Merge WebKit at r67178 : Initial merge by git.

Change-Id: I57e01163b6866cb029cdadf405a0394a3918bc18

29 files changed, 320 insertions, 171 deletions

diff --git a/WebCore/css/CSSComputedStyleDeclaration.cpp b/WebCore/css/CSSComputedStyleDeclaration.cpp
index edb6987..d5330c6 100644
--- a/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -521,13 +521,29 @@ static PassRefPtr<CSSValue> getTimingFunctionValue(const AnimationList* animList
     RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
     if (animList) {
         for (size_t i = 0; i < animList->size(); ++i) {
-            const TimingFunction& tf = animList->animation(i)->timingFunction();
-            list->append(CSSTimingFunctionValue::create(tf.x1(), tf.y1(), tf.x2(), tf.y2()));
+            const TimingFunction* tf = animList->animation(i)->timingFunction().get();
+            if (tf->isCubicBezierTimingFunction()) {
+                const CubicBezierTimingFunction* ctf = static_cast<const CubicBezierTimingFunction*>(tf);
+                list->append(CSSCubicBezierTimingFunctionValue::create(ctf->x1(), ctf->y1(), ctf->x2(), ctf->y2()));
+            } else if (tf->isStepsTimingFunction()) {
+                const StepsTimingFunction* stf = static_cast<const StepsTimingFunction*>(tf);
+                list->append(CSSStepsTimingFunctionValue::create(stf->numberOfSteps(), stf->stepAtStart()));
+            } else {
+                list->append(CSSLinearTimingFunctionValue::create());
+            }
         }
     } else {
         // Note that initialAnimationTimingFunction() is used for both transitions and animations
-        const TimingFunction& tf = Animation::initialAnimationTimingFunction();
-        list->append(CSSTimingFunctionValue::create(tf.x1(), tf.y1(), tf.x2(), tf.y2()));
+        const TimingFunction* tf = Animation::initialAnimationTimingFunction().get();
+        if (tf->isCubicBezierTimingFunction()) {
+            const CubicBezierTimingFunction* ctf = static_cast<const CubicBezierTimingFunction*>(tf);
+            list->append(CSSCubicBezierTimingFunctionValue::create(ctf->x1(), ctf->y1(), ctf->x2(), ctf->y2()));
+        } else if (tf->isStepsTimingFunction()) {
+            const StepsTimingFunction* stf = static_cast<const StepsTimingFunction*>(tf);
+            list->append(CSSStepsTimingFunctionValue::create(stf->numberOfSteps(), stf->stepAtStart()));
+        } else {
+            list->append(CSSLinearTimingFunctionValue::create());
+        }
     }
     return list.release();
 }
@@ -575,13 +591,12 @@ static int cssIdentifierForFontSizeKeyword(int keywordSize)
 
 PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getFontSizeCSSValuePreferringKeyword() const
 {
-    Node* node = m_node.get();
-    if (!node)
+    if (!m_node)
         return 0;
 
-    node->document()->updateLayoutIgnorePendingStylesheets();
+    m_node->document()->updateLayoutIgnorePendingStylesheets();
 
-    RefPtr<RenderStyle> style = node->computedStyle(m_pseudoElementSpecifier);
+    RefPtr<RenderStyle> style = m_node->computedStyle(m_pseudoElementSpecifier);
     if (!style)
         return 0;
 
@@ -591,6 +606,18 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getFontSizeCSSValuePreferringK
     return CSSPrimitiveValue::create(style->fontDescription().computedPixelSize(), CSSPrimitiveValue::CSS_PX);
 }
 
+bool CSSComputedStyleDeclaration::useFixedFontDefaultSize() const
+{
+    if (!m_node)
+        return false;
+
+    RefPtr<RenderStyle> style = m_node->computedStyle(m_pseudoElementSpecifier);
+    if (!style)
+        return false;
+
+    return style->fontDescription().useFixedDefaultSize();
+}
+
 PassRefPtr<CSSValue> CSSComputedStyleDeclaration::valueForShadow(const ShadowData* shadow, int id) const
 {
     if (!shadow)
diff --git a/WebCore/css/CSSComputedStyleDeclaration.h b/WebCore/css/CSSComputedStyleDeclaration.h
index 816d15a..d4b7df2 100644
--- a/WebCore/css/CSSComputedStyleDeclaration.h
+++ b/WebCore/css/CSSComputedStyleDeclaration.h
@@ -58,6 +58,7 @@ public:
 
     PassRefPtr<CSSValue> getPropertyCSSValue(int propertyID, EUpdateLayout) const;
     PassRefPtr<CSSValue> getFontSizeCSSValuePreferringKeyword() const;
+    bool useFixedFontDefaultSize() const;
 #if ENABLE(SVG)
     PassRefPtr<CSSValue> getSVGPropertyCSSValue(int propertyID, EUpdateLayout) const;
 #endif
diff --git a/WebCore/css/CSSCursorImageValue.cpp b/WebCore/css/CSSCursorImageValue.cpp
index f2e5d95..2b09ab3 100644
--- a/WebCore/css/CSSCursorImageValue.cpp
+++ b/WebCore/css/CSSCursorImageValue.cpp
@@ -22,7 +22,7 @@
 #include "config.h"
 #include "CSSCursorImageValue.h"
 
-#include "DocLoader.h"
+#include "CachedResourceLoader.h"
 #include "Document.h"
 #include "PlatformString.h"
 #include <wtf/MathExtras.h>
@@ -111,7 +111,7 @@ bool CSSCursorImageValue::updateIfSVGCursorIsUsed(Element* element)
     return false;
 }
 
-StyleCachedImage* CSSCursorImageValue::cachedImage(DocLoader* loader)
+StyleCachedImage* CSSCursorImageValue::cachedImage(CachedResourceLoader* loader)
 {
     String url = getStringValue();
 
diff --git a/WebCore/css/CSSCursorImageValue.h b/WebCore/css/CSSCursorImageValue.h
index 742138c..2a95c3a 100644
--- a/WebCore/css/CSSCursorImageValue.h
+++ b/WebCore/css/CSSCursorImageValue.h
@@ -42,7 +42,7 @@ public:
     IntPoint hotSpot() const { return m_hotSpot; }
 
     bool updateIfSVGCursorIsUsed(Element*);
-    virtual StyleCachedImage* cachedImage(DocLoader*);
+    virtual StyleCachedImage* cachedImage(CachedResourceLoader*);
 
 #if ENABLE(SVG)
     void removeReferencedElement(SVGElement*);
diff --git a/WebCore/css/CSSFontFaceSource.cpp b/WebCore/css/CSSFontFaceSource.cpp
index 01b5569..ad9bebc 100644
--- a/WebCore/css/CSSFontFaceSource.cpp
+++ b/WebCore/css/CSSFontFaceSource.cpp
@@ -29,7 +29,7 @@
 #include "CachedFont.h"
 #include "CSSFontFace.h"
 #include "CSSFontSelector.h"
-#include "DocLoader.h"
+#include "CachedResourceLoader.h"
 #include "FontCache.h"
 #include "FontDescription.h"
 #include "GlyphPageTreeNode.h"
@@ -173,8 +173,8 @@ SimpleFontData* CSSFontFaceSource::getFontData(const FontDescription& fontDescri
         }
     } else {
         // Kick off the load now.
-        if (DocLoader* docLoader = fontSelector->docLoader())
-            m_font->beginLoadIfNeeded(docLoader);
+        if (CachedResourceLoader* cachedResourceLoader = fontSelector->cachedResourceLoader())
+            m_font->beginLoadIfNeeded(cachedResourceLoader);
         // FIXME: m_string is a URL so it makes no sense to pass it as a family name.
         SimpleFontData* tempData = fontCache()->getCachedFontData(fontDescription, m_string);
         if (!tempData)
diff --git a/WebCore/css/CSSFontSelector.cpp b/WebCore/css/CSSFontSelector.cpp
index 50627d7..d97589d 100644
--- a/WebCore/css/CSSFontSelector.cpp
+++ b/WebCore/css/CSSFontSelector.cpp
@@ -39,7 +39,7 @@
 #include "CSSUnicodeRangeValue.h"
 #include "CSSValueKeywords.h"
 #include "CSSValueList.h"
-#include "DocLoader.h"
+#include "CachedResourceLoader.h"
 #include "Document.h"
 #include "FontCache.h"
 #include "FontFamilyValue.h"
@@ -80,9 +80,9 @@ bool CSSFontSelector::isEmpty() const
     return m_fonts.isEmpty();
 }
 
-DocLoader* CSSFontSelector::docLoader() const
+CachedResourceLoader* CSSFontSelector::cachedResourceLoader() const
 {
-    return m_document ? m_document->docLoader() : 0;
+    return m_document ? m_document->cachedResourceLoader() : 0;
 }
 
 void CSSFontSelector::addFontFaceRule(const CSSFontFaceRule* fontFaceRule)
@@ -245,7 +245,7 @@ void CSSFontSelector::addFontFaceRule(const CSSFontFaceRule* fontFaceRule)
             Settings* settings = m_document ? m_document->frame() ? m_document->frame()->settings() : 0 : 0;
             bool allowDownloading = foundSVGFont || (settings && settings->downloadableBinaryFontsEnabled());
             if (allowDownloading && item->isSupportedFormat() && m_document) {
-                CachedFont* cachedFont = m_document->docLoader()->requestFont(item->resource());
+                CachedFont* cachedFont = m_document->cachedResourceLoader()->requestFont(item->resource());
                 if (cachedFont) {
 #if ENABLE(SVG_FONTS)
                     if (foundSVGFont)
diff --git a/WebCore/css/CSSFontSelector.h b/WebCore/css/CSSFontSelector.h
index abf82cd..93ee274 100644
--- a/WebCore/css/CSSFontSelector.h
+++ b/WebCore/css/CSSFontSelector.h
@@ -38,7 +38,7 @@ class CSSFontFace;
 class CSSFontFaceRule;
 class CSSSegmentedFontFace;
 class Document;
-class DocLoader;
+class CachedResourceLoader;
 class FontDescription;
 
 class CSSFontSelector : public FontSelector {
@@ -60,7 +60,7 @@ public:
 
     bool isEmpty() const;
 
-    DocLoader* docLoader() const;
+    CachedResourceLoader* cachedResourceLoader() const;
 
 private:
     CSSFontSelector(Document*);
diff --git a/WebCore/css/CSSGrammar.y b/WebCore/css/CSSGrammar.y
index ec507be..86a2f7c 100644
--- a/WebCore/css/CSSGrammar.y
+++ b/WebCore/css/CSSGrammar.y
@@ -79,7 +79,7 @@ using namespace HTMLNames;
     MediaQueryExp* mediaQueryExp;
     CSSParserValue value;
     CSSParserValueList* valueList;
-    Vector<MediaQueryExp*>* mediaQueryExpList;
+    Vector<OwnPtr<MediaQueryExp> >* mediaQueryExpList;
     WebKitCSSKeyframeRule* keyframeRule;
     WebKitCSSKeyframesRule* keyframesRule;
     float val;
@@ -627,11 +627,11 @@ media_query_exp_list:
     media_query_exp {
         CSSParser* p = static_cast<CSSParser*>(parser);
         $$ = p->createFloatingMediaQueryExpList();
-        $$->append(p->sinkFloatingMediaQueryExp($1).leakPtr());
+        $$->append(p->sinkFloatingMediaQueryExp($1));
     }
     | media_query_exp_list maybe_space MEDIA_AND maybe_space media_query_exp {
         $$ = $1;
-        $$->append(static_cast<CSSParser*>(parser)->sinkFloatingMediaQueryExp($5).leakPtr());
+        $$->append(static_cast<CSSParser*>(parser)->sinkFloatingMediaQueryExp($5));
     }
     ;
 
diff --git a/WebCore/css/CSSImageValue.cpp b/WebCore/css/CSSImageValue.cpp
index dc2d700..e657fcc 100644
--- a/WebCore/css/CSSImageValue.cpp
+++ b/WebCore/css/CSSImageValue.cpp
@@ -24,7 +24,7 @@
 #include "CSSValueKeywords.h"
 #include "Cache.h"
 #include "CachedImage.h"
-#include "DocLoader.h"
+#include "CachedResourceLoader.h"
 #include "StyleCachedImage.h"
 #include "StylePendingImage.h"
 
@@ -59,12 +59,12 @@ StyleImage* CSSImageValue::cachedOrPendingImage()
     return m_image.get();
 }
 
-StyleCachedImage* CSSImageValue::cachedImage(DocLoader* loader)
+StyleCachedImage* CSSImageValue::cachedImage(CachedResourceLoader* loader)
 {
     return cachedImage(loader, getStringValue());
 }
 
-StyleCachedImage* CSSImageValue::cachedImage(DocLoader* loader, const String& url)
+StyleCachedImage* CSSImageValue::cachedImage(CachedResourceLoader* loader, const String& url)
 {
     if (!m_accessedImage) {
         m_accessedImage = true;
diff --git a/WebCore/css/CSSImageValue.h b/WebCore/css/CSSImageValue.h
index 4205c4f..a9c8c9b 100644
--- a/WebCore/css/CSSImageValue.h
+++ b/WebCore/css/CSSImageValue.h
@@ -27,7 +27,7 @@
 
 namespace WebCore {
 
-class DocLoader;
+class CachedResourceLoader;
 class StyleCachedImage;
 class StyleImage;
 
@@ -37,7 +37,7 @@ public:
     static PassRefPtr<CSSImageValue> create(const String& url) { return adoptRef(new CSSImageValue(url)); }
     virtual ~CSSImageValue();
 
-    virtual StyleCachedImage* cachedImage(DocLoader*);
+    virtual StyleCachedImage* cachedImage(CachedResourceLoader*);
     // Returns a StyleCachedImage if the image is cached already, otherwise a StylePendingImage.
     StyleImage* cachedOrPendingImage();
     
@@ -46,7 +46,7 @@ public:
 protected:
     CSSImageValue(const String& url);
 
-    StyleCachedImage* cachedImage(DocLoader*, const String& url);
+    StyleCachedImage* cachedImage(CachedResourceLoader*, const String& url);
     String cachedImageURL();
     void clearCachedImage();
 
diff --git a/WebCore/css/CSSImportRule.cpp b/WebCore/css/CSSImportRule.cpp
index cc6083e..192f44e 100644
--- a/WebCore/css/CSSImportRule.cpp
+++ b/WebCore/css/CSSImportRule.cpp
@@ -23,7 +23,7 @@
 #include "CSSImportRule.h"
 
 #include "CachedCSSStyleSheet.h"
-#include "DocLoader.h"
+#include "CachedResourceLoader.h"
 #include "Document.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
@@ -115,8 +115,8 @@ void CSSImportRule::insertedIntoParent()
     if (!parentSheet)
         return;
 
-    DocLoader* docLoader = parentSheet->document()->docLoader();
-    if (!docLoader)
+    CachedResourceLoader* cachedResourceLoader = parentSheet->document()->cachedResourceLoader();
+    if (!cachedResourceLoader)
         return;
 
     String absHref = m_strHref;
@@ -135,9 +135,9 @@ void CSSImportRule::insertedIntoParent()
     }
 
     if (parentSheet->isUserStyleSheet())
-        m_cachedSheet = docLoader->requestUserCSSStyleSheet(absHref, parentSheet->charset());
+        m_cachedSheet = cachedResourceLoader->requestUserCSSStyleSheet(absHref, parentSheet->charset());
     else
-        m_cachedSheet = docLoader->requestCSSStyleSheet(absHref, parentSheet->charset());
+        m_cachedSheet = cachedResourceLoader->requestCSSStyleSheet(absHref, parentSheet->charset());
     if (m_cachedSheet) {
         // if the import rule is issued dynamically, the sheet may be
         // removed from the pending sheet count, so let the doc know
diff --git a/WebCore/css/CSSParser.cpp b/WebCore/css/CSSParser.cpp
index 5455eed..8398bd0 100644
--- a/WebCore/css/CSSParser.cpp
+++ b/WebCore/css/CSSParser.cpp
@@ -176,8 +176,6 @@ CSSParser::~CSSParser()
 
     fastFree(m_data);
 
-    if (m_floatingMediaQueryExpList)
-        deleteAllValues(*m_floatingMediaQueryExpList);
     fastDeleteAllValues(m_floatingSelectors);
     deleteAllValues(m_floatingValueLists);
     deleteAllValues(m_floatingFunctions);
@@ -2877,7 +2875,7 @@ void CSSParser::parseTransformOriginShorthand(RefPtr<CSSValue>& value1, RefPtr<C
         m_valueList->next();
 }
 
-bool CSSParser::parseTimingFunctionValue(CSSParserValueList*& args, double& result)
+bool CSSParser::parseCubicBezierTimingFunctionValue(CSSParserValueList*& args, double& result)
 {
     CSSParserValue* v = args->current();
     if (!validUnit(v, FNumber, m_strict))
@@ -2898,31 +2896,67 @@ bool CSSParser::parseTimingFunctionValue(CSSParserValueList*& args, double& resu
 PassRefPtr<CSSValue> CSSParser::parseAnimationTimingFunction()
 {
     CSSParserValue* value = m_valueList->current();
-    if (value->id == CSSValueEase || value->id == CSSValueLinear || value->id == CSSValueEaseIn || value->id == CSSValueEaseOut || value->id == CSSValueEaseInOut)
+    if (value->id == CSSValueEase || value->id == CSSValueLinear || value->id == CSSValueEaseIn || value->id == CSSValueEaseOut
+        || value->id == CSSValueEaseInOut || value->id == CSSValueStepStart || value->id == CSSValueStepEnd)
         return CSSPrimitiveValue::createIdentifier(value->id);
 
     // We must be a function.
     if (value->unit != CSSParserValue::Function)
         return 0;
 
-    // The only timing function we accept for now is a cubic bezier function.  4 points must be specified.
     CSSParserValueList* args = value->function->args.get();
-    if (!equalIgnoringCase(value->function->name, "cubic-bezier(") || !args || args->size() != 7)
-        return 0;
 
-    // There are two points specified.  The values must be between 0 and 1.
-    double x1, y1, x2, y2;
+    if (equalIgnoringCase(value->function->name, "steps(")) {
+        // For steps, 1 or 2 params must be specified (comma-separated)
+        if (!args || (args->size() != 1 && args->size() != 3))
+            return 0;
 
-    if (!parseTimingFunctionValue(args, x1))
-        return 0;
-    if (!parseTimingFunctionValue(args, y1))
-        return 0;
-    if (!parseTimingFunctionValue(args, x2))
-        return 0;
-    if (!parseTimingFunctionValue(args, y2))
-        return 0;
+        // There are two values.
+        int numSteps;
+        bool stepAtStart = false;
 
-    return CSSTimingFunctionValue::create(x1, y1, x2, y2);
+        CSSParserValue* v = args->current();
+        if (!validUnit(v, FInteger, m_strict))
+            return 0;
+        numSteps = (int) min(v->fValue, (double)INT_MAX);
+        if (numSteps < 1)
+            return 0;
+        v = args->next();
+
+        if (v) {
+            // There is a comma so we need to parse the second value
+            if (v->unit != CSSParserValue::Operator && v->iValue != ',')
+                return 0;
+            v = args->next();
+            if (v->id != CSSValueStart && v->id != CSSValueEnd)
+                return 0;
+            stepAtStart = v->id == CSSValueStart;
+        }
+
+        return CSSStepsTimingFunctionValue::create(numSteps, stepAtStart);
+    }
+    
+    if (equalIgnoringCase(value->function->name, "cubic-bezier(")) {
+        // For cubic bezier, 4 values must be specified.
+        if (!args || args->size() != 7)
+            return 0;
+
+        // There are two points specified.  The values must be between 0 and 1.
+        double x1, y1, x2, y2;
+
+        if (!parseCubicBezierTimingFunctionValue(args, x1))
+            return 0;
+        if (!parseCubicBezierTimingFunctionValue(args, y1))
+            return 0;
+        if (!parseCubicBezierTimingFunctionValue(args, x2))
+            return 0;
+        if (!parseCubicBezierTimingFunctionValue(args, y2))
+            return 0;
+
+        return CSSCubicBezierTimingFunctionValue::create(x1, y1, x2, y2);
+    }
+    
+    return 0;
 }
 
 bool CSSParser::parseAnimationProperty(int propId, RefPtr<CSSValue>& result)
@@ -5364,7 +5398,7 @@ CSSParserValue& CSSParser::sinkFloatingValue(CSSParserValue& value)
 
 MediaQueryExp* CSSParser::createFloatingMediaQueryExp(const AtomicString& mediaFeature, CSSParserValueList* values)
 {
-    m_floatingMediaQueryExp = adoptPtr(new MediaQueryExp(mediaFeature, values));
+    m_floatingMediaQueryExp = MediaQueryExp::create(mediaFeature, values);
     return m_floatingMediaQueryExp.get();
 }
 
@@ -5374,27 +5408,25 @@ PassOwnPtr<MediaQueryExp> CSSParser::sinkFloatingMediaQueryExp(MediaQueryExp* ex
     return m_floatingMediaQueryExp.release();
 }
 
-Vector<MediaQueryExp*>* CSSParser::createFloatingMediaQueryExpList()
+Vector<OwnPtr<MediaQueryExp> >* CSSParser::createFloatingMediaQueryExpList()
 {
-    if (m_floatingMediaQueryExpList)
-        deleteAllValues(*m_floatingMediaQueryExpList);
-    m_floatingMediaQueryExpList = adoptPtr(new Vector<MediaQueryExp*>);
+    m_floatingMediaQueryExpList = adoptPtr(new Vector<OwnPtr<MediaQueryExp> >);
     return m_floatingMediaQueryExpList.get();
 }
 
-PassOwnPtr<Vector<MediaQueryExp*> > CSSParser::sinkFloatingMediaQueryExpList(Vector<MediaQueryExp*>* list)
+PassOwnPtr<Vector<OwnPtr<MediaQueryExp> > > CSSParser::sinkFloatingMediaQueryExpList(Vector<OwnPtr<MediaQueryExp> >* list)
 {
     ASSERT_UNUSED(list, list == m_floatingMediaQueryExpList);
     return m_floatingMediaQueryExpList.release();
 }
 
-MediaQuery* CSSParser::createFloatingMediaQuery(MediaQuery::Restrictor restrictor, const String& mediaType, PassOwnPtr<Vector<MediaQueryExp*> > expressions)
+MediaQuery* CSSParser::createFloatingMediaQuery(MediaQuery::Restrictor restrictor, const String& mediaType, PassOwnPtr<Vector<OwnPtr<MediaQueryExp> > > expressions)
 {
     m_floatingMediaQuery = adoptPtr(new MediaQuery(restrictor, mediaType, expressions));
     return m_floatingMediaQuery.get();
 }
 
-MediaQuery* CSSParser::createFloatingMediaQuery(PassOwnPtr<Vector<MediaQueryExp*> > expressions)
+MediaQuery* CSSParser::createFloatingMediaQuery(PassOwnPtr<Vector<OwnPtr<MediaQueryExp> > > expressions)
 {
     return createFloatingMediaQuery(MediaQuery::None, "all", expressions);
 }
diff --git a/WebCore/css/CSSParser.h b/WebCore/css/CSSParser.h
index 6211e62..47f0bed 100644
--- a/WebCore/css/CSSParser.h
+++ b/WebCore/css/CSSParser.h
@@ -108,7 +108,7 @@ namespace WebCore {
         PassRefPtr<CSSValue> parseAnimationTimingFunction();
 
         void parseTransformOriginShorthand(RefPtr<CSSValue>&, RefPtr<CSSValue>&, RefPtr<CSSValue>&);
-        bool parseTimingFunctionValue(CSSParserValueList*& args, double& result);
+        bool parseCubicBezierTimingFunctionValue(CSSParserValueList*& args, double& result);
         bool parseAnimationProperty(int propId, RefPtr<CSSValue>&);
         bool parseTransitionShorthand(bool important);
         bool parseAnimationShorthand(bool important);
@@ -195,10 +195,10 @@ namespace WebCore {
 
         MediaQueryExp* createFloatingMediaQueryExp(const AtomicString&, CSSParserValueList*);
         PassOwnPtr<MediaQueryExp> sinkFloatingMediaQueryExp(MediaQueryExp*);
-        Vector<MediaQueryExp*>* createFloatingMediaQueryExpList();
-        PassOwnPtr<Vector<MediaQueryExp*> > sinkFloatingMediaQueryExpList(Vector<MediaQueryExp*>*);
-        MediaQuery* createFloatingMediaQuery(MediaQuery::Restrictor, const String&, PassOwnPtr<Vector<MediaQueryExp*> >);
-        MediaQuery* createFloatingMediaQuery(PassOwnPtr<Vector<MediaQueryExp*> >);
+        Vector<OwnPtr<MediaQueryExp> >* createFloatingMediaQueryExpList();
+        PassOwnPtr<Vector<OwnPtr<MediaQueryExp> > > sinkFloatingMediaQueryExpList(Vector<OwnPtr<MediaQueryExp> >*);
+        MediaQuery* createFloatingMediaQuery(MediaQuery::Restrictor, const String&, PassOwnPtr<Vector<OwnPtr<MediaQueryExp> > >);
+        MediaQuery* createFloatingMediaQuery(PassOwnPtr<Vector<OwnPtr<MediaQueryExp> > >);
         PassOwnPtr<MediaQuery> sinkFloatingMediaQuery(MediaQuery*);
 
         void addNamespace(const AtomicString& prefix, const AtomicString& uri);
@@ -303,7 +303,7 @@ namespace WebCore {
 
         OwnPtr<MediaQuery> m_floatingMediaQuery;
         OwnPtr<MediaQueryExp> m_floatingMediaQueryExp;
-        OwnPtr<Vector<MediaQueryExp*> > m_floatingMediaQueryExpList;
+        OwnPtr<Vector<OwnPtr<MediaQueryExp> > > m_floatingMediaQueryExpList;
 
         Vector<CSSSelector*> m_reusableSelectorVector;
 
diff --git a/WebCore/css/CSSPrimitiveValue.cpp b/WebCore/css/CSSPrimitiveValue.cpp
index b4478b4..5c83e7c 100644
--- a/WebCore/css/CSSPrimitiveValue.cpp
+++ b/WebCore/css/CSSPrimitiveValue.cpp
@@ -305,82 +305,34 @@ void CSSPrimitiveValue::cleanup()
 
 int CSSPrimitiveValue::computeLengthInt(RenderStyle* style, RenderStyle* rootStyle)
 {
-    double result = computeLengthDouble(style, rootStyle);
-
-    // This conversion is imprecise, often resulting in values of, e.g., 44.99998.  We
-    // need to go ahead and round if we're really close to the next integer value.
-    result += result < 0 ? -0.01 : +0.01;
-
-    if (result > INT_MAX || result < INT_MIN)
-        return 0;
-    return static_cast<int>(result);
+    return roundForImpreciseConversion<int, INT_MAX, INT_MIN>(computeLengthDouble(style, rootStyle));
 }
 
 int CSSPrimitiveValue::computeLengthInt(RenderStyle* style, RenderStyle* rootStyle, double multiplier)
 {
-    double result = computeLengthDouble(style, rootStyle, multiplier);
-
-    // This conversion is imprecise, often resulting in values of, e.g., 44.99998.  We
-    // need to go ahead and round if we're really close to the next integer value.
-    result += result < 0 ? -0.01 : +0.01;
-
-    if (result > INT_MAX || result < INT_MIN)
-        return 0;
-    return static_cast<int>(result);
+    return roundForImpreciseConversion<int, INT_MAX, INT_MIN>(computeLengthDouble(style, rootStyle, multiplier));
 }
 
-// Lengths expect an int that is only 28-bits, so we have to check for a different overflow.
+// Lengths expect an int that is only 28-bits, so we have to check for a
+// different overflow.
 int CSSPrimitiveValue::computeLengthIntForLength(RenderStyle* style, RenderStyle* rootStyle)
 {
-    double result = computeLengthDouble(style, rootStyle);
-
-    // This conversion is imprecise, often resulting in values of, e.g., 44.99998.  We
-    // need to go ahead and round if we're really close to the next integer value.
-    result += result < 0 ? -0.01 : +0.01;
-
-    if (result > intMaxForLength || result < intMinForLength)
-        return 0;
-    return static_cast<int>(result);
+    return roundForImpreciseConversion<int, intMaxForLength, intMinForLength>(computeLengthDouble(style, rootStyle));
 }
 
-// Lengths expect an int that is only 28-bits, so we have to check for a different overflow.
 int CSSPrimitiveValue::computeLengthIntForLength(RenderStyle* style, RenderStyle* rootStyle, double multiplier)
 {
-    double result = computeLengthDouble(style, rootStyle, multiplier);
-
-    // This conversion is imprecise, often resulting in values of, e.g., 44.99998.  We
-    // need to go ahead and round if we're really close to the next integer value.
-    result += result < 0 ? -0.01 : +0.01;
-
-    if (result > intMaxForLength || result < intMinForLength)
-        return 0;
-    return static_cast<int>(result);
+    return roundForImpreciseConversion<int, intMaxForLength, intMinForLength>(computeLengthDouble(style, rootStyle, multiplier));
 }
 
 short CSSPrimitiveValue::computeLengthShort(RenderStyle* style, RenderStyle* rootStyle)
 {
-    double result = computeLengthDouble(style, rootStyle);
-
-    // This conversion is imprecise, often resulting in values of, e.g., 44.99998.  We
-    // need to go ahead and round if we're really close to the next integer value.
-    result += result < 0 ? -0.01 : +0.01;
-
-    if (result > SHRT_MAX || result < SHRT_MIN)
-        return 0;
-    return static_cast<short>(result);
+    return roundForImpreciseConversion<short, SHRT_MAX, SHRT_MIN>(computeLengthDouble(style, rootStyle));
 }
 
 short CSSPrimitiveValue::computeLengthShort(RenderStyle* style, RenderStyle* rootStyle, double multiplier)
 {
-    double result = computeLengthDouble(style, rootStyle, multiplier);
-
-    // This conversion is imprecise, often resulting in values of, e.g., 44.99998.  We
-    // need to go ahead and round if we're really close to the next integer value.
-    result += result < 0 ? -0.01 : +0.01;
-
-    if (result > SHRT_MAX || result < SHRT_MIN)
-        return 0;
-    return static_cast<short>(result);
+    return roundForImpreciseConversion<short, SHRT_MAX, SHRT_MIN>(computeLengthDouble(style, rootStyle, multiplier));
 }
 
 float CSSPrimitiveValue::computeLengthFloat(RenderStyle* style, RenderStyle* rootStyle, bool computingFontSize)
diff --git a/WebCore/css/CSSPrimitiveValue.h b/WebCore/css/CSSPrimitiveValue.h
index b11c7f0..bb3ea70 100644
--- a/WebCore/css/CSSPrimitiveValue.h
+++ b/WebCore/css/CSSPrimitiveValue.h
@@ -38,6 +38,15 @@ class RenderStyle;
 
 struct Length;
 
+template<typename T, T max, T min> inline T roundForImpreciseConversion(double value)
+{
+    // Dimension calculations are imprecise, often resulting in values of e.g.
+    // 44.99998.  We need to go ahead and round if we're really close to the
+    // next integer value.
+    value += (value < 0) ? -0.01 : +0.01;
+    return ((value > max) || (value < min)) ? 0 : static_cast<T>(value);
+}
+
 class CSSPrimitiveValue : public CSSValue {
 public:
     enum UnitTypes {
diff --git a/WebCore/css/CSSStyleSelector.cpp b/WebCore/css/CSSStyleSelector.cpp
index a75dede..60dfb84 100644
--- a/WebCore/css/CSSStyleSelector.cpp
+++ b/WebCore/css/CSSStyleSelector.cpp
@@ -2576,7 +2576,7 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
                 if (!e)
                     return false;
                 e->document()->setContainsValidityStyleRules();
-                return e->willValidate() && !e->isValidFormControlElement();
+                return (e->willValidate() && !e->isValidFormControlElement()) || e->hasUnacceptableValue();
             } case CSSSelector::PseudoChecked: {
                 if (!e || !e->isFormControlElement())
                     break;
@@ -6203,19 +6203,25 @@ void CSSStyleSelector::mapAnimationTimingFunction(Animation* animation, CSSValue
         CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
         switch (primitiveValue->getIdent()) {
             case CSSValueLinear:
-                animation->setTimingFunction(TimingFunction(LinearTimingFunction, 0.0, 0.0, 1.0, 1.0));
+                animation->setTimingFunction(LinearTimingFunction::create());
                 break;
             case CSSValueEase:
-                animation->setTimingFunction(TimingFunction());
+                animation->setTimingFunction(CubicBezierTimingFunction::create());
                 break;
             case CSSValueEaseIn:
-                animation->setTimingFunction(TimingFunction(CubicBezierTimingFunction, 0.42, 0.0, 1.0, 1.0));
+                animation->setTimingFunction(CubicBezierTimingFunction::create(0.42, 0.0, 1.0, 1.0));
                 break;
             case CSSValueEaseOut:
-                animation->setTimingFunction(TimingFunction(CubicBezierTimingFunction, 0.0, 0.0, 0.58, 1.0));
+                animation->setTimingFunction(CubicBezierTimingFunction::create(0.0, 0.0, 0.58, 1.0));
                 break;
             case CSSValueEaseInOut:
-                animation->setTimingFunction(TimingFunction(CubicBezierTimingFunction, 0.42, 0.0, 0.58, 1.0));
+                animation->setTimingFunction(CubicBezierTimingFunction::create(0.42, 0.0, 0.58, 1.0));
+                break;
+            case CSSValueStepStart:
+                animation->setTimingFunction(StepsTimingFunction::create(1, true));
+                break;
+            case CSSValueStepEnd:
+                animation->setTimingFunction(StepsTimingFunction::create(1, false));
                 break;
         }
         return;
@@ -6223,7 +6229,14 @@ void CSSStyleSelector::mapAnimationTimingFunction(Animation* animation, CSSValue
     
     if (value->isTimingFunctionValue()) {
         CSSTimingFunctionValue* timingFunction = static_cast<CSSTimingFunctionValue*>(value);
-        animation->setTimingFunction(TimingFunction(CubicBezierTimingFunction, timingFunction->x1(), timingFunction->y1(), timingFunction->x2(), timingFunction->y2()));
+        if (timingFunction->isCubicBezierTimingFunctionValue()) {
+            CSSCubicBezierTimingFunctionValue* cubicTimingFunction = static_cast<CSSCubicBezierTimingFunctionValue*>(value);
+            animation->setTimingFunction(CubicBezierTimingFunction::create(cubicTimingFunction->x1(), cubicTimingFunction->y1(), cubicTimingFunction->x2(), cubicTimingFunction->y2()));
+        } else if (timingFunction->isStepsTimingFunctionValue()) {
+            CSSStepsTimingFunctionValue* stepsTimingFunction = static_cast<CSSStepsTimingFunctionValue*>(value);
+            animation->setTimingFunction(StepsTimingFunction::create(stepsTimingFunction->numberOfSteps(), stepsTimingFunction->stepAtStart()));
+        } else
+            animation->setTimingFunction(LinearTimingFunction::create());
     }
 }
 
@@ -6442,14 +6455,14 @@ static const int strictFontSizeTable[fontSizeTableMax - fontSizeTableMin + 1][to
 // factors for each keyword value.
 static const float fontSizeFactors[totalKeywords] = { 0.60f, 0.75f, 0.89f, 1.0f, 1.2f, 1.5f, 2.0f, 3.0f };
 
-float CSSStyleSelector::fontSizeForKeyword(Document* document, int keyword, bool fixed)
+float CSSStyleSelector::fontSizeForKeyword(Document* document, int keyword, bool shouldUseFixedDefaultSize)
 {
     Settings* settings = document->settings();
     if (!settings)
         return 1.0f;
 
     bool quirksMode = document->inQuirksMode();
-    int mediumSize = fixed ? settings->defaultFixedFontSize() : settings->defaultFontSize();
+    int mediumSize = shouldUseFixedDefaultSize ? settings->defaultFixedFontSize() : settings->defaultFontSize();
     if (mediumSize >= fontSizeTableMin && mediumSize <= fontSizeTableMax) {
         // Look up the entry in the table.
         int row = mediumSize - fontSizeTableMin;
@@ -6462,6 +6475,33 @@ float CSSStyleSelector::fontSizeForKeyword(Document* document, int keyword, bool
     return max(fontSizeFactors[keyword - CSSValueXxSmall]*mediumSize, minLogicalSize);
 }
 
+template<typename T>
+static int findNearestLegacyFontSize(int pixelFontSize, const T* table, int multiplier)
+{
+    // Ignore table[0] because xx-small does not correspond to any legacy font size.
+    for (int i = 1; i < totalKeywords - 1; i++) {
+        if (pixelFontSize * 2 < (table[i] + table[i + 1]) * multiplier)
+            return i;
+    }
+    return totalKeywords - 1;
+}
+
+int CSSStyleSelector::legacyFontSize(Document* document, int pixelFontSize, bool shouldUseFixedDefaultSize)
+{
+    Settings* settings = document->settings();
+    if (!settings)
+        return 1;
+
+    bool quirksMode = document->inQuirksMode();
+    int mediumSize = shouldUseFixedDefaultSize ? settings->defaultFixedFontSize() : settings->defaultFontSize();
+    if (mediumSize >= fontSizeTableMin && mediumSize <= fontSizeTableMax) {
+        int row = mediumSize - fontSizeTableMin;
+        return findNearestLegacyFontSize<int>(pixelFontSize, quirksMode ? quirksFontSizeTable[row] : strictFontSizeTable[row], 1);
+    }
+
+    return findNearestLegacyFontSize<float>(pixelFontSize, fontSizeFactors, mediumSize);
+}
+
 float CSSStyleSelector::largerFontSize(float size, bool) const
 {
     // FIXME: Figure out where we fall in the size ranges (xx-small to xxx-large) and scale up to
@@ -6855,14 +6895,14 @@ void CSSStyleSelector::loadPendingImages()
     for (HashSet<int>::const_iterator it = m_pendingImageProperties.begin(); it != end; ++it) {
         CSSPropertyID currentProperty = static_cast<CSSPropertyID>(*it);
 
-        DocLoader* docLoader = m_element->document()->docLoader();
+        CachedResourceLoader* cachedResourceLoader = m_element->document()->cachedResourceLoader();
         
         switch (currentProperty) {
             case CSSPropertyBackgroundImage: {
                 for (FillLayer* backgroundLayer = m_style->accessBackgroundLayers(); backgroundLayer; backgroundLayer = backgroundLayer->next()) {
                     if (backgroundLayer->image() && backgroundLayer->image()->isPendingImage()) {
                         CSSImageValue* imageValue = static_cast<StylePendingImage*>(backgroundLayer->image())->cssImageValue();
-                        backgroundLayer->setImage(imageValue->cachedImage(docLoader));
+                        backgroundLayer->setImage(imageValue->cachedImage(cachedResourceLoader));
                     }
                 }
                 break;
@@ -6872,7 +6912,7 @@ void CSSStyleSelector::loadPendingImages()
                 for (ContentData* contentData = const_cast<ContentData*>(m_style->contentData()); contentData; contentData = contentData->next()) {
                     if (contentData->isImage() && contentData->image()->isPendingImage()) {
                         CSSImageValue* imageValue = static_cast<StylePendingImage*>(contentData->image())->cssImageValue();
-                        contentData->setImage(imageValue->cachedImage(docLoader));
+                        contentData->setImage(imageValue->cachedImage(cachedResourceLoader));
                     }
                 }
                 break;
@@ -6884,7 +6924,7 @@ void CSSStyleSelector::loadPendingImages()
                         CursorData& currentCursor = (*cursorList)[i];
                         if (currentCursor.image()->isPendingImage()) {
                             CSSImageValue* imageValue = static_cast<StylePendingImage*>(currentCursor.image())->cssImageValue();
-                            currentCursor.setImage(imageValue->cachedImage(docLoader));
+                            currentCursor.setImage(imageValue->cachedImage(cachedResourceLoader));
                         }
                     }
                 }
@@ -6894,7 +6934,7 @@ void CSSStyleSelector::loadPendingImages()
             case CSSPropertyListStyleImage: {
                 if (m_style->listStyleImage() && m_style->listStyleImage()->isPendingImage()) {
                     CSSImageValue* imageValue = static_cast<StylePendingImage*>(m_style->listStyleImage())->cssImageValue();
-                    m_style->setListStyleImage(imageValue->cachedImage(docLoader));
+                    m_style->setListStyleImage(imageValue->cachedImage(cachedResourceLoader));
                 }
                 break;
             }
@@ -6903,7 +6943,7 @@ void CSSStyleSelector::loadPendingImages()
                 const NinePieceImage& borderImage = m_style->borderImage();
                 if (borderImage.image() && borderImage.image()->isPendingImage()) {
                     CSSImageValue* imageValue = static_cast<StylePendingImage*>(borderImage.image())->cssImageValue();
-                    m_style->setBorderImage(NinePieceImage(imageValue->cachedImage(docLoader), borderImage.slices(), borderImage.horizontalRule(), borderImage.verticalRule()));
+                    m_style->setBorderImage(NinePieceImage(imageValue->cachedImage(cachedResourceLoader), borderImage.slices(), borderImage.horizontalRule(), borderImage.verticalRule()));
                 }
                 break;
             }
@@ -6912,7 +6952,7 @@ void CSSStyleSelector::loadPendingImages()
                 const NinePieceImage& maskImage = m_style->boxReflect()->mask();
                 if (maskImage.image() && maskImage.image()->isPendingImage()) {
                     CSSImageValue* imageValue = static_cast<StylePendingImage*>(maskImage.image())->cssImageValue();
-                    m_style->boxReflect()->setMask(NinePieceImage(imageValue->cachedImage(docLoader), maskImage.slices(), maskImage.horizontalRule(), maskImage.verticalRule()));
+                    m_style->boxReflect()->setMask(NinePieceImage(imageValue->cachedImage(cachedResourceLoader), maskImage.slices(), maskImage.horizontalRule(), maskImage.verticalRule()));
                 }
                 break;
             }
@@ -6921,7 +6961,7 @@ void CSSStyleSelector::loadPendingImages()
                 const NinePieceImage& maskBoxImage = m_style->maskBoxImage();
                 if (maskBoxImage.image() && maskBoxImage.image()->isPendingImage()) {
                     CSSImageValue* imageValue = static_cast<StylePendingImage*>(maskBoxImage.image())->cssImageValue();
-                    m_style->setMaskBoxImage(NinePieceImage(imageValue->cachedImage(docLoader), maskBoxImage.slices(), maskBoxImage.horizontalRule(), maskBoxImage.verticalRule()));
+                    m_style->setMaskBoxImage(NinePieceImage(imageValue->cachedImage(cachedResourceLoader), maskBoxImage.slices(), maskBoxImage.horizontalRule(), maskBoxImage.verticalRule()));
                 }
                 break;
             }
@@ -6930,7 +6970,7 @@ void CSSStyleSelector::loadPendingImages()
                 for (FillLayer* maskLayer = m_style->accessMaskLayers(); maskLayer; maskLayer = maskLayer->next()) {
                     if (maskLayer->image() && maskLayer->image()->isPendingImage()) {
                         CSSImageValue* imageValue = static_cast<StylePendingImage*>(maskLayer->image())->cssImageValue();
-                        maskLayer->setImage(imageValue->cachedImage(docLoader));
+                        maskLayer->setImage(imageValue->cachedImage(cachedResourceLoader));
                     }
                 }
                 break;
diff --git a/WebCore/css/CSSStyleSelector.h b/WebCore/css/CSSStyleSelector.h
index 28d4488..4a4565d 100644
--- a/WebCore/css/CSSStyleSelector.h
+++ b/WebCore/css/CSSStyleSelector.h
@@ -122,10 +122,14 @@ public:
         PassRefPtr<CSSRuleList> styleRulesForElement(Element*, bool authorOnly);
         PassRefPtr<CSSRuleList> pseudoStyleRulesForElement(Element*, PseudoId, bool authorOnly);
 
-    private:
         // Given a CSS keyword in the range (xx-small to -webkit-xxx-large), this function will return
         // the correct font size scaled relative to the user's default (medium).
-        static float fontSizeForKeyword(Document*, int keyword, bool monospace);
+        static float fontSizeForKeyword(Document*, int keyword, bool shouldUseFixedDefaultSize);
+
+        // Given a font size in pixel, this function will return legacy font size between 1 and 7.
+        static int legacyFontSize(Document*, int pixelFontSize, bool shouldUseFixedDefaultSize);
+
+    private:
 
         // When the CSS keyword "larger" is used, this function will attempt to match within the keyword
         // table, and failing that, will simply multiply by 1.2.
diff --git a/WebCore/css/CSSStyleSheet.h b/WebCore/css/CSSStyleSheet.h
index 3b18522..725518f 100644
--- a/WebCore/css/CSSStyleSheet.h
+++ b/WebCore/css/CSSStyleSheet.h
@@ -29,7 +29,7 @@ namespace WebCore {
 struct CSSNamespace;
 class CSSParser;
 class CSSRule;
-class DocLoader;
+class CachedResourceLoader;
 class Document;
 
 typedef int ExceptionCode;
diff --git a/WebCore/css/CSSTimingFunctionValue.cpp b/WebCore/css/CSSTimingFunctionValue.cpp
index e576d36..9eecb2c 100644
--- a/WebCore/css/CSSTimingFunctionValue.cpp
+++ b/WebCore/css/CSSTimingFunctionValue.cpp
@@ -30,7 +30,12 @@
 
 namespace WebCore {
 
-String CSSTimingFunctionValue::cssText() const
+String CSSLinearTimingFunctionValue::cssText() const
+{
+    return "linear";
+}
+
+String CSSCubicBezierTimingFunctionValue::cssText() const
 {
     String text("cubic-bezier(");
     text += String::number(m_x1);
@@ -44,4 +49,14 @@ String CSSTimingFunctionValue::cssText() const
     return text;
 }
 
+String CSSStepsTimingFunctionValue::cssText() const
+{
+    String text("steps(");
+    text += String::number(m_steps);
+    text += ", ";
+    text += m_stepAtStart ? "start" : "end";
+    text += ")";
+    return text;
+}
+
 } // namespace WebCore
diff --git a/WebCore/css/CSSTimingFunctionValue.h b/WebCore/css/CSSTimingFunctionValue.h
index e465993..27e899b 100644
--- a/WebCore/css/CSSTimingFunctionValue.h
+++ b/WebCore/css/CSSTimingFunctionValue.h
@@ -33,20 +33,51 @@ namespace WebCore {
 
 class CSSTimingFunctionValue : public CSSValue {
 public:
-    static PassRefPtr<CSSTimingFunctionValue> create(double x1, double y1, double x2, double y2)
+    virtual String cssText() const = 0;
+
+    virtual bool isLinearTimingFunctionValue() const { return false; }
+    virtual bool isCubicBezierTimingFunctionValue() const { return false; }
+    virtual bool isStepsTimingFunctionValue() const { return false; }
+
+protected:
+    CSSTimingFunctionValue()
+    {
+    }
+
+    virtual bool isTimingFunctionValue() const { return true; }
+};
+
+class CSSLinearTimingFunctionValue : public CSSTimingFunctionValue {
+public:
+    static PassRefPtr<CSSLinearTimingFunctionValue> create()
+    {
+        return adoptRef(new CSSLinearTimingFunctionValue);
+    }
+    
+private:
+    CSSLinearTimingFunctionValue()
     {
-        return adoptRef(new CSSTimingFunctionValue(x1, y1, x2, y2));
     }
 
     virtual String cssText() const;
 
+    virtual bool isLinearTimingFunctionValue() const { return true; }
+};
+    
+class CSSCubicBezierTimingFunctionValue : public CSSTimingFunctionValue {
+public:
+    static PassRefPtr<CSSCubicBezierTimingFunctionValue> create(double x1, double y1, double x2, double y2)
+    {
+        return adoptRef(new CSSCubicBezierTimingFunctionValue(x1, y1, x2, y2));
+    }
+
     double x1() const { return m_x1; }
     double y1() const { return m_y1; }
     double x2() const { return m_x2; }
     double y2() const { return m_y2; }
 
 private:
-    CSSTimingFunctionValue(double x1, double y1, double x2, double y2)
+    CSSCubicBezierTimingFunctionValue(double x1, double y1, double x2, double y2)
         : m_x1(x1)
         , m_y1(y1)
         , m_x2(x2)
@@ -54,14 +85,41 @@ private:
     {
     }
 
-    virtual bool isTimingFunctionValue() const { return true; }
-    
+    virtual String cssText() const;
+
+    virtual bool isCubicBezierTimingFunctionValue() const { return true; }
+
     double m_x1;
     double m_y1;
     double m_x2;
     double m_y2;
 };
 
+class CSSStepsTimingFunctionValue : public CSSTimingFunctionValue {
+public:
+    static PassRefPtr<CSSStepsTimingFunctionValue> create(int steps, bool stepAtStart)
+    {
+        return adoptRef(new CSSStepsTimingFunctionValue(steps, stepAtStart));
+    }
+
+    int numberOfSteps() const { return m_steps; }
+    bool stepAtStart() const { return m_stepAtStart; }
+    
+private:
+    CSSStepsTimingFunctionValue(int steps, bool stepAtStart)
+        : m_steps(steps)
+        , m_stepAtStart(stepAtStart)
+    {
+    }
+
+    virtual String cssText() const;
+
+    virtual bool isStepsTimingFunctionValue() const { return true; }
+
+    int m_steps;
+    bool m_stepAtStart;
+};
+    
 } // namespace
 
 #endif
diff --git a/WebCore/css/CSSValueKeywords.in b/WebCore/css/CSSValueKeywords.in
index 7a9b9c7..1e7c2b5 100644
--- a/WebCore/css/CSSValueKeywords.in
+++ b/WebCore/css/CSSValueKeywords.in
@@ -691,6 +691,8 @@ linear
 ease-in
 ease-out
 ease-in-out
+step-start
+step-end
 
 #
 # CSS_PROP_ZOOM
diff --git a/WebCore/css/MediaList.cpp b/WebCore/css/MediaList.cpp
index e67c9c7..81f8712 100644
--- a/WebCore/css/MediaList.cpp
+++ b/WebCore/css/MediaList.cpp
@@ -25,6 +25,7 @@
 #include "CSSStyleSheet.h"
 #include "ExceptionCode.h"
 #include "MediaQuery.h"
+#include "MediaQueryExp.h"
 
 namespace WebCore {
 
diff --git a/WebCore/css/MediaQuery.cpp b/WebCore/css/MediaQuery.cpp
index b71706c..77a79ad 100644
--- a/WebCore/css/MediaQuery.cpp
+++ b/WebCore/css/MediaQuery.cpp
@@ -31,8 +31,7 @@
 
 #include "MediaQueryExp.h"
 #include "StringBuilder.h"
-
-#include <algorithm>
+#include <wtf/NonCopyingSort.h>
 
 namespace WebCore {
 
@@ -70,23 +69,24 @@ String MediaQuery::serialize() const
     return result.toString();
 }
 
-static bool expressionCompare(const MediaQueryExp* a, const MediaQueryExp* b)
+static bool expressionCompare(const OwnPtr<MediaQueryExp>& a, const OwnPtr<MediaQueryExp>& b) 
 {
     return codePointCompare(a->serialize(), b->serialize()) < 0;
 }
 
-MediaQuery::MediaQuery(Restrictor r, const String& mediaType, PassOwnPtr<Vector<MediaQueryExp*> > exprs)
+
+MediaQuery::MediaQuery(Restrictor r, const String& mediaType, PassOwnPtr<Vector<OwnPtr<MediaQueryExp> > > exprs)
     : m_restrictor(r)
     , m_mediaType(mediaType.lower())
     , m_expressions(exprs)
     , m_ignored(false)
 {
     if (!m_expressions) {
-        m_expressions = new Vector<MediaQueryExp*>;
+        m_expressions = adoptPtr(new Vector<OwnPtr<MediaQueryExp> >);
         return;
     }
 
-    std::sort(m_expressions->begin(), m_expressions->end(), expressionCompare);
+    nonCopyingSort(m_expressions->begin(), m_expressions->end(), expressionCompare);
 
     // remove all duplicated expressions
     String key;
@@ -95,19 +95,16 @@ MediaQuery::MediaQuery(Restrictor r, const String& mediaType, PassOwnPtr<Vector<
         // if not all of the expressions is valid the media query must be ignored.
         if (!m_ignored)
             m_ignored = !m_expressions->at(i)->isValid();
-
-        if (m_expressions->at(i)->serialize() == key) {
-            MediaQueryExp* item = m_expressions->at(i);
+ 
+        if (m_expressions->at(i)->serialize() == key)
             m_expressions->remove(i);
-            delete item;
-        } else
+        else
             key = m_expressions->at(i)->serialize();
     }
 }
 
 MediaQuery::~MediaQuery()
 {
-    deleteAllValues(*m_expressions);
 }
 
 // http://dev.w3.org/csswg/cssom/#compare-media-queries
diff --git a/WebCore/css/MediaQuery.h b/WebCore/css/MediaQuery.h
index 3eea3b2..281009b 100644
--- a/WebCore/css/MediaQuery.h
+++ b/WebCore/css/MediaQuery.h
@@ -43,11 +43,11 @@ public:
         Only, Not, None
     };
 
-    MediaQuery(Restrictor, const String& mediaType, PassOwnPtr<Vector<MediaQueryExp*> > exprs);
+    MediaQuery(Restrictor, const String& mediaType, PassOwnPtr<Vector<OwnPtr<MediaQueryExp> > > exprs);
     ~MediaQuery();
 
     Restrictor restrictor() const { return m_restrictor; }
-    const Vector<MediaQueryExp*>* expressions() const { return m_expressions.get(); }
+    const Vector<OwnPtr<MediaQueryExp> >* expressions() const { return m_expressions.get(); }
     String mediaType() const { return m_mediaType; }
     bool operator==(const MediaQuery& other) const;
     String cssText() const;
@@ -56,7 +56,7 @@ public:
  private:
     Restrictor m_restrictor;
     String m_mediaType;
-    OwnPtr<Vector<MediaQueryExp*> > m_expressions;
+    OwnPtr<Vector<OwnPtr<MediaQueryExp> > > m_expressions;
     bool m_ignored;
     String m_serializationCache;
 
diff --git a/WebCore/css/MediaQueryEvaluator.cpp b/WebCore/css/MediaQueryEvaluator.cpp
index 0b5507e..c757d51 100644
--- a/WebCore/css/MediaQueryEvaluator.cpp
+++ b/WebCore/css/MediaQueryEvaluator.cpp
@@ -148,14 +148,14 @@ bool MediaQueryEvaluator::eval(const MediaList* mediaList, CSSStyleSelector* sty
             continue;
 
         if (mediaTypeMatch(query->mediaType())) {
-            const Vector<MediaQueryExp*>* exps = query->expressions();
+            const Vector<OwnPtr<MediaQueryExp> >* exps = query->expressions();
             // iterate through expressions, stop if any of them eval to false
             // (AND semantics)
             size_t j = 0;
             for (; j < exps->size(); ++j) {
-                bool exprResult = eval(exps->at(j));
+                bool exprResult = eval(exps->at(j).get());
                 if (styleSelector && exps->at(j)->isViewportDependent())
-                    styleSelector->addViewportDependentMediaQueryResult(exps->at(j), exprResult);
+                    styleSelector->addViewportDependentMediaQueryResult(exps->at(j).get(), exprResult);
                 if (!exprResult)
                     break;
             }
diff --git a/WebCore/css/MediaQueryExp.cpp b/WebCore/css/MediaQueryExp.cpp
index a93ddcc..36a155e 100644
--- a/WebCore/css/MediaQueryExp.cpp
+++ b/WebCore/css/MediaQueryExp.cpp
@@ -36,7 +36,7 @@
 
 namespace WebCore {
 
-MediaQueryExp::MediaQueryExp(const AtomicString& mediaFeature, CSSParserValueList* valueList)
+inline MediaQueryExp::MediaQueryExp(const AtomicString& mediaFeature, CSSParserValueList* valueList)
     : m_mediaFeature(mediaFeature)
     , m_value(0)
     , m_isValid(true)
@@ -80,6 +80,12 @@ MediaQueryExp::MediaQueryExp(const AtomicString& mediaFeature, CSSParserValueLis
     }
 }
 
+
+PassOwnPtr<MediaQueryExp> MediaQueryExp::create(const AtomicString& mediaFeature, CSSParserValueList* values)
+{
+    return adoptPtr(new MediaQueryExp(mediaFeature, values));
+}
+
 MediaQueryExp::~MediaQueryExp()
 {
 }
diff --git a/WebCore/css/MediaQueryExp.h b/WebCore/css/MediaQueryExp.h
index 4b42611..72d3fff 100644
--- a/WebCore/css/MediaQueryExp.h
+++ b/WebCore/css/MediaQueryExp.h
@@ -31,6 +31,7 @@
 
 #include "CSSValue.h"
 #include "MediaFeatureNames.h"
+#include <wtf/PassOwnPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/text/AtomicString.h>
 
@@ -39,7 +40,7 @@ class CSSParserValueList;
 
 class MediaQueryExp : public FastAllocBase {
 public:
-    MediaQueryExp(const AtomicString& mediaFeature, CSSParserValueList* values);
+    static PassOwnPtr<MediaQueryExp> create(const AtomicString& mediaFeature, CSSParserValueList* values);
     ~MediaQueryExp();
 
     AtomicString mediaFeature() const { return m_mediaFeature; }
@@ -69,6 +70,8 @@ public:
     String serialize() const;
 
 private:
+    MediaQueryExp(const AtomicString& mediaFeature, CSSParserValueList* values);
+
     AtomicString m_mediaFeature;
     RefPtr<CSSValue> m_value;
     bool m_isValid;
diff --git a/WebCore/css/mathml.css b/WebCore/css/mathml.css
index a5df17c..7cf9866 100644
--- a/WebCore/css/mathml.css
+++ b/WebCore/css/mathml.css
@@ -16,6 +16,9 @@ math[display="block"] {
     display: block;
     page-break-inside: avoid;
     margin-bottom: 1em;
+    text-align: center;
+    margin-left: auto;
+    margin-right: auto;
 }
 
 math > * {
diff --git a/WebCore/css/tokenizer.flex b/WebCore/css/tokenizer.flex
index 290c590..4d226d9 100644
--- a/WebCore/css/tokenizer.flex
+++ b/WebCore/css/tokenizer.flex
@@ -13,7 +13,6 @@ nmstart         [_a-zA-Z]|{nonascii}|{escape}
 nmchar          [_a-zA-Z0-9-]|{nonascii}|{escape}
 string1         \"([\t !#$%&(-~]|\\{nl}|\'|{nonascii}|{escape})*\"
 string2         \'([\t !#$%&(-~]|\\{nl}|\"|{nonascii}|{escape})*\'
-hexcolor        {h}{3}|{h}{6}
 
 ident           -?{nmstart}{nmchar}*
 name            {nmchar}+
@@ -48,8 +47,8 @@ nth             [\+-]?{intnum}*n([\+-]{intnum})?
 {ident}                 {yyTok = IDENT; return yyTok;}
 {nth}                   {yyTok = NTH; return yyTok;}
 
-"#"{hexcolor}           {yyTok = HEX; return yyTok;}
 "#"{ident}              {yyTok = IDSEL; return yyTok;}
+"#"{name}               {yyTok = HEX; return yyTok;}
 
 "@import"               {BEGIN(mediaquery); yyTok = IMPORT_SYM; return yyTok;}
 "@page"                 {yyTok = PAGE_SYM; return yyTok;}