // Alter font-size to the right on-screen value, to avoid scaling the glyphs themselves.
+    AffineTransform ctm;
+    SVGImageBufferTools::calculateTransformationToOutermostSVGCoordinateSystem(renderer, ctm);
+    scalingFactor = narrowPrecisionToFloat(sqrt((pow(ctm.xScale(), 2) + pow(ctm.yScale(), 2)) / 2));
+    if (scalingFactor == 1 || !scalingFactor) {
+        scalingFactor = 1;
+        scaledFont = style->font();
+        return;
+    }
+
+    FontDescription fontDescription(style->fontDescription());
+    fontDescription.setComputedSize(fontDescription.computedSize() * scalingFactor);
+
+    scaledFont = Font(fontDescription, 0, 0);
+    scaledFont.update(styleSelector->fontSelector());
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/rendering/svg/RenderSVGInlineText.h b/Source/WebCore/rendering/svg/RenderSVGInlineText.h
index f5247f6..9eed8cd 100644
--- a/Source/WebCore/rendering/svg/RenderSVGInlineText.h
+++ b/Source/WebCore/rendering/svg/RenderSVGInlineText.h
@@ -40,6 +40,11 @@ public:
     const SVGTextLayoutAttributes& layoutAttributes() const { return m_attributes; }
     void storeLayoutAttributes(const SVGTextLayoutAttributes& attributes) { m_attributes = attributes; }
 
+    float scalingFactor() const { return m_scalingFactor; }
+    const Font& scaledFont() const { return m_scaledFont; }
+    void updateScaledFont();
+    static void computeNewScaledFontForStyle(RenderObject*, const RenderStyle*, float& scalingFactor, Font& scaledFont);
+
 private:
     virtual const char* renderName() const { return "RenderSVGInlineText"; }
 
@@ -57,6 +62,8 @@ private:
     virtual IntRect linesBoundingBox() const;
     virtual InlineTextBox* createTextBox();
 
+    float m_scalingFactor;
+    Font m_scaledFont;
     SVGTextLayoutAttributes m_attributes;
 };
 
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp b/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp
index 4ba4e0a..96514af 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp
@@ -111,7 +111,7 @@ PassRefPtr<SVGFilterBuilder> RenderSVGResourceFilter::buildPrimitives(Filter* fi
             builder->clearEffects();
             return 0;
         }
-        builder->appendEffectToEffectReferences(effect);
+        builder->appendEffectToEffectReferences(effect, effectElement->renderer());
         effectElement->setStandardAttributes(primitiveBoundingBoxMode, effect.get());
         builder->add(effectElement->result(), effect);
     }
@@ -208,13 +208,13 @@ bool RenderSVGResourceFilter::applyResource(RenderObject* object, RenderStyle*,
     if (!lastEffect)
         return false;
 
-    RenderSVGResourceFilterPrimitive::determineFilterPrimitiveSubregion(lastEffect, filterData->filter.get());
+    RenderSVGResourceFilterPrimitive::determineFilterPrimitiveSubregion(lastEffect);
     FloatRect subRegion = lastEffect->maxEffectRect();
     // At least one FilterEffect has a too big image size,
     // recalculate the effect sizes with new scale factors.
     if (!fitsInMaximumImageSize(subRegion.size(), scale)) {
         filterData->filter->setFilterResolution(scale);
-        RenderSVGResourceFilterPrimitive::determineFilterPrimitiveSubregion(lastEffect, filterData->filter.get());
+        RenderSVGResourceFilterPrimitive::determineFilterPrimitiveSubregion(lastEffect);
     }
 
     // If the drawingRegion is empty, we have something like <g filter=".."/>.
@@ -290,16 +290,19 @@ void RenderSVGResourceFilter::postApplyResource(RenderObject* object, GraphicsCo
         // This is the real filtering of the object. It just needs to be called on the
         // initial filtering process. We just take the stored filter result on a
         // second drawing.
-        if (!filterData->builded) {
+        if (!filterData->builded)
             filterData->filter->setSourceImage(filterData->sourceGraphicBuffer.release());
+
+        // Always true if filterData is just built (filterData->builded is false).
+        if (!lastEffect->hasResult()) {
             lastEffect->apply();
 #if !PLATFORM(CG)
             ImageBuffer* resultImage = lastEffect->asImageBuffer();
             if (resultImage)
                 resultImage->transformColorSpace(ColorSpaceLinearRGB, ColorSpaceDeviceRGB);
 #endif
-            filterData->builded = true;
         }
+        filterData->builded = true;
 
         ImageBuffer* resultImage = lastEffect->asImageBuffer();
         if (resultImage) {
@@ -324,5 +327,31 @@ FloatRect RenderSVGResourceFilter::resourceBoundingBox(RenderObject* object)
     return FloatRect();
 }
 
+void RenderSVGResourceFilter::primitiveAttributeChanged(RenderObject* object, const QualifiedName& attribute)
+{
+    HashMap<RenderObject*, FilterData*>::iterator it = m_filter.begin();
+    HashMap<RenderObject*, FilterData*>::iterator end = m_filter.end();
+    SVGFilterPrimitiveStandardAttributes* primitve = static_cast<SVGFilterPrimitiveStandardAttributes*>(object->node());
+
+    for (; it != end; ++it) {
+        FilterData* filterData = it->second;
+        if (!filterData->builded)
+            continue;
+
+        SVGFilterBuilder* builder = filterData->builder.get();
+        FilterEffect* effect = builder->effectByRenderer(object);
+        if (!effect)
+            continue;
+        // Since all effects shares the same attribute value, all
+        // or none of them will be changed.
+        if (!primitve->setFilterEffectAttribute(effect, attribute))
+            return;
+        builder->clearResultsRecursive(effect);
+
+        // Repaint the image on the screen.
+        markClientForInvalidation(it->first, RepaintInvalidation);
+    }
+}
+
 }
 #endif
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceFilter.h b/Source/WebCore/rendering/svg/RenderSVGResourceFilter.h
index f9a15ce..c809f23 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceFilter.h
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceFilter.h
@@ -64,6 +64,7 @@ public:
     virtual ~RenderSVGResourceFilter();
 
     virtual const char* renderName() const { return "RenderSVGResourceFilter"; }
+    virtual bool isSVGResourceFilter() const { return true; }
 
     virtual void removeAllClientsFromCache(bool markForInvalidation = true);
     virtual void removeClientFromCache(RenderObject*, bool markForInvalidation = true);
@@ -78,6 +79,8 @@ public:
     SVGUnitTypes::SVGUnitType filterUnits() const { return toUnitType(static_cast<SVGFilterElement*>(node())->filterUnits()); }
     SVGUnitTypes::SVGUnitType primitiveUnits() const { return toUnitType(static_cast<SVGFilterElement*>(node())->primitiveUnits()); }
 
+    void primitiveAttributeChanged(RenderObject*, const QualifiedName&);
+
     virtual RenderSVGResourceType resourceType() const { return s_resourceType; }
     static RenderSVGResourceType s_resourceType;
 
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceFilterPrimitive.cpp b/Source/WebCore/rendering/svg/RenderSVGResourceFilterPrimitive.cpp
index fc7362e..64df700 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceFilterPrimitive.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceFilterPrimitive.cpp
@@ -29,25 +29,29 @@
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "RenderSVGResourceFilterPrimitive.h"
 
+#include "RenderSVGResource.h"
 #include "SVGFEImage.h"
+#include "SVGFilter.h"
 
 namespace WebCore {
 
-FloatRect RenderSVGResourceFilterPrimitive::determineFilterPrimitiveSubregion(FilterEffect* effect, SVGFilter* filter)
+FloatRect RenderSVGResourceFilterPrimitive::determineFilterPrimitiveSubregion(FilterEffect* effect)
 {
     FloatRect uniteRect;
     FloatRect subregionBoundingBox = effect->effectBoundaries();
     FloatRect subregion = subregionBoundingBox;
+    SVGFilter* filter = static_cast<SVGFilter*>(effect->filter());
+    ASSERT(filter);
 
     if (effect->filterEffectType() != FilterEffectTypeTile) {
         // FETurbulence, FEImage and FEFlood don't have input effects, take the filter region as unite rect.
         if (unsigned numberOfInputEffects = effect->inputEffects().size()) {
             for (unsigned i = 0; i < numberOfInputEffects; ++i)
-                uniteRect.unite(determineFilterPrimitiveSubregion(effect->inputEffect(i), filter));
+                uniteRect.unite(determineFilterPrimitiveSubregion(effect->inputEffect(i)));
         } else
             uniteRect = filter->filterRegionInUserSpace();
     } else {
-        determineFilterPrimitiveSubregion(effect->inputEffect(0), filter);
+        determineFilterPrimitiveSubregion(effect->inputEffect(0));
         uniteRect = filter->filterRegionInUserSpace();
     }
 
@@ -90,7 +94,7 @@ FloatRect RenderSVGResourceFilterPrimitive::determineFilterPrimitiveSubregion(Fi
     // FEImage needs the unclipped subregion in absolute coordinates to determine the correct
     // destination rect in combination with preserveAspectRatio.
     if (effect->filterEffectType() == FilterEffectTypeImage)
-        reinterpret_cast<FEImage*>(effect)->setAbsoluteSubregion(absoluteSubregion);
+        static_cast<FEImage*>(effect)->setAbsoluteSubregion(absoluteSubregion);
 
     // Clip every filter effect to the filter region.
     FloatRect absoluteScaledFilterRegion = filter->filterRegion();
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceFilterPrimitive.h b/Source/WebCore/rendering/svg/RenderSVGResourceFilterPrimitive.h
index f25f62e..8176d29 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceFilterPrimitive.h
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceFilterPrimitive.h
@@ -30,25 +30,32 @@
 #if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "RenderSVGHiddenContainer.h"
-#include "SVGFilter.h"
-#include "SVGFilterPrimitiveStandardAttributes.h"
+#include "RenderSVGResourceFilter.h"
 
 namespace WebCore {
 
+class FilterEffect;
+
 class RenderSVGResourceFilterPrimitive : public RenderSVGHiddenContainer {
 public:
-
-    explicit RenderSVGResourceFilterPrimitive(SVGFilterPrimitiveStandardAttributes* filterPrimitiveElement)
+    explicit RenderSVGResourceFilterPrimitive(SVGStyledElement* filterPrimitiveElement)
         : RenderSVGHiddenContainer(filterPrimitiveElement)
     {
     }
 
-    // They depend on the RenderObject argument of RenderSVGResourceFilter::applyResource.
-    static FloatRect determineFilterPrimitiveSubregion(FilterEffect*, SVGFilter*);
-
-private:
     virtual const char* renderName() const { return "RenderSVGResourceFilterPrimitive"; }
     virtual bool isSVGResourceFilterPrimitive() const { return true; }
+
+    // They depend on the RenderObject argument of RenderSVGResourceFilter::applyResource.
+    static FloatRect determineFilterPrimitiveSubregion(FilterEffect*);
+
+    inline void primitiveAttributeChanged(const QualifiedName& attribute)
+    {
+        RenderObject* filter = parent();
+        if (!filter || !filter->isSVGResourceFilter())
+            return;
+        static_cast<RenderSVGResourceFilter*>(filter)->primitiveAttributeChanged(this, attribute);
+    }
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceMarker.cpp b/Source/WebCore/rendering/svg/RenderSVGResourceMarker.cpp
index 2a68d92..fcad27f 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceMarker.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceMarker.cpp
@@ -86,11 +86,10 @@ FloatRect RenderSVGResourceMarker::markerBoundaries(const AffineTransform& marke
 
 const AffineTransform& RenderSVGResourceMarker::localToParentTransform() const
 {
-    AffineTransform viewportTranslation(viewportTransform());
-    m_localToParentTransform = viewportTranslation.translateRight(m_viewport.x(), m_viewport.y());
+    m_localToParentTransform = AffineTransform::translation(m_viewport.x(), m_viewport.y()) * viewportTransform();
     return m_localToParentTransform;
     // If this class were ever given a localTransform(), then the above would read:
-    // return viewportTransform() * localTransform() * viewportTranslation;
+    // return viewportTranslation * localTransform() * viewportTransform();
 }
 
 FloatPoint RenderSVGResourceMarker::referencePoint() const
diff --git a/Source/WebCore/rendering/svg/RenderSVGRoot.cpp b/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
index 3a8dce9..30f72b9 100644
--- a/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
@@ -261,18 +261,15 @@ IntSize RenderSVGRoot::borderOriginToContentBox() const
 
 AffineTransform RenderSVGRoot::localToRepaintContainerTransform(const IntPoint& parentOriginInContainer) const
 {
-    AffineTransform parentToContainer(localToParentTransform());
-    return parentToContainer.translateRight(parentOriginInContainer.x(), parentOriginInContainer.y());
+    return AffineTransform::translation(parentOriginInContainer.x(), parentOriginInContainer.y()) * localToParentTransform();
 }
 
 const AffineTransform& RenderSVGRoot::localToParentTransform() const
 {
     IntSize parentToBorderBoxOffset = parentOriginToBorderBox();
 
-    AffineTransform borderBoxOriginToParentOrigin(localToBorderBoxTransform());
-    borderBoxOriginToParentOrigin.translateRight(parentToBorderBoxOffset.width(), parentToBorderBoxOffset.height());
+    m_localToParentTransform = AffineTransform::translation(parentToBorderBoxOffset.width(), parentToBorderBoxOffset.height()) * localToBorderBoxTransform();
 
-    m_localToParentTransform = borderBoxOriginToParentOrigin;
     return m_localToParentTransform;
 }
 
diff --git a/Source/WebCore/rendering/svg/RenderSVGText.cpp b/Source/WebCore/rendering/svg/RenderSVGText.cpp
index dad0b70..56d9306 100644
--- a/Source/WebCore/rendering/svg/RenderSVGText.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGText.cpp
@@ -33,7 +33,7 @@
 #include "GraphicsContext.h"
 #include "HitTestRequest.h"
 #include "PointerEventsHitRules.h"
-#include "RenderLayer.h"
+#include "RenderSVGInlineText.h"
 #include "RenderSVGResource.h"
 #include "RenderSVGRoot.h"
 #include "SVGLengthList.h"
@@ -91,6 +91,18 @@ void RenderSVGText::mapLocalToContainer(RenderBoxModelObject* repaintContainer,
     SVGRenderSupport::mapLocalToContainer(this, repaintContainer, fixed, useTransforms, transformState);
 }
 
+static inline void recursiveUpdateScaledFont(RenderObject* start)
+{
+    for (RenderObject* child = start->firstChild(); child; child = child->nextSibling()) {
+        if (child->isSVGInlineText()) {
+            toRenderSVGInlineText(child)->updateScaledFont();
+            continue;
+        }
+
+        recursiveUpdateScaledFont(child);
+    }
+}
+
 void RenderSVGText::layout()
 {
     ASSERT(needsLayout());
@@ -104,6 +116,13 @@ void RenderSVGText::layout()
         updateCachedBoundariesInParents = true;
     }
 
+    // If the root layout size changed (eg. window size changes) or the positioning values change, recompute the on-screen font size.
+    if (m_needsPositioningValuesUpdate || SVGRenderSupport::findTreeRootObject(this)->isLayoutSizeChanged()) {
+        recursiveUpdateScaledFont(this);
+        m_needsPositioningValuesUpdate = true;
+        updateCachedBoundariesInParents = true;
+    }
+
     if (m_needsPositioningValuesUpdate) {
         // Perform SVG text layout phase one (see SVGTextLayoutAttributesBuilder for details).
         SVGTextLayoutAttributesBuilder layoutAttributesBuilder;
diff --git a/Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp b/Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp
index 7f4b6f7..0f2f273 100644
--- a/Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp
@@ -72,11 +72,10 @@ AffineTransform RenderSVGViewportContainer::viewportTransform() const
 
 const AffineTransform& RenderSVGViewportContainer::localToParentTransform() const
 {
-    AffineTransform viewportTranslation(viewportTransform());
-    m_localToParentTransform = viewportTranslation.translateRight(m_viewport.x(), m_viewport.y());
+    m_localToParentTransform = AffineTransform::translation(m_viewport.x(), m_viewport.y()) * viewportTransform();
     return m_localToParentTransform;
     // If this class were ever given a localTransform(), then the above would read:
-    // return viewportTransform() * localTransform() * viewportTranslation;
+    // return viewportTranslation * localTransform() * viewportTransform()
 }
 
 bool RenderSVGViewportContainer::pointIsInsideViewportClip(const FloatPoint& pointInParent)
diff --git a/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp b/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp
index 2879f20..52976f2 100644
--- a/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp
+++ b/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp
@@ -30,6 +30,7 @@
 #include "RenderSVGInlineText.h"
 #include "RenderSVGResource.h"
 #include "RenderSVGResourceSolidColor.h"
+#include "SVGImageBufferTools.h"
 #include "SVGRootInlineBox.h"
 #include "TextRun.h"
 
@@ -56,9 +57,12 @@ int SVGInlineTextBox::offsetForPosition(int, bool) const
 
 int SVGInlineTextBox::offsetForPositionInFragment(const SVGTextFragment& fragment, float position, bool includePartialGlyphs) const
 {
-    RenderText* textRenderer = this->textRenderer();
+    RenderSVGInlineText* textRenderer = toRenderSVGInlineText(this->textRenderer());
     ASSERT(textRenderer);
 
+    float scalingFactor = textRenderer->scalingFactor();
+    ASSERT(scalingFactor);
+
     RenderStyle* style = textRenderer->style();
     ASSERT(style);
 
@@ -69,7 +73,7 @@ int SVGInlineTextBox::offsetForPositionInFragment(const SVGTextFragment& fragmen
     if (!fragment.transform.isIdentity())
         textRun.setHorizontalGlyphStretch(narrowPrecisionToFloat(fragment.transform.xScale()));
 
-    return fragment.positionListOffset - start() + style->font().offsetForPosition(textRun, position, includePartialGlyphs);
+    return fragment.positionListOffset - start() + textRenderer->scaledFont().offsetForPosition(textRun, position * scalingFactor, includePartialGlyphs);
 }
 
 int SVGInlineTextBox::positionForOffset(int) const
@@ -82,10 +86,28 @@ int SVGInlineTextBox::positionForOffset(int) const
 FloatRect SVGInlineTextBox::selectionRectForTextFragment(const SVGTextFragment& fragment, int startPosition, int endPosition, RenderStyle* style)
 {
     ASSERT(startPosition < endPosition);
+    ASSERT(style);
+
+    RenderSVGInlineText* textRenderer = toRenderSVGInlineText(this->textRenderer());
+    ASSERT(textRenderer);
+
+    float scalingFactor = textRenderer->scalingFactor();
+    ASSERT(scalingFactor);
 
-    const Font& font = style->font();
-    FloatPoint textOrigin(fragment.x, fragment.y - font.ascent());
-    return font.selectionRectForText(constructTextRun(style, fragment), textOrigin, fragment.height, startPosition, endPosition);
+    const Font& scaledFont = textRenderer->scaledFont();
+    const FontMetrics& scaledFontMetrics = scaledFont.fontMetrics();
+    FloatPoint textOrigin(fragment.x, fragment.y);
+    if (scalingFactor != 1)
+        textOrigin.scale(scalingFactor, scalingFactor);
+
+    textOrigin.move(0, -scaledFontMetrics.floatAscent());
+
+    FloatRect selectionRect = scaledFont.selectionRectForText(constructTextRun(style, fragment), textOrigin, fragment.height * scalingFactor, startPosition, endPosition);
+    if (scalingFactor == 1)
+        return selectionRect;
+
+    selectionRect.scale(1 / scalingFactor);
+    return selectionRect;
 }
 
 IntRect SVGInlineTextBox::selectionRect(int, int, int startPosition, int endPosition)
@@ -125,6 +147,13 @@ IntRect SVGInlineTextBox::selectionRect(int, int, int startPosition, int endPosi
     return enclosingIntRect(selectionRect);
 }
 
+static inline bool textShouldBePainted(RenderSVGInlineText* textRenderer)
+{
+    // Font::pixelSize(), returns FontDescription::computedPixelSize(), which returns "int(x + 0.5)".
+    // If the absolute font size on screen is below x=0.5, don't render anything.
+    return textRenderer->scaledFont().pixelSize();
+}
+
 void SVGInlineTextBox::paintSelectionBackground(PaintInfo& paintInfo)
 {
     ASSERT(paintInfo.shouldPaintWithinRoot(renderer()));
@@ -148,6 +177,11 @@ void SVGInlineTextBox::paintSelectionBackground(PaintInfo& paintInfo)
     if (!backgroundColor.isValid() || !backgroundColor.alpha())
         return;
 
+    RenderSVGInlineText* textRenderer = toRenderSVGInlineText(this->textRenderer());
+    ASSERT(textRenderer);
+    if (!textShouldBePainted(textRenderer))
+        return;
+
     RenderStyle* style = parentRenderer->style();
     ASSERT(style);
 
@@ -222,6 +256,11 @@ void SVGInlineTextBox::paint(PaintInfo& paintInfo, int, int)
     if (!hasSelection && paintSelectedTextOnly)
         return;
 
+    RenderSVGInlineText* textRenderer = toRenderSVGInlineText(this->textRenderer());
+    ASSERT(textRenderer);
+    if (!textShouldBePainted(textRenderer))
+        return;
+
     RenderStyle* style = parentRenderer->style();
     ASSERT(style);
 
@@ -286,8 +325,9 @@ void SVGInlineTextBox::paint(PaintInfo& paintInfo, int, int)
     ASSERT(!m_paintingResource);
 }
 
-bool SVGInlineTextBox::acquirePaintingResource(GraphicsContext*& context, RenderObject* renderer, RenderStyle* style)
+bool SVGInlineTextBox::acquirePaintingResource(GraphicsContext*& context, float scalingFactor, RenderObject* renderer, RenderStyle* style)
 {
+    ASSERT(scalingFactor);
     ASSERT(renderer);
     ASSERT(style);
     ASSERT(m_paintingResourceMode != ApplyToDefaultMode);
@@ -315,6 +355,9 @@ bool SVGInlineTextBox::acquirePaintingResource(GraphicsContext*& context, Render
         }
     }
 
+    if (scalingFactor != 1 && m_paintingResourceMode & ApplyToStrokeMode)
+        context->setStrokeThickness(context->strokeThickness() * scalingFactor);
+
     return true;
 }
 
@@ -329,9 +372,9 @@ void SVGInlineTextBox::releasePaintingResource(GraphicsContext*& context, const
     m_paintingResource = 0;
 }
 
-bool SVGInlineTextBox::prepareGraphicsContextForTextPainting(GraphicsContext*& context, TextRun& textRun, RenderStyle* style)
+bool SVGInlineTextBox::prepareGraphicsContextForTextPainting(GraphicsContext*& context, float scalingFactor, TextRun& textRun, RenderStyle* style)
 {
-    bool acquiredResource = acquirePaintingResource(context, parent()->renderer(), style);
+    bool acquiredResource = acquirePaintingResource(context, scalingFactor, parent()->renderer(), style);
 
 #if ENABLE(SVG_FONTS)
     // SVG Fonts need access to the painting resource used to draw the current text chunk.
@@ -364,14 +407,12 @@ TextRun SVGInlineTextBox::constructTextRun(RenderStyle* style, const SVGTextFrag
                 , false /* allowTabs */
                 , 0 /* xPos, only relevant with allowTabs=true */
                 , 0 /* padding, only relevant for justified text, not relevant for SVG */
+                , TextRun::AllowTrailingExpansion
                 , direction() == RTL
                 , m_dirOverride || style->visuallyOrdered() /* directionalOverride */);
 
 #if ENABLE(SVG_FONTS)
-    RenderObject* parentRenderer = parent()->renderer();
-    ASSERT(parentRenderer);
-
-    run.setReferencingRenderObject(parentRenderer);
+    run.setReferencingRenderObject(text);
 #endif
 
     // Disable any word/character rounding.
@@ -409,16 +450,16 @@ bool SVGInlineTextBox::mapStartEndPositionsIntoFragmentCoordinates(const SVGText
     return true;
 }
 
-static inline float positionOffsetForDecoration(ETextDecoration decoration, const Font& font, float thickness)
+static inline float positionOffsetForDecoration(ETextDecoration decoration, const FontMetrics& fontMetrics, float thickness)
 {
     // FIXME: For SVG Fonts we need to use the attributes defined in the <font-face> if specified.
     // Compatible with Batik/Opera.
     if (decoration == UNDERLINE)
-        return font.ascent() + thickness * 1.5f;
+        return fontMetrics.floatAscent() + thickness * 1.5f;
     if (decoration == OVERLINE)
         return thickness;
     if (decoration == LINE_THROUGH)
-        return font.ascent() * 5.0f / 8.0f;
+        return fontMetrics.floatAscent() * 5 / 8.0f;
 
     ASSERT_NOT_REACHED();
     return 0.0f;
@@ -486,22 +527,34 @@ void SVGInlineTextBox::paintDecorationWithStyle(GraphicsContext* context, ETextD
     RenderStyle* decorationStyle = decorationRenderer->style();
     ASSERT(decorationStyle);
 
-    const Font& font = decorationStyle->font();
+    float scalingFactor = 1;
+    Font scaledFont;
+    RenderSVGInlineText::computeNewScaledFontForStyle(decorationRenderer, decorationStyle, scalingFactor, scaledFont);
+    ASSERT(scalingFactor);
 
     // The initial y value refers to overline position.
-    float thickness = thicknessForDecoration(decoration, font);
+    float thickness = thicknessForDecoration(decoration, scaledFont);
 
     if (fragment.width <= 0 && thickness <= 0)
         return;
 
-    float y = fragment.y - font.ascent() + positionOffsetForDecoration(decoration, font, thickness);
-
-    Path path;
-    path.addRect(FloatRect(fragment.x, y, fragment.width, thickness));
+    FloatPoint decorationOrigin(fragment.x, fragment.y);
+    float width = fragment.width;
+    const FontMetrics& scaledFontMetrics = scaledFont.fontMetrics();
 
     context->save();
+    if (scalingFactor != 1) {
+        width *= scalingFactor;
+        decorationOrigin.scale(scalingFactor, scalingFactor);
+        context->scale(FloatSize(1 / scalingFactor, 1 / scalingFactor));
+    }
 
-    if (acquirePaintingResource(context, decorationRenderer, decorationStyle))
+    decorationOrigin.move(0, -scaledFontMetrics.floatAscent() + positionOffsetForDecoration(decoration, scaledFontMetrics, thickness));
+
+    Path path;
+    path.addRect(FloatRect(decorationOrigin, FloatSize(width, thickness)));
+
+    if (acquirePaintingResource(context, scalingFactor, decorationRenderer, decorationStyle))
         releasePaintingResource(context, &path);
 
     context->restore();
@@ -509,21 +562,41 @@ void SVGInlineTextBox::paintDecorationWithStyle(GraphicsContext* context, ETextD
 
 void SVGInlineTextBox::paintTextWithShadows(GraphicsContext* context, RenderStyle* style, TextRun& textRun, const SVGTextFragment& fragment, int startPosition, int endPosition)
 {
-    const Font& font = style->font();
+    RenderSVGInlineText* textRenderer = toRenderSVGInlineText(this->textRenderer());
+    ASSERT(textRenderer);
+
+    float scalingFactor = textRenderer->scalingFactor();
+    ASSERT(scalingFactor);
+
+    const Font& scaledFont = textRenderer->scaledFont();
     const ShadowData* shadow = style->textShadow();
 
     FloatPoint textOrigin(fragment.x, fragment.y);
-    FloatRect shadowRect(FloatPoint(textOrigin.x(), textOrigin.y() - font.ascent()), FloatSize(fragment.width, fragment.height));
+    FloatSize textSize(fragment.width, fragment.height);
+
+    if (scalingFactor != 1) {
+        textOrigin.scale(scalingFactor, scalingFactor);
+        textSize.scale(scalingFactor);
+    }
+
+    FloatRect shadowRect(FloatPoint(textOrigin.x(), textOrigin.y() - scaledFont.fontMetrics().floatAscent()), textSize);
 
     do {
-        if (!prepareGraphicsContextForTextPainting(context, textRun, style))
+        if (!prepareGraphicsContextForTextPainting(context, scalingFactor, textRun, style))
             break;
 
         FloatSize extraOffset;
         if (shadow)
             extraOffset = applyShadowToGraphicsContext(context, shadow, shadowRect, false /* stroked */, true /* opaque */, true /* horizontal */);
 
-        font.drawText(context, textRun, textOrigin + extraOffset, startPosition, endPosition);
+        if (scalingFactor != 1)
+            context->scale(FloatSize(1 / scalingFactor, 1 / scalingFactor));
+
+        scaledFont.drawText(context, textRun, textOrigin + extraOffset, startPosition, endPosition);
+
+        if (scalingFactor != 1)
+            context->scale(FloatSize(scalingFactor, scalingFactor));
+
         restoreGraphicsContextAfterTextPainting(context, textRun);
 
         if (!shadow)
@@ -580,19 +653,18 @@ IntRect SVGInlineTextBox::calculateBoundaries() const
 {
     FloatRect textRect;
 
-    RenderText* textRenderer = this->textRenderer();
+    RenderSVGInlineText* textRenderer = toRenderSVGInlineText(this->textRenderer());
     ASSERT(textRenderer);
 
-    RenderStyle* style = textRenderer->style();
-    ASSERT(style);
+    float scalingFactor = textRenderer->scalingFactor();
+    ASSERT(scalingFactor);
 
-    int baseline = baselinePosition(AlphabeticBaseline);
-    int heightDifference = baseline - style->font().ascent();
+    float baseline = textRenderer->scaledFont().fontMetrics().floatAscent() / scalingFactor;
 
     unsigned textFragmentsSize = m_textFragments.size();
     for (unsigned i = 0; i < textFragmentsSize; ++i) {
         const SVGTextFragment& fragment = m_textFragments.at(i);
-        FloatRect fragmentRect(fragment.x, fragment.y - baseline, fragment.width, fragment.height + heightDifference);
+        FloatRect fragmentRect(fragment.x, fragment.y - baseline, fragment.width, fragment.height);
 
         if (!fragment.transform.isIdentity())
             fragmentRect = fragment.transform.mapRect(fragmentRect);
diff --git a/Source/WebCore/rendering/svg/SVGInlineTextBox.h b/Source/WebCore/rendering/svg/SVGInlineTextBox.h
index 0458de0..f2ca303 100644
--- a/Source/WebCore/rendering/svg/SVGInlineTextBox.h
+++ b/Source/WebCore/rendering/svg/SVGInlineTextBox.h
@@ -66,10 +66,10 @@ public:
 private:
     TextRun constructTextRun(RenderStyle*, const SVGTextFragment&) const;
 
-    bool acquirePaintingResource(GraphicsContext*&, RenderObject*, RenderStyle*);
+    bool acquirePaintingResource(GraphicsContext*&, float scalingFactor, RenderObject*, RenderStyle*);
     void releasePaintingResource(GraphicsContext*&, const Path*);
 
-    bool prepareGraphicsContextForTextPainting(GraphicsContext*&, TextRun&, RenderStyle*);
+    bool prepareGraphicsContextForTextPainting(GraphicsContext*&, float scalingFactor, TextRun&, RenderStyle*);
     void restoreGraphicsContextAfterTextPainting(GraphicsContext*&, TextRun&);
 
     void paintDecoration(GraphicsContext*, ETextDecoration, const SVGTextFragment&);
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp b/Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp
index 3b28d2b..c25ed79 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp
@@ -310,7 +310,7 @@ void SVGTextLayoutEngine::finalizeTransformMatrices(Vector<SVGInlineTextBox*>& b
             SVGTextFragment& fragment = fragments.at(i);
             AffineTransform& transform = fragment.transform;
             if (!transform.isIdentity()) {
-                transform.translateRight(fragment.x, fragment.y);
+                transform = AffineTransform::translation(fragment.x, fragment.y) * transform;
                 transform.translate(-fragment.x, -fragment.y);
             }
 
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.cpp b/Source/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.cpp
index 3863322..4221f26 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.cpp
@@ -49,9 +49,9 @@ float SVGTextLayoutEngineBaseline::calculateBaselineShift(const SVGRenderStyle*
     case BS_BASELINE:
         return 0;
     case BS_SUB:
-        return -m_font.height() / 2;
+        return -m_font.fontMetrics().floatHeight() / 2;
     case BS_SUPER:
-        return m_font.height() / 2;
+        return m_font.fontMetrics().floatHeight() / 2;
     default:
         ASSERT_NOT_REACHED();
         return 0;
@@ -122,27 +122,29 @@ float SVGTextLayoutEngineBaseline::calculateAlignmentBaselineShift(bool isVertic
         ASSERT(baseline != AB_AUTO);
     }
 
+    const FontMetrics& fontMetrics = m_font.fontMetrics();
+
     // Note: http://wiki.apache.org/xmlgraphics-fop/LineLayout/AlignmentHandling
     switch (baseline) {
     case AB_BASELINE:
         return dominantBaselineToAlignmentBaseline(isVerticalText, textRendererParent);
     case AB_BEFORE_EDGE:
     case AB_TEXT_BEFORE_EDGE:
-        return m_font.ascent();
+        return fontMetrics.floatAscent();
     case AB_MIDDLE:
-        return m_font.xHeight() / 2;
+        return fontMetrics.xHeight() / 2;
     case AB_CENTRAL:
-        return (m_font.ascent() - m_font.descent()) / 2;
+        return (fontMetrics.floatAscent() - fontMetrics.floatDescent()) / 2;
     case AB_AFTER_EDGE:
     case AB_TEXT_AFTER_EDGE:
     case AB_IDEOGRAPHIC:
-        return m_font.descent();
+        return fontMetrics.floatDescent();
     case AB_ALPHABETIC:
         return 0;
     case AB_HANGING:
-        return m_font.ascent() * 8 / 10.f;
+        return fontMetrics.floatAscent() * 8 / 10.f;
     case AB_MATHEMATICAL:
-        return m_font.ascent() / 2;
+        return fontMetrics.floatAscent() / 2;
     default:
         ASSERT_NOT_REACHED();
         return 0;
@@ -192,12 +194,14 @@ float SVGTextLayoutEngineBaseline::calculateGlyphAdvanceAndOrientation(bool isVe
     // Spec: If if the 'glyph-orientation-vertical' results in an orientation angle that is not a multiple of
     // 180 degrees, then the current text position is incremented according to the horizontal metrics of the glyph.
 
+    const FontMetrics& fontMetrics = m_font.fontMetrics();
+
     // Vertical orientation handling.
     if (isVerticalText) {
-        float ascentMinusDescent = m_font.ascent() - m_font.descent();
+        float ascentMinusDescent = fontMetrics.floatAscent() - fontMetrics.floatDescent();
         if (!angle) {
             xOrientationShift = (ascentMinusDescent - metrics.width()) / 2;
-            yOrientationShift = m_font.ascent();
+            yOrientationShift = fontMetrics.floatAscent();
         } else if (angle == 180)
             xOrientationShift = (ascentMinusDescent + metrics.width()) / 2;
         else if (angle == 270) {
@@ -217,7 +221,7 @@ float SVGTextLayoutEngineBaseline::calculateGlyphAdvanceAndOrientation(bool isVe
         yOrientationShift = -metrics.width();
     else if (angle == 180) {
         xOrientationShift = metrics.width();
-        yOrientationShift = -m_font.ascent();
+        yOrientationShift = -fontMetrics.floatAscent();
     } else if (angle == 270)
         xOrientationShift = metrics.width();
 
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutEngineSpacing.cpp b/Source/WebCore/rendering/svg/SVGTextLayoutEngineSpacing.cpp
index 6c54b67..e9aa127 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutEngineSpacing.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutEngineSpacing.cpp
@@ -58,7 +58,7 @@ float SVGTextLayoutEngineSpacing::calculateSVGKerning(bool isVerticalText, const
 
     m_lastGlyph = currentGlyph;
     m_lastGlyph.isValid = true;
-    kerning *= m_font.size() / m_font.primaryFont()->unitsPerEm();
+    kerning *= m_font.size() / m_font.fontMetrics().unitsPerEm();
     return kerning;
 #else
     UNUSED_PARAM(isVerticalText);
diff --git a/Source/WebCore/rendering/svg/SVGTextMetrics.cpp b/Source/WebCore/rendering/svg/SVGTextMetrics.cpp
index ec8c2c6..ca20d3d 100644
--- a/Source/WebCore/rendering/svg/SVGTextMetrics.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextMetrics.cpp
@@ -34,16 +34,21 @@ SVGTextMetrics::SVGTextMetrics()
 {
 }
 
-SVGTextMetrics::SVGTextMetrics(const Font& font, const TextRun& run, unsigned position, unsigned textLength)
-    : m_width(0)
-    , m_height(0)
-    , m_length(0)
+SVGTextMetrics::SVGTextMetrics(RenderSVGInlineText* textRenderer, const TextRun& run, unsigned position, unsigned textLength)
 {
+    ASSERT(textRenderer);
+
+    float scalingFactor = textRenderer->scalingFactor();
+    ASSERT(scalingFactor);
+
+    const Font& scaledFont = textRenderer->scaledFont();
+
     int extraCharsAvailable = textLength - (position + run.length());
     int length = 0;
 
-    m_width = font.floatWidth(run, extraCharsAvailable, length, m_glyph.name);
-    m_height = font.height();
+    // Calculate width/height using the scaled font, divide this result by the scalingFactor afterwards.
+    m_width = scaledFont.floatWidth(run, extraCharsAvailable, length, m_glyph.name) / scalingFactor;
+    m_height = scaledFont.fontMetrics().floatHeight() / scalingFactor;
     m_glyph.unicodeString = String(run.characters(), length);
     m_glyph.isValid = true;
 
@@ -71,8 +76,7 @@ static TextRun constructTextRun(RenderSVGInlineText* text, const UChar* characte
     TextRun run(characters + position, length);
 
 #if ENABLE(SVG_FONTS)
-    ASSERT(text->parent());
-    run.setReferencingRenderObject(text->parent());
+    run.setReferencingRenderObject(text);
 #endif
 
     // Disable any word/character rounding.
@@ -86,18 +90,13 @@ static TextRun constructTextRun(RenderSVGInlineText* text, const UChar* characte
 SVGTextMetrics SVGTextMetrics::measureCharacterRange(RenderSVGInlineText* text, unsigned position, unsigned length)
 {
     ASSERT(text);
-    ASSERT(text->style());
-
     TextRun run(constructTextRun(text, text->characters(), position, length));
-    return SVGTextMetrics(text->style()->font(), run, position, text->textLength());
+    return SVGTextMetrics(text, run, position, text->textLength());
 }
 
 void SVGTextMetrics::measureAllCharactersIndividually(RenderSVGInlineText* text, Vector<SVGTextMetrics>& allMetrics)
 {
     ASSERT(text);
-    ASSERT(text->style());
-
-    const Font& font = text->style()->font();
     const UChar* characters = text->characters();
     unsigned length = text->textLength();
 
@@ -105,7 +104,7 @@ void SVGTextMetrics::measureAllCharactersIndividually(RenderSVGInlineText* text,
     for (unsigned position = 0; position < length; ) {
         run.setText(characters + position, 1);
 
-        SVGTextMetrics metrics(font, run, position, text->textLength());
+        SVGTextMetrics metrics(text, run, position, text->textLength());
         allMetrics.append(metrics);
         position += metrics.length();
     }
diff --git a/Source/WebCore/rendering/svg/SVGTextMetrics.h b/Source/WebCore/rendering/svg/SVGTextMetrics.h
index ba18589..7ef0f7d 100644
--- a/Source/WebCore/rendering/svg/SVGTextMetrics.h
+++ b/Source/WebCore/rendering/svg/SVGTextMetrics.h
@@ -25,7 +25,6 @@
 
 namespace WebCore {
 
-class Font;
 class RenderSVGInlineText;
 class TextRun;
 
@@ -64,7 +63,7 @@ public:
 
 private:
     SVGTextMetrics();
-    SVGTextMetrics(const Font&, const TextRun&, unsigned position, unsigned textLength);
+    SVGTextMetrics(RenderSVGInlineText*, const TextRun&, unsigned position, unsigned textLength);
 
     float m_width;
     float m_height;
diff --git a/Source/WebCore/rendering/svg/SVGTextQuery.cpp b/Source/WebCore/rendering/svg/SVGTextQuery.cpp
index 42d511b..1a4cdab 100644
--- a/Source/WebCore/rendering/svg/SVGTextQuery.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextQuery.cpp
@@ -472,7 +472,10 @@ struct ExtentOfCharacterData : SVGTextQuery::Data {
 
 static inline void calculateGlyphBoundaries(SVGTextQuery::Data* queryData, const SVGTextFragment& fragment, int startPosition, FloatRect& extent)
 {
-    extent.setLocation(FloatPoint(fragment.x, fragment.y - queryData->textRenderer->style()->font().ascent()));
+    float scalingFactor = queryData->textRenderer->scalingFactor();
+    ASSERT(scalingFactor);
+
+    extent.setLocation(FloatPoint(fragment.x, fragment.y - queryData->textRenderer->scaledFont().fontMetrics().floatAscent() / scalingFactor));
 
     if (startPosition) {
         SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.positionListOffset, startPosition);
diff --git a/Source/WebCore/storage/Database.cpp b/Source/WebCore/storage/Database.cpp
index 8ef780e..75f616a 100644
--- a/Source/WebCore/storage/Database.cpp
+++ b/Source/WebCore/storage/Database.cpp
@@ -36,7 +36,7 @@
 #include "DatabaseThread.h"
 #include "DatabaseTracker.h"
 #include "Document.h"
-#include "InspectorInstrumentation.h"
+#include "InspectorDatabaseInstrumentation.h"
 #include "Logging.h"
 #include "NotImplemented.h"
 #include "Page.h"
@@ -107,7 +107,7 @@ PassRefPtr<Database> Database::openDatabase(ScriptExecutionContext* context, con
 
     context->setHasOpenDatabases();
 
-    InspectorInstrumentation::didOpenDatabase(context, database.get(), context->securityOrigin()->host(), name, expectedVersion);
+    InspectorInstrumentation::didOpenDatabase(context, database, context->securityOrigin()->host(), name, expectedVersion);
 
     // If it's a new database and a creation callback was provided, reset the expected
     // version to "" and schedule the creation callback. Because of some subtle String
diff --git a/Source/WebCore/storage/IDBAbortEvent.cpp b/Source/WebCore/storage/IDBAbortEvent.cpp
index 21760f8..980d656 100644
--- a/Source/WebCore/storage/IDBAbortEvent.cpp
+++ b/Source/WebCore/storage/IDBAbortEvent.cpp
@@ -36,13 +36,13 @@
 
 namespace WebCore {
 
-PassRefPtr<IDBAbortEvent> IDBAbortEvent::create()
+PassRefPtr<IDBAbortEvent> IDBAbortEvent::create(PassRefPtr<IDBAny> source)
 {
-    return adoptRef(new IDBAbortEvent());
+    return adoptRef(new IDBAbortEvent(source));
 }
 
-IDBAbortEvent::IDBAbortEvent()
-    : IDBEvent(eventNames().abortEvent, 0) // FIXME: set the source to the transaction
+IDBAbortEvent::IDBAbortEvent(PassRefPtr<IDBAny> source)
+    : IDBEvent(eventNames().abortEvent, source, true)
 {
 }
 
diff --git a/Source/WebCore/storage/IDBAbortEvent.h b/Source/WebCore/storage/IDBAbortEvent.h
index bdc2202..fc27989 100644
--- a/Source/WebCore/storage/IDBAbortEvent.h
+++ b/Source/WebCore/storage/IDBAbortEvent.h
@@ -40,14 +40,14 @@ namespace WebCore {
 
 class IDBAbortEvent : public IDBEvent {
 public:
-    static PassRefPtr<IDBAbortEvent> create();
+    static PassRefPtr<IDBAbortEvent> create(PassRefPtr<IDBAny> source);
     // FIXME: Need to allow creation of these events from JS.
     virtual ~IDBAbortEvent();
 
     virtual bool isIDBAbortEvent() const { return true; }
 
 private:
-    IDBAbortEvent();
+    IDBAbortEvent(PassRefPtr<IDBAny> source);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/IDBCallbacks.h b/Source/WebCore/storage/IDBCallbacks.h
index e62c085..29fb1c4 100644
--- a/Source/WebCore/storage/IDBCallbacks.h
+++ b/Source/WebCore/storage/IDBCallbacks.h
@@ -49,7 +49,6 @@ public:
     virtual ~IDBCallbacks() { }
 
     virtual void onError(PassRefPtr<IDBDatabaseError>) = 0;
-    virtual void onSuccess() = 0; // For "null".
     virtual void onSuccess(PassRefPtr<IDBCursorBackendInterface>) = 0;
     virtual void onSuccess(PassRefPtr<IDBDatabaseBackendInterface>) = 0;
     virtual void onSuccess(PassRefPtr<IDBIndexBackendInterface>) = 0;
diff --git a/Source/WebCore/storage/IDBCompleteEvent.cpp b/Source/WebCore/storage/IDBCompleteEvent.cpp
index f0ad9fc..20ee57a 100644
--- a/Source/WebCore/storage/IDBCompleteEvent.cpp
+++ b/Source/WebCore/storage/IDBCompleteEvent.cpp
@@ -36,13 +36,13 @@
 
 namespace WebCore {
 
-PassRefPtr<IDBCompleteEvent> IDBCompleteEvent::create()
+PassRefPtr<IDBCompleteEvent> IDBCompleteEvent::create(PassRefPtr<IDBAny> source)
 {
-    return adoptRef(new IDBCompleteEvent());
+    return adoptRef(new IDBCompleteEvent(source));
 }
 
-IDBCompleteEvent::IDBCompleteEvent()
-    : IDBEvent(eventNames().completeEvent, 0) // FIXME: set the source to the transaction
+IDBCompleteEvent::IDBCompleteEvent(PassRefPtr<IDBAny> source)
+    : IDBEvent(eventNames().completeEvent, source, false)
 {
 }
 
diff --git a/Source/WebCore/storage/IDBCompleteEvent.h b/Source/WebCore/storage/IDBCompleteEvent.h
index c407096..c004a72 100644
--- a/Source/WebCore/storage/IDBCompleteEvent.h
+++ b/Source/WebCore/storage/IDBCompleteEvent.h
@@ -40,14 +40,14 @@ namespace WebCore {
 
 class IDBCompleteEvent : public IDBEvent {
 public:
-    static PassRefPtr<IDBCompleteEvent> create();
+    static PassRefPtr<IDBCompleteEvent> create(PassRefPtr<IDBAny> source);
     // FIXME: Need to allow creation of these events from JS.
     virtual ~IDBCompleteEvent();
 
     virtual bool isIDBCompleteEvent() const { return true; }
 
 private:
-    IDBCompleteEvent();
+    IDBCompleteEvent(PassRefPtr<IDBAny> source);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/IDBCursor.cpp b/Source/WebCore/storage/IDBCursor.cpp
index 444c109..531cae1 100644
--- a/Source/WebCore/storage/IDBCursor.cpp
+++ b/Source/WebCore/storage/IDBCursor.cpp
@@ -33,13 +33,13 @@
 #include "IDBCursorBackendInterface.h"
 #include "IDBKey.h"
 #include "IDBRequest.h"
-#include "IDBTransactionBackendInterface.h"
+#include "IDBTransaction.h"
 #include "ScriptExecutionContext.h"
 #include "SerializedScriptValue.h"
 
 namespace WebCore {
 
-IDBCursor::IDBCursor(PassRefPtr<IDBCursorBackendInterface> backend, IDBRequest* request, IDBTransactionBackendInterface* transaction)
+IDBCursor::IDBCursor(PassRefPtr<IDBCursorBackendInterface> backend, IDBRequest* request, IDBTransaction* transaction)
     : m_backend(backend)
     , m_request(request)
     , m_transaction(transaction)
@@ -84,7 +84,7 @@ void IDBCursor::continueFunction(PassRefPtr<IDBKey> key, ExceptionCode& ec)
     if (m_request->resetReadyState(m_transaction.get()))
         m_backend->continueFunction(key, m_request, ec);
     else
-        ASSERT_NOT_REACHED();
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
 }
 
 PassRefPtr<IDBRequest> IDBCursor::deleteFunction(ScriptExecutionContext* context, ExceptionCode& ec)
diff --git a/Source/WebCore/storage/IDBCursor.h b/Source/WebCore/storage/IDBCursor.h
index 54bf51a..9f5ffad 100644
--- a/Source/WebCore/storage/IDBCursor.h
+++ b/Source/WebCore/storage/IDBCursor.h
@@ -40,9 +40,9 @@ class IDBCallbacks;
 class IDBCursorBackendInterface;
 class IDBKey;
 class IDBRequest;
+class IDBTransaction;
 class ScriptExecutionContext;
 class SerializedScriptValue;
-class IDBTransactionBackendInterface;
 
 class IDBCursor : public RefCounted<IDBCursor> {
 public:
@@ -52,7 +52,7 @@ public:
         PREV = 2,
         PREV_NO_DUPLICATE = 3,
     };
-    static PassRefPtr<IDBCursor> create(PassRefPtr<IDBCursorBackendInterface> backend, IDBRequest* request, IDBTransactionBackendInterface* transaction)
+    static PassRefPtr<IDBCursor> create(PassRefPtr<IDBCursorBackendInterface> backend, IDBRequest* request, IDBTransaction* transaction)
     {
         return adoptRef(new IDBCursor(backend, request, transaction));
     }
@@ -70,11 +70,11 @@ public:
     PassRefPtr<IDBRequest> deleteFunction(ScriptExecutionContext*, ExceptionCode&);
 
 private:
-    explicit IDBCursor(PassRefPtr<IDBCursorBackendInterface>, IDBRequest*, IDBTransactionBackendInterface*);
+    explicit IDBCursor(PassRefPtr<IDBCursorBackendInterface>, IDBRequest*, IDBTransaction*);
 
     RefPtr<IDBCursorBackendInterface> m_backend;
     RefPtr<IDBRequest> m_request;
-    RefPtr<IDBTransactionBackendInterface> m_transaction;
+    RefPtr<IDBTransaction> m_transaction;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/IDBCursor.idl b/Source/WebCore/storage/IDBCursor.idl
index 12d0baf..2e1459f 100644
--- a/Source/WebCore/storage/IDBCursor.idl
+++ b/Source/WebCore/storage/IDBCursor.idl
@@ -37,9 +37,8 @@ module storage {
         readonly attribute IDBKey key;
         readonly attribute IDBAny value;
 
-        // FIXME: Implement.
-        //[CallWith=ScriptExecutionContext] IDBRequest update(in SerializedScriptValue value)
-        //    raises (IDBDatabaseException);
+        [CallWith=ScriptExecutionContext] IDBRequest update(in SerializedScriptValue value)
+            raises (IDBDatabaseException);
         [ImplementationFunction=continueFunction] void continue(in [Optional] IDBKey key)
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext, ImplementationFunction=deleteFunction] IDBRequest delete()
diff --git a/Source/WebCore/storage/IDBCursorBackendImpl.cpp b/Source/WebCore/storage/IDBCursorBackendImpl.cpp
index d75e28d..089bb67 100644
--- a/Source/WebCore/storage/IDBCursorBackendImpl.cpp
+++ b/Source/WebCore/storage/IDBCursorBackendImpl.cpp
@@ -68,7 +68,6 @@ unsigned short IDBCursorBackendImpl::direction() const
 
 PassRefPtr<IDBKey> IDBCursorBackendImpl::key() const
 {
-    
     return m_currentKey;
 }
 
@@ -79,43 +78,15 @@ PassRefPtr<IDBAny> IDBCursorBackendImpl::value() const
     return IDBAny::create(m_currentIDBKeyValue.get());
 }
 
-void IDBCursorBackendImpl::update(PassRefPtr<SerializedScriptValue> prpValue, PassRefPtr<IDBCallbacks> prpCallbacks, ExceptionCode& ec)
+void IDBCursorBackendImpl::update(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBCallbacks> callbacks, ExceptionCode& ec)
 {
-    RefPtr<IDBCursorBackendImpl> cursor = this;
-    RefPtr<SerializedScriptValue> value = prpValue;
-    RefPtr<IDBCallbacks> callbacks = prpCallbacks;
-    // FIXME: Throw DATA_ERR and SERIAL_ERR when appropriate.
-    if (!m_transaction->scheduleTask(createCallbackTask(&IDBCursorBackendImpl::updateInternal, cursor, value, callbacks)))
+    if (!m_query || m_currentId == InvalidId || !m_isSerializedScriptValueCursor) {
         ec = IDBDatabaseException::NOT_ALLOWED_ERR;
-}
-
-void IDBCursorBackendImpl::updateInternal(ScriptExecutionContext*, PassRefPtr<IDBCursorBackendImpl> cursor, PassRefPtr<SerializedScriptValue> prpValue, PassRefPtr<IDBCallbacks> callbacks)
-{
-    // FIXME: This method doesn't update indexes. It's dangerous to call in its current state.
-    callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Not implemented."));
-    return;
-
-    RefPtr<SerializedScriptValue> value = prpValue;
-
-    if (!cursor->m_query || cursor->m_currentId == InvalidId) {
-        // FIXME: Use the proper error code when it's specced.
-        callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Operation not possible."));
         return;
     }
 
-    String sql = "UPDATE ObjectStoreData SET value = ? WHERE id = ?";
-    SQLiteStatement updateQuery(cursor->database(), sql);
-    
-    bool ok = updateQuery.prepare() == SQLResultOk;
-    ASSERT_UNUSED(ok, ok); // FIXME: Better error handling.
-    updateQuery.bindText(1, value->toWireString());
-    updateQuery.bindInt64(2, cursor->m_currentId);
-    ok = updateQuery.step() == SQLResultDone;
-    ASSERT_UNUSED(ok, ok); // FIXME: Better error handling.
-
-    if (cursor->m_isSerializedScriptValueCursor)
-        cursor->m_currentSerializedScriptValue = value.release();
-    callbacks->onSuccess();
+    RefPtr<IDBKey> key = m_currentIDBKeyValue ? m_currentIDBKeyValue : m_currentKey;
+    m_objectStore->put(value, key.release(), IDBObjectStoreBackendInterface::CursorUpdate, callbacks, m_transaction.get(), ec);
 }
 
 void IDBCursorBackendImpl::continueFunction(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks> prpCallbacks, ExceptionCode& ec)
@@ -127,6 +98,20 @@ void IDBCursorBackendImpl::continueFunction(PassRefPtr<IDBKey> prpKey, PassRefPt
         ec = IDBDatabaseException::NOT_ALLOWED_ERR;
 }
 
+bool IDBCursorBackendImpl::currentRowExists()
+{
+    String sql = m_currentIDBKeyValue ? "SELECT id FROM IndexData WHERE id = ?" : "SELECT id FROM ObjectStoreData WHERE id = ?";
+    SQLiteStatement statement(m_database->db(), sql);
+
+    bool ok = statement.prepare() == SQLResultOk;
+    ASSERT_UNUSED(ok, ok);
+
+    statement.bindInt64(1, m_currentId);
+    return statement.step() == SQLResultRow;
+}
+
+// IMPORTANT: If this ever 1) fires an 'error' event and 2) it's possible to fire another event afterwards,
+//            IDBRequest::hasPendingActivity() will need to be modified to handle this!!!
 void IDBCursorBackendImpl::continueFunctionInternal(ScriptExecutionContext*, PassRefPtr<IDBCursorBackendImpl> prpCursor, PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks> callbacks)
 {
     RefPtr<IDBCursorBackendImpl> cursor = prpCursor;
@@ -138,13 +123,17 @@ void IDBCursorBackendImpl::continueFunctionInternal(ScriptExecutionContext*, Pas
             cursor->m_currentKey = 0;
             cursor->m_currentSerializedScriptValue = 0;
             cursor->m_currentIDBKeyValue = 0;
-            callbacks->onSuccess();
+            callbacks->onSuccess(SerializedScriptValue::nullValue());
             return;
         }
 
         RefPtr<IDBKey> oldKey = cursor->m_currentKey;
         cursor->loadCurrentRow();
 
+        // Skip if this entry has been deleted from the object store.
+        if (!cursor->currentRowExists())
+            continue;
+
         // If a key was supplied, we must loop until we find that key (or hit the end).
         if (key && !key->isEqual(cursor->m_currentKey.get()))
             continue;
@@ -178,7 +167,7 @@ void IDBCursorBackendImpl::loadCurrentRow()
     m_currentId = m_query->getColumnInt64(0);
     m_currentKey = IDBKey::fromQuery(*m_query, 1);
     if (m_isSerializedScriptValueCursor)
-        m_currentSerializedScriptValue = SerializedScriptValue::createFromWire(m_query->getColumnText(4));
+        m_currentSerializedScriptValue = SerializedScriptValue::createFromWire(m_query->getColumnBlobAsString(4));
 
     m_currentIDBKeyValue = IDBKey::fromQuery(*m_query, 5);
 }
diff --git a/Source/WebCore/storage/IDBCursorBackendImpl.h b/Source/WebCore/storage/IDBCursorBackendImpl.h
index e3a8995..f459139 100644
--- a/Source/WebCore/storage/IDBCursorBackendImpl.h
+++ b/Source/WebCore/storage/IDBCursorBackendImpl.h
@@ -65,10 +65,10 @@ public:
 private:
     IDBCursorBackendImpl(IDBSQLiteDatabase*, PassRefPtr<IDBKeyRange>, IDBCursor::Direction, PassOwnPtr<SQLiteStatement> query, bool isSerializedScriptValueCursor, IDBTransactionBackendInterface*, IDBObjectStoreBackendInterface*);
 
+    bool currentRowExists();
     void loadCurrentRow();
     SQLiteDatabase& database() const;
 
-    static void updateInternal(ScriptExecutionContext*, PassRefPtr<IDBCursorBackendImpl>, PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBCallbacks>);
     static void continueFunctionInternal(ScriptExecutionContext*, PassRefPtr<IDBCursorBackendImpl>, PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>);
 
     static const int64_t InvalidId = -1;
@@ -80,11 +80,15 @@ private:
     OwnPtr<SQLiteStatement> m_query;
     bool m_isSerializedScriptValueCursor;
     int64_t m_currentId;
+
+    // The key in the objectStore or index that this cursor iterates over.
     RefPtr<IDBKey> m_currentKey;
 
     // m_isSerializedScriptValueCursor will only be available for object cursors.
     RefPtr<SerializedScriptValue> m_currentSerializedScriptValue;
+
     // FIXME: make the primary key available via script for all types of cursors.
+    // For cursors on indices, this is the key in the objectstore that corresponds to the current entry in the index.
     RefPtr<IDBKey> m_currentIDBKeyValue;
 
     RefPtr<IDBTransactionBackendInterface> m_transaction;
diff --git a/Source/WebCore/storage/IDBDatabase.cpp b/Source/WebCore/storage/IDBDatabase.cpp
index 33f004b..9a5eb6c 100644
--- a/Source/WebCore/storage/IDBDatabase.cpp
+++ b/Source/WebCore/storage/IDBDatabase.cpp
@@ -41,11 +41,16 @@
 
 namespace WebCore {
 
-// FIXME: We need to spec this differently.
-const unsigned long defaultTimeout = 0; // Infinite.
+PassRefPtr<IDBDatabase> IDBDatabase::create(ScriptExecutionContext* context, PassRefPtr<IDBDatabaseBackendInterface> database)
+{
+    return adoptRef(new IDBDatabase(context, database));
+}
 
-IDBDatabase::IDBDatabase(PassRefPtr<IDBDatabaseBackendInterface> backend)
-    : m_backend(backend)
+IDBDatabase::IDBDatabase(ScriptExecutionContext* context, PassRefPtr<IDBDatabaseBackendInterface> backend)
+    : ActiveDOMObject(context, this)
+    , m_backend(backend)
+    , m_noNewTransactions(false)
+    , m_stopped(false)
 {
     // We pass a reference of this object before it can be adopted.
     relaxAdoptionRequirement();
@@ -53,9 +58,10 @@ IDBDatabase::IDBDatabase(PassRefPtr<IDBDatabaseBackendInterface> backend)
 
 IDBDatabase::~IDBDatabase()
 {
+    ASSERT(m_stopped);
 }
 
-void IDBDatabase::setSetVersionTransaction(IDBTransactionBackendInterface* transaction)
+void IDBDatabase::setSetVersionTransaction(IDBTransaction* transaction)
 {
     m_setVersionTransaction = transaction;
 }
@@ -73,7 +79,7 @@ PassRefPtr<IDBObjectStore> IDBDatabase::createObjectStore(const String& name, co
     options.getKeyBool("autoIncrement", autoIncrement);
     // FIXME: Look up evictable and pass that on as well.
 
-    RefPtr<IDBObjectStoreBackendInterface> objectStore = m_backend->createObjectStore(name, keyPath, autoIncrement, m_setVersionTransaction.get(), ec);
+    RefPtr<IDBObjectStoreBackendInterface> objectStore = m_backend->createObjectStore(name, keyPath, autoIncrement, m_setVersionTransaction->backend(), ec);
     if (!objectStore) {
         ASSERT(ec);
         return 0;
@@ -88,7 +94,7 @@ void IDBDatabase::deleteObjectStore(const String& name, ExceptionCode& ec)
         return;
     }
 
-    m_backend->deleteObjectStore(name, m_setVersionTransaction.get(), ec);
+    m_backend->deleteObjectStore(name, m_setVersionTransaction->backend(), ec);
 }
 
 PassRefPtr<IDBRequest> IDBDatabase::setVersion(ScriptExecutionContext* context, const String& version, ExceptionCode& ec)
@@ -98,38 +104,27 @@ PassRefPtr<IDBRequest> IDBDatabase::setVersion(ScriptExecutionContext* context,
     return request;
 }
 
-PassRefPtr<IDBTransaction> IDBDatabase::transaction(ScriptExecutionContext* context, const OptionsObject& options, ExceptionCode& ec)
+PassRefPtr<IDBTransaction> IDBDatabase::transaction(ScriptExecutionContext* context, PassRefPtr<DOMStringList> prpStoreNames, unsigned short mode, ExceptionCode& ec)
 {
-    RefPtr<DOMStringList> storeNames = options.getKeyDOMStringList("objectStoreNames");
-    if (!storeNames) {
+    RefPtr<DOMStringList> storeNames = prpStoreNames;
+    if (!storeNames)
         storeNames = DOMStringList::create();
-        String storeName;
-        if (options.getKeyString("objectStoreNames", storeName))
-            storeNames->append(storeName);
-    }
 
-    // Gets cast to an unsigned short.
-    int32_t mode = IDBTransaction::READ_ONLY;
-    options.getKeyInt32("mode", mode);
     if (mode != IDBTransaction::READ_WRITE && mode != IDBTransaction::READ_ONLY) {
         // FIXME: May need to change when specced: http://www.w3.org/Bugs/Public/show_bug.cgi?id=11406
         ec = IDBDatabaseException::CONSTRAINT_ERR;
         return 0;
     }
-
-    // Gets cast to an unsigned long.
-    // FIXME: The spec needs to be updated on this. It should probably take a double.
-    int32_t timeout = defaultTimeout; 
-    options.getKeyInt32("timeout", timeout);
-    int64_t unsignedLongMax = std::numeric_limits<unsigned long>::max();
-    if (timeout < 0 || timeout > unsignedLongMax)
-        timeout = defaultTimeout; // Ignore illegal values.
+    if (m_noNewTransactions) {
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
+        return 0;
+    }
 
     // We need to create a new transaction synchronously. Locks are acquired asynchronously. Operations
     // can be queued against the transaction at any point. They will start executing as soon as the
     // appropriate locks have been acquired.
     // Also note that each backend object corresponds to exactly one IDBTransaction object.
-    RefPtr<IDBTransactionBackendInterface> transactionBackend = m_backend->transaction(storeNames.get(), mode, timeout, ec);
+    RefPtr<IDBTransactionBackendInterface> transactionBackend = m_backend->transaction(storeNames.get(), mode, ec);
     if (!transactionBackend) {
         ASSERT(ec);
         return 0;
@@ -141,7 +136,40 @@ PassRefPtr<IDBTransaction> IDBDatabase::transaction(ScriptExecutionContext* cont
 
 void IDBDatabase::close()
 {
-    m_backend->close();
+    m_noNewTransactions = true;
+}
+
+bool IDBDatabase::hasPendingActivity() const
+{
+    // FIXME: Try to find some way not to just leak this object until page navigation.
+    // FIXME: In an ideal world, we should return true as long as anyone has or can
+    //        get a handle to us or any derivative transaction/request object and any
+    //        of those have event listeners. This is in order to handle user generated
+    //        events properly.
+    return !m_stopped || ActiveDOMObject::hasPendingActivity();
+}
+
+void IDBDatabase::stop()
+{
+    // Stop fires at a deterministic time, so we need to call close in it.
+    close();
+
+    m_stopped = true;
+}
+
+ScriptExecutionContext* IDBDatabase::scriptExecutionContext() const
+{
+    return ActiveDOMObject::scriptExecutionContext();
+}
+
+EventTargetData* IDBDatabase::eventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+EventTargetData* IDBDatabase::ensureEventTargetData()
+{
+    return &m_eventTargetData;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/IDBDatabase.h b/Source/WebCore/storage/IDBDatabase.h
index 9ebbf00..f90ddd3 100644
--- a/Source/WebCore/storage/IDBDatabase.h
+++ b/Source/WebCore/storage/IDBDatabase.h
@@ -26,7 +26,10 @@
 #ifndef IDBDatabase_h
 #define IDBDatabase_h
 
+#include "ActiveDOMObject.h"
 #include "DOMStringList.h"
+#include "Event.h"
+#include "EventTarget.h"
 #include "ExceptionCode.h"
 #include "IDBDatabaseBackendInterface.h"
 #include "IDBObjectStore.h"
@@ -42,17 +45,13 @@ namespace WebCore {
 
 class IDBAny;
 class IDBRequest;
-class ScriptExecutionContext;
 
-class IDBDatabase : public RefCounted<IDBDatabase> {
+class IDBDatabase : public RefCounted<IDBDatabase>, public EventTarget, public ActiveDOMObject {
 public:
-    static PassRefPtr<IDBDatabase> create(PassRefPtr<IDBDatabaseBackendInterface> database)
-    {
-        return adoptRef(new IDBDatabase(database));
-    }
+    static PassRefPtr<IDBDatabase> create(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendInterface>);
     ~IDBDatabase();
 
-    void setSetVersionTransaction(IDBTransactionBackendInterface*);
+    void setSetVersionTransaction(IDBTransaction*);
 
     // Implement the IDL
     String name() const { return m_backend->name(); }
@@ -61,19 +60,45 @@ public:
 
     // FIXME: Try to modify the code generator so this is unneeded.
     PassRefPtr<IDBObjectStore> createObjectStore(const String& name, ExceptionCode& ec) { return createObjectStore(name, OptionsObject(), ec); }
-    PassRefPtr<IDBTransaction> transaction(ScriptExecutionContext* context, ExceptionCode& ec) { return transaction(context, OptionsObject(), ec); }
+    PassRefPtr<IDBTransaction> transaction(ScriptExecutionContext* context, ExceptionCode& ec) { return transaction(context, 0, ec); }
+    PassRefPtr<IDBTransaction> transaction(ScriptExecutionContext* context, PassRefPtr<DOMStringList> storeNames, ExceptionCode& ec) { return transaction(context, storeNames, IDBTransaction::READ_ONLY, ec); }
+    PassRefPtr<IDBTransaction> transaction(ScriptExecutionContext*, PassRefPtr<DOMStringList>, unsigned short mode, ExceptionCode&);
 
     PassRefPtr<IDBObjectStore> createObjectStore(const String& name, const OptionsObject&, ExceptionCode&);
     void deleteObjectStore(const String& name, ExceptionCode&);
     PassRefPtr<IDBRequest> setVersion(ScriptExecutionContext*, const String& version, ExceptionCode&);
-    PassRefPtr<IDBTransaction> transaction(ScriptExecutionContext*, const OptionsObject&, ExceptionCode&);
     void close();
 
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(abort);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
+
+    // ActiveDOMObject
+    virtual bool hasPendingActivity() const;
+    virtual void stop();
+
+    // EventTarget
+    virtual IDBDatabase* toIDBDatabase() { return this; }
+    virtual ScriptExecutionContext* scriptExecutionContext() const;
+
+    using RefCounted<IDBDatabase>::ref;
+    using RefCounted<IDBDatabase>::deref;
+
 private:
-    IDBDatabase(PassRefPtr<IDBDatabaseBackendInterface>);
+    IDBDatabase(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendInterface>);
+
+    // EventTarget
+    virtual void refEventTarget() { ref(); }
+    virtual void derefEventTarget() { deref(); }
+    virtual EventTargetData* eventTargetData();
+    virtual EventTargetData* ensureEventTargetData();
 
     RefPtr<IDBDatabaseBackendInterface> m_backend;
-    RefPtr<IDBTransactionBackendInterface> m_setVersionTransaction;
+    RefPtr<IDBTransaction> m_setVersionTransaction;
+
+    bool m_noNewTransactions;
+    bool m_stopped;
+
+    EventTargetData m_eventTargetData;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/IDBDatabase.idl b/Source/WebCore/storage/IDBDatabase.idl
index 7eb43e9..3922144 100644
--- a/Source/WebCore/storage/IDBDatabase.idl
+++ b/Source/WebCore/storage/IDBDatabase.idl
@@ -26,22 +26,35 @@
 module storage {
 
     interface [
-        Conditional=INDEXED_DATABASE
+        Conditional=INDEXED_DATABASE,
+        EventTarget
     ] IDBDatabase {
         readonly attribute DOMString name;
         readonly attribute DOMString version;
         readonly attribute DOMStringList objectStoreNames;
 
+        attribute EventListener onabort;
+        attribute EventListener onerror;
+
         IDBObjectStore createObjectStore(in DOMString name, in [Optional] OptionsObject options)
             raises (IDBDatabaseException);
         void deleteObjectStore(in DOMString name)
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest setVersion(in DOMString version)
             raises (IDBDatabaseException);
-        [CallWith=ScriptExecutionContext] IDBTransaction transaction(in [Optional] OptionsObject optionsObject)
+        [CallWith=ScriptExecutionContext] IDBTransaction transaction(in [Optional] DOMStringList storeNames, in [Optional] unsigned short mode)
             raises (IDBDatabaseException);
-        // FIXME: Implement.
-        //void close();
+        void close();
+
+        // EventTarget interface
+        void addEventListener(in DOMString type,
+                              in EventListener listener,
+                              in boolean useCapture);
+        void removeEventListener(in DOMString type,
+                                 in EventListener listener,
+                                 in boolean useCapture);
+        boolean dispatchEvent(in Event evt) 
+            raises(EventException);
     };
 
 }
diff --git a/Source/WebCore/storage/IDBDatabaseBackendImpl.cpp b/Source/WebCore/storage/IDBDatabaseBackendImpl.cpp
index fa9a336..133c5ae 100644
--- a/Source/WebCore/storage/IDBDatabaseBackendImpl.cpp
+++ b/Source/WebCore/storage/IDBDatabaseBackendImpl.cpp
@@ -214,7 +214,7 @@ void IDBDatabaseBackendImpl::setVersion(const String& version, PassRefPtr<IDBCal
     RefPtr<IDBDatabaseBackendImpl> database = this;
     RefPtr<IDBCallbacks> callbacks = prpCallbacks;
     RefPtr<DOMStringList> objectStoreNames = DOMStringList::create();
-    RefPtr<IDBTransactionBackendInterface> transaction = IDBTransactionBackendImpl::create(objectStoreNames.get(), IDBTransaction::VERSION_CHANGE, 0, this);
+    RefPtr<IDBTransactionBackendInterface> transaction = IDBTransactionBackendImpl::create(objectStoreNames.get(), IDBTransaction::VERSION_CHANGE, this);
     if (!transaction->scheduleTask(createCallbackTask(&IDBDatabaseBackendImpl::setVersionInternal, database, version, callbacks, transaction),
                                    createCallbackTask(&IDBDatabaseBackendImpl::resetVersion, database, m_version))) {
         ec = IDBDatabaseException::NOT_ALLOWED_ERR;
@@ -234,7 +234,7 @@ void IDBDatabaseBackendImpl::setVersionInternal(ScriptExecutionContext*, PassRef
     callbacks->onSuccess(transaction);
 }
 
-PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseBackendImpl::transaction(DOMStringList* objectStoreNames, unsigned short mode, unsigned long timeout, ExceptionCode& ec)
+PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseBackendImpl::transaction(DOMStringList* objectStoreNames, unsigned short mode, ExceptionCode& ec)
 {
     for (size_t i = 0; i < objectStoreNames->length(); ++i) {
         if (!m_objectStores.contains(objectStoreNames->item(i))) {
@@ -244,7 +244,7 @@ PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseBackendImpl::transaction(D
     }
 
     // FIXME: Return not allowed err if close has been called.
-    return IDBTransactionBackendImpl::create(objectStoreNames, mode, timeout, this);
+    return IDBTransactionBackendImpl::create(objectStoreNames, mode, this);
 }
 
 void IDBDatabaseBackendImpl::close()
diff --git a/Source/WebCore/storage/IDBDatabaseBackendImpl.h b/Source/WebCore/storage/IDBDatabaseBackendImpl.h
index 570f6a5..8942968 100644
--- a/Source/WebCore/storage/IDBDatabaseBackendImpl.h
+++ b/Source/WebCore/storage/IDBDatabaseBackendImpl.h
@@ -61,7 +61,7 @@ public:
     virtual PassRefPtr<IDBObjectStoreBackendInterface> createObjectStore(const String& name, const String& keyPath, bool autoIncrement, IDBTransactionBackendInterface*, ExceptionCode&);
     virtual void deleteObjectStore(const String& name, IDBTransactionBackendInterface*, ExceptionCode&);
     virtual void setVersion(const String& version, PassRefPtr<IDBCallbacks>, ExceptionCode&);
-    virtual PassRefPtr<IDBTransactionBackendInterface> transaction(DOMStringList* objectStoreNames, unsigned short mode, unsigned long timeout, ExceptionCode&);
+    virtual PassRefPtr<IDBTransactionBackendInterface> transaction(DOMStringList* objectStoreNames, unsigned short mode, ExceptionCode&);
     virtual void close();
 
     PassRefPtr<IDBObjectStoreBackendInterface> objectStore(const String& name);
diff --git a/Source/WebCore/storage/IDBDatabaseBackendInterface.h b/Source/WebCore/storage/IDBDatabaseBackendInterface.h
index 0dc59b1..9cc7230 100644
--- a/Source/WebCore/storage/IDBDatabaseBackendInterface.h
+++ b/Source/WebCore/storage/IDBDatabaseBackendInterface.h
@@ -57,7 +57,7 @@ public:
     virtual PassRefPtr<IDBObjectStoreBackendInterface> createObjectStore(const String& name, const String& keyPath, bool autoIncrement, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
     virtual void deleteObjectStore(const String& name, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
     virtual void setVersion(const String& version, PassRefPtr<IDBCallbacks>, ExceptionCode&) = 0;
-    virtual PassRefPtr<IDBTransactionBackendInterface> transaction(DOMStringList* storeNames, unsigned short mode, unsigned long timeout, ExceptionCode&) = 0;
+    virtual PassRefPtr<IDBTransactionBackendInterface> transaction(DOMStringList* storeNames, unsigned short mode, ExceptionCode&) = 0;
     virtual void close() = 0;
 };
 
diff --git a/Source/WebCore/storage/IDBErrorEvent.cpp b/Source/WebCore/storage/IDBErrorEvent.cpp
index cba980d..e576fa8 100644
--- a/Source/WebCore/storage/IDBErrorEvent.cpp
+++ b/Source/WebCore/storage/IDBErrorEvent.cpp
@@ -43,7 +43,7 @@ PassRefPtr<IDBErrorEvent> IDBErrorEvent::create(PassRefPtr<IDBAny> source, const
 }
 
 IDBErrorEvent::IDBErrorEvent(PassRefPtr<IDBAny> source, const IDBDatabaseError& error)
-    : IDBEvent(eventNames().errorEvent, source)
+    : IDBEvent(eventNames().errorEvent, source, true)
     , m_code(error.code())
     , m_message(error.message())
 {
diff --git a/Source/WebCore/storage/IDBEvent.cpp b/Source/WebCore/storage/IDBEvent.cpp
index f9f6060..a7f3db1 100644
--- a/Source/WebCore/storage/IDBEvent.cpp
+++ b/Source/WebCore/storage/IDBEvent.cpp
@@ -35,8 +35,8 @@
 
 namespace WebCore {
 
-IDBEvent::IDBEvent(const AtomicString& type, PassRefPtr<IDBAny> source)
-    : Event(type, false, false)
+IDBEvent::IDBEvent(const AtomicString& type, PassRefPtr<IDBAny> source, bool canBubble)
+    : Event(type, canBubble, true)
     , m_source(source)
 {
 }
@@ -50,6 +50,57 @@ PassRefPtr<IDBAny> IDBEvent::source()
     return m_source;
 }
 
+bool IDBEvent::dispatch(Vector<RefPtr<EventTarget> >& eventTargets)
+{
+    size_t size = eventTargets.size();
+    ASSERT(size);
+
+    setEventPhase(Event::CAPTURING_PHASE);
+    for (size_t i = size - 1; i; --i) { // Don't do the first element.
+        setCurrentTarget(eventTargets[i].get());
+        eventTargets[i]->fireEventListeners(this);
+        if (propagationStopped())
+            goto doneDispatching;
+    }
+
+    setEventPhase(Event::AT_TARGET);
+    setCurrentTarget(eventTargets[0].get());
+    eventTargets[0]->fireEventListeners(this);
+    if (propagationStopped() || !bubbles() || cancelBubble())
+        goto doneDispatching;
+
+    setEventPhase(Event::BUBBLING_PHASE);
+    for (size_t i = 1; i < size; ++i) { // Don't do the first element.
+        setCurrentTarget(eventTargets[i].get());
+        eventTargets[i]->fireEventListeners(this);
+        if (propagationStopped() || cancelBubble())
+            goto doneDispatching;
+    }
+
+    // FIXME: "...However, we also wanted to integrate the window.onerror feature in
+    //        HTML5. So after we've fired an "error" event, if .preventDefault() was
+    //        never called on the event, we fire an error event on the window (can't
+    //        remember if this happens before or after we abort the transaction).
+    //        This is a separate event, which for example means that even if you
+    //        attach a capturing "error" handler on window, you won't see any events
+    //        unless an error really went unhandled. And you also can't call
+    //        .preventDefault on the error event fired on the window in order to
+    //        prevent the transaction from being aborted. It's purely there for
+    //        error reporting and distinctly different from the event propagating to
+    //        the window.
+    //        
+    //        This is similar to how "error" events are handled in workers.
+    //        
+    //        (I think that so far webkit hasn't implemented the window.onerror
+    //        feature yet, so you probably don't want to fire the separate error
+    //        event on the window until that has been implemented)."
+
+doneDispatching:
+    setCurrentTarget(0);
+    setEventPhase(0);
+    return !defaultPrevented();
+}
+
 } // namespace WebCore
 
 #endif
diff --git a/Source/WebCore/storage/IDBEvent.h b/Source/WebCore/storage/IDBEvent.h
index c44e449..d28885b 100644
--- a/Source/WebCore/storage/IDBEvent.h
+++ b/Source/WebCore/storage/IDBEvent.h
@@ -32,8 +32,10 @@
 #if ENABLE(INDEXED_DATABASE)
 
 #include "Event.h"
+#include "EventTarget.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
@@ -44,9 +46,10 @@ public:
     virtual ~IDBEvent();
 
     PassRefPtr<IDBAny> source();
+    bool dispatch(Vector<RefPtr<EventTarget> >&); // The target first and then its ancestors in order of how the event bubbles.
 
 protected:
-    IDBEvent(const AtomicString& type, PassRefPtr<IDBAny> source);
+    IDBEvent(const AtomicString& type, PassRefPtr<IDBAny> source, bool canBubble);
 
 private:
     RefPtr<IDBAny> m_source;
diff --git a/Source/WebCore/storage/IDBFactoryBackendImpl.cpp b/Source/WebCore/storage/IDBFactoryBackendImpl.cpp
index 45cffeb..0e883cf 100644
--- a/Source/WebCore/storage/IDBFactoryBackendImpl.cpp
+++ b/Source/WebCore/storage/IDBFactoryBackendImpl.cpp
@@ -49,7 +49,7 @@ IDBFactoryBackendImpl::IDBFactoryBackendImpl()
     : m_transactionCoordinator(IDBTransactionCoordinator::create())
 {
 }
-
+ 
 IDBFactoryBackendImpl::~IDBFactoryBackendImpl()
 {
 }
@@ -93,11 +93,24 @@ static PassRefPtr<IDBSQLiteDatabase> openSQLiteDatabase(SecurityOrigin* security
     return sqliteDatabase.release();
 }
 
+static bool runCommands(SQLiteDatabase& sqliteDatabase, const char** commands, size_t numberOfCommands)
+{
+    SQLiteTransaction transaction(sqliteDatabase, false);
+    transaction.begin();
+    for (size_t i = 0; i < numberOfCommands; ++i) {
+        if (!sqliteDatabase.executeCommand(commands[i])) {
+            LOG_ERROR("Failed to run the following command for IndexedDB: %s", commands[i]);
+            return false;
+        }
+    }
+    transaction.commit();
+    return true;
+}
+
 static bool createTables(SQLiteDatabase& sqliteDatabase)
 {
     if (sqliteDatabase.tableExists("Databases"))
         return true;
-
     static const char* commands[] = {
         "CREATE TABLE Databases (id INTEGER PRIMARY KEY, name TEXT NOT NULL, description TEXT NOT NULL, version TEXT NOT NULL)",
         "CREATE UNIQUE INDEX Databases_name ON Databases(name)",
@@ -117,17 +130,7 @@ static bool createTables(SQLiteDatabase& sqliteDatabase)
         "CREATE INDEX IndexData_indexId ON IndexData(indexId)",
         };
 
-    SQLiteTransaction transaction(sqliteDatabase, false);
-    transaction.begin();
-    for (size_t i = 0; i < arraysize(commands); ++i) {
-        if (!sqliteDatabase.executeCommand(commands[i])) {
-            // FIXME: We should try to recover from this situation. Maybe nuke the database and start over?
-            LOG_ERROR("Failed to run the following command for IndexedDB: %s", commands[i]);
-            return false;
-        }
-    }
-    transaction.commit();
-    return true;
+    return runCommands(sqliteDatabase, commands, sizeof(commands) / sizeof(commands[0]));
 }
 
 static bool createMetaDataTable(SQLiteDatabase& sqliteDatabase)
@@ -137,14 +140,7 @@ static bool createMetaDataTable(SQLiteDatabase& sqliteDatabase)
         "INSERT INTO MetaData VALUES ('version', 1)",
     };
 
-    SQLiteTransaction transaction(sqliteDatabase, false);
-    transaction.begin();
-    for (size_t i = 0; i < arraysize(commands); ++i) {
-        if (!sqliteDatabase.executeCommand(commands[i]))
-            return false;
-    }
-    transaction.commit();
-    return true;
+    return runCommands(sqliteDatabase, commands, sizeof(commands) / sizeof(commands[0]));
 }
 
 static bool getDatabaseVersion(SQLiteDatabase& sqliteDatabase, int* databaseVersion)
@@ -187,19 +183,27 @@ static bool migrateDatabase(SQLiteDatabase& sqliteDatabase)
             "UPDATE MetaData SET value = 2 WHERE name = 'version'",
         };
 
-        SQLiteTransaction transaction(sqliteDatabase, false);
-        transaction.begin();
-        for (size_t i = 0; i < arraysize(commands); ++i) {
-            if (!sqliteDatabase.executeCommand(commands[i])) {
-                LOG_ERROR("Failed to run the following command for IndexedDB: %s", commands[i]);
-                return false;
-            }
-        }
-        transaction.commit();
+        if (!runCommands(sqliteDatabase, commands, sizeof(commands) / sizeof(commands[0])))
+            return false;
 
         databaseVersion = 2;
     }
 
+    if (databaseVersion == 2) {
+        // We need to make the ObjectStoreData.value be a BLOB instead of TEXT.
+        static const char* commands[] = {
+            "DROP TABLE IF EXISTS ObjectStoreData", // This drops associated indices.
+            "CREATE TABLE ObjectStoreData (id INTEGER PRIMARY KEY, objectStoreId INTEGER NOT NULL REFERENCES ObjectStore(id), keyString TEXT, keyDate REAL, keyNumber REAL, value BLOB NOT NULL)",
+            "CREATE UNIQUE INDEX ObjectStoreData_composit ON ObjectStoreData(keyString, keyDate, keyNumber, objectStoreId)",
+            "UPDATE MetaData SET value = 3 WHERE name = 'version'",
+        };
+
+        if (!runCommands(sqliteDatabase, commands, sizeof(commands) / sizeof(commands[0])))
+            return false;
+
+        databaseVersion = 3;
+    }
+
     return true;
 }
 
diff --git a/Source/WebCore/storage/IDBFactoryBackendInterface.cpp b/Source/WebCore/storage/IDBFactoryBackendInterface.cpp
index 935ccac..ac13652 100644
--- a/Source/WebCore/storage/IDBFactoryBackendInterface.cpp
+++ b/Source/WebCore/storage/IDBFactoryBackendInterface.cpp
@@ -43,10 +43,6 @@ PassRefPtr<IDBFactoryBackendInterface> IDBFactoryBackendInterface::create()
     return IDBFactoryBackendImpl::create();
 }
 
-IDBFactoryBackendInterface::~IDBFactoryBackendInterface()
-{
-}
-
 } // namespace WebCore
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebCore/storage/IDBFactoryBackendInterface.h b/Source/WebCore/storage/IDBFactoryBackendInterface.h
index 166d517..e05f316 100644
--- a/Source/WebCore/storage/IDBFactoryBackendInterface.h
+++ b/Source/WebCore/storage/IDBFactoryBackendInterface.h
@@ -49,7 +49,7 @@ class SecurityOrigin;
 class IDBFactoryBackendInterface : public ThreadSafeShared<IDBFactoryBackendInterface> {
 public:
     static PassRefPtr<IDBFactoryBackendInterface> create();
-    virtual ~IDBFactoryBackendInterface();
+    virtual ~IDBFactoryBackendInterface() { }
 
     virtual void open(const String& name, PassRefPtr<IDBCallbacks>, PassRefPtr<SecurityOrigin>, Frame*, const String& dataDir, int64_t maximumSize) = 0;
 };
diff --git a/Source/WebCore/storage/IDBIndex.cpp b/Source/WebCore/storage/IDBIndex.cpp
index 8a38a27..615767b 100644
--- a/Source/WebCore/storage/IDBIndex.cpp
+++ b/Source/WebCore/storage/IDBIndex.cpp
@@ -34,13 +34,13 @@
 #include "IDBKey.h"
 #include "IDBKeyRange.h"
 #include "IDBRequest.h"
-#include "IDBTransactionBackendInterface.h"
+#include "IDBTransaction.h"
 
 namespace WebCore {
 
 static const unsigned short defaultDirection = IDBCursor::NEXT;
 
-IDBIndex::IDBIndex(PassRefPtr<IDBIndexBackendInterface> backend, IDBTransactionBackendInterface* transaction)
+IDBIndex::IDBIndex(PassRefPtr<IDBIndexBackendInterface> backend, IDBTransaction* transaction)
     : m_backend(backend)
     , m_transaction(transaction)
 {
@@ -52,13 +52,8 @@ IDBIndex::~IDBIndex()
 {
 }
 
-PassRefPtr<IDBRequest> IDBIndex::openCursor(ScriptExecutionContext* context, const OptionsObject& options, ExceptionCode& ec)
+PassRefPtr<IDBRequest> IDBIndex::openCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, unsigned short direction, ExceptionCode& ec)
 {
-    RefPtr<IDBKeyRange> keyRange = options.getKeyKeyRange("range");
-
-    // Converted to an unsigned short.
-    int32_t direction = defaultDirection;
-    options.getKeyInt32("direction", direction);
     if (direction != IDBCursor::NEXT && direction != IDBCursor::NEXT_NO_DUPLICATE && direction != IDBCursor::PREV && direction != IDBCursor::PREV_NO_DUPLICATE) {
         // FIXME: May need to change when specced: http://www.w3.org/Bugs/Public/show_bug.cgi?id=11406
         ec = IDBDatabaseException::CONSTRAINT_ERR;
@@ -66,19 +61,14 @@ PassRefPtr<IDBRequest> IDBIndex::openCursor(ScriptExecutionContext* context, con
     }
 
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
-    m_backend->openCursor(keyRange, direction, request, m_transaction.get(), ec);
+    m_backend->openCursor(keyRange, direction, request, m_transaction->backend(), ec);
     if (ec)
         return 0;
     return request;
 }
 
-PassRefPtr<IDBRequest> IDBIndex::openKeyCursor(ScriptExecutionContext* context, const OptionsObject& options, ExceptionCode& ec)
+PassRefPtr<IDBRequest> IDBIndex::openKeyCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, unsigned short direction, ExceptionCode& ec)
 {
-    RefPtr<IDBKeyRange> keyRange = options.getKeyKeyRange("range");
-
-    // Converted to an unsigned short.
-    int32_t direction = defaultDirection;
-    options.getKeyInt32("direction", direction);
     if (direction != IDBCursor::NEXT && direction != IDBCursor::NEXT_NO_DUPLICATE && direction != IDBCursor::PREV && direction != IDBCursor::PREV_NO_DUPLICATE) {
         // FIXME: May need to change when specced: http://www.w3.org/Bugs/Public/show_bug.cgi?id=11406
         ec = IDBDatabaseException::CONSTRAINT_ERR;
@@ -86,7 +76,7 @@ PassRefPtr<IDBRequest> IDBIndex::openKeyCursor(ScriptExecutionContext* context,
     }
 
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
-    m_backend->openKeyCursor(keyRange, direction, request, m_transaction.get(), ec);
+    m_backend->openKeyCursor(keyRange, direction, request, m_transaction->backend(), ec);
     if (ec)
         return 0;
     return request;
@@ -95,7 +85,7 @@ PassRefPtr<IDBRequest> IDBIndex::openKeyCursor(ScriptExecutionContext* context,
 PassRefPtr<IDBRequest> IDBIndex::get(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
-    m_backend->get(key, request, m_transaction.get(), ec);
+    m_backend->get(key, request, m_transaction->backend(), ec);
     if (ec)
         return 0;
     return request;
@@ -104,7 +94,7 @@ PassRefPtr<IDBRequest> IDBIndex::get(ScriptExecutionContext* context, PassRefPtr
 PassRefPtr<IDBRequest> IDBIndex::getKey(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
-    m_backend->getKey(key, request, m_transaction.get(), ec);
+    m_backend->getKey(key, request, m_transaction->backend(), ec);
     if (ec)
         return 0;
     return request;
diff --git a/Source/WebCore/storage/IDBIndex.h b/Source/WebCore/storage/IDBIndex.h
index 7f1aae3..10b46f1 100644
--- a/Source/WebCore/storage/IDBIndex.h
+++ b/Source/WebCore/storage/IDBIndex.h
@@ -30,7 +30,6 @@
 #include "IDBIndexBackendInterface.h"
 #include "IDBKeyRange.h"
 #include "IDBRequest.h"
-#include "OptionsObject.h"
 #include "PlatformString.h"
 #include <wtf/Forward.h>
 
@@ -40,7 +39,7 @@ namespace WebCore {
 
 class IDBIndex : public RefCounted<IDBIndex> {
 public:
-    static PassRefPtr<IDBIndex> create(PassRefPtr<IDBIndexBackendInterface> backend, IDBTransactionBackendInterface* transaction)
+    static PassRefPtr<IDBIndex> create(PassRefPtr<IDBIndexBackendInterface> backend, IDBTransaction* transaction)
     {
         return adoptRef(new IDBIndex(backend, transaction));
     }
@@ -53,19 +52,22 @@ public:
     bool unique() const { return m_backend->unique(); }
 
     // FIXME: Try to modify the code generator so this is unneeded.
-    PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext* context, ExceptionCode& ec) { return openCursor(context, OptionsObject(), ec); }
-    PassRefPtr<IDBRequest> openKeyCursor(ScriptExecutionContext* context, ExceptionCode& ec) { return openKeyCursor(context, OptionsObject(), ec); }
+    PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext* context, ExceptionCode& ec) { return openCursor(context, 0, ec); }
+    PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, ExceptionCode& ec) { return openCursor(context, keyRange, IDBCursor::NEXT, ec); }
+    PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext*, PassRefPtr<IDBKeyRange>, unsigned short direction, ExceptionCode&);
+
+    PassRefPtr<IDBRequest> openKeyCursor(ScriptExecutionContext* context, ExceptionCode& ec) { return openKeyCursor(context, 0, ec); } 
+    PassRefPtr<IDBRequest> openKeyCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, ExceptionCode& ec) { return openKeyCursor(context, keyRange, IDBCursor::NEXT, ec); }
+    PassRefPtr<IDBRequest> openKeyCursor(ScriptExecutionContext*, PassRefPtr<IDBKeyRange>, unsigned short direction, ExceptionCode&);
 
-    PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext*, const OptionsObject&, ExceptionCode&);
-    PassRefPtr<IDBRequest> openKeyCursor(ScriptExecutionContext*, const OptionsObject&, ExceptionCode&);
     PassRefPtr<IDBRequest> get(ScriptExecutionContext*, PassRefPtr<IDBKey>, ExceptionCode&);
     PassRefPtr<IDBRequest> getKey(ScriptExecutionContext*, PassRefPtr<IDBKey>, ExceptionCode&);
 
 private:
-    IDBIndex(PassRefPtr<IDBIndexBackendInterface>, IDBTransactionBackendInterface* transaction);
+    IDBIndex(PassRefPtr<IDBIndexBackendInterface>, IDBTransaction*);
 
     RefPtr<IDBIndexBackendInterface> m_backend;
-    RefPtr<IDBTransactionBackendInterface> m_transaction;
+    RefPtr<IDBTransaction> m_transaction;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/IDBIndex.idl b/Source/WebCore/storage/IDBIndex.idl
index e6ba1e6..13089cc 100644
--- a/Source/WebCore/storage/IDBIndex.idl
+++ b/Source/WebCore/storage/IDBIndex.idl
@@ -33,9 +33,9 @@ module storage {
         readonly attribute DOMString keyPath;
         readonly attribute boolean unique;
 
-        [CallWith=ScriptExecutionContext] IDBRequest openCursor(in [Optional] OptionsObject options)
+        [CallWith=ScriptExecutionContext] IDBRequest openCursor(in [Optional] IDBKeyRange range, in [Optional] unsigned short direction)
             raises (IDBDatabaseException);
-        [CallWith=ScriptExecutionContext] IDBRequest openKeyCursor(in [Optional] OptionsObject options)
+        [CallWith=ScriptExecutionContext] IDBRequest openKeyCursor(in [Optional] IDBKeyRange range, in [Optional] unsigned short direction))
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest get(in IDBKey key)
             raises (IDBDatabaseException);
diff --git a/Source/WebCore/storage/IDBIndexBackendImpl.cpp b/Source/WebCore/storage/IDBIndexBackendImpl.cpp
index df88fdb..6eba189 100644
--- a/Source/WebCore/storage/IDBIndexBackendImpl.cpp
+++ b/Source/WebCore/storage/IDBIndexBackendImpl.cpp
@@ -100,7 +100,7 @@ void IDBIndexBackendImpl::openCursorInternal(ScriptExecutionContext*, PassRefPtr
     query->bindInt64(indexColumn, index->id());
 
     if (query->step() != SQLResultRow) {
-        callbacks->onSuccess();
+        callbacks->onSuccess(SerializedScriptValue::nullValue());
         return;
     }
 
diff --git a/Source/WebCore/storage/IDBObjectStore.cpp b/Source/WebCore/storage/IDBObjectStore.cpp
index ed5c96a..53ae279 100644
--- a/Source/WebCore/storage/IDBObjectStore.cpp
+++ b/Source/WebCore/storage/IDBObjectStore.cpp
@@ -34,7 +34,7 @@
 #include "IDBIndex.h"
 #include "IDBKey.h"
 #include "IDBKeyRange.h"
-#include "IDBTransactionBackendInterface.h"
+#include "IDBTransaction.h"
 #include "SerializedScriptValue.h"
 #include <wtf/UnusedParam.h>
 
@@ -42,7 +42,7 @@ namespace WebCore {
 
 static const unsigned short defaultDirection = IDBCursor::NEXT;
 
-IDBObjectStore::IDBObjectStore(PassRefPtr<IDBObjectStoreBackendInterface> idbObjectStore, IDBTransactionBackendInterface* transaction)
+IDBObjectStore::IDBObjectStore(PassRefPtr<IDBObjectStoreBackendInterface> idbObjectStore, IDBTransaction* transaction)
     : m_objectStore(idbObjectStore)
     , m_transaction(transaction)
 {
@@ -70,7 +70,7 @@ PassRefPtr<DOMStringList> IDBObjectStore::indexNames() const
 PassRefPtr<IDBRequest> IDBObjectStore::get(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
-    m_objectStore->get(key, request, m_transaction.get(), ec);
+    m_objectStore->get(key, request, m_transaction->backend(), ec);
     if (ec)
         return 0;
     return request.release();
@@ -79,7 +79,7 @@ PassRefPtr<IDBRequest> IDBObjectStore::get(ScriptExecutionContext* context, Pass
 PassRefPtr<IDBRequest> IDBObjectStore::add(ScriptExecutionContext* context, PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
-    m_objectStore->put(value, key, true, request, m_transaction.get(), ec);
+    m_objectStore->put(value, key, IDBObjectStoreBackendInterface::AddOnly, request, m_transaction->backend(), ec);
     if (ec)
         return 0;
     return request;
@@ -88,7 +88,7 @@ PassRefPtr<IDBRequest> IDBObjectStore::add(ScriptExecutionContext* context, Pass
 PassRefPtr<IDBRequest> IDBObjectStore::put(ScriptExecutionContext* context, PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
-    m_objectStore->put(value, key, false, request, m_transaction.get(), ec);
+    m_objectStore->put(value, key, IDBObjectStoreBackendInterface::AddOrUpdate, request, m_transaction->backend(), ec);
     if (ec)
         return 0;
     return request;
@@ -97,7 +97,16 @@ PassRefPtr<IDBRequest> IDBObjectStore::put(ScriptExecutionContext* context, Pass
 PassRefPtr<IDBRequest> IDBObjectStore::deleteFunction(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
-    m_objectStore->deleteFunction(key, request, m_transaction.get(), ec);
+    m_objectStore->deleteFunction(key, request, m_transaction->backend(), ec);
+    if (ec)
+        return 0;
+    return request;
+}
+
+PassRefPtr<IDBRequest> IDBObjectStore::clear(ScriptExecutionContext* context, ExceptionCode& ec)
+{
+    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
+    m_objectStore->clear(request, m_transaction->backend(), ec);
     if (ec)
         return 0;
     return request;
@@ -108,7 +117,7 @@ PassRefPtr<IDBIndex> IDBObjectStore::createIndex(const String& name, const Strin
     bool unique = false;
     options.getKeyBool("unique", unique);
 
-    RefPtr<IDBIndexBackendInterface> index = m_objectStore->createIndex(name, keyPath, unique, m_transaction.get(), ec);
+    RefPtr<IDBIndexBackendInterface> index = m_objectStore->createIndex(name, keyPath, unique, m_transaction->backend(), ec);
     ASSERT(!index != !ec); // If we didn't get an index, we should have gotten an exception code. And vice versa.
     if (!index)
         return 0;
@@ -126,16 +135,11 @@ PassRefPtr<IDBIndex> IDBObjectStore::index(const String& name, ExceptionCode& ec
 
 void IDBObjectStore::deleteIndex(const String& name, ExceptionCode& ec)
 {
-    m_objectStore->deleteIndex(name, m_transaction.get(), ec);
+    m_objectStore->deleteIndex(name, m_transaction->backend(), ec);
 }
 
-PassRefPtr<IDBRequest> IDBObjectStore::openCursor(ScriptExecutionContext* context, const OptionsObject& options, ExceptionCode& ec)
+PassRefPtr<IDBRequest> IDBObjectStore::openCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> range, unsigned short direction, ExceptionCode& ec)
 {
-    RefPtr<IDBKeyRange> range = options.getKeyKeyRange("range");
-
-    // Converted to an unsigned short.
-    int32_t direction = defaultDirection;
-    options.getKeyInt32("direction", direction);
     if (direction != IDBCursor::NEXT && direction != IDBCursor::NEXT_NO_DUPLICATE && direction != IDBCursor::PREV && direction != IDBCursor::PREV_NO_DUPLICATE) {
         // FIXME: May need to change when specced: http://www.w3.org/Bugs/Public/show_bug.cgi?id=11406
         ec = IDBDatabaseException::CONSTRAINT_ERR;
@@ -143,7 +147,7 @@ PassRefPtr<IDBRequest> IDBObjectStore::openCursor(ScriptExecutionContext* contex
     }
 
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
-    m_objectStore->openCursor(range, direction, request, m_transaction.get(), ec);
+    m_objectStore->openCursor(range, direction, request, m_transaction->backend(), ec);
     if (ec)
         return 0;
     return request.release();
diff --git a/Source/WebCore/storage/IDBObjectStore.h b/Source/WebCore/storage/IDBObjectStore.h
index 0e9a4a9..f0c5ebf 100644
--- a/Source/WebCore/storage/IDBObjectStore.h
+++ b/Source/WebCore/storage/IDBObjectStore.h
@@ -45,11 +45,10 @@ namespace WebCore {
 
 class DOMStringList;
 class IDBAny;
-class IDBTransactionBackendInterface;
 
 class IDBObjectStore : public RefCounted<IDBObjectStore> {
 public:
-    static PassRefPtr<IDBObjectStore> create(PassRefPtr<IDBObjectStoreBackendInterface> idbObjectStore, IDBTransactionBackendInterface* transaction)
+    static PassRefPtr<IDBObjectStore> create(PassRefPtr<IDBObjectStoreBackendInterface> idbObjectStore, IDBTransaction* transaction)
     {
         return adoptRef(new IDBObjectStore(idbObjectStore, transaction));
     }
@@ -63,25 +62,27 @@ public:
     PassRefPtr<IDBRequest> add(ScriptExecutionContext* context, PassRefPtr<SerializedScriptValue> value, ExceptionCode& ec) { return add(context, value, 0, ec);  }
     PassRefPtr<IDBRequest> put(ScriptExecutionContext* context, PassRefPtr<SerializedScriptValue> value, ExceptionCode& ec) { return put(context, value, 0, ec);  }
     PassRefPtr<IDBIndex> createIndex(const String& name, const String& keyPath, ExceptionCode& ec) { return createIndex(name, keyPath, OptionsObject(), ec); }
-    PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext* context, ExceptionCode& ec) { return openCursor(context, OptionsObject(), ec); }
+    PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext* context, ExceptionCode& ec) { return openCursor(context, 0, ec); } 
+    PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, ExceptionCode& ec) { return openCursor(context, keyRange, IDBCursor::NEXT, ec); } 
 
     PassRefPtr<IDBRequest> get(ScriptExecutionContext*, PassRefPtr<IDBKey>, ExceptionCode&);
     PassRefPtr<IDBRequest> add(ScriptExecutionContext*, PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, ExceptionCode&);
     PassRefPtr<IDBRequest> put(ScriptExecutionContext*, PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, ExceptionCode&);
     PassRefPtr<IDBRequest> deleteFunction(ScriptExecutionContext*, PassRefPtr<IDBKey> key, ExceptionCode&);
+    PassRefPtr<IDBRequest> clear(ScriptExecutionContext*, ExceptionCode&);
 
     PassRefPtr<IDBIndex> createIndex(const String& name, const String& keyPath, const OptionsObject&, ExceptionCode&);
     PassRefPtr<IDBIndex> index(const String& name, ExceptionCode&);
     void deleteIndex(const String& name, ExceptionCode&);
 
-    PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext*, const OptionsObject&, ExceptionCode&);
+    PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext*, PassRefPtr<IDBKeyRange>, unsigned short direction, ExceptionCode&); 
 
 private:
-    IDBObjectStore(PassRefPtr<IDBObjectStoreBackendInterface>, IDBTransactionBackendInterface* transaction);
+    IDBObjectStore(PassRefPtr<IDBObjectStoreBackendInterface>, IDBTransaction*);
     void removeTransactionFromPendingList();
 
     RefPtr<IDBObjectStoreBackendInterface> m_objectStore;
-    RefPtr<IDBTransactionBackendInterface> m_transaction;
+    RefPtr<IDBTransaction> m_transaction;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/IDBObjectStore.idl b/Source/WebCore/storage/IDBObjectStore.idl
index f023dbe..c95fb9d 100644
--- a/Source/WebCore/storage/IDBObjectStore.idl
+++ b/Source/WebCore/storage/IDBObjectStore.idl
@@ -38,9 +38,11 @@ module storage {
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext, ImplementationFunction=deleteFunction] IDBRequest delete(in IDBKey key)
             raises (IDBDatabaseException);
+        [CallWith=ScriptExecutionContext] IDBRequest clear()
+            raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest get(in IDBKey key)
             raises (IDBDatabaseException);
-        [CallWith=ScriptExecutionContext] IDBRequest openCursor(in [Optional] OptionsObject options)
+        [CallWith=ScriptExecutionContext] IDBRequest openCursor(in [Optional] IDBKeyRange range, in [Optional] unsigned short direction)
             raises (IDBDatabaseException);
         IDBIndex createIndex(in DOMString name, in [ConvertNullToNullString] DOMString keyPath, in [Optional] OptionsObject options)
             raises (IDBDatabaseException);
diff --git a/Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp b/Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp
index 6b162ef..921bbab 100644
--- a/Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp
+++ b/Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp
@@ -118,7 +118,7 @@ void IDBObjectStoreBackendImpl::getInternal(ScriptExecutionContext*, PassRefPtr<
     ASSERT((key->type() == IDBKey::DateType) != query.isColumnNull(1));
     ASSERT((key->type() == IDBKey::NumberType) != query.isColumnNull(2));
 
-    callbacks->onSuccess(SerializedScriptValue::createFromWire(query.getColumnText(3)));
+    callbacks->onSuccess(SerializedScriptValue::createFromWire(query.getColumnBlobAsString(3)));
     ASSERT(query.step() != SQLResultRow);
 }
 
@@ -142,7 +142,7 @@ static bool putObjectStoreData(SQLiteDatabase& db, IDBKey* key, SerializedScript
     if (query.prepare() != SQLResultOk)
         return false;
     key->bindWithNulls(query, 1);
-    query.bindText(4, value->toWireString());
+    query.bindBlob(4, value->toWireString());
     if (dataRowId != IDBDatabaseBackendImpl::InvalidId)
         query.bindInt64(5, dataRowId);
     else
@@ -179,7 +179,7 @@ static bool putIndexData(SQLiteDatabase& db, IDBKey* key, int64_t indexId, int64
     return putQuery.step() == SQLResultDone;
 }
 
-void IDBObjectStoreBackendImpl::put(PassRefPtr<SerializedScriptValue> prpValue, PassRefPtr<IDBKey> prpKey, bool addOnly, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
+void IDBObjectStoreBackendImpl::put(PassRefPtr<SerializedScriptValue> prpValue, PassRefPtr<IDBKey> prpKey, PutMode putMode, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
 {
     if (transactionPtr->mode() == IDBTransaction::READ_ONLY) {
         ec = IDBDatabaseException::READ_ONLY_ERR;
@@ -193,45 +193,75 @@ void IDBObjectStoreBackendImpl::put(PassRefPtr<SerializedScriptValue> prpValue,
     RefPtr<IDBTransactionBackendInterface> transaction = transactionPtr;
     // FIXME: This should throw a SERIAL_ERR on structured clone problems.
     // FIXME: This should throw a DATA_ERR when the wrong key/keyPath data is supplied.
-    if (!transaction->scheduleTask(createCallbackTask(&IDBObjectStoreBackendImpl::putInternal, objectStore, value, key, addOnly, callbacks, transaction)))
+    if (!transaction->scheduleTask(createCallbackTask(&IDBObjectStoreBackendImpl::putInternal, objectStore, value, key, putMode, callbacks, transaction)))
         ec = IDBDatabaseException::NOT_ALLOWED_ERR;
 }
 
-void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<SerializedScriptValue> prpValue, PassRefPtr<IDBKey> prpKey, bool addOnly, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBTransactionBackendInterface> transaction)
+PassRefPtr<IDBKey> IDBObjectStoreBackendImpl::selectKeyForPut(IDBObjectStoreBackendImpl* objectStore, SerializedScriptValue* value, IDBKey* key, PutMode putMode, IDBCallbacks* callbacks)
 {
-    RefPtr<SerializedScriptValue> value = prpValue;
-    RefPtr<IDBKey> key = prpKey;
+    if (putMode == CursorUpdate)
+        ASSERT(key);
 
-    if (!objectStore->m_keyPath.isNull() && key) {
+    const bool autoIncrement = objectStore->autoIncrement();
+    const bool hasKeyPath = !objectStore->m_keyPath.isNull();
+
+    if (hasKeyPath && key && putMode != CursorUpdate) {
         callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::DATA_ERR, "A key was supplied for an objectStore that has a keyPath."));
-        return;
+        return 0;
     }
 
-    if (objectStore->autoIncrement() && key) {
-        callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::DATA_ERR, "A key was supplied for an objectStore that is using auto increment."));
-        return;
+    if (autoIncrement && key) {
+        objectStore->resetAutoIncrementKeyCache();
+        return key;
     }
 
-    if (objectStore->autoIncrement()) {
-        key = objectStore->genAutoIncrementKey();
+    if (autoIncrement) {
+        ASSERT(!key);
+        if (!hasKeyPath)
+            return objectStore->genAutoIncrementKey();
 
-        if (!objectStore->m_keyPath.isNull()) {
-            // FIXME: Inject the generated key into the object.
-            callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Adding data to object stores with auto increment and in-line keys not yet supported."));
-            return;
+        RefPtr<IDBKey> keyPathKey = fetchKeyFromKeyPath(value, objectStore->m_keyPath);
+        if (keyPathKey) {
+            objectStore->resetAutoIncrementKeyCache();
+            return keyPathKey;
         }
-    } else if (!objectStore->m_keyPath.isNull()) {
-        key = fetchKeyFromKeyPath(value.get(), objectStore->m_keyPath);
 
-        if (!key) {
+        // FIXME: Generate auto increment key, and inject it through the key path.
+        callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Adding data to object stores with auto increment and in-line keys not yet supported."));
+        return 0;
+    }
+
+    if (hasKeyPath) {
+        RefPtr<IDBKey> keyPathKey = fetchKeyFromKeyPath(value, objectStore->m_keyPath);
+
+        if (!keyPathKey) {
             callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::DATA_ERR, "The key could not be fetched from the keyPath."));
-            return;
+            return 0;
         }
-    } else if (!key) {
-        callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::DATA_ERR, "No key supplied."));
-        return;
+
+        if (putMode == CursorUpdate && !keyPathKey->isEqual(key)) {
+            callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::DATA_ERR, "The key fetched from the keyPath does not match the key of the cursor."));
+            return 0;
+        }
+
+        return keyPathKey.release();
+    }
+
+    if (!key) {
+        callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::DATA_ERR, "No key supplied"));
+        return 0;
     }
 
+    return key;
+}
+
+void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<SerializedScriptValue> prpValue, PassRefPtr<IDBKey> prpKey, PutMode putMode, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBTransactionBackendInterface> transaction)
+{
+    RefPtr<SerializedScriptValue> value = prpValue;
+    RefPtr<IDBKey> key = selectKeyForPut(objectStore.get(), value.get(), prpKey.get(), putMode, callbacks.get());
+    if (!key)
+        return;
+
     if (key->type() == IDBKey::NullType) {
         callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::DATA_ERR, "NULL key is not allowed."));
         return;
@@ -261,7 +291,7 @@ void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<
 
     bindWhereClause(getQuery, objectStore->id(), key.get());
     bool isExistingValue = getQuery.step() == SQLResultRow;
-    if (addOnly && isExistingValue) {
+    if (putMode == AddOnly && isExistingValue) {
         callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::CONSTRAINT_ERR, "Key already exists in the object store."));
         return;
     }
@@ -342,7 +372,39 @@ void IDBObjectStoreBackendImpl::deleteInternal(ScriptExecutionContext*, PassRefP
     ok = indexQuery.step() == SQLResultDone;
     ASSERT_UNUSED(ok, ok);
 
-    callbacks->onSuccess();
+    callbacks->onSuccess(SerializedScriptValue::nullValue());
+}
+
+void IDBObjectStoreBackendImpl::clear(PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
+{
+    if (transaction->mode() == IDBTransaction::READ_ONLY) {
+        ec = IDBDatabaseException::READ_ONLY_ERR;
+        return;
+    }
+
+    RefPtr<IDBObjectStoreBackendImpl> objectStore = this;
+    RefPtr<IDBCallbacks> callbacks = prpCallbacks;
+
+    if (!transaction->scheduleTask(createCallbackTask(&IDBObjectStoreBackendImpl::clearInternal, objectStore, callbacks)))
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
+}
+
+static void doDelete(SQLiteDatabase& db, const char* sql, int64_t id)
+{
+    SQLiteStatement deleteQuery(db, sql);
+    bool ok = deleteQuery.prepare() == SQLResultOk;
+    ASSERT_UNUSED(ok, ok); // FIXME: Better error handling.
+    deleteQuery.bindInt64(1, id);
+    ok = deleteQuery.step() == SQLResultDone;
+    ASSERT_UNUSED(ok, ok); // FIXME: Better error handling.
+}
+
+void IDBObjectStoreBackendImpl::clearInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBCallbacks> callbacks)
+{
+    doDelete(objectStore->sqliteDatabase(), "DELETE FROM IndexData WHERE objectStoreDataId IN (SELECT id FROM ObjectStoreData WHERE objectStoreId = ?)", objectStore->id());
+    doDelete(objectStore->sqliteDatabase(), "DELETE FROM ObjectStoreData WHERE objectStoreId = ?", objectStore->id());
+
+    callbacks->onSuccess(SerializedScriptValue::undefinedValue());
 }
 
 PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendImpl::createIndex(const String& name, const String& keyPath, bool unique, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
@@ -401,16 +463,6 @@ PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendImpl::index(const Stri
     return index.release();
 }
 
-static void doDelete(SQLiteDatabase& db, const char* sql, int64_t id)
-{
-    SQLiteStatement deleteQuery(db, sql);
-    bool ok = deleteQuery.prepare() == SQLResultOk;
-    ASSERT_UNUSED(ok, ok); // FIXME: Better error handling.
-    deleteQuery.bindInt64(1, id);
-    ok = deleteQuery.step() == SQLResultDone;
-    ASSERT_UNUSED(ok, ok); // FIXME: Better error handling.
-}
-
 void IDBObjectStoreBackendImpl::deleteIndex(const String& name, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     if (transaction->mode() != IDBTransaction::VERSION_CHANGE) {
@@ -483,7 +535,7 @@ void IDBObjectStoreBackendImpl::openCursorInternal(ScriptExecutionContext*, Pass
     query->bindInt64(currentColumn, objectStore->id());
 
     if (query->step() != SQLResultRow) {
-        callbacks->onSuccess();
+        callbacks->onSuccess(SerializedScriptValue::nullValue());
         return;
     }
 
diff --git a/Source/WebCore/storage/IDBObjectStoreBackendImpl.h b/Source/WebCore/storage/IDBObjectStoreBackendImpl.h
index 9fb1b7c..b54f9fd 100644
--- a/Source/WebCore/storage/IDBObjectStoreBackendImpl.h
+++ b/Source/WebCore/storage/IDBObjectStoreBackendImpl.h
@@ -67,8 +67,9 @@ public:
     virtual bool autoIncrement() const { return m_autoIncrement; }
 
     virtual void get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
-    virtual void put(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, bool addOnly, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void put(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, PutMode, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
     virtual void deleteFunction(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void clear(PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
 
     virtual PassRefPtr<IDBIndexBackendInterface> createIndex(const String& name, const String& keyPath, bool unique, IDBTransactionBackendInterface*, ExceptionCode&);
     virtual PassRefPtr<IDBIndexBackendInterface> index(const String& name, ExceptionCode&);
@@ -83,10 +84,13 @@ private:
     void loadIndexes();
     SQLiteDatabase& sqliteDatabase() const;
     PassRefPtr<IDBKey> genAutoIncrementKey();
+    void resetAutoIncrementKeyCache() { m_autoIncrementNumber = -1; }
+    static PassRefPtr<IDBKey> selectKeyForPut(IDBObjectStoreBackendImpl*, SerializedScriptValue*, IDBKey*, PutMode, IDBCallbacks*);
 
     static void getInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>);
-    static void putInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, bool addOnly, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBTransactionBackendInterface>);
+    static void putInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, PutMode, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBTransactionBackendInterface>);
     static void deleteInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>);
+    static void clearInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBCallbacks>);
     static void createIndexInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBIndexBackendImpl>, PassRefPtr<IDBTransactionBackendInterface>);
     static void deleteIndexInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBIndexBackendImpl>, PassRefPtr<IDBTransactionBackendInterface>);
     static void openCursorInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBKeyRange> range, unsigned short direction, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBTransactionBackendInterface>);
diff --git a/Source/WebCore/storage/IDBObjectStoreBackendInterface.h b/Source/WebCore/storage/IDBObjectStoreBackendInterface.h
index 02ceb27..177701c 100644
--- a/Source/WebCore/storage/IDBObjectStoreBackendInterface.h
+++ b/Source/WebCore/storage/IDBObjectStoreBackendInterface.h
@@ -51,9 +51,17 @@ public:
     virtual PassRefPtr<DOMStringList> indexNames() const = 0;
 
     virtual void get(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
-    virtual void put(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, bool addOnly, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
+
+    enum PutMode {
+        AddOrUpdate,
+        AddOnly,
+        CursorUpdate
+    };
+    virtual void put(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, PutMode, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
     virtual void deleteFunction(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
 
+    virtual void clear(PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
+
     virtual PassRefPtr<IDBIndexBackendInterface> createIndex(const String& name, const String& keyPath, bool unique, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
     virtual PassRefPtr<IDBIndexBackendInterface> index(const String& name, ExceptionCode&) = 0;
     virtual void deleteIndex(const String& name, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
@@ -66,4 +74,3 @@ public:
 #endif
 
 #endif // IDBObjectStoreBackendInterface_h
-
diff --git a/Source/WebCore/storage/IDBRequest.cpp b/Source/WebCore/storage/IDBRequest.cpp
index cbd635c..e7498ec 100644
--- a/Source/WebCore/storage/IDBRequest.cpp
+++ b/Source/WebCore/storage/IDBRequest.cpp
@@ -31,10 +31,11 @@
 
 #if ENABLE(INDEXED_DATABASE)
 
-#include "Event.h"
+#include "Document.h"
 #include "EventException.h"
 #include "EventListener.h"
 #include "EventNames.h"
+#include "EventQueue.h"
 #include "IDBCursor.h"
 #include "IDBDatabase.h"
 #include "IDBIndex.h"
@@ -42,163 +43,169 @@
 #include "IDBObjectStore.h"
 #include "IDBPendingTransactionMonitor.h"
 #include "IDBSuccessEvent.h"
-#include "ScriptExecutionContext.h"
 
 namespace WebCore {
 
-IDBRequest::IDBRequest(ScriptExecutionContext* context, PassRefPtr<IDBAny> source, IDBTransactionBackendInterface* transaction)
+PassRefPtr<IDBRequest> IDBRequest::create(ScriptExecutionContext* context, PassRefPtr<IDBAny> source, IDBTransaction* transaction)
+{
+    return adoptRef(new IDBRequest(context, source, transaction));
+}
+
+IDBRequest::IDBRequest(ScriptExecutionContext* context, PassRefPtr<IDBAny> source, IDBTransaction* transaction)
     : ActiveDOMObject(context, this)
     , m_source(source)
     , m_transaction(transaction)
-    , m_timer(this, &IDBRequest::timerFired)
     , m_readyState(LOADING)
+    , m_finished(false)
 {
     if (m_transaction)
-        IDBPendingTransactionMonitor::removePendingTransaction(m_transaction.get());
+        IDBPendingTransactionMonitor::removePendingTransaction(m_transaction->backend());
 }
 
 IDBRequest::~IDBRequest()
 {
 }
 
-bool IDBRequest::resetReadyState(IDBTransactionBackendInterface* transaction)
+bool IDBRequest::resetReadyState(IDBTransaction* transaction)
 {
-    ASSERT(m_readyState == DONE);
-    m_readyState = LOADING;
-    ASSERT(!m_transaction);
+    ASSERT(!m_finished);
+    ASSERT(scriptExecutionContext());
+    if (m_readyState != DONE)
+        return false;
+
     m_transaction = transaction;
-    IDBPendingTransactionMonitor::removePendingTransaction(m_transaction.get());
+    m_readyState = LOADING;
+
+    IDBPendingTransactionMonitor::removePendingTransaction(m_transaction->backend());
+
     return true;
 }
 
 void IDBRequest::onError(PassRefPtr<IDBDatabaseError> error)
 {
-    scheduleEvent(0, error);
-}
-
-void IDBRequest::onSuccess()
-{
-    scheduleEvent(IDBAny::createNull(), 0);
+    enqueueEvent(IDBErrorEvent::create(m_source, *error));
 }
 
 void IDBRequest::onSuccess(PassRefPtr<IDBCursorBackendInterface> backend)
 {
-    scheduleEvent(IDBAny::create(IDBCursor::create(backend, this, m_transaction.get())), 0);
+    enqueueEvent(IDBSuccessEvent::create(m_source, IDBAny::create(IDBCursor::create(backend, this, m_transaction.get()))));
 }
 
 void IDBRequest::onSuccess(PassRefPtr<IDBDatabaseBackendInterface> backend)
 {
-    scheduleEvent(IDBAny::create(IDBDatabase::create(backend)), 0);
+    enqueueEvent(IDBSuccessEvent::create(m_source, IDBAny::create(IDBDatabase::create(scriptExecutionContext(), backend))));
 }
 
 void IDBRequest::onSuccess(PassRefPtr<IDBIndexBackendInterface> backend)
 {
-    scheduleEvent(IDBAny::create(IDBIndex::create(backend, m_transaction.get())), 0);
+    ASSERT_NOT_REACHED(); // FIXME: This method should go away.
 }
 
 void IDBRequest::onSuccess(PassRefPtr<IDBKey> idbKey)
 {
-    scheduleEvent(IDBAny::create(idbKey), 0);
+    enqueueEvent(IDBSuccessEvent::create(m_source, IDBAny::create(idbKey)));
 }
 
 void IDBRequest::onSuccess(PassRefPtr<IDBObjectStoreBackendInterface> backend)
 {
-    // FIXME: This function should go away once createObjectStore is sync.
-    scheduleEvent(IDBAny::create(IDBObjectStore::create(backend, m_transaction.get())), 0);
+    ASSERT_NOT_REACHED(); // FIXME: This method should go away.
 }
 
 void IDBRequest::onSuccess(PassRefPtr<IDBTransactionBackendInterface> prpBackend)
 {
+    if (!scriptExecutionContext())
+        return;
+
     RefPtr<IDBTransactionBackendInterface> backend = prpBackend;
-    // This is only used by setVersion which will always have a source that's an IDBDatabase.
-    m_source->idbDatabase()->setSetVersionTransaction(backend.get());
     RefPtr<IDBTransaction> frontend = IDBTransaction::create(scriptExecutionContext(), backend, m_source->idbDatabase().get());
     backend->setCallbacks(frontend.get());
-    m_transaction = backend;
-    IDBPendingTransactionMonitor::removePendingTransaction(m_transaction.get());
-    scheduleEvent(IDBAny::create(frontend.release()), 0);
-}
+    m_transaction = frontend;
 
-void IDBRequest::onSuccess(PassRefPtr<SerializedScriptValue> serializedScriptValue)
-{
-    scheduleEvent(IDBAny::create(serializedScriptValue), 0);
-}
+    ASSERT(m_source->type() == IDBAny::IDBDatabaseType);
+    m_source->idbDatabase()->setSetVersionTransaction(frontend.get());
 
-ScriptExecutionContext* IDBRequest::scriptExecutionContext() const
-{
-    return ActiveDOMObject::scriptExecutionContext();
+    IDBPendingTransactionMonitor::removePendingTransaction(m_transaction->backend());
+    enqueueEvent(IDBSuccessEvent::create(m_source, IDBAny::create(frontend.release())));
 }
 
-bool IDBRequest::canSuspend() const
+void IDBRequest::onSuccess(PassRefPtr<SerializedScriptValue> serializedScriptValue)
 {
-    // IDBTransactions cannot be suspended at the moment. We therefore
-    // disallow the back/forward cache for pages that use IndexedDatabase.
-    return false;
+    enqueueEvent(IDBSuccessEvent::create(m_source, IDBAny::create(serializedScriptValue)));
 }
 
-EventTargetData* IDBRequest::eventTargetData()
+bool IDBRequest::hasPendingActivity() const
 {
-    return &m_eventTargetData;
+    // FIXME: In an ideal world, we should return true as long as anyone has a or can
+    //        get a handle to us and we have event listeners. This is order to handle
+    //        user generated events properly.
+    return !m_finished || ActiveDOMObject::hasPendingActivity();
 }
 
-EventTargetData* IDBRequest::ensureEventTargetData()
+ScriptExecutionContext* IDBRequest::scriptExecutionContext() const
 {
-    return &m_eventTargetData;
+    return ActiveDOMObject::scriptExecutionContext();
 }
 
-void IDBRequest::timerFired(Timer<IDBRequest>*)
+bool IDBRequest::dispatchEvent(PassRefPtr<Event> event)
 {
-    ASSERT(m_selfRef);
-    ASSERT(m_pendingEvents.size());
-    // FIXME: We should handle the stop event and stop any timers when we see it. We can then assert here that scriptExecutionContext is non-null.
-
-    // We need to keep self-referencing ourself, otherwise it's possible we'll be deleted.
-    // But in some cases, suspend() could be called while we're dispatching an event, so we
-    // need to make sure that resume() doesn't re-start the timer based on m_selfRef being set.
-    RefPtr<IDBRequest> selfRef = m_selfRef.release();
-
-    // readyStateReset can be called synchronously while we're dispatching the event.
-    RefPtr<IDBTransactionBackendInterface> transaction = m_transaction;
-    m_transaction.clear();
-
-    Vector<PendingEvent> pendingEvents;
-    pendingEvents.swap(m_pendingEvents);
-    for (size_t i = 0; i < pendingEvents.size(); ++i) {
-        // It's possible we've navigated in which case we'll crash.
-        if (!scriptExecutionContext())
-            return;
+    ASSERT(!m_finished);
+    ASSERT(scriptExecutionContext());
+    ASSERT(event->target() == this);
+    ASSERT(m_readyState < DONE);
+    m_readyState = DONE;
 
-        if (pendingEvents[i].m_error) {
-            ASSERT(!pendingEvents[i].m_result);
-            dispatchEvent(IDBErrorEvent::create(m_source, *pendingEvents[i].m_error));
-        } else {
-            ASSERT(pendingEvents[i].m_result->type() != IDBAny::UndefinedType);
-            dispatchEvent(IDBSuccessEvent::create(m_source, pendingEvents[i].m_result));
-        }
+    Vector<RefPtr<EventTarget> > targets;
+    targets.append(this);
+    if (m_transaction) {
+        targets.append(m_transaction);
+        // If there ever are events that are associated with a database but
+        // that do not have a transaction, then this will not work and we need
+        // this object to actually hold a reference to the database (to ensure
+        // it stays alive).
+        targets.append(m_transaction->db());
     }
-    if (transaction) {
-        // Now that we processed all pending events, let the transaction monitor check if
-        // it can commit the current transaction or if there's anything new pending.
-        // FIXME: Handle the workers case.
-        transaction->didCompleteTaskEvents();
+
+    ASSERT(event->isIDBErrorEvent() || event->isIDBSuccessEvent());
+    bool dontPreventDefault = static_cast<IDBEvent*>(event.get())->dispatch(targets);
+
+    // If the event's result was of type IDBCursor, then it's possible for us to
+    // fire again (unless the transaction completes).
+    if (event->isIDBSuccessEvent()) {
+        RefPtr<IDBAny> any = static_cast<IDBSuccessEvent*>(event.get())->result();
+        if (any->type() != IDBAny::IDBCursorType)
+            m_finished = true;
+    } else
+        m_finished = true;
+
+    if (m_transaction) {
+        if (dontPreventDefault && event->isIDBErrorEvent())
+            m_transaction->backend()->abort();
+        m_transaction->backend()->didCompleteTaskEvents();
     }
+    return dontPreventDefault;
 }
 
-void IDBRequest::scheduleEvent(PassRefPtr<IDBAny> result, PassRefPtr<IDBDatabaseError> error)
+void IDBRequest::enqueueEvent(PassRefPtr<Event> event)
 {
+    ASSERT(!m_finished);
     ASSERT(m_readyState < DONE);
-    ASSERT(!!m_selfRef == m_timer.isActive());
+    if (!scriptExecutionContext())
+        return;
 
-    PendingEvent pendingEvent;
-    pendingEvent.m_result = result;
-    pendingEvent.m_error = error;
-    m_pendingEvents.append(pendingEvent);
+    ASSERT(scriptExecutionContext()->isDocument());
+    EventQueue* eventQueue = static_cast<Document*>(scriptExecutionContext())->eventQueue();
+    event->setTarget(this);
+    eventQueue->enqueueEvent(event);
+}
 
-    m_readyState = DONE;
-    if (!m_timer.isActive()) {
-        m_selfRef = this;
-        m_timer.startOneShot(0);
-    }
+EventTargetData* IDBRequest::eventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+EventTargetData* IDBRequest::ensureEventTargetData()
+{
+    return &m_eventTargetData;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/IDBRequest.h b/Source/WebCore/storage/IDBRequest.h
index fa68208..5c31318 100644
--- a/Source/WebCore/storage/IDBRequest.h
+++ b/Source/WebCore/storage/IDBRequest.h
@@ -32,21 +32,21 @@
 #if ENABLE(INDEXED_DATABASE)
 
 #include "ActiveDOMObject.h"
+#include "Event.h"
 #include "EventListener.h"
 #include "EventNames.h"
 #include "EventTarget.h"
 #include "IDBAny.h"
 #include "IDBCallbacks.h"
-#include "Timer.h"
-#include <wtf/Vector.h>
 
 namespace WebCore {
 
-class IDBTransactionBackendInterface;
+class IDBEvent;
+class IDBTransaction;
 
 class IDBRequest : public IDBCallbacks, public EventTarget, public ActiveDOMObject {
 public:
-    static PassRefPtr<IDBRequest> create(ScriptExecutionContext* context, PassRefPtr<IDBAny> source, IDBTransactionBackendInterface* transaction) { return adoptRef(new IDBRequest(context, source, transaction)); }
+    static PassRefPtr<IDBRequest> create(ScriptExecutionContext*, PassRefPtr<IDBAny> source, IDBTransaction*);
     virtual ~IDBRequest();
 
     // Defined in the IDL
@@ -58,11 +58,10 @@ public:
     DEFINE_ATTRIBUTE_EVENT_LISTENER(success);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
 
-    bool resetReadyState(IDBTransactionBackendInterface*);
+    bool resetReadyState(IDBTransaction*);
 
     // IDBCallbacks
     virtual void onError(PassRefPtr<IDBDatabaseError>);
-    virtual void onSuccess(); // For "null".
     virtual void onSuccess(PassRefPtr<IDBDatabaseBackendInterface>);
     virtual void onSuccess(PassRefPtr<IDBCursorBackendInterface>);
     virtual void onSuccess(PassRefPtr<IDBIndexBackendInterface>);
@@ -71,21 +70,22 @@ public:
     virtual void onSuccess(PassRefPtr<IDBTransactionBackendInterface>);
     virtual void onSuccess(PassRefPtr<SerializedScriptValue>);
 
+    // ActiveDOMObject
+    virtual bool hasPendingActivity() const;
+
     // EventTarget
     virtual IDBRequest* toIDBRequest() { return this; }
-
-    // ActiveDOMObject
     virtual ScriptExecutionContext* scriptExecutionContext() const;
-    virtual bool canSuspend() const;
+    virtual bool dispatchEvent(PassRefPtr<Event>);
+    bool dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec) { return EventTarget::dispatchEvent(event, ec); }
 
     using ThreadSafeShared<IDBCallbacks>::ref;
     using ThreadSafeShared<IDBCallbacks>::deref;
 
 private:
-    IDBRequest(ScriptExecutionContext*, PassRefPtr<IDBAny> source, IDBTransactionBackendInterface* transaction);
+    IDBRequest(ScriptExecutionContext*, PassRefPtr<IDBAny> source, IDBTransaction*);
 
-    void timerFired(Timer<IDBRequest>*);
-    void scheduleEvent(PassRefPtr<IDBAny> result, PassRefPtr<IDBDatabaseError>);
+    void enqueueEvent(PassRefPtr<Event>);
 
     // EventTarget
     virtual void refEventTarget() { ref(); }
@@ -94,19 +94,11 @@ private:
     virtual EventTargetData* ensureEventTargetData();
 
     RefPtr<IDBAny> m_source;
-    RefPtr<IDBTransactionBackendInterface> m_transaction;
-
-    struct PendingEvent {
-        RefPtr<IDBAny> m_result;
-        RefPtr<IDBDatabaseError> m_error;
-    };
-    Vector<PendingEvent> m_pendingEvents;
-
-    // Used to fire events asynchronously.
-    Timer<IDBRequest> m_timer;
-    RefPtr<IDBRequest> m_selfRef; // This is set to us iff there's an event pending.
+    RefPtr<IDBTransaction> m_transaction;
 
     ReadyState m_readyState;
+    bool m_finished; // Is it possible that we'll fire any more events? If not, we're finished.
+
     EventTargetData m_eventTargetData;
 };
 
diff --git a/Source/WebCore/storage/IDBSuccessEvent.cpp b/Source/WebCore/storage/IDBSuccessEvent.cpp
index 2dcd964..110b78b 100644
--- a/Source/WebCore/storage/IDBSuccessEvent.cpp
+++ b/Source/WebCore/storage/IDBSuccessEvent.cpp
@@ -42,7 +42,7 @@ PassRefPtr<IDBSuccessEvent> IDBSuccessEvent::create(PassRefPtr<IDBAny> source, P
 }
 
 IDBSuccessEvent::IDBSuccessEvent(PassRefPtr<IDBAny> source, PassRefPtr<IDBAny> result)
-    : IDBEvent(eventNames().successEvent, source)
+    : IDBEvent(eventNames().successEvent, source, false)
     , m_result(result)
 {
 }
diff --git a/Source/WebCore/storage/IDBTransaction.cpp b/Source/WebCore/storage/IDBTransaction.cpp
index e3625d4..1f696b3 100644
--- a/Source/WebCore/storage/IDBTransaction.cpp
+++ b/Source/WebCore/storage/IDBTransaction.cpp
@@ -28,8 +28,9 @@
 
 #if ENABLE(INDEXED_DATABASE)
 
-#include "Event.h"
+#include "Document.h"
 #include "EventException.h"
+#include "EventQueue.h"
 #include "IDBAbortEvent.h"
 #include "IDBCompleteEvent.h"
 #include "IDBDatabase.h"
@@ -38,20 +39,22 @@
 #include "IDBObjectStore.h"
 #include "IDBObjectStoreBackendInterface.h"
 #include "IDBPendingTransactionMonitor.h"
-#include "IDBTimeoutEvent.h"
-#include "ScriptExecutionContext.h"
 
 namespace WebCore {
 
+PassRefPtr<IDBTransaction> IDBTransaction::create(ScriptExecutionContext* context, PassRefPtr<IDBTransactionBackendInterface> backend, IDBDatabase* db)
+{ 
+    return adoptRef(new IDBTransaction(context, backend, db));
+}
+
 IDBTransaction::IDBTransaction(ScriptExecutionContext* context, PassRefPtr<IDBTransactionBackendInterface> backend, IDBDatabase* db)
     : ActiveDOMObject(context, this)
     , m_backend(backend)
     , m_database(db)
     , m_mode(m_backend->mode())
-    , m_onAbortTimer(this, &IDBTransaction::onAbortTimerFired)
-    , m_onCompleteTimer(this, &IDBTransaction::onCompleteTimerFired)
-    , m_onTimeoutTimer(this, &IDBTransaction::onTimeoutTimerFired)
+    , m_finished(false)
 {
+    ASSERT(m_backend);
     IDBPendingTransactionMonitor::addPendingTransaction(m_backend.get());
 }
 
@@ -59,19 +62,29 @@ IDBTransaction::~IDBTransaction()
 {
 }
 
+IDBTransactionBackendInterface* IDBTransaction::backend() const
+{
+    return m_backend.get();
+}
+
+bool IDBTransaction::finished() const
+{
+    return m_finished;
+}
+
 unsigned short IDBTransaction::mode() const
 {
     return m_mode;
 }
 
-IDBDatabase* IDBTransaction::db()
+IDBDatabase* IDBTransaction::db() const
 {
     return m_database.get();
 }
 
 PassRefPtr<IDBObjectStore> IDBTransaction::objectStore(const String& name, ExceptionCode& ec)
 {
-    if (!m_backend) {
+    if (m_finished) {
         ec = IDBDatabaseException::NOT_ALLOWED_ERR;
         return 0;
     }
@@ -80,94 +93,96 @@ PassRefPtr<IDBObjectStore> IDBTransaction::objectStore(const String& name, Excep
         ASSERT(ec);
         return 0;
     }
-    RefPtr<IDBObjectStore> objectStore = IDBObjectStore::create(objectStoreBackend, m_backend.get());
+    RefPtr<IDBObjectStore> objectStore = IDBObjectStore::create(objectStoreBackend, this);
     return objectStore.release();
 }
 
 void IDBTransaction::abort()
 {
+    RefPtr<IDBTransaction> selfRef = this;
     if (m_backend)
         m_backend->abort();
 }
 
-ScriptExecutionContext* IDBTransaction::scriptExecutionContext() const
-{
-    return ActiveDOMObject::scriptExecutionContext();
-}
-
 void IDBTransaction::onAbort()
 {
-    ASSERT(!m_onAbortTimer.isActive());
-    ASSERT(!m_onCompleteTimer.isActive());
-    ASSERT(!m_onTimeoutTimer.isActive());
-    m_selfRef = this;
-    m_onAbortTimer.startOneShot(0);
-    m_backend.clear(); // Release the backend as it holds a (circular) reference back to us.
+    enqueueEvent(IDBAbortEvent::create(IDBAny::create(this)));
 }
 
 void IDBTransaction::onComplete()
 {
-    ASSERT(!m_onAbortTimer.isActive());
-    ASSERT(!m_onCompleteTimer.isActive());
-    ASSERT(!m_onTimeoutTimer.isActive());
-    m_selfRef = this;
-    m_onCompleteTimer.startOneShot(0);
-    m_backend.clear(); // Release the backend as it holds a (circular) reference back to us.
+    enqueueEvent(IDBCompleteEvent::create(IDBAny::create(this)));
 }
 
-void IDBTransaction::onTimeout()
+bool IDBTransaction::hasPendingActivity() const
 {
-    ASSERT(!m_onAbortTimer.isActive());
-    ASSERT(!m_onCompleteTimer.isActive());
-    ASSERT(!m_onTimeoutTimer.isActive());
-    m_selfRef = this;
-    m_onTimeoutTimer.startOneShot(0);
-    m_backend.clear(); // Release the backend as it holds a (circular) reference back to us.
+    // FIXME: In an ideal world, we should return true as long as anyone has a or can
+    //        get a handle to us or any child request object and any of those have
+    //        event listeners. This is  in order to handle user generated events properly.
+    return !m_finished || ActiveDOMObject::hasPendingActivity();
 }
 
-bool IDBTransaction::canSuspend() const
+ScriptExecutionContext* IDBTransaction::scriptExecutionContext() const
 {
-    // We may be in the middle of a transaction so we cannot suspend our object.
-    // Instead, we simply don't allow the owner page to go into the back/forward cache.
-    return false;
+    return ActiveDOMObject::scriptExecutionContext();
 }
 
-void IDBTransaction::stop()
+bool IDBTransaction::dispatchEvent(PassRefPtr<Event> event)
 {
-    if (m_backend)
-        m_backend->abort();
+    ASSERT(!m_finished);
+    ASSERT(scriptExecutionContext());
+    ASSERT(event->target() == this);
+    ASSERT(!m_finished);
+    m_finished = true;
+
+    Vector<RefPtr<EventTarget> > targets;
+    targets.append(this);
+    targets.append(db());
+
+    ASSERT(event->isIDBAbortEvent() || event->isIDBCompleteEvent());
+    return static_cast<IDBEvent*>(event.get())->dispatch(targets);
 }
 
-EventTargetData* IDBTransaction::eventTargetData()
+bool IDBTransaction::canSuspend() const
 {
-    return &m_eventTargetData;
+    // FIXME: Technically we can suspend before the first request is schedule
+    //        and after the complete/abort event is enqueued.
+    return m_finished;
 }
 
-EventTargetData* IDBTransaction::ensureEventTargetData()
+void IDBTransaction::contextDestroyed()
 {
-    return &m_eventTargetData;
+    ActiveDOMObject::contextDestroyed();
+
+    // Must happen in contextDestroyed since it can result in ActiveDOMObjects being destructed
+    // (and contextDestroyed is the only one resilient against this).
+    RefPtr<IDBTransaction> selfRef = this;
+    if (m_backend)
+        m_backend->abort();
+
+    m_finished = true;
 }
 
-void IDBTransaction::onAbortTimerFired(Timer<IDBTransaction>* transaction)
+void IDBTransaction::enqueueEvent(PassRefPtr<Event> event)
 {
-    ASSERT(m_selfRef);
-    RefPtr<IDBTransaction> selfRef = m_selfRef.release();
-    dispatchEvent(IDBAbortEvent::create());
+    ASSERT(!m_finished);
+    if (!scriptExecutionContext())
+        return;
+
+    ASSERT(scriptExecutionContext()->isDocument());
+    EventQueue* eventQueue = static_cast<Document*>(scriptExecutionContext())->eventQueue();
+    event->setTarget(this);
+    eventQueue->enqueueEvent(event);
 }
 
-void IDBTransaction::onCompleteTimerFired(Timer<IDBTransaction>* transaction)
+EventTargetData* IDBTransaction::eventTargetData()
 {
-    ASSERT(m_selfRef);
-    RefPtr<IDBTransaction> selfRef = m_selfRef.release();
-    dispatchEvent(IDBCompleteEvent::create());
+    return &m_eventTargetData;
 }
 
-
-void IDBTransaction::onTimeoutTimerFired(Timer<IDBTransaction>* transaction)
+EventTargetData* IDBTransaction::ensureEventTargetData()
 {
-    ASSERT(m_selfRef);
-    RefPtr<IDBTransaction> selfRef = m_selfRef.release();
-    dispatchEvent(IDBTimeoutEvent::create());
+    return &m_eventTargetData;
 }
 
 }
diff --git a/Source/WebCore/storage/IDBTransaction.h b/Source/WebCore/storage/IDBTransaction.h
index d0a9f0f..ff4feb6 100644
--- a/Source/WebCore/storage/IDBTransaction.h
+++ b/Source/WebCore/storage/IDBTransaction.h
@@ -30,12 +30,12 @@
 
 #include "ActiveDOMObject.h"
 #include "DOMStringList.h"
+#include "Event.h"
 #include "EventListener.h"
 #include "EventNames.h"
 #include "EventTarget.h"
 #include "IDBTransactionBackendInterface.h"
 #include "IDBTransactionCallbacks.h"
-#include "Timer.h"
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
@@ -45,10 +45,7 @@ class IDBObjectStore;
 
 class IDBTransaction : public IDBTransactionCallbacks, public EventTarget, public ActiveDOMObject {
 public:
-    static PassRefPtr<IDBTransaction> create(ScriptExecutionContext* context, PassRefPtr<IDBTransactionBackendInterface> backend, IDBDatabase* db)
-    { 
-        return adoptRef(new IDBTransaction(context, backend, db)); 
-    }
+    static PassRefPtr<IDBTransaction> create(ScriptExecutionContext*, PassRefPtr<IDBTransactionBackendInterface>, IDBDatabase*);
     virtual ~IDBTransaction();
 
     enum Mode {
@@ -57,27 +54,32 @@ public:
         VERSION_CHANGE = 2
     };
 
+    IDBTransactionBackendInterface* backend() const;
+    bool finished() const;
+
     unsigned short mode() const;
-    IDBDatabase* db();
+    IDBDatabase* db() const;
     PassRefPtr<IDBObjectStore> objectStore(const String& name, ExceptionCode&);
     void abort();
 
     DEFINE_ATTRIBUTE_EVENT_LISTENER(abort);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(complete);
-    DEFINE_ATTRIBUTE_EVENT_LISTENER(timeout);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
 
     // IDBTransactionCallbacks
     virtual void onAbort();
     virtual void onComplete();
-    virtual void onTimeout();
 
     // EventTarget
     virtual IDBTransaction* toIDBTransaction() { return this; }
+    virtual ScriptExecutionContext* scriptExecutionContext() const;
+    virtual bool dispatchEvent(PassRefPtr<Event>);
+    bool dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec) { return EventTarget::dispatchEvent(event, ec); }
 
     // ActiveDOMObject
-    virtual ScriptExecutionContext* scriptExecutionContext() const;
+    virtual bool hasPendingActivity() const;
     virtual bool canSuspend() const;
-    virtual void stop();
+    virtual void contextDestroyed();
 
     using RefCounted<IDBTransactionCallbacks>::ref;
     using RefCounted<IDBTransactionCallbacks>::deref;
@@ -85,25 +87,20 @@ public:
 private:
     IDBTransaction(ScriptExecutionContext*, PassRefPtr<IDBTransactionBackendInterface>, IDBDatabase*);
 
+    void enqueueEvent(PassRefPtr<Event>);
+
     // EventTarget
     virtual void refEventTarget() { ref(); }
     virtual void derefEventTarget() { deref(); }
     virtual EventTargetData* eventTargetData();
     virtual EventTargetData* ensureEventTargetData();
 
-    void onAbortTimerFired(Timer<IDBTransaction>*);
-    void onCompleteTimerFired(Timer<IDBTransaction>*);
-    void onTimeoutTimerFired(Timer<IDBTransaction>*);
-
-    EventTargetData m_eventTargetData;
     RefPtr<IDBTransactionBackendInterface> m_backend;
     RefPtr<IDBDatabase> m_database;
     unsigned short m_mode;
+    bool m_finished; // Is it possible that we'll fire any more events or allow any new transactions? If not, we're finished.
 
-    Timer<IDBTransaction> m_onAbortTimer;
-    Timer<IDBTransaction> m_onCompleteTimer;
-    Timer<IDBTransaction> m_onTimeoutTimer;
-    RefPtr<IDBTransaction> m_selfRef; // This is set to us iff there's an event pending.
+    EventTargetData m_eventTargetData;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/IDBTransaction.idl b/Source/WebCore/storage/IDBTransaction.idl
index b57ac4a..2f02195 100644
--- a/Source/WebCore/storage/IDBTransaction.idl
+++ b/Source/WebCore/storage/IDBTransaction.idl
@@ -44,7 +44,7 @@ module storage {
         // Events
         attribute EventListener onabort;
         attribute EventListener oncomplete;
-        attribute EventListener ontimeout;
+        attribute EventListener onerror;
         // EventTarget interface
         void addEventListener(in DOMString type,
                               in EventListener listener,
diff --git a/Source/WebCore/storage/IDBTransactionBackendImpl.cpp b/Source/WebCore/storage/IDBTransactionBackendImpl.cpp
index 0012231..1357838 100644
--- a/Source/WebCore/storage/IDBTransactionBackendImpl.cpp
+++ b/Source/WebCore/storage/IDBTransactionBackendImpl.cpp
@@ -35,15 +35,14 @@
 
 namespace WebCore {
 
-PassRefPtr<IDBTransactionBackendImpl> IDBTransactionBackendImpl::create(DOMStringList* objectStores, unsigned short mode, unsigned long timeout, IDBDatabaseBackendImpl* database)
+PassRefPtr<IDBTransactionBackendImpl> IDBTransactionBackendImpl::create(DOMStringList* objectStores, unsigned short mode, IDBDatabaseBackendImpl* database)
 {
-    return adoptRef(new IDBTransactionBackendImpl(objectStores, mode, timeout, database));
+    return adoptRef(new IDBTransactionBackendImpl(objectStores, mode, database));
 }
 
-IDBTransactionBackendImpl::IDBTransactionBackendImpl(DOMStringList* objectStores, unsigned short mode, unsigned long timeout, IDBDatabaseBackendImpl* database)
+IDBTransactionBackendImpl::IDBTransactionBackendImpl(DOMStringList* objectStores, unsigned short mode, IDBDatabaseBackendImpl* database)
     : m_objectStoreNames(objectStores)
     , m_mode(mode)
-    , m_timeout(timeout) // FIXME: Implement timeout.
     , m_state(Unused)
     , m_database(database)
     , m_transaction(new SQLiteTransaction(database->sqliteDatabase()))
@@ -180,12 +179,12 @@ void IDBTransactionBackendImpl::taskTimerFired(Timer<IDBTransactionBackendImpl>*
     if (m_state == StartPending) {
         m_transaction->begin();
         m_state = Running;
-    } else
-        ASSERT(m_state == Running);
+    }
 
     TaskQueue queue;
     queue.swap(m_taskQueue);
     while (!queue.isEmpty() && m_state != Finished) {
+        ASSERT(m_state == Running);
         OwnPtr<ScriptExecutionContext::Task> task(queue.first().release());
         queue.removeFirst();
         m_pendingEvents++;
diff --git a/Source/WebCore/storage/IDBTransactionBackendImpl.h b/Source/WebCore/storage/IDBTransactionBackendImpl.h
index f4dfaa8..1297e74 100644
--- a/Source/WebCore/storage/IDBTransactionBackendImpl.h
+++ b/Source/WebCore/storage/IDBTransactionBackendImpl.h
@@ -42,7 +42,7 @@ class IDBDatabaseBackendImpl;
 
 class IDBTransactionBackendImpl : public IDBTransactionBackendInterface {
 public:
-    static PassRefPtr<IDBTransactionBackendImpl> create(DOMStringList* objectStores, unsigned short mode, unsigned long timeout, IDBDatabaseBackendImpl*);
+    static PassRefPtr<IDBTransactionBackendImpl> create(DOMStringList* objectStores, unsigned short mode, IDBDatabaseBackendImpl*);
     virtual ~IDBTransactionBackendImpl();
 
     virtual PassRefPtr<IDBObjectStoreBackendInterface> objectStore(const String& name, ExceptionCode&);
@@ -55,7 +55,7 @@ public:
     void run();
 
 private:
-    IDBTransactionBackendImpl(DOMStringList* objectStores, unsigned short mode, unsigned long timeout, IDBDatabaseBackendImpl*);
+    IDBTransactionBackendImpl(DOMStringList* objectStores, unsigned short mode, IDBDatabaseBackendImpl*);
 
     enum State {
         Unused, // Created, but no tasks yet.
@@ -72,7 +72,6 @@ private:
 
     RefPtr<DOMStringList> m_objectStoreNames;
     unsigned short m_mode;
-    unsigned long m_timeout;
 
     State m_state;
     RefPtr<IDBTransactionCallbacks> m_callbacks;
diff --git a/Source/WebCore/storage/IDBTransactionCallbacks.h b/Source/WebCore/storage/IDBTransactionCallbacks.h
index 348608d..8d906a6 100644
--- a/Source/WebCore/storage/IDBTransactionCallbacks.h
+++ b/Source/WebCore/storage/IDBTransactionCallbacks.h
@@ -42,7 +42,6 @@ public:
 
     virtual void onAbort() = 0;
     virtual void onComplete() = 0;
-    virtual void onTimeout() = 0;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/chromium/IDBFactoryBackendInterface.cpp b/Source/WebCore/storage/chromium/IDBFactoryBackendInterface.cpp
index 92e9a7b..81eeb3e 100644
--- a/Source/WebCore/storage/chromium/IDBFactoryBackendInterface.cpp
+++ b/Source/WebCore/storage/chromium/IDBFactoryBackendInterface.cpp
@@ -39,11 +39,6 @@ PassRefPtr<IDBFactoryBackendInterface> IDBFactoryBackendInterface::create()
     return PlatformBridge::idbFactory();
 }
 
-IDBFactoryBackendInterface::~IDBFactoryBackendInterface()
-{
-    PlatformBridge::idbShutdown();
-}
-
 } // namespace WebCore
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebCore/svg/SVGAElement.cpp b/Source/WebCore/svg/SVGAElement.cpp
index 8fbfc01..601b432 100644
--- a/Source/WebCore/svg/SVGAElement.cpp
+++ b/Source/WebCore/svg/SVGAElement.cpp
@@ -105,6 +105,21 @@ void SVGAElement::svgAttributeChanged(const QualifiedName& attrName)
     }
 }
 
+AttributeToPropertyTypeMap& SVGAElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGAElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGStyledTransformableElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::targetAttr, AnimatedString);
+    attributeToPropertyTypeMap.set(XLinkNames::hrefAttr, AnimatedString);
+}
+
 void SVGAElement::synchronizeProperty(const QualifiedName& attrName)
 {
     SVGStyledTransformableElement::synchronizeProperty(attrName);
diff --git a/Source/WebCore/svg/SVGAElement.h b/Source/WebCore/svg/SVGAElement.h
index 20a4e07..6d9cd43 100644
--- a/Source/WebCore/svg/SVGAElement.h
+++ b/Source/WebCore/svg/SVGAElement.h
@@ -52,6 +52,9 @@ private:
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
 
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
+
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
     virtual void defaultEventHandler(Event*);
diff --git a/Source/WebCore/svg/SVGAltGlyphElement.cpp b/Source/WebCore/svg/SVGAltGlyphElement.cpp
index ca13740..96fbac6 100644
--- a/Source/WebCore/svg/SVGAltGlyphElement.cpp
+++ b/Source/WebCore/svg/SVGAltGlyphElement.cpp
@@ -54,6 +54,20 @@ void SVGAltGlyphElement::synchronizeProperty(const QualifiedName& attrName)
         synchronizeHref();
 }
 
+AttributeToPropertyTypeMap& SVGAltGlyphElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGAltGlyphElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGTextPositioningElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(XLinkNames::hrefAttr, AnimatedString);
+}
+
 void SVGAltGlyphElement::setGlyphRef(const AtomicString&, ExceptionCode& ec)
 {
     ec = NO_MODIFICATION_ALLOWED_ERR;
diff --git a/Source/WebCore/svg/SVGAltGlyphElement.h b/Source/WebCore/svg/SVGAltGlyphElement.h
index 0cbee79..114e666 100644
--- a/Source/WebCore/svg/SVGAltGlyphElement.h
+++ b/Source/WebCore/svg/SVGAltGlyphElement.h
@@ -47,6 +47,9 @@ private:
 
     virtual void synchronizeProperty(const QualifiedName&);
 
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
+
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual bool childShouldCreateRenderer(Node*) const;
 
diff --git a/Source/WebCore/svg/SVGAnimateElement.cpp b/Source/WebCore/svg/SVGAnimateElement.cpp
index 7fe4c87..0dfe086 100644
--- a/Source/WebCore/svg/SVGAnimateElement.cpp
+++ b/Source/WebCore/svg/SVGAnimateElement.cpp
@@ -24,8 +24,11 @@
 #if ENABLE(SVG) && ENABLE(SVG_ANIMATION)
 #include "SVGAnimateElement.h"
 
+#include "CSSPropertyNames.h"
 #include "ColorDistance.h"
 #include "FloatConversion.h"
+#include "QualifiedName.h"
+#include "RenderObject.h"
 #include "SVGColor.h"
 #include "SVGNames.h"
 #include "SVGParserUtilities.h"
@@ -82,17 +85,31 @@ static bool parseNumberValueAndUnit(const String& in, double& value, String& uni
     return ok;
 }
 
+static inline bool adjustForCurrentColor(Color& color, const String& value, SVGElement* target)
+{
+    if (!target || !target->isStyled() || value != "currentColor")
+        return false;
+    
+    if (RenderObject* targetRenderer = target->renderer())
+        color = targetRenderer->style()->visitedDependentColor(CSSPropertyColor);
+
+    return true;
+}
+
 SVGAnimateElement::PropertyType SVGAnimateElement::determinePropertyType(const String& attribute) const
 {
-    // FIXME: We need a full property table for figuring this out reliably.
+    // FIXME: We should not allow animation of attribute types other than AnimatedColor for <animateColor>.
     if (hasTagName(SVGNames::animateColorTag))
         return ColorProperty;
-    if (attribute == "d")
+
+    // FIXME: Now that we have a full property table we need a more granular type specific animation.
+    AnimatedAttributeType type = targetElement()->animatedPropertyTypeForAttribute(QualifiedName(nullAtom, attribute, nullAtom));
+    if (type == AnimatedColor)
+        return ColorProperty;
+    if (type == AnimatedPath)
         return PathProperty;
-    if (attribute == "points")
+    if (type == AnimatedPoints)
         return PointsProperty;
-    if (attribute == "color" || attribute == "fill" || attribute == "stroke")
-        return ColorProperty;
     return NumberProperty;
 }
 
@@ -100,6 +117,9 @@ void SVGAnimateElement::calculateAnimatedValue(float percentage, unsigned repeat
 {
     ASSERT(percentage >= 0.f && percentage <= 1.f);
     ASSERT(resultElement);
+    bool isInFirstHalfOfAnimation = percentage < 0.5;
+    AnimationMode animationMode = this->animationMode();
+    
     if (hasTagName(SVGNames::setTag))
         percentage = 1.f;
     if (!resultElement->hasTagName(SVGNames::animateTag) && !resultElement->hasTagName(SVGNames::animateColorTag) 
@@ -111,33 +131,45 @@ void SVGAnimateElement::calculateAnimatedValue(float percentage, unsigned repeat
         return;
     if (m_propertyType == NumberProperty) {
         // To animation uses contributions from the lower priority animations as the base value.
-        if (animationMode() == ToAnimation)
+        if (animationMode == ToAnimation)
             m_fromNumber = results->m_animatedNumber;
-    
-        double number = (m_toNumber - m_fromNumber) * percentage + m_fromNumber;
+        
+        double number;
+        if (calcMode() == CalcModeDiscrete)
+            number = isInFirstHalfOfAnimation ? m_fromNumber : m_toNumber;
+        else
+            number = (m_toNumber - m_fromNumber) * percentage + m_fromNumber;
 
         // FIXME: This is not correct for values animation.
         if (isAccumulated() && repeat)
             number += m_toNumber * repeat;
-        if (isAdditive() && animationMode() != ToAnimation)
+        if (isAdditive() && animationMode != ToAnimation)
             results->m_animatedNumber += number;
         else 
             results->m_animatedNumber = number;
         return;
     } 
     if (m_propertyType == ColorProperty) {
-        if (animationMode() == ToAnimation)
+        if (animationMode == ToAnimation)
             m_fromColor = results->m_animatedColor;
-        Color color = ColorDistance(m_fromColor, m_toColor).scaledDistance(percentage).addToColorAndClamp(m_fromColor);
+        Color color;
+        if (calcMode() == CalcModeDiscrete)
+            color = isInFirstHalfOfAnimation ? m_fromColor : m_toColor;
+        else
+            color = ColorDistance(m_fromColor, m_toColor).scaledDistance(percentage).addToColorAndClamp(m_fromColor);
+
         // FIXME: Accumulate colors.
-        if (isAdditive() && animationMode() != ToAnimation)
+        if (isAdditive() && animationMode != ToAnimation)
             results->m_animatedColor = ColorDistance::addColorsAndClamp(results->m_animatedColor, color);
         else
             results->m_animatedColor = color;
         return;
     }
-    AnimationMode animationMode = this->animationMode();
     if (m_propertyType == PathProperty) {
+        if (animationMode == ToAnimation) {
+            ASSERT(results->m_animatedPathPointer);
+            m_fromPath = results->m_animatedPathPointer->copy();
+        }
         if (!percentage) {
             ASSERT(m_fromPath);
             ASSERT(percentage >= 0);
@@ -197,8 +229,11 @@ bool SVGAnimateElement::calculateFromAndToValues(const String& fromString, const
     // FIXME: Needs more solid way determine target attribute type.
     m_propertyType = determinePropertyType(attributeName());
     if (m_propertyType == ColorProperty) {
-        m_fromColor = SVGColor::colorFromRGBColorString(fromString);
-        m_toColor = SVGColor::colorFromRGBColorString(toString);
+        SVGElement* targetElement = this->targetElement();
+        if (!adjustForCurrentColor(m_fromColor, fromString, targetElement))
+            m_fromColor = SVGColor::colorFromRGBColorString(fromString);
+        if (!adjustForCurrentColor(m_toColor, toString, targetElement))
+            m_toColor = SVGColor::colorFromRGBColorString(toString);
         if ((m_fromColor.isValid() && m_toColor.isValid()) || (m_toColor.isValid() && animationMode() == ToAnimation))
             return true;
     } else if (m_propertyType == NumberProperty) {
@@ -210,8 +245,9 @@ bool SVGAnimateElement::calculateFromAndToValues(const String& fromString, const
         }
     } else if (m_propertyType == PathProperty) {
         SVGPathParserFactory* factory = SVGPathParserFactory::self();
-        if (factory->buildSVGPathByteStreamFromString(fromString, m_fromPath, UnalteredParsing)) {
-            if (factory->buildSVGPathByteStreamFromString(toString, m_toPath, UnalteredParsing))
+        if (factory->buildSVGPathByteStreamFromString(toString, m_toPath, UnalteredParsing)) {
+            // For to-animations the from number is calculated later
+            if (animationMode() == ToAnimation || factory->buildSVGPathByteStreamFromString(fromString, m_fromPath, UnalteredParsing))
                 return true;
         }
         m_fromPath.clear();
@@ -235,8 +271,12 @@ bool SVGAnimateElement::calculateFromAndByValues(const String& fromString, const
     ASSERT(!hasTagName(SVGNames::setTag));
     m_propertyType = determinePropertyType(attributeName());
     if (m_propertyType == ColorProperty) {
-        m_fromColor = fromString.isEmpty() ? Color() : SVGColor::colorFromRGBColorString(fromString);
-        m_toColor = ColorDistance::addColorsAndClamp(m_fromColor, SVGColor::colorFromRGBColorString(byString));
+        SVGElement* targetElement = this->targetElement();
+        if (!adjustForCurrentColor(m_fromColor, fromString, targetElement))
+            m_fromColor = fromString.isEmpty() ? Color() : SVGColor::colorFromRGBColorString(fromString);
+        if (!adjustForCurrentColor(m_toColor, byString, targetElement))
+            m_toColor = SVGColor::colorFromRGBColorString(byString);
+        m_toColor = ColorDistance::addColorsAndClamp(m_fromColor, m_toColor);
         if (!m_fromColor.isValid() || !m_toColor.isValid())
             return false;
     } else {
@@ -272,7 +312,9 @@ void SVGAnimateElement::resetToBaseValue(const String& baseString)
             return;
     } else if (m_propertyType == PathProperty) {
         m_animatedPath.clear();
-        m_animatedPathPointer = 0;
+        SVGPathParserFactory* factory = SVGPathParserFactory::self();
+        factory->buildSVGPathByteStreamFromString(baseString, m_animatedPath, UnalteredParsing);
+        m_animatedPathPointer = m_animatedPath.get();
         return;
     } else if (m_propertyType == PointsProperty) {
         m_animatedPoints.clear();
diff --git a/Source/WebCore/svg/SVGAnimationElement.cpp b/Source/WebCore/svg/SVGAnimationElement.cpp
index 0fcda6d..c56e3b6 100644
--- a/Source/WebCore/svg/SVGAnimationElement.cpp
+++ b/Source/WebCore/svg/SVGAnimationElement.cpp
@@ -38,7 +38,6 @@
 #include "FloatConversion.h"
 #include "HTMLNames.h"
 #include "PlatformString.h"
-#include "RenderObject.h"
 #include "SVGElementInstance.h"
 #include "SVGNames.h"
 #include "SVGParserUtilities.h"
@@ -499,14 +498,6 @@ void SVGAnimationElement::currentValuesForValuesAnimation(float percent, float&
         effectivePercent = calculatePercentForSpline(effectivePercent, index);
     }
 }
-static inline void adjustForCurrentColor(String& value, SVGElement* target)
-{
-    if (!target || !target->isStyled() || value != "currentColor")
-        return;
-
-    if (RenderObject* targetRenderer = target->renderer())
-        value = targetRenderer->style()->visitedDependentColor(CSSPropertyColor).name();
-}
     
 void SVGAnimationElement::startedActiveInterval()
 {
@@ -531,29 +522,22 @@ void SVGAnimationElement::startedActiveInterval()
     String from = fromValue();
     String to = toValue();
     String by = byValue();
-    SVGElement* target = targetElement();
     if (animationMode == NoAnimation)
         return;
-    if (animationMode == FromToAnimation) {
-        adjustForCurrentColor(from, target);
-        adjustForCurrentColor(to, target);
+    if (animationMode == FromToAnimation)
         m_animationValid = calculateFromAndToValues(from, to);
-    } else if (animationMode == ToAnimation) {
+    else if (animationMode == ToAnimation) {
         // For to-animations the from value is the current accumulated value from lower priority animations.
         // The value is not static and is determined during the animation.
-        adjustForCurrentColor(to, target);
         m_animationValid = calculateFromAndToValues(String(), to);
-    } else if (animationMode == FromByAnimation) {
-        adjustForCurrentColor(from, target);
-        adjustForCurrentColor(by, target);
+    } else if (animationMode == FromByAnimation)
         m_animationValid = calculateFromAndByValues(from, by);
-    } else if (animationMode == ByAnimation) {
-        adjustForCurrentColor(by, target);
+    else if (animationMode == ByAnimation)
         m_animationValid = calculateFromAndByValues(String(), by);
-    } else if (animationMode == ValuesAnimation) {
+    else if (animationMode == ValuesAnimation) {
         m_animationValid = m_values.size() > 1
             && (calcMode == CalcModePaced || !hasAttribute(SVGNames::keyTimesAttr) || hasAttribute(SVGNames::keyPointsAttr) || (m_values.size() == m_keyTimes.size()))
-            && (calcMode == CalcModeDiscrete || !m_keyTimes.size() || m_keyTimes.last() == 1.0)
+            && (calcMode == CalcModeDiscrete || !m_keyTimes.size() || m_keyTimes.last() == 1)
             && (calcMode != CalcModeSpline || ((m_keySplines.size() && (m_keySplines.size() == m_values.size() - 1)) || m_keySplines.size() == m_keyPoints.size() - 1))
             && (!hasAttribute(SVGNames::keyPointsAttr) || (m_keyTimes.size() > 1 && m_keyTimes.size() == m_keyPoints.size()));
         if (calcMode == CalcModePaced && m_animationValid)
diff --git a/Source/WebCore/svg/SVGCircleElement.cpp b/Source/WebCore/svg/SVGCircleElement.cpp
index 0ac4600..6a3a0d4 100644
--- a/Source/WebCore/svg/SVGCircleElement.cpp
+++ b/Source/WebCore/svg/SVGCircleElement.cpp
@@ -132,6 +132,22 @@ void SVGCircleElement::synchronizeProperty(const QualifiedName& attrName)
         SVGTests::synchronizeProperties(this, attrName);
 }
 
+AttributeToPropertyTypeMap& SVGCircleElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGCircleElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGStyledTransformableElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::cxAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::cyAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::rAttr, AnimatedLength);
+}
+
 void SVGCircleElement::toPathData(Path& path) const
 {
     ASSERT(path.isEmpty());
diff --git a/Source/WebCore/svg/SVGCircleElement.h b/Source/WebCore/svg/SVGCircleElement.h
index f6946dd..32d3a22 100644
--- a/Source/WebCore/svg/SVGCircleElement.h
+++ b/Source/WebCore/svg/SVGCircleElement.h
@@ -47,6 +47,9 @@ private:
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
 
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
+
     virtual void toPathData(Path&) const;
 
     virtual bool selfHasRelativeLengths() const;
diff --git a/Source/WebCore/svg/SVGClipPathElement.cpp b/Source/WebCore/svg/SVGClipPathElement.cpp
index d86370d..74727ee 100644
--- a/Source/WebCore/svg/SVGClipPathElement.cpp
+++ b/Source/WebCore/svg/SVGClipPathElement.cpp
@@ -102,6 +102,20 @@ void SVGClipPathElement::synchronizeProperty(const QualifiedName& attrName)
         SVGTests::synchronizeProperties(this, attrName);
 }
 
+AttributeToPropertyTypeMap& SVGClipPathElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGClipPathElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGStyledTransformableElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::clipPathUnitsAttr, AnimatedEnumeration);
+}
+
 void SVGClipPathElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     SVGStyledTransformableElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
diff --git a/Source/WebCore/svg/SVGClipPathElement.h b/Source/WebCore/svg/SVGClipPathElement.h
index 23242e8..ed2e13c 100644
--- a/Source/WebCore/svg/SVGClipPathElement.h
+++ b/Source/WebCore/svg/SVGClipPathElement.h
@@ -49,6 +49,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/Source/WebCore/svg/SVGComponentTransferFunctionElement.cpp b/Source/WebCore/svg/SVGComponentTransferFunctionElement.cpp
index 142d82d..c35a344 100644
--- a/Source/WebCore/svg/SVGComponentTransferFunctionElement.cpp
+++ b/Source/WebCore/svg/SVGComponentTransferFunctionElement.cpp
@@ -112,6 +112,24 @@ void SVGComponentTransferFunctionElement::synchronizeProperty(const QualifiedNam
         synchronizeOffset();
 }
 
+AttributeToPropertyTypeMap& SVGComponentTransferFunctionElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGComponentTransferFunctionElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+    attributeToPropertyTypeMap.set(SVGNames::typeAttr, AnimatedEnumeration);
+    attributeToPropertyTypeMap.set(SVGNames::tableValuesAttr, AnimatedNumberList);
+    attributeToPropertyTypeMap.set(SVGNames::slopeAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::interceptAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::amplitudeAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::exponentAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::offsetAttr, AnimatedNumber);
+}
+
 ComponentTransferFunction SVGComponentTransferFunctionElement::transferFunction() const
 {
     ComponentTransferFunction func;
diff --git a/Source/WebCore/svg/SVGComponentTransferFunctionElement.h b/Source/WebCore/svg/SVGComponentTransferFunctionElement.h
index 5f836f7..2be693b 100644
--- a/Source/WebCore/svg/SVGComponentTransferFunctionElement.h
+++ b/Source/WebCore/svg/SVGComponentTransferFunctionElement.h
@@ -38,6 +38,8 @@ protected:
 
     virtual void parseMappedAttribute(Attribute*);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     
 private:
     // Animated property declarations
diff --git a/Source/WebCore/svg/SVGCursorElement.cpp b/Source/WebCore/svg/SVGCursorElement.cpp
index 0c6a5d9..c49f799 100644
--- a/Source/WebCore/svg/SVGCursorElement.cpp
+++ b/Source/WebCore/svg/SVGCursorElement.cpp
@@ -72,6 +72,20 @@ void SVGCursorElement::parseMappedAttribute(Attribute* attr)
     }
 }
 
+AttributeToPropertyTypeMap& SVGCursorElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGCursorElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+    attributeToPropertyTypeMap.set(SVGNames::xAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::yAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(XLinkNames::hrefAttr, AnimatedString);
+}
+
 void SVGCursorElement::addClient(SVGElement* element)
 {
     m_clients.add(element);
diff --git a/Source/WebCore/svg/SVGCursorElement.h b/Source/WebCore/svg/SVGCursorElement.h
index cd4a44e..c670009 100644
--- a/Source/WebCore/svg/SVGCursorElement.h
+++ b/Source/WebCore/svg/SVGCursorElement.h
@@ -53,6 +53,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
diff --git a/Source/WebCore/svg/SVGDocumentExtensions.cpp b/Source/WebCore/svg/SVGDocumentExtensions.cpp
index 3fd9761..7f7ba67 100644
--- a/Source/WebCore/svg/SVGDocumentExtensions.cpp
+++ b/Source/WebCore/svg/SVGDocumentExtensions.cpp
@@ -93,8 +93,12 @@ void SVGDocumentExtensions::startAnimations()
     // FIXME: Eventually every "Time Container" will need a way to latch on to some global timer
     // starting animations for a document will do this "latching"
 #if ENABLE(SVG_ANIMATION)    
-    HashSet<SVGSVGElement*>::iterator end = m_timeContainers.end();
-    for (HashSet<SVGSVGElement*>::iterator itr = m_timeContainers.begin(); itr != end; ++itr)
+    // FIXME: We hold a ref pointers to prevent a shadow tree from getting removed out from underneath us.
+    // In the future we should refactor the use-element to avoid this. See https://webkit.org/b/53704
+    Vector<RefPtr<SVGSVGElement> > timeContainers;
+    timeContainers.appendRange(m_timeContainers.begin(), m_timeContainers.end());
+    Vector<RefPtr<SVGSVGElement> >::iterator end = timeContainers.end();
+    for (Vector<RefPtr<SVGSVGElement> >::iterator itr = timeContainers.begin(); itr != end; ++itr)
         (*itr)->timeContainer()->begin();
 #endif
 }
diff --git a/Source/WebCore/svg/SVGElement.cpp b/Source/WebCore/svg/SVGElement.cpp
index c9efae8..99134b2 100644
--- a/Source/WebCore/svg/SVGElement.cpp
+++ b/Source/WebCore/svg/SVGElement.cpp
@@ -256,6 +256,25 @@ void SVGElement::parseMappedAttribute(Attribute* attr)
         StyledElement::parseMappedAttribute(attr);
 }
 
+AttributeToPropertyTypeMap& SVGElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+AnimatedAttributeType SVGElement::animatedPropertyTypeForAttribute(const QualifiedName& attrName)
+{
+    AttributeToPropertyTypeMap& animatedAttributeMap = attributeToPropertyTypeMap();
+    if (animatedAttributeMap.isEmpty())
+        fillAttributeToPropertyTypeMap();
+    if (animatedAttributeMap.contains(attrName))
+        return animatedAttributeMap.get(attrName);
+    if (isStyled())
+        return static_cast<SVGStyledElement*>(this)->animatedPropertyTypeForCSSProperty(attrName);
+
+    return AnimatedUnknown;
+}
+
 bool SVGElement::haveLoadedRequiredResources()
 {
     Node* child = firstChild();
diff --git a/Source/WebCore/svg/SVGElement.h b/Source/WebCore/svg/SVGElement.h
index 2c87f6e..ceb0973 100644
--- a/Source/WebCore/svg/SVGElement.h
+++ b/Source/WebCore/svg/SVGElement.h
@@ -25,9 +25,32 @@
 #if ENABLE(SVG)
 #include "SVGLocatable.h"
 #include "StyledElement.h"
+#include <wtf/HashMap.h>
 
 namespace WebCore {
 
+enum AnimatedAttributeType {
+    AnimatedAngle,
+    AnimatedBoolean,
+    AnimatedColor,
+    AnimatedEnumeration,
+    AnimatedInteger,
+    AnimatedLength,
+    AnimatedLengthList,
+    AnimatedNumber,
+    AnimatedNumberList,
+    AnimatedNumberOptionalNumber,
+    AnimatedPath,
+    AnimatedPoints,
+    AnimatedPreserveAspectRatio,
+    AnimatedRect,
+    AnimatedString,
+    AnimatedTransformList,
+    AnimatedUnknown
+};
+
+typedef HashMap<QualifiedName, AnimatedAttributeType> AttributeToPropertyTypeMap;
+
 class CSSCursorImageValue;
 class Document;
 class SVGCursorElement;
@@ -64,6 +87,11 @@ public:
     virtual void svgAttributeChanged(const QualifiedName&) { }
     virtual void synchronizeProperty(const QualifiedName&) { }
 
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
+    AnimatedAttributeType animatedPropertyTypeForAttribute(const QualifiedName&);
+
+    virtual void fillAttributeToPropertyTypeMap() { }
+
     void sendSVGLoadEventIfPossible(bool sendParentLoadEvents = false);
 
     virtual AffineTransform* supplementalTransform() { return 0; }
diff --git a/Source/WebCore/svg/SVGEllipseElement.cpp b/Source/WebCore/svg/SVGEllipseElement.cpp
index 4a12aa7..129e1cd 100644
--- a/Source/WebCore/svg/SVGEllipseElement.cpp
+++ b/Source/WebCore/svg/SVGEllipseElement.cpp
@@ -142,6 +142,23 @@ void SVGEllipseElement::synchronizeProperty(const QualifiedName& attrName)
         SVGTests::synchronizeProperties(this, attrName);
 }
 
+AttributeToPropertyTypeMap& SVGEllipseElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGEllipseElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGStyledTransformableElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);    
+    attributeToPropertyTypeMap.set(SVGNames::cxAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::cyAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::rxAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::ryAttr, AnimatedLength);
+}
+
 void SVGEllipseElement::toPathData(Path& path) const
 {
     ASSERT(path.isEmpty());
diff --git a/Source/WebCore/svg/SVGEllipseElement.h b/Source/WebCore/svg/SVGEllipseElement.h
index 7ba2085..2c8a864 100644
--- a/Source/WebCore/svg/SVGEllipseElement.h
+++ b/Source/WebCore/svg/SVGEllipseElement.h
@@ -46,6 +46,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 
     virtual void toPathData(Path&) const;
 
diff --git a/Source/WebCore/svg/SVGFEBlendElement.cpp b/Source/WebCore/svg/SVGFEBlendElement.cpp
index 4128232..b0f580c 100644
--- a/Source/WebCore/svg/SVGFEBlendElement.cpp
+++ b/Source/WebCore/svg/SVGFEBlendElement.cpp
@@ -97,6 +97,22 @@ void SVGFEBlendElement::synchronizeProperty(const QualifiedName& attrName)
         synchronizeIn2();
 }
 
+AttributeToPropertyTypeMap& SVGFEBlendElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGFEBlendElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGFilterPrimitiveStandardAttributes::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);    
+    attributeToPropertyTypeMap.set(SVGNames::inAttr, AnimatedString);
+    attributeToPropertyTypeMap.set(SVGNames::in2Attr, AnimatedString);
+    attributeToPropertyTypeMap.set(SVGNames::modeAttr, AnimatedEnumeration);
+}
+
 PassRefPtr<FilterEffect> SVGFEBlendElement::build(SVGFilterBuilder* filterBuilder, Filter* filter)
 {
     FilterEffect* input1 = filterBuilder->getEffectById(in1());
diff --git a/Source/WebCore/svg/SVGFEBlendElement.h b/Source/WebCore/svg/SVGFEBlendElement.h
index 292f385..c579ac5 100644
--- a/Source/WebCore/svg/SVGFEBlendElement.h
+++ b/Source/WebCore/svg/SVGFEBlendElement.h
@@ -38,6 +38,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
 
     // Animated property declarations
diff --git a/Source/WebCore/svg/SVGFEColorMatrixElement.cpp b/Source/WebCore/svg/SVGFEColorMatrixElement.cpp
index 4c7ac0b..d3229d0 100644
--- a/Source/WebCore/svg/SVGFEColorMatrixElement.cpp
+++ b/Source/WebCore/svg/SVGFEColorMatrixElement.cpp
@@ -98,6 +98,22 @@ void SVGFEColorMatrixElement::synchronizeProperty(const QualifiedName& attrName)
         synchronizeValues();
 }
 
+AttributeToPropertyTypeMap& SVGFEColorMatrixElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGFEColorMatrixElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGFilterPrimitiveStandardAttributes::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::inAttr, AnimatedString);
+    attributeToPropertyTypeMap.set(SVGNames::typeAttr, AnimatedEnumeration);
+    attributeToPropertyTypeMap.set(SVGNames::valuesAttr, AnimatedNumberList);
+}
+
 PassRefPtr<FilterEffect> SVGFEColorMatrixElement::build(SVGFilterBuilder* filterBuilder, Filter* filter)
 {
     FilterEffect* input1 = filterBuilder->getEffectById(in1());
diff --git a/Source/WebCore/svg/SVGFEColorMatrixElement.h b/Source/WebCore/svg/SVGFEColorMatrixElement.h
index 04a8966..7bff011 100644
--- a/Source/WebCore/svg/SVGFEColorMatrixElement.h
+++ b/Source/WebCore/svg/SVGFEColorMatrixElement.h
@@ -39,6 +39,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
 
     // Animated property declarations
diff --git a/Source/WebCore/svg/SVGFEComponentTransferElement.cpp b/Source/WebCore/svg/SVGFEComponentTransferElement.cpp
index 243f856..1b62ed9 100644
--- a/Source/WebCore/svg/SVGFEComponentTransferElement.cpp
+++ b/Source/WebCore/svg/SVGFEComponentTransferElement.cpp
@@ -64,6 +64,20 @@ void SVGFEComponentTransferElement::synchronizeProperty(const QualifiedName& att
         synchronizeIn1();
 }
 
+AttributeToPropertyTypeMap& SVGFEComponentTransferElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGFEComponentTransferElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGFilterPrimitiveStandardAttributes::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::inAttr, AnimatedString);
+}
+
 PassRefPtr<FilterEffect> SVGFEComponentTransferElement::build(SVGFilterBuilder* filterBuilder, Filter* filter)
 {
     FilterEffect* input1 = filterBuilder->getEffectById(in1());
diff --git a/Source/WebCore/svg/SVGFEComponentTransferElement.h b/Source/WebCore/svg/SVGFEComponentTransferElement.h
index ea7f84d..0b3608c 100644
--- a/Source/WebCore/svg/SVGFEComponentTransferElement.h
+++ b/Source/WebCore/svg/SVGFEComponentTransferElement.h
@@ -36,6 +36,8 @@ private:
 
     virtual void parseMappedAttribute(Attribute*);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
 
     // Animated property declarations
diff --git a/Source/WebCore/svg/SVGFECompositeElement.cpp b/Source/WebCore/svg/SVGFECompositeElement.cpp
index 4c83d4f..af738a9 100644
--- a/Source/WebCore/svg/SVGFECompositeElement.cpp
+++ b/Source/WebCore/svg/SVGFECompositeElement.cpp
@@ -127,6 +127,26 @@ void SVGFECompositeElement::synchronizeProperty(const QualifiedName& attrName)
         synchronizeK4();
 }
 
+AttributeToPropertyTypeMap& SVGFECompositeElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGFECompositeElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGFilterPrimitiveStandardAttributes::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);    
+    attributeToPropertyTypeMap.set(SVGNames::inAttr, AnimatedString);
+    attributeToPropertyTypeMap.set(SVGNames::in2Attr, AnimatedString);
+    attributeToPropertyTypeMap.set(SVGNames::operatorAttr, AnimatedEnumeration);
+    attributeToPropertyTypeMap.set(SVGNames::k1Attr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::k2Attr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::k3Attr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::k4Attr, AnimatedNumber);
+}
+
 PassRefPtr<FilterEffect> SVGFECompositeElement::build(SVGFilterBuilder* filterBuilder, Filter* filter)
 {
     FilterEffect* input1 = filterBuilder->getEffectById(in1());
diff --git a/Source/WebCore/svg/SVGFECompositeElement.h b/Source/WebCore/svg/SVGFECompositeElement.h
index 6892220..a4a9617 100644
--- a/Source/WebCore/svg/SVGFECompositeElement.h
+++ b/Source/WebCore/svg/SVGFECompositeElement.h
@@ -39,6 +39,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
 
     // Animated property declarations
diff --git a/Source/WebCore/svg/SVGFEConvolveMatrixElement.cpp b/Source/WebCore/svg/SVGFEConvolveMatrixElement.cpp
index 301e351..07ebc41 100644
--- a/Source/WebCore/svg/SVGFEConvolveMatrixElement.cpp
+++ b/Source/WebCore/svg/SVGFEConvolveMatrixElement.cpp
@@ -159,6 +159,29 @@ void SVGFEConvolveMatrixElement::svgAttributeChanged(const QualifiedName& attrNa
         invalidate();
 }
 
+AttributeToPropertyTypeMap& SVGFEConvolveMatrixElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGFEConvolveMatrixElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGFilterPrimitiveStandardAttributes::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::inAttr, AnimatedString);
+    attributeToPropertyTypeMap.set(SVGNames::orderAttr, AnimatedNumberOptionalNumber);
+    attributeToPropertyTypeMap.set(SVGNames::kernelMatrixAttr, AnimatedNumberList);
+    attributeToPropertyTypeMap.set(SVGNames::divisorAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::biasAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::targetXAttr, AnimatedInteger);
+    attributeToPropertyTypeMap.set(SVGNames::targetYAttr, AnimatedInteger);
+    attributeToPropertyTypeMap.set(SVGNames::operatorAttr, AnimatedEnumeration);
+    attributeToPropertyTypeMap.set(SVGNames::kernelUnitLengthAttr, AnimatedNumberOptionalNumber);
+    attributeToPropertyTypeMap.set(SVGNames::preserveAlphaAttr, AnimatedBoolean);
+}
+
 PassRefPtr<FilterEffect> SVGFEConvolveMatrixElement::build(SVGFilterBuilder* filterBuilder, Filter* filter)
 {
     FilterEffect* input1 = filterBuilder->getEffectById(in1());
diff --git a/Source/WebCore/svg/SVGFEConvolveMatrixElement.h b/Source/WebCore/svg/SVGFEConvolveMatrixElement.h
index 87709ab..ccc45ce 100644
--- a/Source/WebCore/svg/SVGFEConvolveMatrixElement.h
+++ b/Source/WebCore/svg/SVGFEConvolveMatrixElement.h
@@ -43,6 +43,8 @@ private:
 
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
 
     static const AtomicString& orderXIdentifier();
diff --git a/Source/WebCore/svg/SVGFEDiffuseLightingElement.cpp b/Source/WebCore/svg/SVGFEDiffuseLightingElement.cpp
index 49888da..1e86097 100644
--- a/Source/WebCore/svg/SVGFEDiffuseLightingElement.cpp
+++ b/Source/WebCore/svg/SVGFEDiffuseLightingElement.cpp
@@ -84,18 +84,69 @@ void SVGFEDiffuseLightingElement::parseMappedAttribute(Attribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
+bool SVGFEDiffuseLightingElement::setFilterEffectAttribute(FilterEffect* effect, const QualifiedName& attrName)
+{
+    FEDiffuseLighting* diffuseLighting = static_cast<FEDiffuseLighting*>(effect);
+    if (attrName == SVGNames::surfaceScaleAttr)
+        return diffuseLighting->setSurfaceScale(surfaceScale());
+    if (attrName == SVGNames::diffuseConstantAttr)
+        return diffuseLighting->setDiffuseConstant(diffuseConstant());
+    if (attrName == SVGNames::lighting_colorAttr) {
+        RefPtr<RenderStyle> filterStyle = styleForRenderer();
+        return diffuseLighting->setLightingColor(filterStyle->svgStyle()->lightingColor());
+    }
+
+    LightSource* lightSource = const_cast<LightSource*>(diffuseLighting->lightSource());
+    const SVGFELightElement* lightElement = findLightElement();
+
+    if (attrName == SVGNames::azimuthAttr)
+        return lightSource->setAzimuth(lightElement->azimuth());
+    if (attrName == SVGNames::elevationAttr)
+        return lightSource->setElevation(lightElement->elevation());
+    if (attrName == SVGNames::xAttr)
+        return lightSource->setX(lightElement->x());
+    if (attrName == SVGNames::yAttr)
+        return lightSource->setY(lightElement->y());
+    if (attrName == SVGNames::zAttr)
+        return lightSource->setZ(lightElement->z());
+    if (attrName == SVGNames::pointsAtXAttr)
+        return lightSource->setPointsAtX(lightElement->pointsAtX());
+    if (attrName == SVGNames::pointsAtYAttr)
+        return lightSource->setPointsAtY(lightElement->pointsAtY());
+    if (attrName == SVGNames::pointsAtZAttr)
+        return lightSource->setPointsAtZ(lightElement->pointsAtZ());
+    if (attrName == SVGNames::specularExponentAttr)
+        return lightSource->setSpecularExponent(lightElement->specularExponent());
+    if (attrName == SVGNames::limitingConeAngleAttr)
+        return lightSource->setLimitingConeAngle(lightElement->limitingConeAngle());
+
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
 void SVGFEDiffuseLightingElement::svgAttributeChanged(const QualifiedName& attrName)
 {
     SVGFilterPrimitiveStandardAttributes::svgAttributeChanged(attrName);
 
-    if (attrName == SVGNames::inAttr
-        || attrName == SVGNames::surfaceScaleAttr
+    if (attrName == SVGNames::surfaceScaleAttr
         || attrName == SVGNames::diffuseConstantAttr
         || attrName == SVGNames::kernelUnitLengthAttr
         || attrName == SVGNames::lighting_colorAttr)
+        primitiveAttributeChanged(attrName);
+
+    if (attrName == SVGNames::inAttr)
         invalidate();
 }
 
+void SVGFEDiffuseLightingElement::lightElementAttributeChanged(const SVGFELightElement* lightElement, const QualifiedName& attrName)
+{
+    if (findLightElement() != lightElement)
+        return;
+
+    // The light element has different attribute names.
+    primitiveAttributeChanged(attrName);
+}
+
 void SVGFEDiffuseLightingElement::synchronizeProperty(const QualifiedName& attrName)
 {
     SVGFilterPrimitiveStandardAttributes::synchronizeProperty(attrName);
@@ -121,6 +172,23 @@ void SVGFEDiffuseLightingElement::synchronizeProperty(const QualifiedName& attrN
     }
 }
 
+AttributeToPropertyTypeMap& SVGFEDiffuseLightingElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGFEDiffuseLightingElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGFilterPrimitiveStandardAttributes::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);    
+    attributeToPropertyTypeMap.set(SVGNames::inAttr, AnimatedString);
+    attributeToPropertyTypeMap.set(SVGNames::diffuseConstantAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::surfaceScaleAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::kernelUnitLengthAttr, AnimatedNumberOptionalNumber);
+}
+
 PassRefPtr<FilterEffect> SVGFEDiffuseLightingElement::build(SVGFilterBuilder* filterBuilder, Filter* filter)
 {
     FilterEffect* input1 = filterBuilder->getEffectById(in1());
@@ -132,25 +200,31 @@ PassRefPtr<FilterEffect> SVGFEDiffuseLightingElement::build(SVGFilterBuilder* fi
     Color color = filterStyle->svgStyle()->lightingColor();
     
     RefPtr<FilterEffect> effect = FEDiffuseLighting::create(filter, color, surfaceScale(), diffuseConstant(), 
-                                                                kernelUnitLengthX(), kernelUnitLengthY(), findLights());
+                                                                kernelUnitLengthX(), kernelUnitLengthY(), findLight());
     effect->inputEffects().append(input1);
     return effect.release();
 }
 
-PassRefPtr<LightSource> SVGFEDiffuseLightingElement::findLights() const
+SVGFELightElement* SVGFEDiffuseLightingElement::findLightElement() const
 {
     for (Node* node = firstChild(); node; node = node->nextSibling()) {
         if (node->hasTagName(SVGNames::feDistantLightTag)
             || node->hasTagName(SVGNames::fePointLightTag)
             || node->hasTagName(SVGNames::feSpotLightTag)) {
-            SVGFELightElement* lightNode = static_cast<SVGFELightElement*>(node); 
-            return lightNode->lightSource();
+            return static_cast<SVGFELightElement*>(node);
         }
     }
-
     return 0;
 }
 
+PassRefPtr<LightSource> SVGFEDiffuseLightingElement::findLight() const
+{
+    SVGFELightElement* lightNode = findLightElement();
+    if (!lightNode)
+        return 0;
+    return lightNode->lightSource();
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/svg/SVGFEDiffuseLightingElement.h b/Source/WebCore/svg/SVGFEDiffuseLightingElement.h
index d56ced9..5f698c2 100644
--- a/Source/WebCore/svg/SVGFEDiffuseLightingElement.h
+++ b/Source/WebCore/svg/SVGFEDiffuseLightingElement.h
@@ -34,13 +34,17 @@ class SVGColor;
 class SVGFEDiffuseLightingElement : public SVGFilterPrimitiveStandardAttributes {
 public:
     static PassRefPtr<SVGFEDiffuseLightingElement> create(const QualifiedName&, Document*);
+    void lightElementAttributeChanged(const SVGFELightElement*, const QualifiedName&);
 
 private:
     SVGFEDiffuseLightingElement(const QualifiedName&, Document*);
 
     virtual void parseMappedAttribute(Attribute*);
+    virtual bool setFilterEffectAttribute(FilterEffect*, const QualifiedName&);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
 
     static const AtomicString& kernelUnitLengthXIdentifier();
@@ -53,7 +57,8 @@ private:
     DECLARE_ANIMATED_NUMBER(KernelUnitLengthX, kernelUnitLengthX)
     DECLARE_ANIMATED_NUMBER(KernelUnitLengthY, kernelUnitLengthY)
 
-    PassRefPtr<LightSource> findLights() const;
+    SVGFELightElement* findLightElement() const;
+    PassRefPtr<LightSource> findLight() const;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/svg/SVGFEDisplacementMapElement.cpp b/Source/WebCore/svg/SVGFEDisplacementMapElement.cpp
index 56315b6..b5f2e32 100644
--- a/Source/WebCore/svg/SVGFEDisplacementMapElement.cpp
+++ b/Source/WebCore/svg/SVGFEDisplacementMapElement.cpp
@@ -116,6 +116,24 @@ void SVGFEDisplacementMapElement::synchronizeProperty(const QualifiedName& attrN
         synchronizeScale();
 }
 
+AttributeToPropertyTypeMap& SVGFEDisplacementMapElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGFEDisplacementMapElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGFilterPrimitiveStandardAttributes::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::inAttr, AnimatedString);
+    attributeToPropertyTypeMap.set(SVGNames::in2Attr, AnimatedString);
+    attributeToPropertyTypeMap.set(SVGNames::xChannelSelectorAttr, AnimatedEnumeration);
+    attributeToPropertyTypeMap.set(SVGNames::yChannelSelectorAttr, AnimatedEnumeration);
+    attributeToPropertyTypeMap.set(SVGNames::scaleAttr, AnimatedNumber);
+}
+
 PassRefPtr<FilterEffect> SVGFEDisplacementMapElement::build(SVGFilterBuilder* filterBuilder, Filter* filter)
 {
     FilterEffect* input1 = filterBuilder->getEffectById(in1());
diff --git a/Source/WebCore/svg/SVGFEDisplacementMapElement.h b/Source/WebCore/svg/SVGFEDisplacementMapElement.h
index 3af378c..c211de5 100644
--- a/Source/WebCore/svg/SVGFEDisplacementMapElement.h
+++ b/Source/WebCore/svg/SVGFEDisplacementMapElement.h
@@ -40,6 +40,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
 
     // Animated property declarations
diff --git a/Source/WebCore/svg/SVGFEFloodElement.cpp b/Source/WebCore/svg/SVGFEFloodElement.cpp
index 53ad910..eb20927 100644
--- a/Source/WebCore/svg/SVGFEFloodElement.cpp
+++ b/Source/WebCore/svg/SVGFEFloodElement.cpp
@@ -49,6 +49,17 @@ PassRefPtr<FilterEffect> SVGFEFloodElement::build(SVGFilterBuilder*, Filter* fil
     return FEFlood::create(filter, color, opacity);
 }
 
+AttributeToPropertyTypeMap& SVGFEFloodElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGFEFloodElement::fillAttributeToPropertyTypeMap()
+{
+    SVGFilterPrimitiveStandardAttributes::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap());
+}
+
 }
 
 #endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/Source/WebCore/svg/SVGFEFloodElement.h b/Source/WebCore/svg/SVGFEFloodElement.h
index 1485ddd..f7c7987 100644
--- a/Source/WebCore/svg/SVGFEFloodElement.h
+++ b/Source/WebCore/svg/SVGFEFloodElement.h
@@ -34,6 +34,8 @@ public:
 private:
     SVGFEFloodElement(const QualifiedName&, Document*);
 
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
 };
 
diff --git a/Source/WebCore/svg/SVGFEGaussianBlurElement.cpp b/Source/WebCore/svg/SVGFEGaussianBlurElement.cpp
index 03368ac..4bbfc3d 100644
--- a/Source/WebCore/svg/SVGFEGaussianBlurElement.cpp
+++ b/Source/WebCore/svg/SVGFEGaussianBlurElement.cpp
@@ -107,6 +107,21 @@ void SVGFEGaussianBlurElement::synchronizeProperty(const QualifiedName& attrName
         synchronizeIn1();
 }
 
+AttributeToPropertyTypeMap& SVGFEGaussianBlurElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGFEGaussianBlurElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGFilterPrimitiveStandardAttributes::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::inAttr, AnimatedString);
+    attributeToPropertyTypeMap.set(SVGNames::stdDeviationAttr, AnimatedNumberOptionalNumber);
+}
+
 PassRefPtr<FilterEffect> SVGFEGaussianBlurElement::build(SVGFilterBuilder* filterBuilder, Filter* filter)
 {
     FilterEffect* input1 = filterBuilder->getEffectById(in1());
diff --git a/Source/WebCore/svg/SVGFEGaussianBlurElement.h b/Source/WebCore/svg/SVGFEGaussianBlurElement.h
index 1b04658..0c8d8a3 100644
--- a/Source/WebCore/svg/SVGFEGaussianBlurElement.h
+++ b/Source/WebCore/svg/SVGFEGaussianBlurElement.h
@@ -40,6 +40,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
 
     static const AtomicString& stdDeviationXIdentifier();
diff --git a/Source/WebCore/svg/SVGFEImageElement.cpp b/Source/WebCore/svg/SVGFEImageElement.cpp
index 0fd4763..f33cd36 100644
--- a/Source/WebCore/svg/SVGFEImageElement.cpp
+++ b/Source/WebCore/svg/SVGFEImageElement.cpp
@@ -122,6 +122,21 @@ void SVGFEImageElement::synchronizeProperty(const QualifiedName& attrName)
         synchronizeExternalResourcesRequired();
 }
 
+AttributeToPropertyTypeMap& SVGFEImageElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGFEImageElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGFilterPrimitiveStandardAttributes::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::preserveAspectRatioAttr, AnimatedPreserveAspectRatio);
+    attributeToPropertyTypeMap.set(XLinkNames::hrefAttr, AnimatedString);
+}
+
 void SVGFEImageElement::notifyFinished(CachedResource*)
 {
     if (!inDocument())
diff --git a/Source/WebCore/svg/SVGFEImageElement.h b/Source/WebCore/svg/SVGFEImageElement.h
index 3f22805..8a63fc9 100644
--- a/Source/WebCore/svg/SVGFEImageElement.h
+++ b/Source/WebCore/svg/SVGFEImageElement.h
@@ -51,6 +51,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual void notifyFinished(CachedResource*);
 
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
diff --git a/Source/WebCore/svg/SVGFELightElement.cpp b/Source/WebCore/svg/SVGFELightElement.cpp
index 8ff8eb1..58a2f26 100644
--- a/Source/WebCore/svg/SVGFELightElement.cpp
+++ b/Source/WebCore/svg/SVGFELightElement.cpp
@@ -27,7 +27,9 @@
 #include "Attribute.h"
 #include "RenderObject.h"
 #include "RenderSVGResource.h"
+#include "SVGFEDiffuseLightingElement.h"
 #include "SVGFilterElement.h"
+#include "SVGFilterPrimitiveStandardAttributes.h"
 #include "SVGNames.h"
 
 namespace WebCore {
@@ -91,11 +93,21 @@ void SVGFELightElement::svgAttributeChanged(const QualifiedName& attrName)
         || attrName == SVGNames::pointsAtZAttr
         || attrName == SVGNames::specularExponentAttr
         || attrName == SVGNames::limitingConeAngleAttr) {
-        if (ContainerNode* parent = parentNode()) {
-            RenderObject* renderer = parent->renderer();
-            if (renderer && renderer->isSVGResourceFilterPrimitive())
-                RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer);
+        ContainerNode* parent = parentNode();
+        if (!parent)
+            return;
+
+        RenderObject* renderer = parent->renderer();
+        if (!renderer || !renderer->isSVGResourceFilterPrimitive())
+            return;
+
+        if (parent->hasTagName(SVGNames::feDiffuseLightingTag)) {
+            SVGFEDiffuseLightingElement* diffuseLighting = static_cast<SVGFEDiffuseLightingElement*>(parent);
+            diffuseLighting->lightElementAttributeChanged(this, attrName);
+            return;
         }
+        // Handler for SpecularLighting has not implemented yet.
+        RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer);
     }
 }
 
@@ -139,6 +151,27 @@ void SVGFELightElement::synchronizeProperty(const QualifiedName& attrName)
         synchronizeLimitingConeAngle();
 }
 
+AttributeToPropertyTypeMap& SVGFELightElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGFELightElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+    attributeToPropertyTypeMap.set(SVGNames::azimuthAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::elevationAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::xAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::yAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::zAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::pointsAtXAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::pointsAtYAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::pointsAtZAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::specularExponentAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::limitingConeAngleAttr, AnimatedNumber);
+}
+
 void SVGFELightElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     SVGElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
diff --git a/Source/WebCore/svg/SVGFELightElement.h b/Source/WebCore/svg/SVGFELightElement.h
index 2f6e687..606a499 100644
--- a/Source/WebCore/svg/SVGFELightElement.h
+++ b/Source/WebCore/svg/SVGFELightElement.h
@@ -40,6 +40,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
     // Animated property declarations
diff --git a/Source/WebCore/svg/SVGFEMergeElement.cpp b/Source/WebCore/svg/SVGFEMergeElement.cpp
index 8b1c753..f94acaa 100644
--- a/Source/WebCore/svg/SVGFEMergeElement.cpp
+++ b/Source/WebCore/svg/SVGFEMergeElement.cpp
@@ -59,6 +59,17 @@ PassRefPtr<FilterEffect> SVGFEMergeElement::build(SVGFilterBuilder* filterBuilde
     return effect.release();
 }
 
+AttributeToPropertyTypeMap& SVGFEMergeElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGFEMergeElement::fillAttributeToPropertyTypeMap()
+{
+    SVGFilterPrimitiveStandardAttributes::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap());
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/svg/SVGFEMergeElement.h b/Source/WebCore/svg/SVGFEMergeElement.h
index 2495a56..8241ea8 100644
--- a/Source/WebCore/svg/SVGFEMergeElement.h
+++ b/Source/WebCore/svg/SVGFEMergeElement.h
@@ -34,6 +34,8 @@ public:
 private:
     SVGFEMergeElement(const QualifiedName&, Document*);
 
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
 };
 
diff --git a/Source/WebCore/svg/SVGFEMergeNodeElement.cpp b/Source/WebCore/svg/SVGFEMergeNodeElement.cpp
index 83739de..b6e9f84 100644
--- a/Source/WebCore/svg/SVGFEMergeNodeElement.cpp
+++ b/Source/WebCore/svg/SVGFEMergeNodeElement.cpp
@@ -71,6 +71,17 @@ void SVGFEMergeNodeElement::svgAttributeChanged(const QualifiedName& attrName)
     RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer);
 }
 
+AttributeToPropertyTypeMap& SVGFEMergeNodeElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGFEMergeNodeElement::fillAttributeToPropertyTypeMap()
+{
+    attributeToPropertyTypeMap().set(SVGNames::inAttr, AnimatedString);
+}
+
 void SVGFEMergeNodeElement::synchronizeProperty(const QualifiedName& attrName)
 {
     SVGElement::synchronizeProperty(attrName);
diff --git a/Source/WebCore/svg/SVGFEMergeNodeElement.h b/Source/WebCore/svg/SVGFEMergeNodeElement.h
index 14f0e8e..d986829 100644
--- a/Source/WebCore/svg/SVGFEMergeNodeElement.h
+++ b/Source/WebCore/svg/SVGFEMergeNodeElement.h
@@ -37,6 +37,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 
     // Animated property declarations
     DECLARE_ANIMATED_STRING(In1, in1)
diff --git a/Source/WebCore/svg/SVGFEMorphologyElement.cpp b/Source/WebCore/svg/SVGFEMorphologyElement.cpp
index caf8e7b..1a44e3c 100644
--- a/Source/WebCore/svg/SVGFEMorphologyElement.cpp
+++ b/Source/WebCore/svg/SVGFEMorphologyElement.cpp
@@ -118,6 +118,22 @@ void SVGFEMorphologyElement::synchronizeProperty(const QualifiedName& attrName)
     }
 }
 
+AttributeToPropertyTypeMap& SVGFEMorphologyElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGFEMorphologyElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGFilterPrimitiveStandardAttributes::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::inAttr, AnimatedString);
+    attributeToPropertyTypeMap.set(SVGNames::operatorAttr, AnimatedEnumeration);
+    attributeToPropertyTypeMap.set(SVGNames::radiusAttr, AnimatedNumberOptionalNumber);
+}
+
 PassRefPtr<FilterEffect> SVGFEMorphologyElement::build(SVGFilterBuilder* filterBuilder, Filter* filter)
 {
     FilterEffect* input1 = filterBuilder->getEffectById(in1());
diff --git a/Source/WebCore/svg/SVGFEMorphologyElement.h b/Source/WebCore/svg/SVGFEMorphologyElement.h
index 77190e6..931288f 100644
--- a/Source/WebCore/svg/SVGFEMorphologyElement.h
+++ b/Source/WebCore/svg/SVGFEMorphologyElement.h
@@ -40,6 +40,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
 
     static const AtomicString& radiusXIdentifier();
diff --git a/Source/WebCore/svg/SVGFEOffsetElement.cpp b/Source/WebCore/svg/SVGFEOffsetElement.cpp
index 2bd8aee..03b3be3 100644
--- a/Source/WebCore/svg/SVGFEOffsetElement.cpp
+++ b/Source/WebCore/svg/SVGFEOffsetElement.cpp
@@ -87,6 +87,22 @@ void SVGFEOffsetElement::synchronizeProperty(const QualifiedName& attrName)
         synchronizeIn1();
 }
 
+AttributeToPropertyTypeMap& SVGFEOffsetElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGFEOffsetElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGFilterPrimitiveStandardAttributes::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::inAttr, AnimatedString);
+    attributeToPropertyTypeMap.set(SVGNames::dxAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::dyAttr, AnimatedNumber);
+}
+
 PassRefPtr<FilterEffect> SVGFEOffsetElement::build(SVGFilterBuilder* filterBuilder, Filter* filter)
 {
     FilterEffect* input1 = filterBuilder->getEffectById(in1());
diff --git a/Source/WebCore/svg/SVGFEOffsetElement.h b/Source/WebCore/svg/SVGFEOffsetElement.h
index 2092df2..e5b6fd1 100644
--- a/Source/WebCore/svg/SVGFEOffsetElement.h
+++ b/Source/WebCore/svg/SVGFEOffsetElement.h
@@ -38,6 +38,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
 
     // Animated property declarations
diff --git a/Source/WebCore/svg/SVGFESpecularLightingElement.cpp b/Source/WebCore/svg/SVGFESpecularLightingElement.cpp
index 9298b3c..f4f2648 100644
--- a/Source/WebCore/svg/SVGFESpecularLightingElement.cpp
+++ b/Source/WebCore/svg/SVGFESpecularLightingElement.cpp
@@ -89,6 +89,18 @@ void SVGFESpecularLightingElement::parseMappedAttribute(Attribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
+void SVGFESpecularLightingElement::svgAttributeChanged(const QualifiedName& attrName)
+{
+    SVGFilterPrimitiveStandardAttributes::svgAttributeChanged(attrName);
+
+    if (attrName == SVGNames::inAttr
+        || attrName == SVGNames::surfaceScaleAttr
+        || attrName == SVGNames::specularConstantAttr
+        || attrName == SVGNames::specularExponentAttr
+        || attrName == SVGNames::kernelUnitLengthAttr)
+        invalidate();
+}
+
 void SVGFESpecularLightingElement::synchronizeProperty(const QualifiedName& attrName)
 {
     SVGFilterPrimitiveStandardAttributes::synchronizeProperty(attrName);
@@ -117,6 +129,24 @@ void SVGFESpecularLightingElement::synchronizeProperty(const QualifiedName& attr
     }
 }
 
+AttributeToPropertyTypeMap& SVGFESpecularLightingElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGFESpecularLightingElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGFilterPrimitiveStandardAttributes::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::inAttr, AnimatedString);
+    attributeToPropertyTypeMap.set(SVGNames::specularConstantAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::specularExponentAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::surfaceScaleAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::kernelUnitLengthAttr, AnimatedNumberOptionalNumber);
+}
+
 PassRefPtr<LightSource> SVGFESpecularLightingElement::findLights() const
 {
     for (Node* node = firstChild(); node; node = node->nextSibling()) {
diff --git a/Source/WebCore/svg/SVGFESpecularLightingElement.h b/Source/WebCore/svg/SVGFESpecularLightingElement.h
index ace3a3e..9914123 100644
--- a/Source/WebCore/svg/SVGFESpecularLightingElement.h
+++ b/Source/WebCore/svg/SVGFESpecularLightingElement.h
@@ -37,7 +37,10 @@ private:
     SVGFESpecularLightingElement(const QualifiedName&, Document*);
     
     virtual void parseMappedAttribute(Attribute*);
+    virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
 
     static const AtomicString& kernelUnitLengthXIdentifier();
diff --git a/Source/WebCore/svg/SVGFETileElement.cpp b/Source/WebCore/svg/SVGFETileElement.cpp
index 6fc19e6..7ed6ca0 100644
--- a/Source/WebCore/svg/SVGFETileElement.cpp
+++ b/Source/WebCore/svg/SVGFETileElement.cpp
@@ -69,6 +69,20 @@ void SVGFETileElement::synchronizeProperty(const QualifiedName& attrName)
         synchronizeIn1();
 }
 
+AttributeToPropertyTypeMap& SVGFETileElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGFETileElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGFilterPrimitiveStandardAttributes::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::inAttr, AnimatedString);
+}
+
 PassRefPtr<FilterEffect> SVGFETileElement::build(SVGFilterBuilder* filterBuilder, Filter* filter)
 {
     FilterEffect* input1 = filterBuilder->getEffectById(in1());
diff --git a/Source/WebCore/svg/SVGFETileElement.h b/Source/WebCore/svg/SVGFETileElement.h
index f47d355..447827c 100644
--- a/Source/WebCore/svg/SVGFETileElement.h
+++ b/Source/WebCore/svg/SVGFETileElement.h
@@ -37,6 +37,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
 
     // Animated property declarations
diff --git a/Source/WebCore/svg/SVGFETurbulenceElement.cpp b/Source/WebCore/svg/SVGFETurbulenceElement.cpp
index 0f59bf7..2eaf1fc 100644
--- a/Source/WebCore/svg/SVGFETurbulenceElement.cpp
+++ b/Source/WebCore/svg/SVGFETurbulenceElement.cpp
@@ -128,6 +128,24 @@ void SVGFETurbulenceElement::synchronizeProperty(const QualifiedName& attrName)
         synchronizeNumOctaves();
 }
 
+AttributeToPropertyTypeMap& SVGFETurbulenceElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGFETurbulenceElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGFilterPrimitiveStandardAttributes::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::baseFrequencyAttr, AnimatedNumberOptionalNumber);
+    attributeToPropertyTypeMap.set(SVGNames::numOctavesAttr, AnimatedInteger);
+    attributeToPropertyTypeMap.set(SVGNames::seedAttr, AnimatedNumber);
+    attributeToPropertyTypeMap.set(SVGNames::stitchTilesAttr, AnimatedEnumeration);
+    attributeToPropertyTypeMap.set(SVGNames::typeAttr, AnimatedEnumeration);
+}
+
 PassRefPtr<FilterEffect> SVGFETurbulenceElement::build(SVGFilterBuilder*, Filter* filter)
 {
     if (baseFrequencyX() < 0 || baseFrequencyY() < 0)
diff --git a/Source/WebCore/svg/SVGFETurbulenceElement.h b/Source/WebCore/svg/SVGFETurbulenceElement.h
index f9d86cb..5e8a8b6 100644
--- a/Source/WebCore/svg/SVGFETurbulenceElement.h
+++ b/Source/WebCore/svg/SVGFETurbulenceElement.h
@@ -46,6 +46,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
 
     static const AtomicString& baseFrequencyXIdentifier();
diff --git a/Source/WebCore/svg/SVGFilterElement.cpp b/Source/WebCore/svg/SVGFilterElement.cpp
index 03ff7fa..539d4df 100644
--- a/Source/WebCore/svg/SVGFilterElement.cpp
+++ b/Source/WebCore/svg/SVGFilterElement.cpp
@@ -196,6 +196,27 @@ void SVGFilterElement::synchronizeProperty(const QualifiedName& attrName)
         synchronizeHref();
 }
 
+AttributeToPropertyTypeMap& SVGFilterElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGFilterElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGStyledElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::filterUnitsAttr, AnimatedEnumeration);
+    attributeToPropertyTypeMap.set(SVGNames::primitiveUnitsAttr, AnimatedEnumeration);
+    attributeToPropertyTypeMap.set(SVGNames::xAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::yAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::widthAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::heightAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::filterResAttr, AnimatedNumberOptionalNumber);
+    attributeToPropertyTypeMap.set(XLinkNames::hrefAttr, AnimatedEnumeration);
+}
+
 void SVGFilterElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     SVGStyledElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
diff --git a/Source/WebCore/svg/SVGFilterElement.h b/Source/WebCore/svg/SVGFilterElement.h
index a438625..4851296 100644
--- a/Source/WebCore/svg/SVGFilterElement.h
+++ b/Source/WebCore/svg/SVGFilterElement.h
@@ -53,6 +53,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp b/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
index 00f99c5..d34a130 100644
--- a/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
+++ b/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
@@ -70,6 +70,13 @@ void SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(Attribute* attr)
         return SVGStyledElement::parseMappedAttribute(attr);
 }
 
+bool SVGFilterPrimitiveStandardAttributes::setFilterEffectAttribute(FilterEffect*, const QualifiedName&)
+{
+    // When all filters support this method, it will be changed to a pure virtual method.
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
 void SVGFilterPrimitiveStandardAttributes::svgAttributeChanged(const QualifiedName& attrName)
 {
     SVGStyledElement::svgAttributeChanged(attrName);
@@ -145,6 +152,17 @@ void SVGFilterPrimitiveStandardAttributes::setStandardAttributes(bool primitiveB
     filterEffect->setEffectBoundaries(effectBBox);
 }
 
+void SVGFilterPrimitiveStandardAttributes::fillPassedAttributeToPropertyTypeMap(AttributeToPropertyTypeMap& attributeToPropertyTypeMap)
+{
+    SVGStyledElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    
+    attributeToPropertyTypeMap.set(SVGNames::xAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::yAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::widthAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::heightAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::resultAttr, AnimatedString);
+}
+
 RenderObject* SVGFilterPrimitiveStandardAttributes::createRenderer(RenderArena* arena, RenderStyle*)
 {
     return new (arena) RenderSVGResourceFilterPrimitive(this);
diff --git a/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h b/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
index 34e19ea..526592a 100644
--- a/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
+++ b/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
@@ -22,7 +22,8 @@
 #define SVGFilterPrimitiveStandardAttributes_h
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
-#include "RenderSVGResource.h"
+#include "RenderSVGResourceFilter.h"
+#include "RenderSVGResourceFilterPrimitive.h"
 #include "SVGAnimatedLength.h"
 #include "SVGAnimatedString.h"
 #include "SVGStyledElement.h"
@@ -41,6 +42,8 @@ public:
     void setStandardAttributes(bool, FilterEffect*) const;
 
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter* filter) = 0;
+    // Returns true, if the new value is different from the old one.
+    virtual bool setFilterEffectAttribute(FilterEffect*, const QualifiedName&);
 
 protected:
     SVGFilterPrimitiveStandardAttributes(const QualifiedName&, Document*);
@@ -48,15 +51,21 @@ protected:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    void fillPassedAttributeToPropertyTypeMap(AttributeToPropertyTypeMap&);
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
-protected:
     inline void invalidate()
     {
         if (RenderObject* primitiveRenderer = renderer())
             RenderSVGResource::markForLayoutAndParentResourceInvalidation(primitiveRenderer);
     }
 
+    inline void primitiveAttributeChanged(const QualifiedName& attribute)
+    {
+        if (RenderObject* primitiveRenderer = renderer())
+            static_cast<RenderSVGResourceFilterPrimitive*>(primitiveRenderer)->primitiveAttributeChanged(attribute);
+    }
+
 private:
     virtual bool isFilterEffect() const { return true; }
 
diff --git a/Source/WebCore/svg/SVGFont.cpp b/Source/WebCore/svg/SVGFont.cpp
index e5164c0..a92b9b6 100644
--- a/Source/WebCore/svg/SVGFont.cpp
+++ b/Source/WebCore/svg/SVGFont.cpp
@@ -26,6 +26,7 @@
 #include "CSSFontSelector.h"
 #include "GraphicsContext.h"
 #include "RenderObject.h"
+#include "RenderSVGInlineText.h"
 #include "RenderSVGResourceSolidColor.h"
 #include "SVGAltGlyphElement.h"
 #include "SVGFontData.h"
@@ -243,7 +244,7 @@ struct SVGTextRunWalker {
     {
         ASSERT(0 <= from && from <= to && to - from <= run.length());
 
-        const String text = Font::normalizeSpaces(String(run.data(from), run.length()));
+        const String text = Font::normalizeSpaces(run.data(from), to - from);
         Vector<SVGGlyphIdentifier::ArabicForm> chars(charactersWithArabicForm(text, run.rtl()));
 
         SVGGlyphIdentifier identifier;
@@ -254,8 +255,10 @@ struct SVGTextRunWalker {
         bool haveAltGlyph = false;
         SVGGlyphIdentifier altGlyphIdentifier;
         if (RenderObject* renderObject = run.referencingRenderObject()) {
-            if (renderObject->node() && renderObject->node()->hasTagName(SVGNames::altGlyphTag)) {
-                SVGGlyphElement* glyphElement = static_cast<SVGAltGlyphElement*>(renderObject->node())->glyphElement();
+            RenderObject* parentRenderer = renderObject->parent();
+            ASSERT(parentRenderer);
+            if (parentRenderer->node() && parentRenderer->node()->hasTagName(SVGNames::altGlyphTag)) {
+                SVGGlyphElement* glyphElement = static_cast<SVGAltGlyphElement*>(parentRenderer->node())->glyphElement();
                 if (glyphElement) {
                     haveAltGlyph = true;
                     altGlyphIdentifier = glyphElement->buildGlyphIdentifier();
@@ -271,7 +274,7 @@ struct SVGTextRunWalker {
             // extended to the n-th next character (where n is 'characterLookupRange'), to check for any possible ligature.
             characterLookupRange = endOfScanRange - i;
 
-            String lookupString = Font::normalizeSpaces(String(run.data(i), characterLookupRange));
+            String lookupString = Font::normalizeSpaces(run.data(i), characterLookupRange);
 
             Vector<SVGGlyphIdentifier> glyphs;
             if (haveAltGlyph)
@@ -407,9 +410,11 @@ static float floatWidthOfSubStringUsingSVGFont(const Font* font, const TextRun&
 
         // TODO: language matching & svg glyphs should be possible for HTML text, too.
         if (RenderObject* renderObject = run.referencingRenderObject()) {
-            isVerticalText = isVerticalWritingMode(renderObject->style()->svgStyle());
+            RenderObject* parentRenderer = renderObject->parent();
+            ASSERT(parentRenderer);
+            isVerticalText = isVerticalWritingMode(parentRenderer->style()->svgStyle());
 
-            if (SVGElement* element = static_cast<SVGElement*>(renderObject->node()))
+            if (SVGElement* element = static_cast<SVGElement*>(parentRenderer->node()))
                 language = element->getAttribute(XMLNames::langAttr);
         }
 
@@ -495,10 +500,15 @@ void Font::drawTextUsingSVGFont(GraphicsContext* context, const TextRun& run,
         String language;
 
         // TODO: language matching & svg glyphs should be possible for HTML text, too.
-        if (run.referencingRenderObject()) {
-            isVerticalText = isVerticalWritingMode(run.referencingRenderObject()->style()->svgStyle());    
-
-            if (SVGElement* element = static_cast<SVGElement*>(run.referencingRenderObject()->node()))
+        RenderObject* referencingRenderObject = run.referencingRenderObject();
+        RenderObject* referencingRenderObjectParent = referencingRenderObject ? referencingRenderObject->parent() : 0;
+        RenderStyle* referencingRenderObjectParentStyle = 0;
+        if (referencingRenderObject) {
+            ASSERT(referencingRenderObjectParent);
+            referencingRenderObjectParentStyle = referencingRenderObjectParent->style();
+
+            isVerticalText = isVerticalWritingMode(referencingRenderObjectParentStyle->svgStyle());    
+            if (SVGElement* element = static_cast<SVGElement*>(referencingRenderObjectParent->node()))
                 language = element->getAttribute(XMLNames::langAttr);
         }
 
@@ -536,9 +546,13 @@ void Font::drawTextUsingSVGFont(GraphicsContext* context, const TextRun& run,
                     Path glyphPath = identifier.pathData;
                     glyphPath.transform(glyphPathTransform);
 
-                    RenderStyle* style = run.referencingRenderObject() ? run.referencingRenderObject()->style() : 0;
-                    if (activePaintingResource->applyResource(run.referencingRenderObject(), style, context, resourceMode))
-                        activePaintingResource->postApplyResource(run.referencingRenderObject(), context, resourceMode, &glyphPath);
+                    if (activePaintingResource->applyResource(referencingRenderObjectParent, referencingRenderObjectParentStyle, context, resourceMode)) {
+                        if (referencingRenderObject) {
+                            RenderSVGInlineText* textRenderer = toRenderSVGInlineText(referencingRenderObject);
+                            context->setStrokeThickness(context->strokeThickness() * textRenderer->scalingFactor());
+                        }
+                        activePaintingResource->postApplyResource(referencingRenderObjectParent, context, resourceMode, &glyphPath);
+                    }
 
                     context->restore();
                 }
diff --git a/Source/WebCore/svg/SVGFontElement.cpp b/Source/WebCore/svg/SVGFontElement.cpp
index d70d46a..2d67c51 100644
--- a/Source/WebCore/svg/SVGFontElement.cpp
+++ b/Source/WebCore/svg/SVGFontElement.cpp
@@ -179,6 +179,17 @@ void SVGFontElement::getGlyphIdentifiersForString(const String& string, Vector<S
     m_glyphMap.get(string, glyphs);
 }
 
+AttributeToPropertyTypeMap& SVGFontElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGFontElement::fillAttributeToPropertyTypeMap()
+{
+    SVGStyledElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap());
+}
+
 }
 
 #endif // ENABLE(SVG_FONTS)
diff --git a/Source/WebCore/svg/SVGFontElement.h b/Source/WebCore/svg/SVGFontElement.h
index b2de38c..1559f43 100644
--- a/Source/WebCore/svg/SVGFontElement.h
+++ b/Source/WebCore/svg/SVGFontElement.h
@@ -70,7 +70,9 @@ private:
     SVGFontElement(const QualifiedName&, Document*);
 
     virtual void synchronizeProperty(const QualifiedName&);
-    virtual bool rendererIsNeeded(RenderStyle*) { return false; }    
+    virtual bool rendererIsNeeded(RenderStyle*) { return false; }  
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 
     void ensureGlyphCache() const;
 
diff --git a/Source/WebCore/svg/SVGFontFaceElement.cpp b/Source/WebCore/svg/SVGFontFaceElement.cpp
index ef7f5bd..68be2c6 100644
--- a/Source/WebCore/svg/SVGFontFaceElement.cpp
+++ b/Source/WebCore/svg/SVGFontFaceElement.cpp
@@ -125,7 +125,7 @@ unsigned SVGFontFaceElement::unitsPerEm() const
 {
     const AtomicString& value = getAttribute(units_per_emAttr);
     if (value.isEmpty())
-        return defaultUnitsPerEm;
+        return gDefaultUnitsPerEm;
 
     return static_cast<unsigned>(ceilf(value.toFloat()));
 }
@@ -261,6 +261,11 @@ String SVGFontFaceElement::fontFamily() const
     return m_styleDeclaration->getPropertyValue(CSSPropertyFontFamily);
 }
 
+SVGFontElement* SVGFontFaceElement::associatedFontElement() const
+{
+    return m_fontElement.get();
+}
+
 void SVGFontFaceElement::rebuildFontFace()
 {
     if (!inDocument())
diff --git a/Source/WebCore/svg/SVGFontFaceElement.h b/Source/WebCore/svg/SVGFontFaceElement.h
index 5e974a7..168f21c 100644
--- a/Source/WebCore/svg/SVGFontFaceElement.h
+++ b/Source/WebCore/svg/SVGFontFaceElement.h
@@ -47,7 +47,7 @@ public:
     int descent() const;
     String fontFamily() const;
 
-    SVGFontElement* associatedFontElement() const { return m_fontElement; }
+    SVGFontElement* associatedFontElement() const;
     void rebuildFontFace();
     void removeFromMappedElementSheet();
 
@@ -63,7 +63,7 @@ private:
     RefPtr<CSSFontFaceRule> m_fontFaceRule;
     RefPtr<CSSMutableStyleDeclaration> m_styleDeclaration;
 
-    SVGFontElement* m_fontElement;
+    RefPtr<SVGFontElement> m_fontElement;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/svg/SVGForeignObjectElement.cpp b/Source/WebCore/svg/SVGForeignObjectElement.cpp
index 6b5cd41..f2175ac 100644
--- a/Source/WebCore/svg/SVGForeignObjectElement.cpp
+++ b/Source/WebCore/svg/SVGForeignObjectElement.cpp
@@ -137,6 +137,24 @@ void SVGForeignObjectElement::synchronizeProperty(const QualifiedName& attrName)
         SVGTests::synchronizeProperties(this, attrName);
 }
 
+AttributeToPropertyTypeMap& SVGForeignObjectElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGForeignObjectElement::fillAttributeToPropertyTypeMap()
+{    
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGStyledTransformableElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::xAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::yAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::widthAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::heightAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(XLinkNames::hrefAttr, AnimatedString);
+}
+
 RenderObject* SVGForeignObjectElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
     return new (arena) RenderSVGForeignObject(this);
diff --git a/Source/WebCore/svg/SVGForeignObjectElement.h b/Source/WebCore/svg/SVGForeignObjectElement.h
index 687d089..82f21b4 100644
--- a/Source/WebCore/svg/SVGForeignObjectElement.h
+++ b/Source/WebCore/svg/SVGForeignObjectElement.h
@@ -45,6 +45,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 
     virtual bool childShouldCreateRenderer(Node*) const;
     virtual RenderObject* createRenderer(RenderArena* arena, RenderStyle* style);
diff --git a/Source/WebCore/svg/SVGGlyphElement.cpp b/Source/WebCore/svg/SVGGlyphElement.cpp
index a64d833..9913f5f 100644
--- a/Source/WebCore/svg/SVGGlyphElement.cpp
+++ b/Source/WebCore/svg/SVGGlyphElement.cpp
@@ -132,6 +132,20 @@ static inline float parseSVGGlyphAttribute(const SVGElement* element, const WebC
     return value.toFloat();
 }
 
+AttributeToPropertyTypeMap& SVGGlyphElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGGlyphElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGStyledElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::dAttr, AnimatedPath);
+}
+
 SVGGlyphIdentifier SVGGlyphElement::buildGenericGlyphIdentifier(const SVGElement* element)
 {
     SVGGlyphIdentifier identifier;
diff --git a/Source/WebCore/svg/SVGGlyphElement.h b/Source/WebCore/svg/SVGGlyphElement.h
index 4ac5d9b..a79da4b 100644
--- a/Source/WebCore/svg/SVGGlyphElement.h
+++ b/Source/WebCore/svg/SVGGlyphElement.h
@@ -117,6 +117,8 @@ private:
     SVGGlyphElement(const QualifiedName&, Document*);
 
     virtual void parseMappedAttribute(Attribute*);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
diff --git a/Source/WebCore/svg/SVGGradientElement.cpp b/Source/WebCore/svg/SVGGradientElement.cpp
index f36fea5..67eb8fb 100644
--- a/Source/WebCore/svg/SVGGradientElement.cpp
+++ b/Source/WebCore/svg/SVGGradientElement.cpp
@@ -124,6 +124,16 @@ void SVGGradientElement::synchronizeProperty(const QualifiedName& attrName)
         synchronizeHref();
 }
 
+void SVGGradientElement::fillPassedAttributeToPropertyTypeMap(AttributeToPropertyTypeMap& attributeToPropertyTypeMap)
+{
+    SVGStyledElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+
+    attributeToPropertyTypeMap.set(SVGNames::spreadMethodAttr, AnimatedEnumeration);
+    attributeToPropertyTypeMap.set(SVGNames::gradientUnitsAttr, AnimatedEnumeration);
+    attributeToPropertyTypeMap.set(SVGNames::gradientTransformAttr, AnimatedTransformList);
+    attributeToPropertyTypeMap.set(XLinkNames::hrefAttr, AnimatedString);
+}
+    
 void SVGGradientElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     SVGStyledElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
diff --git a/Source/WebCore/svg/SVGGradientElement.h b/Source/WebCore/svg/SVGGradientElement.h
index 1fd1f0b..09da5b0 100644
--- a/Source/WebCore/svg/SVGGradientElement.h
+++ b/Source/WebCore/svg/SVGGradientElement.h
@@ -44,6 +44,7 @@ protected:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    void fillPassedAttributeToPropertyTypeMap(AttributeToPropertyTypeMap&);
 
 private:
     virtual bool needsPendingResourceHandling() const { return false; }
diff --git a/Source/WebCore/svg/SVGImageElement.cpp b/Source/WebCore/svg/SVGImageElement.cpp
index 80bf34b..784c1ab 100644
--- a/Source/WebCore/svg/SVGImageElement.cpp
+++ b/Source/WebCore/svg/SVGImageElement.cpp
@@ -164,6 +164,25 @@ void SVGImageElement::synchronizeProperty(const QualifiedName& attrName)
         SVGTests::synchronizeProperties(this, attrName);
 }
 
+AttributeToPropertyTypeMap& SVGImageElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGImageElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGStyledTransformableElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::xAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::yAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::widthAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::heightAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::preserveAspectRatioAttr, AnimatedPreserveAspectRatio);
+    attributeToPropertyTypeMap.set(XLinkNames::hrefAttr, AnimatedString);
+}
+
 bool SVGImageElement::selfHasRelativeLengths() const
 {
     return x().isRelative()
diff --git a/Source/WebCore/svg/SVGImageElement.h b/Source/WebCore/svg/SVGImageElement.h
index 06e6490..ec67823 100644
--- a/Source/WebCore/svg/SVGImageElement.h
+++ b/Source/WebCore/svg/SVGImageElement.h
@@ -50,6 +50,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 
     virtual void attach();
     virtual void insertedIntoDocument();
diff --git a/Source/WebCore/svg/SVGLength.cpp b/Source/WebCore/svg/SVGLength.cpp
index 6d75f8b..281ee14 100644
--- a/Source/WebCore/svg/SVGLength.cpp
+++ b/Source/WebCore/svg/SVGLength.cpp
@@ -438,7 +438,7 @@ float SVGLength::convertValueFromUserUnitsToEXS(float value, const SVGElement* c
 
     // Use of ceil allows a pixel match to the W3Cs expected output of coords-units-03-b.svg
     // if this causes problems in real world cases maybe it would be best to remove this
-    float xHeight = ceilf(style->font().xHeight());
+    float xHeight = ceilf(style->fontMetrics().xHeight());
     if (!xHeight) {
         ec = NOT_SUPPORTED_ERR;
         return 0;
@@ -457,7 +457,7 @@ float SVGLength::convertValueFromEXSToUserUnits(float value, const SVGElement* c
     RenderStyle* style = context->renderer()->style();
     // Use of ceil allows a pixel match to the W3Cs expected output of coords-units-03-b.svg
     // if this causes problems in real world cases maybe it would be best to remove this
-    return value * ceilf(style->font().xHeight());
+    return value * ceilf(style->fontMetrics().xHeight());
 }
 
 SVGLength SVGLength::fromCSSPrimitiveValue(CSSPrimitiveValue* value)
diff --git a/Source/WebCore/svg/SVGLineElement.cpp b/Source/WebCore/svg/SVGLineElement.cpp
index cfe43da..2e435c5 100644
--- a/Source/WebCore/svg/SVGLineElement.cpp
+++ b/Source/WebCore/svg/SVGLineElement.cpp
@@ -138,6 +138,23 @@ void SVGLineElement::synchronizeProperty(const QualifiedName& attrName)
         SVGTests::synchronizeProperties(this, attrName);
 }
 
+AttributeToPropertyTypeMap& SVGLineElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGLineElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGStyledTransformableElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::x1Attr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::y1Attr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::x2Attr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::y2Attr, AnimatedLength);
+}
+
 void SVGLineElement::toPathData(Path& path) const
 {
     ASSERT(path.isEmpty());
diff --git a/Source/WebCore/svg/SVGLineElement.h b/Source/WebCore/svg/SVGLineElement.h
index ad60a95..4ba4ec1 100644
--- a/Source/WebCore/svg/SVGLineElement.h
+++ b/Source/WebCore/svg/SVGLineElement.h
@@ -46,6 +46,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 
     virtual void toPathData(Path&) const;
 
diff --git a/Source/WebCore/svg/SVGLinearGradientElement.cpp b/Source/WebCore/svg/SVGLinearGradientElement.cpp
index 5bece06..c109b4f 100644
--- a/Source/WebCore/svg/SVGLinearGradientElement.cpp
+++ b/Source/WebCore/svg/SVGLinearGradientElement.cpp
@@ -114,6 +114,23 @@ void SVGLinearGradientElement::synchronizeProperty(const QualifiedName& attrName
         synchronizeY2();
 }
 
+AttributeToPropertyTypeMap& SVGLinearGradientElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGLinearGradientElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGGradientElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::x1Attr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::y1Attr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::x2Attr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::y2Attr, AnimatedLength);
+}
+
 RenderObject* SVGLinearGradientElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
     return new (arena) RenderSVGResourceLinearGradient(this);
diff --git a/Source/WebCore/svg/SVGLinearGradientElement.h b/Source/WebCore/svg/SVGLinearGradientElement.h
index 198f0ee..1c91556 100644
--- a/Source/WebCore/svg/SVGLinearGradientElement.h
+++ b/Source/WebCore/svg/SVGLinearGradientElement.h
@@ -42,6 +42,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
diff --git a/Source/WebCore/svg/SVGMPathElement.cpp b/Source/WebCore/svg/SVGMPathElement.cpp
index 0df262e..9cc3c56 100644
--- a/Source/WebCore/svg/SVGMPathElement.cpp
+++ b/Source/WebCore/svg/SVGMPathElement.cpp
@@ -65,6 +65,17 @@ void SVGMPathElement::synchronizeProperty(const QualifiedName& attrName)
         synchronizeHref();
 }
 
+AttributeToPropertyTypeMap& SVGMPathElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGMPathElement::fillAttributeToPropertyTypeMap()
+{
+    attributeToPropertyTypeMap().set(XLinkNames::hrefAttr, AnimatedString);
+}
+
 SVGPathElement* SVGMPathElement::pathElement()
 {
     Element* target = document()->getElementById(getTarget(href()));
diff --git a/Source/WebCore/svg/SVGMPathElement.h b/Source/WebCore/svg/SVGMPathElement.h
index 2fa7c28..ad59650 100644
--- a/Source/WebCore/svg/SVGMPathElement.h
+++ b/Source/WebCore/svg/SVGMPathElement.h
@@ -43,6 +43,8 @@ private:
     
     virtual void parseMappedAttribute(Attribute*);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 
     // Animated property declarations
 
diff --git a/Source/WebCore/svg/SVGMarkerElement.cpp b/Source/WebCore/svg/SVGMarkerElement.cpp
index 3174711..c255a9b 100644
--- a/Source/WebCore/svg/SVGMarkerElement.cpp
+++ b/Source/WebCore/svg/SVGMarkerElement.cpp
@@ -183,6 +183,26 @@ void SVGMarkerElement::synchronizeProperty(const QualifiedName& attrName)
     }
 }
 
+AttributeToPropertyTypeMap& SVGMarkerElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGMarkerElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGStyledElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::refXAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::refYAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::markerWidthAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::markerHeightAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::markerUnitsAttr, AnimatedEnumeration);
+    attributeToPropertyTypeMap.set(SVGNames::orientAttr, AnimatedAngle);
+    attributeToPropertyTypeMap.set(SVGNames::viewBoxAttr, AnimatedRect);
+}
+
 void SVGMarkerElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     SVGStyledElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
diff --git a/Source/WebCore/svg/SVGMarkerElement.h b/Source/WebCore/svg/SVGMarkerElement.h
index 472baa6..2275480 100644
--- a/Source/WebCore/svg/SVGMarkerElement.h
+++ b/Source/WebCore/svg/SVGMarkerElement.h
@@ -67,6 +67,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/Source/WebCore/svg/SVGMaskElement.cpp b/Source/WebCore/svg/SVGMaskElement.cpp
index ec23e29..d5df621 100644
--- a/Source/WebCore/svg/SVGMaskElement.cpp
+++ b/Source/WebCore/svg/SVGMaskElement.cpp
@@ -148,6 +148,25 @@ void SVGMaskElement::synchronizeProperty(const QualifiedName& attrName)
         SVGTests::synchronizeProperties(this, attrName);
 }
 
+AttributeToPropertyTypeMap& SVGMaskElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGMaskElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGStyledLocatableElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::xAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::yAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::widthAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::heightAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::maskUnitsAttr, AnimatedEnumeration);
+    attributeToPropertyTypeMap.set(SVGNames::maskContentUnitsAttr, AnimatedEnumeration);
+}
+
 void SVGMaskElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     SVGStyledElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
diff --git a/Source/WebCore/svg/SVGMaskElement.h b/Source/WebCore/svg/SVGMaskElement.h
index 87e91ff..1add472 100644
--- a/Source/WebCore/svg/SVGMaskElement.h
+++ b/Source/WebCore/svg/SVGMaskElement.h
@@ -49,6 +49,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/Source/WebCore/svg/SVGMissingGlyphElement.cpp b/Source/WebCore/svg/SVGMissingGlyphElement.cpp
index 4c80494..9741231 100644
--- a/Source/WebCore/svg/SVGMissingGlyphElement.cpp
+++ b/Source/WebCore/svg/SVGMissingGlyphElement.cpp
@@ -34,6 +34,17 @@ PassRefPtr<SVGMissingGlyphElement> SVGMissingGlyphElement::create(const Qualifie
     return adoptRef(new SVGMissingGlyphElement(tagName, document));
 }
 
+AttributeToPropertyTypeMap& SVGMissingGlyphElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGMissingGlyphElement::fillAttributeToPropertyTypeMap()
+{
+    SVGStyledElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap());
+}
+
 }
 
 #endif // ENABLE(SVG_FONTS)
diff --git a/Source/WebCore/svg/SVGMissingGlyphElement.h b/Source/WebCore/svg/SVGMissingGlyphElement.h
index a133d6d..528c53c 100644
--- a/Source/WebCore/svg/SVGMissingGlyphElement.h
+++ b/Source/WebCore/svg/SVGMissingGlyphElement.h
@@ -32,6 +32,9 @@ public:
 private:
     SVGMissingGlyphElement(const QualifiedName&, Document*);
 
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
+
     virtual bool rendererIsNeeded(RenderStyle*) { return false; }
 };
 
diff --git a/Source/WebCore/svg/SVGPathBlender.cpp b/Source/WebCore/svg/SVGPathBlender.cpp
index d46e24a..6de783d 100644
--- a/Source/WebCore/svg/SVGPathBlender.cpp
+++ b/Source/WebCore/svg/SVGPathBlender.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ * Copyright (C) Research In Motion Limited 2010, 2011. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -34,14 +34,60 @@ SVGPathBlender::SVGPathBlender()
 {
 }
 
-float SVGPathBlender::blendAnimatedFloat(float from, float to)
+// Helper functions
+static inline FloatPoint blendFloatPoint(const FloatPoint& a, const FloatPoint& b, float progress)
 {
-    return (to - from) * m_progress + from;
+    return FloatPoint((b.x() - a.x()) * progress + a.x(), (b.y() - a.y()) * progress + a.y());
 }
 
-FloatPoint SVGPathBlender::blendAnimatedFloatPoint(FloatPoint& from, FloatPoint& to)
+static inline float blendAnimatedFloat(float from, float to, float progress)
 {
-    return FloatPoint((to.x() - from.x()) * m_progress + from.x(), (to.y() - from.y()) * m_progress + from.y());
+    return (to - from) * progress + from;
+}
+
+float SVGPathBlender::blendAnimatedDimensonalFloat(float from, float to, FloatBlendMode blendMode)
+{
+    if (m_fromMode == m_toMode)
+        return blendAnimatedFloat(from, to, m_progress);
+    
+    float fromValue = blendMode == BlendHorizontal ? m_fromCurrentPoint.x() : m_fromCurrentPoint.y();
+    float toValue = blendMode == BlendHorizontal ? m_toCurrentPoint.x() : m_toCurrentPoint.y();
+
+    // Transform toY to the coordinate mode of fromY
+    float animValue = blendAnimatedFloat(from, m_fromMode == AbsoluteCoordinates ? to + toValue : to - toValue, m_progress);
+    
+    if (m_isInFirstHalfOfAnimation)
+        return animValue;
+    
+    // Transform the animated point to the coordinate mode, needed for the current progress.
+    float currentValue = blendAnimatedFloat(fromValue, toValue, m_progress);
+    return m_toMode == AbsoluteCoordinates ? animValue + currentValue : animValue - currentValue;
+}
+
+FloatPoint SVGPathBlender::blendAnimatedFloatPoint(const FloatPoint& fromPoint, const FloatPoint& toPoint)
+{
+    if (m_fromMode == m_toMode)
+        return blendFloatPoint(fromPoint, toPoint, m_progress);
+
+    // Transform toPoint to the coordinate mode of fromPoint
+    FloatPoint animatedPoint = toPoint;
+    if (m_fromMode == AbsoluteCoordinates)
+        animatedPoint += m_toCurrentPoint;
+    else
+        animatedPoint.move(-m_toCurrentPoint.x(), -m_toCurrentPoint.y());
+
+    animatedPoint = blendFloatPoint(fromPoint, animatedPoint, m_progress);
+
+    if (m_isInFirstHalfOfAnimation)
+        return animatedPoint;
+
+    // Transform the animated point to the coordinate mode, needed for the current progress.
+    FloatPoint currentPoint = blendFloatPoint(m_fromCurrentPoint, m_toCurrentPoint, m_progress);
+    if (m_toMode == AbsoluteCoordinates)
+        return animatedPoint + currentPoint;
+
+    animatedPoint.move(-currentPoint.x(), -currentPoint.y());
+    return animatedPoint;
 }
 
 bool SVGPathBlender::blendMoveToSegment()
@@ -52,7 +98,9 @@ bool SVGPathBlender::blendMoveToSegment()
         || !m_toSource->parseMoveToSegment(toTargetPoint))
         return false;
 
-    m_consumer->moveTo(blendAnimatedFloatPoint(fromTargetPoint, toTargetPoint), false, m_mode);
+    m_consumer->moveTo(blendAnimatedFloatPoint(fromTargetPoint, toTargetPoint), false, m_isInFirstHalfOfAnimation ? m_fromMode : m_toMode);
+    m_fromCurrentPoint = m_fromMode == AbsoluteCoordinates ? fromTargetPoint : m_fromCurrentPoint + fromTargetPoint;
+    m_toCurrentPoint = m_toMode == AbsoluteCoordinates ? toTargetPoint : m_toCurrentPoint + toTargetPoint;
     return true;
 }
 
@@ -64,7 +112,9 @@ bool SVGPathBlender::blendLineToSegment()
         || !m_toSource->parseLineToSegment(toTargetPoint))
         return false;
 
-    m_consumer->lineTo(blendAnimatedFloatPoint(fromTargetPoint, toTargetPoint), m_mode);
+    m_consumer->lineTo(blendAnimatedFloatPoint(fromTargetPoint, toTargetPoint), m_isInFirstHalfOfAnimation ? m_fromMode : m_toMode);
+    m_fromCurrentPoint = m_fromMode == AbsoluteCoordinates ? fromTargetPoint : m_fromCurrentPoint + fromTargetPoint;
+    m_toCurrentPoint = m_toMode == AbsoluteCoordinates ? toTargetPoint : m_toCurrentPoint + toTargetPoint;
     return true;
 }
 
@@ -76,7 +126,9 @@ bool SVGPathBlender::blendLineToHorizontalSegment()
         || !m_toSource->parseLineToHorizontalSegment(toX))
         return false;
 
-    m_consumer->lineToHorizontal(blendAnimatedFloat(fromX, toX), m_mode);
+    m_consumer->lineToHorizontal(blendAnimatedDimensonalFloat(fromX, toX, BlendHorizontal), m_isInFirstHalfOfAnimation ? m_fromMode : m_toMode);
+    m_fromCurrentPoint.setX(m_fromMode == AbsoluteCoordinates ? fromX : m_fromCurrentPoint.x() + fromX);
+    m_toCurrentPoint.setX(m_toMode == AbsoluteCoordinates ? toX : m_toCurrentPoint.x() + toX);
     return true;
 }
 
@@ -88,7 +140,9 @@ bool SVGPathBlender::blendLineToVerticalSegment()
         || !m_toSource->parseLineToVerticalSegment(toY))
         return false;
 
-    m_consumer->lineToVertical(blendAnimatedFloat(fromY, toY), m_mode);
+    m_consumer->lineToVertical(blendAnimatedDimensonalFloat(fromY, toY, BlendVertical), m_isInFirstHalfOfAnimation ? m_fromMode : m_toMode);
+    m_fromCurrentPoint.setY(m_fromMode == AbsoluteCoordinates ? fromY : m_fromCurrentPoint.y() + fromY);
+    m_toCurrentPoint.setY(m_toMode == AbsoluteCoordinates ? toY : m_toCurrentPoint.y() + toY);
     return true;
 }
 
@@ -107,7 +161,9 @@ bool SVGPathBlender::blendCurveToCubicSegment()
     m_consumer->curveToCubic(blendAnimatedFloatPoint(fromPoint1, toPoint1),
                              blendAnimatedFloatPoint(fromPoint2, toPoint2),
                              blendAnimatedFloatPoint(fromTargetPoint, toTargetPoint),
-                             m_mode);
+                             m_isInFirstHalfOfAnimation ? m_fromMode : m_toMode);
+    m_fromCurrentPoint = m_fromMode == AbsoluteCoordinates ? fromTargetPoint : m_fromCurrentPoint + fromTargetPoint;
+    m_toCurrentPoint = m_toMode == AbsoluteCoordinates ? toTargetPoint : m_toCurrentPoint + toTargetPoint;
     return true;
 }
 
@@ -123,7 +179,9 @@ bool SVGPathBlender::blendCurveToCubicSmoothSegment()
 
     m_consumer->curveToCubicSmooth(blendAnimatedFloatPoint(fromPoint2, toPoint2),
                                    blendAnimatedFloatPoint(fromTargetPoint, toTargetPoint),
-                                   m_mode);
+                                   m_isInFirstHalfOfAnimation ? m_fromMode : m_toMode);
+    m_fromCurrentPoint = m_fromMode == AbsoluteCoordinates ? fromTargetPoint : m_fromCurrentPoint + fromTargetPoint;
+    m_toCurrentPoint = m_toMode == AbsoluteCoordinates ? toTargetPoint : m_toCurrentPoint + toTargetPoint;
     return true;
 }
 
@@ -139,7 +197,9 @@ bool SVGPathBlender::blendCurveToQuadraticSegment()
 
     m_consumer->curveToQuadratic(blendAnimatedFloatPoint(fromPoint1, toPoint1),
                                  blendAnimatedFloatPoint(fromTargetPoint, toTargetPoint),
-                                 m_mode);
+                                 m_isInFirstHalfOfAnimation ? m_fromMode : m_toMode);
+    m_fromCurrentPoint = m_fromMode == AbsoluteCoordinates ? fromTargetPoint : m_fromCurrentPoint + fromTargetPoint;
+    m_toCurrentPoint = m_toMode == AbsoluteCoordinates ? toTargetPoint : m_toCurrentPoint + toTargetPoint;
     return true;
 }
 
@@ -151,7 +211,9 @@ bool SVGPathBlender::blendCurveToQuadraticSmoothSegment()
         || !m_toSource->parseCurveToQuadraticSmoothSegment(toTargetPoint))
         return false;
 
-    m_consumer->curveToQuadraticSmooth(blendAnimatedFloatPoint(fromTargetPoint, toTargetPoint), m_mode);
+    m_consumer->curveToQuadraticSmooth(blendAnimatedFloatPoint(fromTargetPoint, toTargetPoint), m_isInFirstHalfOfAnimation ? m_fromMode : m_toMode);
+    m_fromCurrentPoint = m_fromMode == AbsoluteCoordinates ? fromTargetPoint : m_fromCurrentPoint + fromTargetPoint;
+    m_toCurrentPoint = m_toMode == AbsoluteCoordinates ? toTargetPoint : m_toCurrentPoint + toTargetPoint;
     return true;
 }
 
@@ -173,16 +235,44 @@ bool SVGPathBlender::blendArcToSegment()
         || !m_toSource->parseArcToSegment(toRx, toRy, toAngle, toLargeArc, toSweep, toTargetPoint))
         return false;
 
-    m_consumer->arcTo(blendAnimatedFloat(fromRx, toRx),
-                      blendAnimatedFloat(fromRy, toRy),
-                      blendAnimatedFloat(fromAngle, toAngle),
-                      m_progress < 0.5 ? fromLargeArc : toLargeArc,
-                      m_progress < 0.5 ? fromSweep : toSweep,
+    m_consumer->arcTo(blendAnimatedFloat(fromRx, toRx, m_progress),
+                      blendAnimatedFloat(fromRy, toRy, m_progress),
+                      blendAnimatedFloat(fromAngle, toAngle, m_progress),
+                      m_isInFirstHalfOfAnimation ? fromLargeArc : toLargeArc,
+                      m_isInFirstHalfOfAnimation ? fromSweep : toSweep,
                       blendAnimatedFloatPoint(fromTargetPoint, toTargetPoint),
-                      m_mode);
+                      m_isInFirstHalfOfAnimation ? m_fromMode : m_toMode);
+    m_fromCurrentPoint = m_fromMode == AbsoluteCoordinates ? fromTargetPoint : m_fromCurrentPoint + fromTargetPoint;
+    m_toCurrentPoint = m_toMode == AbsoluteCoordinates ? toTargetPoint : m_toCurrentPoint + toTargetPoint;
     return true;
 }
 
+static inline PathCoordinateMode coordinateModeOfCommand(const SVGPathSegType& type)
+{
+    if (type < PathSegMoveToAbs)
+        return AbsoluteCoordinates;
+
+    // Odd number = relative command
+    if (type % 2)
+        return RelativeCoordinates;
+
+    return AbsoluteCoordinates;
+}
+
+static inline bool isSegmentEqual(const SVGPathSegType& fromType, const SVGPathSegType& toType, const PathCoordinateMode& fromMode, const PathCoordinateMode& toMode)
+{
+    if (fromType == toType && (fromType == PathSegUnknown || fromType == PathSegClosePath))
+        return true;
+
+    unsigned short from = fromType;
+    unsigned short to = toType;
+    if (fromMode == toMode)
+        return from == to;
+    if (fromMode == AbsoluteCoordinates)
+        return from == to - 1;
+    return to == from - 1;
+}
+
 bool SVGPathBlender::blendAnimatedPath(float progress, SVGPathSource* fromSource, SVGPathSource* toSource, SVGPathConsumer* consumer)
 {
     ASSERT(fromSource);
@@ -191,6 +281,7 @@ bool SVGPathBlender::blendAnimatedPath(float progress, SVGPathSource* fromSource
     m_fromSource = fromSource;
     m_toSource = toSource;
     m_consumer = consumer;
+    m_isInFirstHalfOfAnimation = progress < 0.5f;
 
     m_progress = progress;
     while (true) {
@@ -198,31 +289,29 @@ bool SVGPathBlender::blendAnimatedPath(float progress, SVGPathSource* fromSource
         SVGPathSegType toCommand;
         if (!m_fromSource->parseSVGSegmentType(fromCommand) || !m_toSource->parseSVGSegmentType(toCommand))
             return false;
-        if (fromCommand != toCommand)
+
+        m_fromMode = coordinateModeOfCommand(fromCommand);
+        m_toMode = coordinateModeOfCommand(toCommand);
+        if (!isSegmentEqual(fromCommand, toCommand, m_fromMode, m_toMode))
             return false;
 
-        m_mode = AbsoluteCoordinates;
         switch (fromCommand) {
         case PathSegMoveToRel:
-            m_mode = RelativeCoordinates;
         case PathSegMoveToAbs:
             if (!blendMoveToSegment())
                 return false;
             break;
         case PathSegLineToRel:
-            m_mode = RelativeCoordinates;
         case PathSegLineToAbs:
             if (!blendLineToSegment())
                 return false;
             break;
         case PathSegLineToHorizontalRel:
-            m_mode = RelativeCoordinates;
         case PathSegLineToHorizontalAbs:
             if (!blendLineToHorizontalSegment())
                 return false;
             break;
         case PathSegLineToVerticalRel:
-            m_mode = RelativeCoordinates;
         case PathSegLineToVerticalAbs:
             if (!blendLineToVerticalSegment())
                 return false;
@@ -231,31 +320,26 @@ bool SVGPathBlender::blendAnimatedPath(float progress, SVGPathSource* fromSource
             m_consumer->closePath();
             break;
         case PathSegCurveToCubicRel:
-            m_mode = RelativeCoordinates;
         case PathSegCurveToCubicAbs:
             if (!blendCurveToCubicSegment())
                 return false;
             break;
         case PathSegCurveToCubicSmoothRel:
-            m_mode = RelativeCoordinates;
         case PathSegCurveToCubicSmoothAbs:
             if (!blendCurveToCubicSmoothSegment())
                 return false;
             break;
         case PathSegCurveToQuadraticRel:
-            m_mode = RelativeCoordinates;
         case PathSegCurveToQuadraticAbs:
             if (!blendCurveToQuadraticSegment())
                 return false;
             break;
         case PathSegCurveToQuadraticSmoothRel:
-            m_mode = RelativeCoordinates;
         case PathSegCurveToQuadraticSmoothAbs:
             if (!blendCurveToQuadraticSmoothSegment())
                 return false;
             break;
         case PathSegArcRel:
-            m_mode = RelativeCoordinates;
         case PathSegArcAbs:
             if (!blendArcToSegment())
                 return false;
@@ -281,6 +365,8 @@ void SVGPathBlender::cleanup()
     m_toSource = 0;
     m_fromSource = 0;
     m_consumer = 0;
+    m_fromCurrentPoint = FloatPoint();
+    m_toCurrentPoint = FloatPoint();
 }
 
 }
diff --git a/Source/WebCore/svg/SVGPathBlender.h b/Source/WebCore/svg/SVGPathBlender.h
index 8e43b94..2290fbb 100644
--- a/Source/WebCore/svg/SVGPathBlender.h
+++ b/Source/WebCore/svg/SVGPathBlender.h
@@ -26,6 +26,11 @@
 
 namespace WebCore {
 
+enum FloatBlendMode {
+    BlendHorizontal,
+    BlendVertical
+};
+
 class SVGPathBlender {
     WTF_MAKE_NONCOPYABLE(SVGPathBlender); WTF_MAKE_FAST_ALLOCATED;
 public:
@@ -45,14 +50,20 @@ private:
     bool blendCurveToQuadraticSmoothSegment();
     bool blendArcToSegment();
 
-    float blendAnimatedFloat(float, float);
-    FloatPoint blendAnimatedFloatPoint(FloatPoint&, FloatPoint&);
+    float blendAnimatedDimensonalFloat(float, float, FloatBlendMode);
+    FloatPoint blendAnimatedFloatPoint(const FloatPoint& from, const FloatPoint& to);
 
     SVGPathSource* m_fromSource;
     SVGPathSource* m_toSource;
     SVGPathConsumer* m_consumer;
-    PathCoordinateMode m_mode;
+
+    FloatPoint m_fromCurrentPoint;
+    FloatPoint m_toCurrentPoint;
+    
+    PathCoordinateMode m_fromMode;
+    PathCoordinateMode m_toMode;
     float m_progress;
+    bool m_isInFirstHalfOfAnimation;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/svg/SVGPathByteStream.h b/Source/WebCore/svg/SVGPathByteStream.h
index a444ac0..af283f7 100644
--- a/Source/WebCore/svg/SVGPathByteStream.h
+++ b/Source/WebCore/svg/SVGPathByteStream.h
@@ -51,6 +51,11 @@ public:
         return adoptPtr(new SVGPathByteStream);
     }
 
+    PassOwnPtr<SVGPathByteStream> copy()
+    {
+        return adoptPtr(new SVGPathByteStream(m_data));
+    }
+
     typedef Vector<unsigned char> Data;
     typedef Data::const_iterator DataIterator;
 
@@ -62,6 +67,11 @@ public:
 
 private:
     SVGPathByteStream() { }
+    SVGPathByteStream(Data& data)
+        : m_data(data)
+    {
+    }
+
     Data m_data;
 };
 
diff --git a/Source/WebCore/svg/SVGPathElement.cpp b/Source/WebCore/svg/SVGPathElement.cpp
index 77b543f..c56873b 100644
--- a/Source/WebCore/svg/SVGPathElement.cpp
+++ b/Source/WebCore/svg/SVGPathElement.cpp
@@ -272,6 +272,21 @@ void SVGPathElement::synchronizeD()
     SVGAnimatedPropertySynchronizer<true>::synchronize(this, SVGNames::dAttr, m_pathSegList.value.valueAsString());
 }
 
+AttributeToPropertyTypeMap& SVGPathElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGPathElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGStyledTransformableElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::dAttr, AnimatedPath);
+    attributeToPropertyTypeMap.set(SVGNames::pathLengthAttr, AnimatedNumber);
+}
+
 SVGPathSegListPropertyTearOff* SVGPathElement::pathSegList()
 {
     if (!m_animatablePathSegList) {
diff --git a/Source/WebCore/svg/SVGPathElement.h b/Source/WebCore/svg/SVGPathElement.h
index 6ea7d55..7f836c4 100644
--- a/Source/WebCore/svg/SVGPathElement.h
+++ b/Source/WebCore/svg/SVGPathElement.h
@@ -104,6 +104,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void synchronizeProperty(const QualifiedName&);
     virtual void svgAttributeChanged(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual bool supportsMarkers() const { return true; }
 
     // Animated property declarations
diff --git a/Source/WebCore/svg/SVGPatternElement.cpp b/Source/WebCore/svg/SVGPatternElement.cpp
index 60dfeaf..97e505e 100644
--- a/Source/WebCore/svg/SVGPatternElement.cpp
+++ b/Source/WebCore/svg/SVGPatternElement.cpp
@@ -194,6 +194,29 @@ void SVGPatternElement::synchronizeProperty(const QualifiedName& attrName)
         SVGTests::synchronizeProperties(this, attrName);
 }
 
+AttributeToPropertyTypeMap& SVGPatternElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGPatternElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGStyledElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::xAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::yAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::widthAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::heightAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::patternUnitsAttr, AnimatedEnumeration);
+    attributeToPropertyTypeMap.set(SVGNames::patternContentUnitsAttr, AnimatedEnumeration);
+    attributeToPropertyTypeMap.set(SVGNames::patternTransformAttr, AnimatedTransformList);
+    attributeToPropertyTypeMap.set(XLinkNames::hrefAttr, AnimatedString);
+    attributeToPropertyTypeMap.set(SVGNames::viewBoxAttr, AnimatedRect);
+    attributeToPropertyTypeMap.set(SVGNames::preserveAspectRatioAttr, AnimatedPreserveAspectRatio);
+}
+
 void SVGPatternElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     SVGStyledElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
diff --git a/Source/WebCore/svg/SVGPatternElement.h b/Source/WebCore/svg/SVGPatternElement.h
index e581308..e7bfd80 100644
--- a/Source/WebCore/svg/SVGPatternElement.h
+++ b/Source/WebCore/svg/SVGPatternElement.h
@@ -59,6 +59,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/Source/WebCore/svg/SVGPolyElement.cpp b/Source/WebCore/svg/SVGPolyElement.cpp
index 0fb48d7..8a70347 100644
--- a/Source/WebCore/svg/SVGPolyElement.cpp
+++ b/Source/WebCore/svg/SVGPolyElement.cpp
@@ -112,6 +112,20 @@ void SVGPolyElement::synchronizeProperty(const QualifiedName& attrName)
         SVGTests::synchronizeProperties(this, attrName);
 }
 
+AttributeToPropertyTypeMap& SVGPolyElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGPolyElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGStyledTransformableElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::pointsAttr, AnimatedPoints);
+}
+
 void SVGPolyElement::synchronizePoints()
 {
     if (!m_points.shouldSynchronize)
diff --git a/Source/WebCore/svg/SVGPolyElement.h b/Source/WebCore/svg/SVGPolyElement.h
index 3af8a79..7e3248e 100644
--- a/Source/WebCore/svg/SVGPolyElement.h
+++ b/Source/WebCore/svg/SVGPolyElement.h
@@ -50,6 +50,8 @@ private:
     virtual void parseMappedAttribute(Attribute*); 
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 
     virtual bool supportsMarkers() const { return true; }
 
diff --git a/Source/WebCore/svg/SVGRadialGradientElement.cpp b/Source/WebCore/svg/SVGRadialGradientElement.cpp
index d525531..4f0f203 100644
--- a/Source/WebCore/svg/SVGRadialGradientElement.cpp
+++ b/Source/WebCore/svg/SVGRadialGradientElement.cpp
@@ -124,6 +124,24 @@ void SVGRadialGradientElement::synchronizeProperty(const QualifiedName& attrName
         synchronizeR();
 }
 
+AttributeToPropertyTypeMap& SVGRadialGradientElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGRadialGradientElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGGradientElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::cxAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::cyAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::rAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::fxAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::fyAttr, AnimatedLength);
+}
+
 RenderObject* SVGRadialGradientElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
     return new (arena) RenderSVGResourceRadialGradient(this);
diff --git a/Source/WebCore/svg/SVGRadialGradientElement.h b/Source/WebCore/svg/SVGRadialGradientElement.h
index 199eaba..40af133 100644
--- a/Source/WebCore/svg/SVGRadialGradientElement.h
+++ b/Source/WebCore/svg/SVGRadialGradientElement.h
@@ -42,6 +42,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
diff --git a/Source/WebCore/svg/SVGRectElement.cpp b/Source/WebCore/svg/SVGRectElement.cpp
index d5db5b9..10c5743 100644
--- a/Source/WebCore/svg/SVGRectElement.cpp
+++ b/Source/WebCore/svg/SVGRectElement.cpp
@@ -161,6 +161,25 @@ void SVGRectElement::synchronizeProperty(const QualifiedName& attrName)
         SVGTests::synchronizeProperties(this, attrName);
 }
 
+AttributeToPropertyTypeMap& SVGRectElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGRectElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGStyledTransformableElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::xAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::yAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::widthAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::heightAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::rxAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::ryAttr, AnimatedLength);
+}
+
 void SVGRectElement::toPathData(Path& path) const
 {
     ASSERT(path.isEmpty());
diff --git a/Source/WebCore/svg/SVGRectElement.h b/Source/WebCore/svg/SVGRectElement.h
index 0c30378..08ab4bf 100644
--- a/Source/WebCore/svg/SVGRectElement.h
+++ b/Source/WebCore/svg/SVGRectElement.h
@@ -46,6 +46,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 
     virtual void toPathData(Path&) const;
 
diff --git a/Source/WebCore/svg/SVGSVGElement.cpp b/Source/WebCore/svg/SVGSVGElement.cpp
index 483e45f..e2540e3 100644
--- a/Source/WebCore/svg/SVGSVGElement.cpp
+++ b/Source/WebCore/svg/SVGSVGElement.cpp
@@ -379,6 +379,23 @@ void SVGSVGElement::synchronizeProperty(const QualifiedName& attrName)
         SVGTests::synchronizeProperties(this, attrName);
 }
 
+AttributeToPropertyTypeMap& SVGSVGElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGSVGElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+    attributeToPropertyTypeMap.set(SVGNames::xAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::yAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::widthAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::heightAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::viewBoxAttr, AnimatedRect);
+    attributeToPropertyTypeMap.set(SVGNames::preserveAspectRatioAttr, AnimatedPreserveAspectRatio);
+}
+
 unsigned SVGSVGElement::suspendRedraw(unsigned /* maxWaitMilliseconds */)
 {
     // FIXME: Implement me (see bug 11275)
diff --git a/Source/WebCore/svg/SVGSVGElement.h b/Source/WebCore/svg/SVGSVGElement.h
index 0995c67..edb56d7 100644
--- a/Source/WebCore/svg/SVGSVGElement.h
+++ b/Source/WebCore/svg/SVGSVGElement.h
@@ -144,6 +144,8 @@ private:
 
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 
     virtual bool selfHasRelativeLengths() const;
 
diff --git a/Source/WebCore/svg/SVGScriptElement.cpp b/Source/WebCore/svg/SVGScriptElement.cpp
index 6452700..babb1e7 100644
--- a/Source/WebCore/svg/SVGScriptElement.cpp
+++ b/Source/WebCore/svg/SVGScriptElement.cpp
@@ -97,6 +97,17 @@ void SVGScriptElement::synchronizeProperty(const QualifiedName& attrName)
         synchronizeHref();
 }
 
+AttributeToPropertyTypeMap& SVGScriptElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGScriptElement::fillAttributeToPropertyTypeMap()
+{
+    attributeToPropertyTypeMap().set(XLinkNames::hrefAttr, AnimatedString);
+}
+
 void SVGScriptElement::insertedIntoDocument()
 {
     SVGElement::insertedIntoDocument();
diff --git a/Source/WebCore/svg/SVGScriptElement.h b/Source/WebCore/svg/SVGScriptElement.h
index df502e0..dabec79 100644
--- a/Source/WebCore/svg/SVGScriptElement.h
+++ b/Source/WebCore/svg/SVGScriptElement.h
@@ -51,6 +51,8 @@ private:
 
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual bool isURLAttribute(Attribute*) const;
     virtual void finishParsingChildren();
 
diff --git a/Source/WebCore/svg/SVGStopElement.cpp b/Source/WebCore/svg/SVGStopElement.cpp
index 10bd9ae..c6f5f98 100644
--- a/Source/WebCore/svg/SVGStopElement.cpp
+++ b/Source/WebCore/svg/SVGStopElement.cpp
@@ -77,6 +77,20 @@ void SVGStopElement::synchronizeProperty(const QualifiedName& attrName)
         synchronizeOffset();
 }
 
+AttributeToPropertyTypeMap& SVGStopElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGStopElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGStyledElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::offsetAttr, AnimatedLength);
+}
+
 RenderObject* SVGStopElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
     return new (arena) RenderSVGGradientStop(this);
diff --git a/Source/WebCore/svg/SVGStopElement.h b/Source/WebCore/svg/SVGStopElement.h
index 907afae..8ea1cf5 100644
--- a/Source/WebCore/svg/SVGStopElement.h
+++ b/Source/WebCore/svg/SVGStopElement.h
@@ -39,6 +39,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 
     virtual bool isGradientStop() const { return true; }
 
diff --git a/Source/WebCore/svg/SVGStyledElement.cpp b/Source/WebCore/svg/SVGStyledElement.cpp
index 58248d8..7f3b041 100644
--- a/Source/WebCore/svg/SVGStyledElement.cpp
+++ b/Source/WebCore/svg/SVGStyledElement.cpp
@@ -43,6 +43,7 @@
 #include "SVGSVGElement.h"
 #include "SVGUseElement.h"
 #include <wtf/Assertions.h>
+#include <wtf/HashMap.h>
 
 namespace WebCore {
 
@@ -200,6 +201,83 @@ int SVGStyledElement::cssPropertyIdForSVGAttributeName(const QualifiedName& attr
     return propertyNameToIdMap->get(attrName.localName().impl());
 }
 
+static inline AttributeToPropertyTypeMap& cssPropertyToTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_cssPropertyMap, ());
+    
+    if (!s_cssPropertyMap.isEmpty())
+        return s_cssPropertyMap;
+
+    // Fill the map for the first use.
+    s_cssPropertyMap.set(alignment_baselineAttr, AnimatedString);
+    s_cssPropertyMap.set(baseline_shiftAttr, AnimatedString);
+    s_cssPropertyMap.set(clipAttr, AnimatedRect);
+    s_cssPropertyMap.set(clip_pathAttr, AnimatedString);
+    s_cssPropertyMap.set(clip_ruleAttr, AnimatedString);
+    s_cssPropertyMap.set(SVGNames::colorAttr, AnimatedColor);
+    s_cssPropertyMap.set(color_interpolationAttr, AnimatedString);
+    s_cssPropertyMap.set(color_interpolation_filtersAttr, AnimatedString);
+    s_cssPropertyMap.set(color_profileAttr, AnimatedString);
+    s_cssPropertyMap.set(color_renderingAttr, AnimatedString); 
+    s_cssPropertyMap.set(cursorAttr, AnimatedString);
+    s_cssPropertyMap.set(displayAttr, AnimatedString);
+    s_cssPropertyMap.set(dominant_baselineAttr, AnimatedString);
+    s_cssPropertyMap.set(fillAttr, AnimatedColor);
+    s_cssPropertyMap.set(fill_opacityAttr, AnimatedNumber);
+    s_cssPropertyMap.set(fill_ruleAttr, AnimatedString);
+    s_cssPropertyMap.set(filterAttr, AnimatedString);
+    s_cssPropertyMap.set(flood_colorAttr, AnimatedColor);
+    s_cssPropertyMap.set(flood_opacityAttr, AnimatedNumber);
+    s_cssPropertyMap.set(font_familyAttr, AnimatedString);
+    s_cssPropertyMap.set(font_sizeAttr, AnimatedLength);
+    s_cssPropertyMap.set(font_stretchAttr, AnimatedString);
+    s_cssPropertyMap.set(font_styleAttr, AnimatedString);
+    s_cssPropertyMap.set(font_variantAttr, AnimatedString);
+    s_cssPropertyMap.set(font_weightAttr, AnimatedString);
+    s_cssPropertyMap.set(image_renderingAttr, AnimatedString);
+    s_cssPropertyMap.set(kerningAttr, AnimatedLength);
+    s_cssPropertyMap.set(letter_spacingAttr, AnimatedLength);
+    s_cssPropertyMap.set(lighting_colorAttr, AnimatedColor);
+    s_cssPropertyMap.set(marker_endAttr, AnimatedString);
+    s_cssPropertyMap.set(marker_midAttr, AnimatedString);
+    s_cssPropertyMap.set(marker_startAttr, AnimatedString);
+    s_cssPropertyMap.set(maskAttr, AnimatedString);
+    s_cssPropertyMap.set(opacityAttr, AnimatedNumber);
+    s_cssPropertyMap.set(overflowAttr, AnimatedString);
+    s_cssPropertyMap.set(pointer_eventsAttr, AnimatedString);
+    s_cssPropertyMap.set(shape_renderingAttr, AnimatedString);
+    s_cssPropertyMap.set(stop_colorAttr, AnimatedColor);
+    s_cssPropertyMap.set(stop_opacityAttr, AnimatedNumber);
+    s_cssPropertyMap.set(strokeAttr, AnimatedColor);
+    s_cssPropertyMap.set(stroke_dasharrayAttr, AnimatedLengthList);
+    s_cssPropertyMap.set(stroke_dashoffsetAttr, AnimatedLength);
+    s_cssPropertyMap.set(stroke_linecapAttr, AnimatedString);
+    s_cssPropertyMap.set(stroke_linejoinAttr, AnimatedString);
+    s_cssPropertyMap.set(stroke_miterlimitAttr, AnimatedNumber);
+    s_cssPropertyMap.set(stroke_opacityAttr, AnimatedNumber);
+    s_cssPropertyMap.set(stroke_widthAttr, AnimatedLength);
+    s_cssPropertyMap.set(text_anchorAttr, AnimatedString);
+    s_cssPropertyMap.set(text_decorationAttr, AnimatedString);
+    s_cssPropertyMap.set(text_renderingAttr, AnimatedString);
+    s_cssPropertyMap.set(vector_effectAttr, AnimatedString);
+    s_cssPropertyMap.set(visibilityAttr, AnimatedString);
+    s_cssPropertyMap.set(word_spacingAttr, AnimatedLength);
+    return s_cssPropertyMap;
+}
+
+AnimatedAttributeType SVGStyledElement::animatedPropertyTypeForCSSProperty(const QualifiedName& attrName)
+{
+    AttributeToPropertyTypeMap& cssPropertyTypeMap = cssPropertyToTypeMap();
+    if (cssPropertyTypeMap.contains(attrName))
+        return cssPropertyTypeMap.get(attrName);
+    return AnimatedUnknown;
+}
+
+void SVGStyledElement::fillPassedAttributeToPropertyTypeMap(AttributeToPropertyTypeMap& attributeToPropertyTypeMap)
+{
+    attributeToPropertyTypeMap.set(HTMLNames::classAttr, AnimatedString);
+}
+
 bool SVGStyledElement::mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const
 {
     if (SVGStyledElement::cssPropertyIdForSVGAttributeName(attrName) > 0) {
diff --git a/Source/WebCore/svg/SVGStyledElement.h b/Source/WebCore/svg/SVGStyledElement.h
index 0714d43..85a2b5a 100644
--- a/Source/WebCore/svg/SVGStyledElement.h
+++ b/Source/WebCore/svg/SVGStyledElement.h
@@ -52,6 +52,8 @@ public:
     bool instanceUpdatesBlocked() const;
     void setInstanceUpdatesBlocked(bool);
 
+    AnimatedAttributeType animatedPropertyTypeForCSSProperty(const QualifiedName&);
+
     virtual AffineTransform localCoordinateSpaceTransform(SVGLocatable::CTMScope) const;
 
     virtual CSSStyleDeclaration* style() { return StyledElement::style(); }
@@ -66,6 +68,8 @@ protected:
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
 
+    void fillPassedAttributeToPropertyTypeMap(AttributeToPropertyTypeMap&);
+
     virtual void attach();
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
diff --git a/Source/WebCore/svg/SVGStyledTransformableElement.cpp b/Source/WebCore/svg/SVGStyledTransformableElement.cpp
index 15528e0..ce1c5fd 100644
--- a/Source/WebCore/svg/SVGStyledTransformableElement.cpp
+++ b/Source/WebCore/svg/SVGStyledTransformableElement.cpp
@@ -114,6 +114,13 @@ RenderObject* SVGStyledTransformableElement::createRenderer(RenderArena* arena,
     return new (arena) RenderSVGPath(this);
 }
 
+void SVGStyledTransformableElement::fillPassedAttributeToPropertyTypeMap(AttributeToPropertyTypeMap& attributeToPropertyTypeMap)
+{
+    SVGStyledElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    
+    attributeToPropertyTypeMap.set(SVGNames::transformAttr, AnimatedTransformList);
+}
+
 void SVGStyledTransformableElement::toClipPath(Path& path) const
 {
     toPathData(path);
diff --git a/Source/WebCore/svg/SVGStyledTransformableElement.h b/Source/WebCore/svg/SVGStyledTransformableElement.h
index 1d882e5..cbd70ed 100644
--- a/Source/WebCore/svg/SVGStyledTransformableElement.h
+++ b/Source/WebCore/svg/SVGStyledTransformableElement.h
@@ -59,6 +59,7 @@ protected:
 
     virtual void parseMappedAttribute(Attribute*);
     virtual void synchronizeProperty(const QualifiedName&);
+    void fillPassedAttributeToPropertyTypeMap(AttributeToPropertyTypeMap&);
 
     // Animated property declarations
     DECLARE_ANIMATED_TRANSFORM_LIST(Transform, transform)
diff --git a/Source/WebCore/svg/SVGSwitchElement.cpp b/Source/WebCore/svg/SVGSwitchElement.cpp
index c225053..fb89f6f 100644
--- a/Source/WebCore/svg/SVGSwitchElement.cpp
+++ b/Source/WebCore/svg/SVGSwitchElement.cpp
@@ -80,6 +80,17 @@ void SVGSwitchElement::synchronizeProperty(const QualifiedName& attrName)
         SVGTests::synchronizeProperties(this, attrName);
 }
 
+AttributeToPropertyTypeMap& SVGSwitchElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGSwitchElement::fillAttributeToPropertyTypeMap()
+{
+    SVGStyledTransformableElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap());
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/svg/SVGSwitchElement.h b/Source/WebCore/svg/SVGSwitchElement.h
index 937a1e4..b52a30d 100644
--- a/Source/WebCore/svg/SVGSwitchElement.h
+++ b/Source/WebCore/svg/SVGSwitchElement.h
@@ -46,6 +46,9 @@ private:
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual void synchronizeProperty(const QualifiedName&);
+     
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 
     // Animated property declarations
 
diff --git a/Source/WebCore/svg/SVGSymbolElement.cpp b/Source/WebCore/svg/SVGSymbolElement.cpp
index ee4278d..31bb9a9 100644
--- a/Source/WebCore/svg/SVGSymbolElement.cpp
+++ b/Source/WebCore/svg/SVGSymbolElement.cpp
@@ -88,6 +88,21 @@ void SVGSymbolElement::synchronizeProperty(const QualifiedName& attrName)
     } 
 }
 
+AttributeToPropertyTypeMap& SVGSymbolElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGSymbolElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGStyledElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::viewBoxAttr, AnimatedRect);
+    attributeToPropertyTypeMap.set(SVGNames::preserveAspectRatioAttr, AnimatedPreserveAspectRatio);
+}
+
 bool SVGSymbolElement::selfHasRelativeLengths() const
 {
     return hasAttribute(SVGNames::viewBoxAttr);
diff --git a/Source/WebCore/svg/SVGSymbolElement.h b/Source/WebCore/svg/SVGSymbolElement.h
index e049f0d..8f3f251 100644
--- a/Source/WebCore/svg/SVGSymbolElement.h
+++ b/Source/WebCore/svg/SVGSymbolElement.h
@@ -45,6 +45,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
     virtual bool rendererIsNeeded(RenderStyle*) { return false; }
 
     virtual bool selfHasRelativeLengths() const;
diff --git a/Source/WebCore/svg/SVGTRefElement.cpp b/Source/WebCore/svg/SVGTRefElement.cpp
index 14c4700..1161ffe 100644
--- a/Source/WebCore/svg/SVGTRefElement.cpp
+++ b/Source/WebCore/svg/SVGTRefElement.cpp
@@ -84,6 +84,20 @@ void SVGTRefElement::synchronizeProperty(const QualifiedName& attrName)
         synchronizeHref();
 }
 
+AttributeToPropertyTypeMap& SVGTRefElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGTRefElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGTextPositioningElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(XLinkNames::hrefAttr, AnimatedString);
+}
+
 RenderObject* SVGTRefElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
     return new (arena) RenderSVGInline(this);
diff --git a/Source/WebCore/svg/SVGTRefElement.h b/Source/WebCore/svg/SVGTRefElement.h
index 8b98383..2e7d005 100644
--- a/Source/WebCore/svg/SVGTRefElement.h
+++ b/Source/WebCore/svg/SVGTRefElement.h
@@ -38,6 +38,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual bool childShouldCreateRenderer(Node*) const;
diff --git a/Source/WebCore/svg/SVGTSpanElement.cpp b/Source/WebCore/svg/SVGTSpanElement.cpp
index 8fe30e2..24c979a 100644
--- a/Source/WebCore/svg/SVGTSpanElement.cpp
+++ b/Source/WebCore/svg/SVGTSpanElement.cpp
@@ -73,6 +73,17 @@ bool SVGTSpanElement::rendererIsNeeded(RenderStyle* style)
     return false;
 }
 
+AttributeToPropertyTypeMap& SVGTSpanElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGTSpanElement::fillAttributeToPropertyTypeMap()
+{        
+    SVGTextPositioningElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap());
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/svg/SVGTSpanElement.h b/Source/WebCore/svg/SVGTSpanElement.h
index 58a7990..ac02b57 100644
--- a/Source/WebCore/svg/SVGTSpanElement.h
+++ b/Source/WebCore/svg/SVGTSpanElement.h
@@ -36,6 +36,9 @@ private:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual bool childShouldCreateRenderer(Node*) const;
     virtual bool rendererIsNeeded(RenderStyle*);
+
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/svg/SVGTextContentElement.cpp b/Source/WebCore/svg/SVGTextContentElement.cpp
index f723ecc..0bb8b3b 100644
--- a/Source/WebCore/svg/SVGTextContentElement.cpp
+++ b/Source/WebCore/svg/SVGTextContentElement.cpp
@@ -221,6 +221,14 @@ void SVGTextContentElement::svgAttributeChanged(const QualifiedName& attrName)
     // FIXME: also handle attribute changes for lengthAdjust and textLength
 }
 
+void SVGTextContentElement::fillPassedAttributeToPropertyTypeMap(AttributeToPropertyTypeMap& attributeToPropertyTypeMap)
+{
+    SVGStyledElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+
+    attributeToPropertyTypeMap.set(SVGNames::textLengthAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::lengthAdjustAttr, AnimatedEnumeration);
+}
+
 bool SVGTextContentElement::isKnownAttribute(const QualifiedName& attrName)
 {
     return attrName.matches(SVGNames::lengthAdjustAttr)
@@ -232,7 +240,10 @@ bool SVGTextContentElement::isKnownAttribute(const QualifiedName& attrName)
 
 bool SVGTextContentElement::selfHasRelativeLengths() const
 {
-    return textLength().isRelative();
+    // Any element of the <text> subtree is advertized as using relative lengths.
+    // On any window size change, we have to relayout the text subtree, as the
+    // effective 'on-screen' font size may change.
+    return true;
 }
 
 SVGTextContentElement* SVGTextContentElement::elementFromRenderer(RenderObject* renderer)
diff --git a/Source/WebCore/svg/SVGTextContentElement.h b/Source/WebCore/svg/SVGTextContentElement.h
index 60b023b..7abffd8 100644
--- a/Source/WebCore/svg/SVGTextContentElement.h
+++ b/Source/WebCore/svg/SVGTextContentElement.h
@@ -65,6 +65,7 @@ protected:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    void fillPassedAttributeToPropertyTypeMap(AttributeToPropertyTypeMap&);
 
     virtual bool selfHasRelativeLengths() const;
 
diff --git a/Source/WebCore/svg/SVGTextElement.cpp b/Source/WebCore/svg/SVGTextElement.cpp
index b6094c9..3bb9b5e 100644
--- a/Source/WebCore/svg/SVGTextElement.cpp
+++ b/Source/WebCore/svg/SVGTextElement.cpp
@@ -143,6 +143,20 @@ void SVGTextElement::synchronizeProperty(const QualifiedName& attrName)
         synchronizeTransform();
 }
 
+AttributeToPropertyTypeMap& SVGTextElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGTextElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGTextPositioningElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::transformAttr, AnimatedTransformList);
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/svg/SVGTextElement.h b/Source/WebCore/svg/SVGTextElement.h
index 8dda8c6..1c57f82 100644
--- a/Source/WebCore/svg/SVGTextElement.h
+++ b/Source/WebCore/svg/SVGTextElement.h
@@ -54,6 +54,8 @@ private:
             
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 
     // Animated property declarations
     DECLARE_ANIMATED_TRANSFORM_LIST(Transform, transform)
diff --git a/Source/WebCore/svg/SVGTextPathElement.cpp b/Source/WebCore/svg/SVGTextPathElement.cpp
index 9935b43..1bfc12c 100644
--- a/Source/WebCore/svg/SVGTextPathElement.cpp
+++ b/Source/WebCore/svg/SVGTextPathElement.cpp
@@ -110,6 +110,23 @@ void SVGTextPathElement::synchronizeProperty(const QualifiedName& attrName)
         synchronizeHref();
 }
 
+AttributeToPropertyTypeMap& SVGTextPathElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGTextPathElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGTextContentElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::startOffsetAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::methodAttr, AnimatedEnumeration);
+    attributeToPropertyTypeMap.set(SVGNames::spacingAttr, AnimatedEnumeration);
+    attributeToPropertyTypeMap.set(XLinkNames::hrefAttr, AnimatedString);
+}
+
 RenderObject* SVGTextPathElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
     return new (arena) RenderSVGTextPath(this);
diff --git a/Source/WebCore/svg/SVGTextPathElement.h b/Source/WebCore/svg/SVGTextPathElement.h
index 6c372f9..b113718 100644
--- a/Source/WebCore/svg/SVGTextPathElement.h
+++ b/Source/WebCore/svg/SVGTextPathElement.h
@@ -62,6 +62,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual bool childShouldCreateRenderer(Node*) const;
diff --git a/Source/WebCore/svg/SVGTextPositioningElement.cpp b/Source/WebCore/svg/SVGTextPositioningElement.cpp
index 544d192..a96f0cb 100644
--- a/Source/WebCore/svg/SVGTextPositioningElement.cpp
+++ b/Source/WebCore/svg/SVGTextPositioningElement.cpp
@@ -161,31 +161,15 @@ void SVGTextPositioningElement::synchronizeProperty(const QualifiedName& attrNam
         synchronizeRotate();
 }
 
-static inline bool listContainsRelativeValue(const SVGLengthList& list)
+void SVGTextPositioningElement::fillPassedAttributeToPropertyTypeMap(AttributeToPropertyTypeMap& attributeToPropertyTypeMap)
 {
-    unsigned size = list.size();
-    for (unsigned i = 0; i < size; ++i) {
-        const SVGLength& length = list.at(i);
-        if (length.isRelative())
-            return true;
-    }
-
-    return false;
-}
+    SVGTextContentElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
 
-bool SVGTextPositioningElement::selfHasRelativeLengths() const
-{
-    if (SVGTextContentElement::selfHasRelativeLengths())
-        return true;
-    if (listContainsRelativeValue(x()))
-        return true;
-    if (listContainsRelativeValue(y()))
-        return true;
-    if (listContainsRelativeValue(dx()))
-        return true;
-    if (listContainsRelativeValue(dy()))
-        return true;
-    return false;
+    attributeToPropertyTypeMap.set(SVGNames::xAttr, AnimatedNumberList);
+    attributeToPropertyTypeMap.set(SVGNames::yAttr, AnimatedNumberList);
+    attributeToPropertyTypeMap.set(SVGNames::dxAttr, AnimatedNumberList);
+    attributeToPropertyTypeMap.set(SVGNames::dyAttr, AnimatedNumberList);
+    attributeToPropertyTypeMap.set(SVGNames::rotateAttr, AnimatedNumberList);
 }
 
 SVGTextPositioningElement* SVGTextPositioningElement::elementFromRenderer(RenderObject* renderer)
diff --git a/Source/WebCore/svg/SVGTextPositioningElement.h b/Source/WebCore/svg/SVGTextPositioningElement.h
index e4bc4ea..5e6dadc 100644
--- a/Source/WebCore/svg/SVGTextPositioningElement.h
+++ b/Source/WebCore/svg/SVGTextPositioningElement.h
@@ -39,8 +39,7 @@ protected:
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
-
-    virtual bool selfHasRelativeLengths() const;
+    void fillPassedAttributeToPropertyTypeMap(AttributeToPropertyTypeMap&);
 
     // Animated property declarations
     DECLARE_ANIMATED_LENGTH_LIST(X, x)
diff --git a/Source/WebCore/svg/SVGTitleElement.cpp b/Source/WebCore/svg/SVGTitleElement.cpp
index 5eb2204..6281f10 100644
--- a/Source/WebCore/svg/SVGTitleElement.cpp
+++ b/Source/WebCore/svg/SVGTitleElement.cpp
@@ -56,6 +56,17 @@ void SVGTitleElement::childrenChanged(bool changedByParser, Node* beforeChange,
         document()->setTitle(textContent(), this);
 }
 
+AttributeToPropertyTypeMap& SVGTitleElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGTitleElement::fillAttributeToPropertyTypeMap()
+{        
+    SVGStyledElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap());
+}
+
 }
 
 // vim:ts=4:noet
diff --git a/Source/WebCore/svg/SVGTitleElement.h b/Source/WebCore/svg/SVGTitleElement.h
index 5d0762f..c1cec49 100644
--- a/Source/WebCore/svg/SVGTitleElement.h
+++ b/Source/WebCore/svg/SVGTitleElement.h
@@ -40,6 +40,9 @@ private:
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
     virtual bool rendererIsNeeded(RenderStyle*) { return false; }
+
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/svg/SVGUseElement.cpp b/Source/WebCore/svg/SVGUseElement.cpp
index 9f43f82..cc53bda 100644
--- a/Source/WebCore/svg/SVGUseElement.cpp
+++ b/Source/WebCore/svg/SVGUseElement.cpp
@@ -227,6 +227,24 @@ void SVGUseElement::synchronizeProperty(const QualifiedName& attrName)
         SVGTests::synchronizeProperties(this, attrName);
 }
 
+AttributeToPropertyTypeMap& SVGUseElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGUseElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGStyledTransformableElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::xAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::yAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::widthAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(SVGNames::heightAttr, AnimatedLength);
+    attributeToPropertyTypeMap.set(XLinkNames::hrefAttr, AnimatedLength);
+}
+
 static void updateContainerSize(SVGUseElement* useElement, SVGElementInstance* targetInstance)
 {
     // Depth-first used to write the method in early exit style, no particular other reason.
@@ -716,6 +734,8 @@ void SVGUseElement::buildInstanceTree(SVGElement* target, SVGElementInstance* ta
 
         // Enter recursion, appending new instance tree nodes to the "instance" object.
         buildInstanceTree(element, instancePtr, foundProblem);
+        if (foundProblem)
+            return;
     }
 
     if (!targetHasUseTag || !newTarget)
diff --git a/Source/WebCore/svg/SVGUseElement.h b/Source/WebCore/svg/SVGUseElement.h
index c1095ed..10c9be9 100644
--- a/Source/WebCore/svg/SVGUseElement.h
+++ b/Source/WebCore/svg/SVGUseElement.h
@@ -62,6 +62,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 
     virtual void recalcStyle(StyleChange = NoChange);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/Source/WebCore/svg/SVGViewElement.cpp b/Source/WebCore/svg/SVGViewElement.cpp
index ee3c8d1..2dcf674 100644
--- a/Source/WebCore/svg/SVGViewElement.cpp
+++ b/Source/WebCore/svg/SVGViewElement.cpp
@@ -80,6 +80,21 @@ void SVGViewElement::synchronizeProperty(const QualifiedName& attrName)
     }
 }
 
+AttributeToPropertyTypeMap& SVGViewElement::attributeToPropertyTypeMap()
+{
+    DEFINE_STATIC_LOCAL(AttributeToPropertyTypeMap, s_attributeToPropertyTypeMap, ());
+    return s_attributeToPropertyTypeMap;
+}
+
+void SVGViewElement::fillAttributeToPropertyTypeMap()
+{
+    AttributeToPropertyTypeMap& attributeToPropertyTypeMap = this->attributeToPropertyTypeMap();
+
+    SVGStyledElement::fillPassedAttributeToPropertyTypeMap(attributeToPropertyTypeMap);
+    attributeToPropertyTypeMap.set(SVGNames::viewBoxAttr, AnimatedRect);
+    attributeToPropertyTypeMap.set(SVGNames::preserveAspectRatioAttr, AnimatedPreserveAspectRatio);
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/svg/SVGViewElement.h b/Source/WebCore/svg/SVGViewElement.h
index 0e2e4fd..b371774 100644
--- a/Source/WebCore/svg/SVGViewElement.h
+++ b/Source/WebCore/svg/SVGViewElement.h
@@ -47,6 +47,8 @@ private:
 
     virtual void parseMappedAttribute(Attribute*);
     virtual void synchronizeProperty(const QualifiedName&);
+    virtual void fillAttributeToPropertyTypeMap();
+    virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
 
     virtual bool rendererIsNeeded(RenderStyle*) { return false; }
 
diff --git a/Source/WebCore/svg/graphics/SVGImage.cpp b/Source/WebCore/svg/graphics/SVGImage.cpp
index fc2fd08..2d400a4 100644
--- a/Source/WebCore/svg/graphics/SVGImage.cpp
+++ b/Source/WebCore/svg/graphics/SVGImage.cpp
@@ -279,10 +279,10 @@ bool SVGImage::dataChanged(bool allDataReceived)
         loader->load(fakeRequest, false); // Make sure the DocumentLoader is created
         loader->policyChecker()->cancelCheck(); // cancel any policy checks
         loader->commitProvisionalLoad();
-        loader->writer()->setMIMEType("image/svg+xml");
-        loader->writer()->begin(KURL()); // create the empty document
-        loader->writer()->addData(data()->data(), data()->size());
-        loader->writer()->end();
+        loader->activeDocumentLoader()->writer()->setMIMEType("image/svg+xml");
+        loader->activeDocumentLoader()->writer()->begin(KURL()); // create the empty document
+        loader->activeDocumentLoader()->writer()->addData(data()->data(), data()->size());
+        loader->activeDocumentLoader()->writer()->end();
         frame->view()->setTransparent(true); // SVG Images are transparent.
     }
 
diff --git a/Source/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp b/Source/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp
index b31b994..e6d0e65 100644
--- a/Source/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp
+++ b/Source/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp
@@ -68,10 +68,11 @@ FilterEffect* SVGFilterBuilder::getEffectById(const AtomicString& id) const
     return m_namedEffects.get(id).get();
 }
 
-void SVGFilterBuilder::appendEffectToEffectReferences(RefPtr<FilterEffect> effectReference)
+void SVGFilterBuilder::appendEffectToEffectReferences(RefPtr<FilterEffect> effectReference, RenderObject* object)
 {
     // The effect must be a newly created filter effect.
     ASSERT(!m_effectReferences.contains(effectReference));
+    ASSERT(object && !m_effectRenderer.contains(object));
     m_effectReferences.add(effectReference, FilterEffectSet());
 
     FilterEffect* effect = effectReference.get();
@@ -79,7 +80,8 @@ void SVGFilterBuilder::appendEffectToEffectReferences(RefPtr<FilterEffect> effec
 
     // It is not possible to add the same value to a set twice.
     for (unsigned i = 0; i < numberOfInputEffects; ++i)
-        getEffectReferences(effect->inputEffect(i)).add(effect);
+        effectReferences(effect->inputEffect(i)).add(effect);
+    m_effectRenderer.add(object, effectReference.get());
 }
 
 void SVGFilterBuilder::clearEffects()
@@ -87,9 +89,23 @@ void SVGFilterBuilder::clearEffects()
     m_lastEffect = 0;
     m_namedEffects.clear();
     m_effectReferences.clear();
+    m_effectRenderer.clear();
     addBuiltinEffects();
 }
 
+void SVGFilterBuilder::clearResultsRecursive(FilterEffect* effect)
+{
+    if (!effect->hasResult())
+        return;
+
+    effect->clearResult();
+
+    HashSet<FilterEffect*>& effectReferences = this->effectReferences(effect);
+    HashSet<FilterEffect*>::iterator end = effectReferences.end();
+    for (HashSet<FilterEffect*>::iterator it = effectReferences.begin(); it != end; ++it)
+         clearResultsRecursive(*it);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/Source/WebCore/svg/graphics/filters/SVGFilterBuilder.h b/Source/WebCore/svg/graphics/filters/SVGFilterBuilder.h
index a3c1244..9e7b2fe 100644
--- a/Source/WebCore/svg/graphics/filters/SVGFilterBuilder.h
+++ b/Source/WebCore/svg/graphics/filters/SVGFilterBuilder.h
@@ -24,6 +24,7 @@
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "FilterEffect.h"
 #include "PlatformString.h"
+#include "RenderObject.h"
 
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
@@ -43,16 +44,20 @@ public:
     FilterEffect* getEffectById(const AtomicString& id) const;
     FilterEffect* lastEffect() const { return m_lastEffect.get(); }
 
-    void appendEffectToEffectReferences(RefPtr<FilterEffect>);
+    void appendEffectToEffectReferences(RefPtr<FilterEffect>, RenderObject*);
 
-    inline FilterEffectSet& getEffectReferences(FilterEffect* effect)
+    inline FilterEffectSet& effectReferences(FilterEffect* effect)
     {
         // Only allowed for effects belongs to this builder.
         ASSERT(m_effectReferences.contains(effect));
         return m_effectReferences.find(effect)->second;
     }
 
+    // Required to change the attributes of a filter during an svgAttributeChanged.
+    inline FilterEffect* effectByRenderer(RenderObject* object) { return m_effectRenderer.get(object); }
+
     void clearEffects();
+    void clearResultsRecursive(FilterEffect*);
 
 private:
     SVGFilterBuilder(Filter*);
@@ -69,6 +74,7 @@ private:
     // The value is a list, which contains those filter effects,
     // which depends on the key filter effect.
     HashMap<RefPtr<FilterEffect>, FilterEffectSet> m_effectReferences;
+    HashMap<RenderObject*, FilterEffect*> m_effectRenderer;
 
     RefPtr<FilterEffect> m_lastEffect;
 };
diff --git a/Source/WebCore/webaudio/AudioBuffer.cpp b/Source/WebCore/webaudio/AudioBuffer.cpp
index f46d153..7075752 100644
--- a/Source/WebCore/webaudio/AudioBuffer.cpp
+++ b/Source/WebCore/webaudio/AudioBuffer.cpp
@@ -28,7 +28,7 @@
 
 #include "config.h"
 
-#if ENABLE(WEB_AUDIO) & ENABLE(3D_CANVAS)
+#if ENABLE(WEB_AUDIO) & ENABLE(WEBGL)
 
 #include "AudioBuffer.h"
 
@@ -107,4 +107,4 @@ void AudioBuffer::zero()
 
 } // namespace WebCore
 
-#endif // ENABLE(WEB_AUDIO) & ENABLE(3D_CANVAS)
+#endif // ENABLE(WEB_AUDIO) & ENABLE(WEBGL)
diff --git a/Source/WebCore/webaudio/AudioBuffer.idl b/Source/WebCore/webaudio/AudioBuffer.idl
index e7353bf..594ee69 100644
--- a/Source/WebCore/webaudio/AudioBuffer.idl
+++ b/Source/WebCore/webaudio/AudioBuffer.idl
@@ -28,7 +28,7 @@
 
 module audio {
     interface [
-        Conditional=WEB_AUDIO & 3D_CANVAS
+        Conditional=WEB_AUDIO & WEBGL
     ] AudioBuffer {
         readonly attribute long length; // in sample-frames
         readonly attribute float duration; // in seconds
diff --git a/Source/WebCore/webaudio/AudioContext.cpp b/Source/WebCore/webaudio/AudioContext.cpp
index a452775..f25b494 100644
--- a/Source/WebCore/webaudio/AudioContext.cpp
+++ b/Source/WebCore/webaudio/AudioContext.cpp
@@ -41,6 +41,7 @@
 #include "ConvolverNode.h"
 #include "DelayNode.h"
 #include "Document.h"
+#include "FFTFrame.h"
 #include "HRTFDatabaseLoader.h"
 #include "HRTFPanner.h"
 #include "HighPass2FilterNode.h"
@@ -79,6 +80,8 @@ AudioContext::AudioContext(Document* document)
     // relax the check.
     relaxAdoptionRequirement();
     
+    FFTFrame::initialize();
+    
     m_destinationNode = AudioDestinationNode::create(this);
     m_listener = AudioListener::create();
     m_temporaryMonoBus = adoptPtr(new AudioBus(1, AudioNode::ProcessingSizeInFrames));
diff --git a/Source/WebCore/webaudio/AudioContext.idl b/Source/WebCore/webaudio/AudioContext.idl
index 9f0f49c..531774e 100644
--- a/Source/WebCore/webaudio/AudioContext.idl
+++ b/Source/WebCore/webaudio/AudioContext.idl
@@ -41,8 +41,10 @@ module webaudio {
         // All panning is relative to this listener.
         readonly attribute AudioListener listener;
 
-        AudioBuffer createBuffer(in unsigned long numberOfChannels, in unsigned long numberOfFrames, in float sampleRate);
-        AudioBuffer createBuffer(in ArrayBuffer buffer, in boolean mixToMono);
+        // AudioBuffer createBuffer(in unsigned long numberOfChannels, in unsigned long numberOfFrames, in float sampleRate);
+        // AudioBuffer createBuffer(in ArrayBuffer buffer, in boolean mixToMono);
+        [Custom] AudioBuffer createBuffer()
+            raises(DOMException);
 
         // Source
         AudioBufferSourceNode createBufferSource();
diff --git a/Source/WebCore/webaudio/RealtimeAnalyser.cpp b/Source/WebCore/webaudio/RealtimeAnalyser.cpp
index 30a7de1..1a1e920 100644
--- a/Source/WebCore/webaudio/RealtimeAnalyser.cpp
+++ b/Source/WebCore/webaudio/RealtimeAnalyser.cpp
@@ -32,7 +32,7 @@
 #include "AudioUtilities.h"
 #include "FFTFrame.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 #include "Float32Array.h"
 #include "Uint8Array.h"
 #endif
@@ -193,7 +193,7 @@ void RealtimeAnalyser::doFFTAnalysis()
     }
 }
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 void RealtimeAnalyser::getFloatFrequencyData(Float32Array* destinationArray)
 {
@@ -294,7 +294,7 @@ void RealtimeAnalyser::getByteTimeDomainData(Uint8Array* destinationArray)
     }
 }
 
-#endif // 3D_CANVAS
+#endif // WEBGL
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/webaudio/RealtimeAnalyser.h b/Source/WebCore/webaudio/RealtimeAnalyser.h
index c6ec2c0..84d2992 100644
--- a/Source/WebCore/webaudio/RealtimeAnalyser.h
+++ b/Source/WebCore/webaudio/RealtimeAnalyser.h
@@ -34,7 +34,7 @@ namespace WebCore {
 class AudioBus;
 class FFTFrame;
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 class Float32Array;
 class Uint8Array;
 #endif
@@ -61,7 +61,7 @@ public:
     void setSmoothingTimeConstant(float k) { m_smoothingTimeConstant = k; }
     float smoothingTimeConstant() const { return static_cast<float>(m_smoothingTimeConstant); }
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
     void getFloatFrequencyData(Float32Array*);
     void getByteFrequencyData(Uint8Array*);
     void getByteTimeDomainData(Uint8Array*);
diff --git a/Source/WebCore/webaudio/RealtimeAnalyserNode.h b/Source/WebCore/webaudio/RealtimeAnalyserNode.h
index 9f62464..07488ee 100644
--- a/Source/WebCore/webaudio/RealtimeAnalyserNode.h
+++ b/Source/WebCore/webaudio/RealtimeAnalyserNode.h
@@ -59,7 +59,7 @@ public:
     void setSmoothingTimeConstant(float k) { m_analyser.setSmoothingTimeConstant(k); }
     float smoothingTimeConstant() const { return m_analyser.smoothingTimeConstant(); }
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
     void getFloatFrequencyData(Float32Array* array) { m_analyser.getFloatFrequencyData(array); }
     void getByteFrequencyData(Uint8Array* array) { m_analyser.getByteFrequencyData(array); }
     void getByteTimeDomainData(Uint8Array* array) { m_analyser.getByteTimeDomainData(array); }
diff --git a/Source/WebCore/webaudio/RealtimeAnalyserNode.idl b/Source/WebCore/webaudio/RealtimeAnalyserNode.idl
index 5b2b223..fdd8819 100644
--- a/Source/WebCore/webaudio/RealtimeAnalyserNode.idl
+++ b/Source/WebCore/webaudio/RealtimeAnalyserNode.idl
@@ -39,10 +39,10 @@ module audio {
         
         // Copies the current frequency data into the passed array.
         // If the array has fewer elements than the frequencyBinCount, the excess elements will be dropped.
-        [Conditional=3D_CANVAS] void getFloatFrequencyData(in Float32Array array);
-        [Conditional=3D_CANVAS] void getByteFrequencyData(in Uint8Array array);
+        [Conditional=WEBGL] void getFloatFrequencyData(in Float32Array array);
+        [Conditional=WEBGL] void getByteFrequencyData(in Uint8Array array);
 
         // Real-time waveform data
-        [Conditional=3D_CANVAS] void getByteTimeDomainData(in Uint8Array array);
+        [Conditional=WEBGL] void getByteTimeDomainData(in Uint8Array array);
     };
 }
diff --git a/Source/WebCore/websockets/WebSocketHandshake.cpp b/Source/WebCore/websockets/WebSocketHandshake.cpp
index f653415..84779f5 100644
--- a/Source/WebCore/websockets/WebSocketHandshake.cpp
+++ b/Source/WebCore/websockets/WebSocketHandshake.cpp
@@ -35,7 +35,6 @@
 
 #include "WebSocketHandshake.h"
 
-#include "CharacterNames.h"
 #include "Cookie.h"
 #include "CookieJar.h"
 #include "Document.h"
@@ -45,7 +44,6 @@
 #include "ScriptCallStack.h"
 #include "ScriptExecutionContext.h"
 #include "SecurityOrigin.h"
-
 #include <wtf/MD5.h>
 #include <wtf/RandomNumber.h>
 #include <wtf/StdLibExtras.h>
@@ -55,6 +53,7 @@
 #include <wtf/text/CString.h>
 #include <wtf/text/StringBuilder.h>
 #include <wtf/text/StringConcatenate.h>
+#include <wtf/unicode/CharacterNames.h>
 
 namespace WebCore {
 
diff --git a/Source/WebCore/wml/WMLInputElement.h b/Source/WebCore/wml/WMLInputElement.h
index df7f497..6c66410 100644
--- a/Source/WebCore/wml/WMLInputElement.h
+++ b/Source/WebCore/wml/WMLInputElement.h
@@ -63,6 +63,7 @@ public:
     virtual String value() const;
     virtual void setValue(const String&, bool sendChangeEvent = false);
     virtual void setValueForUser(const String&);
+    virtual String visibleValue() const { return value(); }
     virtual void setValueFromRenderer(const String&);
 
     virtual bool saveFormControlState(String& value) const;
diff --git a/Source/WebCore/wml/WMLTableElement.cpp b/Source/WebCore/wml/WMLTableElement.cpp
index ed3522d..7501e24 100644
--- a/Source/WebCore/wml/WMLTableElement.cpp
+++ b/Source/WebCore/wml/WMLTableElement.cpp
@@ -26,7 +26,6 @@
 #include "Attribute.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
-#include "CharacterNames.h"
 #include "Document.h"
 #include "HTMLNames.h"
 #include "NodeList.h"
@@ -34,6 +33,7 @@
 #include "Text.h"
 #include "WMLErrorHandling.h"
 #include "WMLNames.h"
+#include <wtf/unicode/CharacterNames.h>
 
 namespace WebCore {
 
diff --git a/Source/WebCore/workers/WorkerContext.cpp b/Source/WebCore/workers/WorkerContext.cpp
index 36c4215..acf7f04 100644
--- a/Source/WebCore/workers/WorkerContext.cpp
+++ b/Source/WebCore/workers/WorkerContext.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- * Copyright (C) 2009 Google Inc. All Rights Reserved.
+ * Copyright (C) 2009, 2011 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -249,7 +249,7 @@ void WorkerContext::importScripts(const Vector<String>& urls, ExceptionCode& ec)
        InspectorInstrumentation::scriptImported(scriptExecutionContext(), scriptLoader.identifier(), scriptLoader.script());
 
         ScriptValue exception;
-        m_script->evaluate(ScriptSourceCode(scriptLoader.script(), *it), &exception);
+        m_script->evaluate(ScriptSourceCode(scriptLoader.script(), scriptLoader.responseURL()), &exception);
         if (!exception.hasNoValue()) {
             m_script->setException(exception);
             return;
diff --git a/Source/WebCore/workers/WorkerContext.idl b/Source/WebCore/workers/WorkerContext.idl
index ccbd964..179221e 100644
--- a/Source/WebCore/workers/WorkerContext.idl
+++ b/Source/WebCore/workers/WorkerContext.idl
@@ -114,14 +114,14 @@ module threads {
                  attribute [EnabledAtRuntime=FileSystem] FlagsConstructor Flags;
 #endif
 
-        attribute [Conditional=BLOB,EnabledAtRuntime] ArrayBufferConstructor ArrayBuffer; // Usable with new operator
-        attribute [Conditional=BLOB,EnabledAtRuntime] Int8ArrayConstructor Int8Array; // Usable with new operator
-        attribute [Conditional=BLOB,EnabledAtRuntime] Uint8ArrayConstructor Uint8Array; // Usable with new operator
-        attribute [Conditional=BLOB,EnabledAtRuntime] Int16ArrayConstructor Int16Array; // Usable with new operator
-        attribute [Conditional=BLOB,EnabledAtRuntime] Uint16ArrayConstructor Uint16Array; // Usable with new operator
-        attribute [Conditional=BLOB,EnabledAtRuntime] Int32ArrayConstructor Int32Array; // Usable with new operator
-        attribute [Conditional=BLOB,EnabledAtRuntime] Uint32ArrayConstructor Uint32Array; // Usable with new operator
-        attribute [Conditional=BLOB,EnabledAtRuntime] Float32ArrayConstructor Float32Array; // Usable with new operator
+        attribute ArrayBufferConstructor ArrayBuffer; // Usable with new operator
+        attribute Int8ArrayConstructor Int8Array; // Usable with new operator
+        attribute Uint8ArrayConstructor Uint8Array; // Usable with new operator
+        attribute Int16ArrayConstructor Int16Array; // Usable with new operator
+        attribute Uint16ArrayConstructor Uint16Array; // Usable with new operator
+        attribute Int32ArrayConstructor Int32Array; // Usable with new operator
+        attribute Uint32ArrayConstructor Uint32Array; // Usable with new operator
+        attribute Float32ArrayConstructor Float32Array; // Usable with new operator
     };
 
 }
diff --git a/Source/WebCore/workers/WorkerScriptLoader.cpp b/Source/WebCore/workers/WorkerScriptLoader.cpp
index 1786b89..2224d87 100644
--- a/Source/WebCore/workers/WorkerScriptLoader.cpp
+++ b/Source/WebCore/workers/WorkerScriptLoader.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All Rights Reserved.
- * Copyright (C) 2009 Google Inc. All Rights Reserved.
+ * Copyright (C) 2009, 2011 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -87,6 +87,12 @@ void WorkerScriptLoader::loadAsynchronously(ScriptExecutionContext* scriptExecut
     m_threadableLoader = ThreadableLoader::create(scriptExecutionContext, this, *request, options);
 }
 
+const KURL& WorkerScriptLoader::responseURL() const
+{
+    ASSERT(!failed());
+    return m_responseURL;
+}
+
 PassOwnPtr<ResourceRequest> WorkerScriptLoader::createResourceRequest()
 {
     OwnPtr<ResourceRequest> request(new ResourceRequest(m_url));
@@ -101,6 +107,7 @@ void WorkerScriptLoader::didReceiveResponse(const ResourceResponse& response)
         m_failed = true;
         return;
     }
+    m_responseURL = response.url();
     m_responseEncoding = response.textEncodingName();
     if (m_client)
         m_client->didReceiveResponse(response);
diff --git a/Source/WebCore/workers/WorkerScriptLoader.h b/Source/WebCore/workers/WorkerScriptLoader.h
index fc8b0b4..98e21e1 100644
--- a/Source/WebCore/workers/WorkerScriptLoader.h
+++ b/Source/WebCore/workers/WorkerScriptLoader.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All Rights Reserved.
- * Copyright (C) 2009 Google Inc. All Rights Reserved.
+ * Copyright (C) 2009, 2011 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -53,6 +53,7 @@ namespace WebCore {
 
         const String& script() const { return m_script; }
         const KURL& url() const { return m_url; }
+        const KURL& responseURL() const;
         bool failed() const { return m_failed; }
         unsigned long identifier() const { return m_identifier; }
 
@@ -73,6 +74,7 @@ namespace WebCore {
         RefPtr<TextResourceDecoder> m_decoder;
         String m_script;
         KURL m_url;
+        KURL m_responseURL;
         bool m_failed;
         unsigned long m_identifier;
         ResourceRequestBase::TargetType m_targetType;
diff --git a/Source/WebCore/xml/XMLHttpRequest.cpp b/Source/WebCore/xml/XMLHttpRequest.cpp
index c05ab29..a548ebc 100644
--- a/Source/WebCore/xml/XMLHttpRequest.cpp
+++ b/Source/WebCore/xml/XMLHttpRequest.cpp
@@ -56,6 +56,7 @@
 #if USE(JSC)
 #include "JSDOMBinding.h"
 #include "JSDOMWindow.h"
+#include <runtime/JSLock.h>
 #include <runtime/Protect.h>
 #endif
 
@@ -249,6 +250,7 @@ Document* XMLHttpRequest::responseXML(ExceptionCode& ec)
             m_responseXML = Document::create(0, m_url);
             // FIXME: Set Last-Modified.
             m_responseXML->setContent(m_responseBuilder.toStringPreserveCapacity());
+            m_responseXML->setSecurityOrigin(document()->securityOrigin());
             if (!m_responseXML->wellFormed())
                 m_responseXML = 0;
         }
@@ -269,7 +271,7 @@ Blob* XMLHttpRequest::responseBlob(ExceptionCode& ec) const
 }
 #endif
 
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
+#if ENABLE(WEBGL) || ENABLE(BLOB)
 ArrayBuffer* XMLHttpRequest::responseArrayBuffer(ExceptionCode& ec)
 {
     if (m_responseTypeCode != ResponseTypeArrayBuffer) {
@@ -310,7 +312,7 @@ void XMLHttpRequest::setResponseType(const String& responseType, ExceptionCode&
         m_responseTypeCode = ResponseTypeBlob;
 #endif
     } else if (responseType == "arraybuffer") {
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
+#if ENABLE(WEBGL) || ENABLE(BLOB)
         m_responseTypeCode = ResponseTypeArrayBuffer;
 #endif
     } else
@@ -584,7 +586,7 @@ void XMLHttpRequest::send(DOMFormData* body, ExceptionCode& ec)
     createRequest(ec);
 }
 
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
+#if ENABLE(WEBGL) || ENABLE(BLOB)
 void XMLHttpRequest::send(ArrayBuffer* body, ExceptionCode& ec)
 {
     if (!initSend(ec))
@@ -737,7 +739,7 @@ void XMLHttpRequest::clearResponse()
 #if ENABLE(XHR_RESPONSE_BLOB)
     m_responseBlob = 0;
 #endif
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
+#if ENABLE(WEBGL) || ENABLE(BLOB)
     m_binaryResponseBuilder.clear();
     m_responseArrayBuffer.clear();
 #endif
@@ -791,8 +793,10 @@ void XMLHttpRequest::dropProtection()
     // can't be recouped until the load is done, so only
     // report the extra cost at that point.
     JSC::JSGlobalData* globalData = scriptExecutionContext()->globalData();
-    if (hasCachedDOMObjectWrapper(globalData, this))
+    if (hasCachedDOMObjectWrapper(globalData, this)) {
+        JSC::JSLock lock(JSC::SilenceAssertionsOnly);
         globalData->heap.reportExtraMemoryCost(m_responseBuilder.length() * 2);
+    }
 #endif
 
     unsetPendingActivity(this);
@@ -1072,7 +1076,7 @@ void XMLHttpRequest::didReceiveData(const char* data, int len)
 
     if (useDecoder)
         m_responseBuilder.append(m_decoder->decode(data, len));
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
+#if ENABLE(WEBGL) || ENABLE(BLOB)
     else if (responseTypeCode() == ResponseTypeArrayBuffer) {
         // Buffer binary data.
         if (!m_binaryResponseBuilder)
diff --git a/Source/WebCore/xml/XMLHttpRequest.h b/Source/WebCore/xml/XMLHttpRequest.h
index b15d358..384a846 100644
--- a/Source/WebCore/xml/XMLHttpRequest.h
+++ b/Source/WebCore/xml/XMLHttpRequest.h
@@ -95,7 +95,7 @@ public:
     void send(const String&, ExceptionCode&);
     void send(Blob*, ExceptionCode&);
     void send(DOMFormData*, ExceptionCode&);
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
+#if ENABLE(WEBGL) || ENABLE(BLOB)
     void send(ArrayBuffer*, ExceptionCode&);
 #endif
     void abort();
@@ -115,7 +115,7 @@ public:
     String responseType();
     ResponseTypeCode responseTypeCode() const { return m_responseTypeCode; }
     
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
+#if ENABLE(WEBGL) || ENABLE(BLOB)
     // response attribute has custom getter.
     ArrayBuffer* responseArrayBuffer(ExceptionCode&);
     ArrayBuffer* optionalResponseArrayBuffer() const { return m_responseArrayBuffer.get(); }
@@ -206,7 +206,7 @@ private:
     mutable bool m_createdDocument;
     mutable RefPtr<Document> m_responseXML;
     
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
+#if ENABLE(WEBGL) || ENABLE(BLOB)
     RefPtr<SharedBuffer> m_binaryResponseBuilder;
     mutable RefPtr<ArrayBuffer> m_responseArrayBuffer;
 #endif
diff --git a/Source/WebCore/xml/XSLStyleSheet.h b/Source/WebCore/xml/XSLStyleSheet.h
index 4312771..b36ac1d 100644
--- a/Source/WebCore/xml/XSLStyleSheet.h
+++ b/Source/WebCore/xml/XSLStyleSheet.h
@@ -79,7 +79,8 @@ public:
 
     CachedResourceLoader* cachedResourceLoader();
 
-    Document* ownerDocument() { return m_ownerDocument; }
+    Document* ownerDocument();
+    XSLStyleSheet* parentStyleSheet() const { return m_parentStyleSheet; }
     void setParentStyleSheet(XSLStyleSheet* parent);
 
 #if USE(QXMLQUERY)
diff --git a/Source/WebCore/xml/XSLStyleSheetLibxslt.cpp b/Source/WebCore/xml/XSLStyleSheetLibxslt.cpp
index eb735f4..a519023 100644
--- a/Source/WebCore/xml/XSLStyleSheetLibxslt.cpp
+++ b/Source/WebCore/xml/XSLStyleSheetLibxslt.cpp
@@ -56,7 +56,6 @@ namespace WebCore {
 
 XSLStyleSheet::XSLStyleSheet(XSLImportRule* parentRule, const String& originalURL, const KURL& finalURL)
     : StyleSheet(parentRule, originalURL, finalURL)
-    , m_ownerDocument(0)
     , m_embedded(false)
     , m_processed(false) // Child sheets get marked as processed when the libxslt engine has finally seen them.
     , m_stylesheetDoc(0)
@@ -67,7 +66,6 @@ XSLStyleSheet::XSLStyleSheet(XSLImportRule* parentRule, const String& originalUR
 
 XSLStyleSheet::XSLStyleSheet(Node* parentNode, const String& originalURL, const KURL& finalURL,  bool embedded)
     : StyleSheet(parentNode, originalURL, finalURL)
-    , m_ownerDocument(parentNode->document())
     , m_embedded(embedded)
     , m_processed(true) // The root sheet starts off processed.
     , m_stylesheetDoc(0)
@@ -129,9 +127,10 @@ void XSLStyleSheet::clearDocuments()
 
 CachedResourceLoader* XSLStyleSheet::cachedResourceLoader()
 {
-    if (!m_ownerDocument)
+    Document* document = ownerDocument();
+    if (!document)
         return 0;
-    return m_ownerDocument->cachedResourceLoader();
+    return document->cachedResourceLoader();
 }
 
 bool XSLStyleSheet::parseString(const String& string, bool)
@@ -257,8 +256,16 @@ xsltStylesheetPtr XSLStyleSheet::compileStyleSheet()
 void XSLStyleSheet::setParentStyleSheet(XSLStyleSheet* parent)
 {
     m_parentStyleSheet = parent;
-    if (parent)
-        m_ownerDocument = parent->ownerDocument();
+}
+
+Document* XSLStyleSheet::ownerDocument()
+{
+    for (XSLStyleSheet* styleSheet = this; styleSheet; styleSheet = styleSheet->parentStyleSheet()) {
+        Node* node = styleSheet->ownerNode();
+        if (node)
+            return node->document();
+    }
+    return 0;
 }
 
 xmlDocPtr XSLStyleSheet::locateStylesheetSubResource(xmlDocPtr parentDoc, const xmlChar* uri)
diff --git a/Source/WebCore/xml/XSLStyleSheetQt.cpp b/Source/WebCore/xml/XSLStyleSheetQt.cpp
index 855d6ba..6026285 100644
--- a/Source/WebCore/xml/XSLStyleSheetQt.cpp
+++ b/Source/WebCore/xml/XSLStyleSheetQt.cpp
@@ -34,7 +34,6 @@ namespace WebCore {
 
 XSLStyleSheet::XSLStyleSheet(Node* parentNode, const String& originalURL, const KURL& finalURL,  bool embedded)
     : StyleSheet(parentNode, originalURL, finalURL)
-    , m_ownerDocument(parentNode->document())
     , m_embedded(embedded)
 {
 }
@@ -62,9 +61,10 @@ void XSLStyleSheet::clearDocuments()
 
 CachedResourceLoader* XSLStyleSheet::cachedResourceLoader()
 {
-    if (!m_ownerDocument)
+    Document* document = ownerDocument();
+    if (!document)
         return 0;
-    return m_ownerDocument->cachedResourceLoader();
+    return document->cachedResourceLoader();
 }
 
 bool XSLStyleSheet::parseString(const String& string, bool)
@@ -87,6 +87,12 @@ void XSLStyleSheet::loadChildSheet(const String&)
     notImplemented();
 }
 
+Document* XSLStyleSheet::ownerDocument()
+{
+    Node* node = ownerNode();
+    return node ? node->document() : 0;
+}
+
 void XSLStyleSheet::setParentStyleSheet(XSLStyleSheet*)
 {
     notImplemented();