Merge WebKit at r70209: Initial merge by Git

Change-Id: Id23a68efa36e9d1126bcce0b137872db00892c8e

27 files changed, 420 insertions, 400 deletions

diff --git a/WebCore/css/CSSBorderImageValue.cpp b/WebCore/css/CSSBorderImageValue.cpp
index 3260af4..8d4721a 100644
--- a/WebCore/css/CSSBorderImageValue.cpp
+++ b/WebCore/css/CSSBorderImageValue.cpp
@@ -34,6 +34,10 @@ CSSBorderImageValue::CSSBorderImageValue(PassRefPtr<CSSValue> image, PassRefPtr<
 {
 }
 
+CSSBorderImageValue::~CSSBorderImageValue()
+{
+}
+
 String CSSBorderImageValue::cssText() const
 {
     // Image first.
diff --git a/WebCore/css/CSSBorderImageValue.h b/WebCore/css/CSSBorderImageValue.h
index 23832b8..a17df7d 100644
--- a/WebCore/css/CSSBorderImageValue.h
+++ b/WebCore/css/CSSBorderImageValue.h
@@ -35,6 +35,7 @@ public:
     {
         return adoptRef(new CSSBorderImageValue(image, sliceRect, horizontalRule, verticalRule));
     }
+    virtual ~CSSBorderImageValue();
 
     virtual String cssText() const;
 
diff --git a/WebCore/css/CSSComputedStyleDeclaration.cpp b/WebCore/css/CSSComputedStyleDeclaration.cpp
index 1d574ab..44cfd74 100644
--- a/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -127,6 +127,7 @@ static const int computedProperties[] = {
     CSSPropertyPosition,
     CSSPropertyResize,
     CSSPropertyRight,
+    CSSPropertySpeak,
     CSSPropertyTableLayout,
     CSSPropertyTextAlign,
     CSSPropertyTextDecoration,
@@ -162,7 +163,6 @@ static const int computedProperties[] = {
     CSSPropertyWebkitBackgroundComposite,
     CSSPropertyWebkitBackgroundOrigin,
     CSSPropertyWebkitBackgroundSize,
-    CSSPropertyWebkitBlockFlow,
     CSSPropertyWebkitBorderFit,
     CSSPropertyWebkitBorderHorizontalSpacing,
     CSSPropertyWebkitBorderImage,
@@ -229,7 +229,8 @@ static const int computedProperties[] = {
     CSSPropertyWebkitTransitionTimingFunction,
     CSSPropertyWebkitUserDrag,
     CSSPropertyWebkitUserModify,
-    CSSPropertyWebkitUserSelect
+    CSSPropertyWebkitUserSelect,
+    CSSPropertyWebkitWritingMode
 
 #if ENABLE(SVG)
     ,
@@ -753,10 +754,14 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
     if (!style)
         return 0;
 
+<<<<<<< HEAD
     propertyID = CSSProperty::resolveDirectionAwareProperty(propertyID, style->direction(), style->blockFlow());
 #ifdef ANDROID_LAYOUT
     const Settings * settings = node->document()->frame() ? node->document()->frame()->settings() : 0; 
 #endif
+=======
+    propertyID = CSSProperty::resolveDirectionAwareProperty(propertyID, style->direction(), style->writingMode());
+>>>>>>> webkit.org at r70209
 
     switch (static_cast<CSSPropertyID>(propertyID)) {
         case CSSPropertyInvalid:
@@ -1407,8 +1412,6 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return CSSPrimitiveValue::create(style->appearance());
         case CSSPropertyWebkitBackfaceVisibility:
             return CSSPrimitiveValue::createIdentifier((style->backfaceVisibility() == BackfaceVisibilityHidden) ? CSSValueHidden : CSSValueVisible);
-        case CSSPropertyWebkitBlockFlow:
-            return CSSPrimitiveValue::create(style->blockFlow());
         case CSSPropertyWebkitBorderImage:
             return valueForNinePieceImage(style->borderImage());
         case CSSPropertyWebkitMaskBoxImage:
@@ -1416,8 +1419,10 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyWebkitFontSizeDelta:
             // Not a real style property -- used by the editing engine -- so has no computed value.
             break;
+        case CSSPropertyWebkitMarginBottomCollapse:
         case CSSPropertyWebkitMarginAfterCollapse:
             return CSSPrimitiveValue::create(style->marginAfterCollapse());
+        case CSSPropertyWebkitMarginTopCollapse:
         case CSSPropertyWebkitMarginBeforeCollapse:
             return CSSPrimitiveValue::create(style->marginBeforeCollapse());
         case CSSPropertyWebkitPerspective:
@@ -1463,6 +1468,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             rect->setLeft(zoomAdjustedPixelValue(style->clip().left().value(), style.get()));
             return CSSPrimitiveValue::create(rect.release());
         }
+        case CSSPropertySpeak:
+            return CSSPrimitiveValue::create(style->speak());
         case CSSPropertyWebkitTransform:
             return computedTransform(renderer, style.get());
         case CSSPropertyWebkitTransformOrigin: {
@@ -1512,7 +1519,9 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return CSSPrimitiveValue::create(style->pointerEvents());
         case CSSPropertyWebkitColorCorrection:
             return CSSPrimitiveValue::create(style->colorSpace());
-
+        case CSSPropertyWebkitWritingMode:
+            return CSSPrimitiveValue::create(style->writingMode());
+        
         /* Shorthand properties, currently not supported see bug 13658*/
         case CSSPropertyBackground:
         case CSSPropertyBorder:
@@ -1528,7 +1537,6 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyListStyle:
         case CSSPropertyMargin:
         case CSSPropertyPadding:
-        case CSSPropertyWebkitWritingMode:
             break;
 
         /* Unimplemented CSS 3 properties (including CSS3 shorthand properties) */
@@ -1650,10 +1658,47 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return CSSPrimitiveValue::createColor(style->tapHighlightColor().rgb());
 #endif
 #if ENABLE(SVG)
-        // FIXME: This default case ruins the point of using an enum for
-        // properties -- it prevents us from getting a warning when we
-        // forget to list a property above.
-        default:
+        case CSSPropertyClipPath:
+        case CSSPropertyClipRule:
+        case CSSPropertyMask:
+        case CSSPropertyEnableBackground:
+        case CSSPropertyFilter:
+        case CSSPropertyFloodColor:
+        case CSSPropertyFloodOpacity:
+        case CSSPropertyLightingColor:
+        case CSSPropertyStopColor:
+        case CSSPropertyStopOpacity:
+        case CSSPropertyColorInterpolation:
+        case CSSPropertyColorInterpolationFilters:
+        case CSSPropertyColorProfile:
+        case CSSPropertyColorRendering:
+        case CSSPropertyFill:
+        case CSSPropertyFillOpacity:
+        case CSSPropertyFillRule:
+        case CSSPropertyImageRendering:
+        case CSSPropertyMarker:
+        case CSSPropertyMarkerEnd:
+        case CSSPropertyMarkerMid:
+        case CSSPropertyMarkerStart:
+        case CSSPropertyShapeRendering:
+        case CSSPropertyStroke:
+        case CSSPropertyStrokeDasharray:
+        case CSSPropertyStrokeDashoffset:
+        case CSSPropertyStrokeLinecap:
+        case CSSPropertyStrokeLinejoin:
+        case CSSPropertyStrokeMiterlimit:
+        case CSSPropertyStrokeOpacity:
+        case CSSPropertyStrokeWidth:
+        case CSSPropertyAlignmentBaseline:
+        case CSSPropertyBaselineShift:
+        case CSSPropertyDominantBaseline:
+        case CSSPropertyGlyphOrientationHorizontal:
+        case CSSPropertyGlyphOrientationVertical:
+        case CSSPropertyKerning:
+        case CSSPropertyTextAnchor:
+        case CSSPropertyVectorEffect:
+        case CSSPropertyWritingMode:
+        case CSSPropertyWebkitSvgShadow:
             return getSVGPropertyCSSValue(propertyID, DoNotUpdateLayout);
 #endif
     }
diff --git a/WebCore/css/CSSFontFaceSrcValue.cpp b/WebCore/css/CSSFontFaceSrcValue.cpp
index 5b204d7..d951e5d 100644
--- a/WebCore/css/CSSFontFaceSrcValue.cpp
+++ b/WebCore/css/CSSFontFaceSrcValue.cpp
@@ -31,6 +31,10 @@
 
 namespace WebCore {
 
+CSSFontFaceSrcValue::~CSSFontFaceSrcValue()
+{
+}
+
 #if ENABLE(SVG_FONTS)
 bool CSSFontFaceSrcValue::isSVGFontFaceSrc() const
 {
diff --git a/WebCore/css/CSSFontFaceSrcValue.h b/WebCore/css/CSSFontFaceSrcValue.h
index 22f1be7..570652d 100644
--- a/WebCore/css/CSSFontFaceSrcValue.h
+++ b/WebCore/css/CSSFontFaceSrcValue.h
@@ -47,7 +47,7 @@ public:
         return adoptRef(new CSSFontFaceSrcValue(resource, true));
     }
 
-    virtual ~CSSFontFaceSrcValue() { }
+    virtual ~CSSFontFaceSrcValue();
 
     const String& resource() const { return m_resource; }
     const String& format() const { return m_format; }
diff --git a/WebCore/css/CSSFunctionValue.h b/WebCore/css/CSSFunctionValue.h
index e9545a1..1d73f33 100644
--- a/WebCore/css/CSSFunctionValue.h
+++ b/WebCore/css/CSSFunctionValue.h
@@ -40,14 +40,14 @@ public:
         return adoptRef(new CSSFunctionValue(function));
     }
 
-    ~CSSFunctionValue();
+    virtual ~CSSFunctionValue();
     
     virtual String cssText() const;
 
     virtual CSSParserValue parserValue() const;
 
 private:
-    CSSFunctionValue(CSSParserFunction*);
+    explicit CSSFunctionValue(CSSParserFunction*);
     
     String m_name;
     RefPtr<CSSValueList> m_args;
diff --git a/WebCore/css/CSSGrammar.y b/WebCore/css/CSSGrammar.y
index c55f998..c0139a2 100644
--- a/WebCore/css/CSSGrammar.y
+++ b/WebCore/css/CSSGrammar.y
@@ -408,7 +408,9 @@ rule_list:
  ;
 
 valid_rule:
-    ruleset
+    before_ruleset ruleset {
+        $$ = $2;
+    }
   | media
   | page
   | font_face
@@ -910,8 +912,22 @@ maybe_space_before_declaration:
     }
   ;
 
+before_ruleset:
+    /* empty */ {
+        CSSParser* p = static_cast<CSSParser*>(parser);
+        p->markSelectorListStart();
+    }
+  ;
+
+before_rule_opening_brace:
+    /* empty */ {
+        CSSParser* p = static_cast<CSSParser*>(parser);
+        p->markSelectorListEnd();
+    }
+  ;
+
 ruleset:
-    selector_list '{' maybe_space_before_declaration declaration_list closing_brace {
+    selector_list before_rule_opening_brace '{' maybe_space_before_declaration declaration_list closing_brace {
         CSSParser* p = static_cast<CSSParser*>(parser);
         $$ = p->createStyleRule($1);
     }
diff --git a/WebCore/css/CSSHelper.cpp b/WebCore/css/CSSHelper.cpp
deleted file mode 100644
index e0ce7c3..0000000
--- a/WebCore/css/CSSHelper.cpp
+++ /dev/null
@@ -1,104 +0,0 @@
-/*
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "CSSHelper.h"
-
-#include "PlatformString.h"
-#include <wtf/Vector.h>
-
-namespace WebCore {
-
-String deprecatedParseURL(const String& url)
-{
-    StringImpl* i = url.impl();
-    if (!i)
-        return url;
-
-    int length = i->length();
-
-    int o = 0;
-    int l = length;
-
-    while (0 < l && (*i)[o] <= ' ') {
-        ++o;
-        --l;
-    }
-    while (l > 0 && (*i)[o + l - 1] <= ' ')
-        --l;
-
-    if (l >= 5
-            && ((*i)[o] == 'u' || (*i)[o] == 'U')
-            && ((*i)[o + 1] == 'r' || (*i)[o + 1] == 'R')
-            && ((*i)[o + 2] == 'l' || (*i)[o + 2] == 'L')
-            && (*i)[o + 3] == '('
-            && (*i)[o + l - 1] == ')') {
-        o += 4;
-        l -= 5;
-    }
-
-    while (0 < l && (*i)[o] <= ' ') {
-        ++o;
-        --l;
-    }
-    while (l > 0 && (*i)[o + l - 1] <= ' ')
-        --l;
-
-    if (l >= 2 && (*i)[o] == (*i)[o + l - 1] && ((*i)[o] == '\'' || (*i)[o] == '\"')) {
-        o++;
-        l -= 2;
-    }
-
-    while (0 < l && (*i)[o] <= ' ') {
-        ++o;
-        --l;
-    }
-    while (l > 0 && (*i)[o + l - 1] <= ' ')
-        --l;
-
-    const UChar* characters = i->characters();
-
-    // Optimize for the likely case there there is nothing to strip.
-    if (l == length) {
-        int k;
-        // If the URL has any control characters in it, we have to strip them.
-        // '\r' (ascii value 13) is the largest control character.
-        for (k = 0; k < length; k++) {
-            if (characters[k] <= '\r')
-                break;
-        }
-        if (k == length)
-            return url;
-    }
-
-    Vector<UChar, 2048> buffer(l);
-
-    int nl = 0;
-    for (int k = o; k < o + l; k++) {
-        UChar c = characters[k];
-        if (c > '\r')
-            buffer[nl++] = c;
-    }
-
-    return String(buffer.data(), nl);
-}
-
-} // namespace WebCore
diff --git a/WebCore/css/CSSHelper.h b/WebCore/css/CSSHelper.h
index ffd9166..6f2ffca 100644
--- a/WebCore/css/CSSHelper.h
+++ b/WebCore/css/CSSHelper.h
@@ -26,10 +26,6 @@
 
 namespace WebCore {
 
-// Used in many inappropriate contexts throughout WebCore. Most callers should be using
-// stripLeadingAndTrailingHTMLSpaces instead.
-String deprecatedParseURL(const String&);
-
 // We always assume 96 CSS pixels in a CSS inch. This is the cold hard truth of the Web.
 // At high DPI, we may scale a CSS pixel, but the ratio of the CSS pixel to the so-called
 // "absolute" CSS length units like inch and pt is always fixed and never changes.
diff --git a/WebCore/css/CSSMutableStyleDeclaration.cpp b/WebCore/css/CSSMutableStyleDeclaration.cpp
index f620be1..708e2eb 100644
--- a/WebCore/css/CSSMutableStyleDeclaration.cpp
+++ b/WebCore/css/CSSMutableStyleDeclaration.cpp
@@ -424,18 +424,16 @@ String CSSMutableStyleDeclaration::getCommonValue(const int* properties, int num
 {
     String res;
     for (int i = 0; i < number; ++i) {
-        if (!isPropertyImplicit(properties[i])) {
-            RefPtr<CSSValue> value = getPropertyCSSValue(properties[i]);
-            if (!value)
-                return String();
-            String text = value->cssText();
-            if (text.isNull())
-                return String();
-            if (res.isNull())
-                res = text;
-            else if (res != text)
-                return String();
-        }
+        RefPtr<CSSValue> value = getPropertyCSSValue(properties[i]);
+        if (!value)
+            return String();
+        String text = value->cssText();
+        if (text.isNull())
+            return String();
+        if (res.isNull())
+            res = text;
+        else if (res != text)
+            return String();
     }
     return res;
 }
diff --git a/WebCore/css/CSSParser.cpp b/WebCore/css/CSSParser.cpp
index 0347d69..f098a9f 100644
--- a/WebCore/css/CSSParser.cpp
+++ b/WebCore/css/CSSParser.cpp
@@ -25,16 +25,14 @@
 #include "config.h"
 #include "CSSParser.h"
 
-#include "CSSTimingFunctionValue.h"
 #include "CSSBorderImageValue.h"
 #include "CSSCanvasValue.h"
 #include "CSSCharsetRule.h"
 #include "CSSCursorImageValue.h"
-#include "CSSHelper.h"
-#include "CSSImageValue.h"
 #include "CSSFontFaceRule.h"
 #include "CSSFontFaceSrcValue.h"
 #include "CSSGradientValue.h"
+#include "CSSImageValue.h"
 #include "CSSImportRule.h"
 #include "CSSInheritedValue.h"
 #include "CSSInitialValue.h"
@@ -51,6 +49,7 @@
 #include "CSSSelector.h"
 #include "CSSStyleRule.h"
 #include "CSSStyleSheet.h"
+#include "CSSTimingFunctionValue.h"
 #include "CSSUnicodeRangeValue.h"
 #include "CSSValueKeywords.h"
 #include "CSSValueList.h"
@@ -62,6 +61,7 @@
 #include "FloatConversion.h"
 #include "FontFamilyValue.h"
 #include "FontValue.h"
+#include "HTMLParserIdioms.h"
 #include "HashTools.h"
 #include "MediaList.h"
 #include "MediaQueryExp.h"
@@ -148,12 +148,11 @@ CSSParser::CSSParser(bool strictParsing)
     , m_hasFontFaceOnlyValues(false)
     , m_hadSyntacticallyValidCSSRule(false)
     , m_defaultNamespace(starAtom)
-    , m_ruleBodyStartOffset(0)
-    , m_ruleBodyEndOffset(0)
-    , m_propertyStartOffset(UINT_MAX)
-    , m_propertyEndOffset(UINT_MAX)
+    , m_selectorListRange(0, 0)
+    , m_ruleBodyRange(0, 0)
+    , m_propertyRange(UINT_MAX, UINT_MAX)
     , m_ruleRangeMap(0)
-    , m_currentStyleData(0)
+    , m_currentRuleData(0)
     , m_data(0)
     , yy_start(1)
     , m_lineNumber(0)
@@ -236,14 +235,16 @@ void CSSParser::parseSheet(CSSStyleSheet* sheet, const String& string, int start
     m_styleSheet = sheet;
     m_defaultNamespace = starAtom; // Reset the default namespace.
     m_ruleRangeMap = ruleRangeMap;
-    if (ruleRangeMap)
-        m_currentStyleData = CSSStyleSourceData::create();
+    if (ruleRangeMap) {
+        m_currentRuleData = CSSRuleSourceData::create();
+        m_currentRuleData->styleSourceData = CSSStyleSourceData::create();
+    }
 
     m_lineNumber = startLineNumber;
     setupParser("", string, "");
     cssyyparse(this);
     m_ruleRangeMap = 0;
-    m_currentStyleData = 0;
+    m_currentRuleData = 0;
     m_rule = 0;
 #ifdef ANDROID_INSTRUMENT
     android::TimeCounter::record(android::TimeCounter::CSSParseTimeCounter, __FUNCTION__);
@@ -373,7 +374,7 @@ void CSSParser::parseSelector(const String& string, Document* doc, CSSSelectorLi
 #endif
 }
 
-bool CSSParser::parseDeclaration(CSSMutableStyleDeclaration* declaration, const String& string, CSSStyleSourceData* styleSourceData)
+bool CSSParser::parseDeclaration(CSSMutableStyleDeclaration* declaration, const String& string, RefPtr<CSSStyleSourceData>* styleSourceData)
 {
 #ifdef ANDROID_INSTRUMENT
     android::TimeCounter::start(android::TimeCounter::CSSParseTimeCounter);
@@ -384,7 +385,10 @@ bool CSSParser::parseDeclaration(CSSMutableStyleDeclaration* declaration, const
 
     ASSERT(!declaration->stylesheet() || declaration->stylesheet()->isCSSStyleSheet());
     m_styleSheet = static_cast<CSSStyleSheet*>(declaration->stylesheet());
-    m_currentStyleData = styleSourceData;
+    if (styleSourceData) {
+        m_currentRuleData = CSSRuleSourceData::create();
+        m_currentRuleData->styleSourceData = CSSStyleSourceData::create();
+    }
 
     setupParser("@-webkit-decls{", string, "} ");
     cssyyparse(this);
@@ -399,15 +403,16 @@ bool CSSParser::parseDeclaration(CSSMutableStyleDeclaration* declaration, const
         clearProperties();
     }
 
-    if (m_currentStyleData) {
-        m_currentStyleData->styleBodyRange.start = 0;
-        m_currentStyleData->styleBodyRange.end = string.length();
-        for (Vector<CSSPropertySourceData>::iterator it = m_currentStyleData->propertyData.begin(); it != m_currentStyleData->propertyData.end(); ++it) {
+    if (m_currentRuleData) {
+        m_currentRuleData->styleSourceData->styleBodyRange.start = 0;
+        m_currentRuleData->styleSourceData->styleBodyRange.end = string.length();
+        for (Vector<CSSPropertySourceData>::iterator it = m_currentRuleData->styleSourceData->propertyData.begin(), endIt = m_currentRuleData->styleSourceData->propertyData.end(); it != endIt; ++it) {
             (*it).range.start -= prefixLength;
             (*it).range.end -= prefixLength;
         }
     }
 
+<<<<<<< HEAD
     if (!m_ruleRangeMap)
         m_currentStyleData = 0;
 
@@ -415,6 +420,12 @@ bool CSSParser::parseDeclaration(CSSMutableStyleDeclaration* declaration, const
     android::TimeCounter::record(android::TimeCounter::CSSParseTimeCounter, __FUNCTION__);
 #endif
 
+=======
+    if (styleSourceData) {
+        *styleSourceData = m_currentRuleData->styleSourceData.release();
+        m_currentRuleData = 0;
+    }
+>>>>>>> webkit.org at r70209
     return ok;
 }
 
@@ -1056,7 +1067,12 @@ bool CSSParser::parseValue(int propId, bool important)
         if (id == CSSValueNormal || id == CSSValueBreakWord)
             validPrimitive = true;
         break;
-
+    case CSSPropertySpeak:           // none | normal | spell-out | digits | literal-punctuation | no-punctuation | inherit
+        if (id == CSSValueNone || id == CSSValueNormal || id == CSSValueSpellOut || id == CSSValueDigits 
+            || id == CSSValueLiteralPunctuation || id == CSSValueNoPunctuation)
+            validPrimitive = true;
+        break;
+            
     case CSSPropertyTextIndent:          // <length> | <percentage> | inherit
         validPrimitive = (!id && validUnit(value, FLength | FPercent, m_strict));
         break;
@@ -1826,15 +1842,8 @@ bool CSSParser::parseValue(int propId, bool important)
 #endif
 
     // CSS Text Layout Module Level 3: Vertical writing support
-    case CSSPropertyWebkitBlockFlow:
-        // [ "tb" | "rl" | "lr" | "bt" ]
-        if (id == CSSValueTb || id == CSSValueRl || id == CSSValueLr || id == CSSValueBt)
-            validPrimitive = true;
-        break;
-
     case CSSPropertyWebkitWritingMode:
-        // [ "lr-tb" | "rl-tb" | "tb-rl" | "bt-rl" | "tb-lr" | "bt-lr" ]
-        if (id == CSSValueLrTb || id == CSSValueRlTb || id == CSSValueTbRl || id == CSSValueBtRl || id == CSSValueTbLr || id == CSSValueBtLr)
+        if (id >= CSSValueHorizontalTb && id <= CSSValueHorizontalBt)
             validPrimitive = true;
         break;
 
@@ -3849,17 +3858,12 @@ bool CSSParser::parseFontFaceUnicodeRange()
     return true;
 }
 
-static inline bool isCSSWhitespace(UChar c)
-{
-    return c == ' ' || c == '\t' || c == '\r' || c == '\n' || c == '\f';
-}
-
 static inline bool parseColorInt(const UChar*& string, const UChar* end, UChar terminator, int& value)
 {
     const UChar* current = string;
     int localValue = 0;
     bool negative = false;
-    while (current != end && isCSSWhitespace(*current))
+    while (current != end && isHTMLSpace(*current))
         current++;
     if (current != end && *current == '-') {
         negative = true;
@@ -3878,7 +3882,7 @@ static inline bool parseColorInt(const UChar*& string, const UChar* end, UChar t
         }
         localValue = newValue;
     }
-    while (current != end && isCSSWhitespace(*current))
+    while (current != end && isHTMLSpace(*current))
         current++;
     if (current == end || *current++ != terminator)
         return false;
@@ -3903,7 +3907,7 @@ static inline bool isTenthAlpha(const UChar* string, const int length)
 
 static inline bool parseAlphaValue(const UChar*& string, const UChar* end, UChar terminator, int& value)
 {
-    while (string != end && isCSSWhitespace(*string))
+    while (string != end && isHTMLSpace(*string))
         string++;
 
     value = 0;
@@ -5287,11 +5291,11 @@ UChar* CSSParser::text(int *length)
         start += 4;
         l -= 5;
         // strip {w}
-        while (l && isCSSWhitespace(*start)) {
+        while (l && isHTMLSpace(*start)) {
             ++start;
             --l;
         }
-        while (l && isCSSWhitespace(start[l - 1]))
+        while (l && isHTMLSpace(start[l - 1]))
             --l;
         if (l && (*start == '"' || *start == '\'')) {
             ASSERT(l >= 2 && start[l - 1] == *start);
@@ -5305,11 +5309,11 @@ UChar* CSSParser::text(int *length)
         start += 12;
         l -= 13;
         // strip {w}
-        while (l && isCSSWhitespace(*start)) {
+        while (l && isHTMLSpace(*start)) {
             ++start;
             --l;
         }
-        while (l && isCSSWhitespace(start[l - 1]))
+        while (l && isHTMLSpace(start[l - 1]))
             --l;
         break;
     default:
@@ -5361,7 +5365,7 @@ UChar* CSSParser::text(int *length)
                 uc = 0xfffd;
             *out++ = uc;
             escape = 0;
-            if (isCSSWhitespace(*current))
+            if (isHTMLSpace(*current))
                 continue;
         }
         if (!escape && *current == '\\') {
@@ -5573,12 +5577,15 @@ CSSRule* CSSParser::createStyleRule(Vector<CSSSelector*>* selectors)
         result = rule.get();
         m_parsedStyleObjects.append(rule.release());
         if (m_ruleRangeMap) {
-            ASSERT(m_currentStyleData);
-            m_currentStyleData->styleBodyRange = SourceRange(m_ruleBodyStartOffset, m_ruleBodyEndOffset);
-            m_ruleRangeMap->set(result, m_currentStyleData.release());
-            m_currentStyleData = CSSStyleSourceData::create();
+            ASSERT(m_currentRuleData);
+            m_currentRuleData->styleSourceData->styleBodyRange = m_ruleBodyRange;
+            m_currentRuleData->selectorListRange = m_selectorListRange;
+            m_ruleRangeMap->set(result, m_currentRuleData.release());
+            m_currentRuleData = CSSRuleSourceData::create();
+            m_currentRuleData->styleSourceData = CSSStyleSourceData::create();
         }
     }
+    resetSelectorListMarks();
     resetRuleBodyMarks();
     clearProperties();
     return result;
@@ -5833,26 +5840,44 @@ void CSSParser::updateLastSelectorLineAndPosition()
     markRuleBodyStart();
 }
 
+void CSSParser::markSelectorListStart()
+{
+    m_selectorListRange.start = yytext - m_data;
+}
+
+void CSSParser::markSelectorListEnd()
+{
+    if (!m_currentRuleData)
+        return;
+    UChar* listEnd = yytext;
+    while (listEnd > m_data + 1) {
+        if (isHTMLSpace(*(listEnd - 1)))
+            --listEnd;
+        else
+            break;
+    }
+    m_selectorListRange.end = listEnd - m_data;
+}
+
 void CSSParser::markRuleBodyStart()
 {
     unsigned offset = yytext - m_data;
     if (*yytext == '{')
         ++offset; // Skip the rule body opening brace.
-    if (offset > m_ruleBodyStartOffset)
-        m_ruleBodyStartOffset = offset;
+    if (offset > m_ruleBodyRange.start)
+        m_ruleBodyRange.start = offset;
 }
 
 void CSSParser::markRuleBodyEnd()
 {
     unsigned offset = yytext - m_data;
-    if (offset > m_ruleBodyEndOffset)
-        m_ruleBodyEndOffset = offset;
+    if (offset > m_ruleBodyRange.end)
+        m_ruleBodyRange.end = offset;
 }
 
 void CSSParser::markPropertyStart()
 {
-    unsigned offset = yytext - m_data;
-    m_propertyStartOffset = offset;
+    m_propertyRange.start = yytext - m_data;
 }
 
 void CSSParser::markPropertyEnd(bool isImportantFound, bool isPropertyParsed)
@@ -5860,11 +5885,11 @@ void CSSParser::markPropertyEnd(bool isImportantFound, bool isPropertyParsed)
     unsigned offset = yytext - m_data;
     if (*yytext == ';') // Include semicolon into the property text.
         ++offset;
-    m_propertyEndOffset = offset;
-    if (m_propertyStartOffset != UINT_MAX && m_currentStyleData) {
+    m_propertyRange.end = offset;
+    if (m_propertyRange.start != UINT_MAX && m_currentRuleData) {
         // This stuff is only executed when the style data retrieval is requested by client.
-        const unsigned start = m_propertyStartOffset;
-        const unsigned end = m_propertyEndOffset;
+        const unsigned start = m_propertyRange.start;
+        const unsigned end = m_propertyRange.end;
         ASSERT(start < end);
         String propertyString = String(m_data + start, end - start).stripWhiteSpace();
         if (propertyString.endsWith(";", true))
@@ -5876,8 +5901,8 @@ void CSSParser::markPropertyEnd(bool isImportantFound, bool isPropertyParsed)
         String name = propertyString.left(colonIndex).stripWhiteSpace();
         String value = propertyString.substring(colonIndex + 1, propertyString.length()).stripWhiteSpace();
         // The property range is relative to the declaration start offset.
-        m_currentStyleData->propertyData.append(
-            CSSPropertySourceData(name, value, isImportantFound, isPropertyParsed, SourceRange(m_propertyStartOffset - m_ruleBodyStartOffset, m_propertyEndOffset - m_ruleBodyStartOffset)));
+        m_currentRuleData->styleSourceData->propertyData.append(
+            CSSPropertySourceData(name, value, isImportantFound, isPropertyParsed, SourceRange(start - m_ruleBodyRange.start, end - m_ruleBodyRange.start)));
     }
     resetPropertyMarks();
 }
diff --git a/WebCore/css/CSSParser.h b/WebCore/css/CSSParser.h
index f8b24df..8f3c6dd 100644
--- a/WebCore/css/CSSParser.h
+++ b/WebCore/css/CSSParser.h
@@ -65,7 +65,7 @@ namespace WebCore {
         bool parseValue(CSSMutableStyleDeclaration*, int propId, const String&, bool important);
         static bool parseColor(RGBA32& color, const String&, bool strict = false);
         bool parseColor(CSSMutableStyleDeclaration*, const String&);
-        bool parseDeclaration(CSSMutableStyleDeclaration*, const String&, CSSStyleSourceData* styleSourceData = 0);
+        bool parseDeclaration(CSSMutableStyleDeclaration*, const String&, RefPtr<CSSStyleSourceData>* styleSourceData = 0);
         bool parseMediaQuery(MediaList*, const String&);
 
         Document* document() const;
@@ -241,18 +241,20 @@ namespace WebCore {
         AtomicString m_defaultNamespace;
 
         // tokenizer methods and data
-        unsigned m_ruleBodyStartOffset;
-        unsigned m_ruleBodyEndOffset;
-        unsigned m_propertyStartOffset;
-        unsigned m_propertyEndOffset;
+        SourceRange m_selectorListRange;
+        SourceRange m_ruleBodyRange;
+        SourceRange m_propertyRange;
         StyleRuleRangeMap* m_ruleRangeMap;
-        RefPtr<CSSStyleSourceData> m_currentStyleData;
+        RefPtr<CSSRuleSourceData> m_currentRuleData;
+        void markSelectorListStart();
+        void markSelectorListEnd();
         void markRuleBodyStart();
         void markRuleBodyEnd();
         void markPropertyStart();
         void markPropertyEnd(bool isImportantFound, bool isPropertyParsed);
-        void resetRuleBodyMarks() { m_ruleBodyStartOffset = m_ruleBodyEndOffset = 0; }
-        void resetPropertyMarks() { m_propertyStartOffset = m_propertyEndOffset = UINT_MAX; }
+        void resetSelectorListMarks() { m_selectorListRange.start = m_selectorListRange.end = 0; }
+        void resetRuleBodyMarks() { m_ruleBodyRange.start = m_ruleBodyRange.end = 0; }
+        void resetPropertyMarks() { m_propertyRange.start = m_propertyRange.end = UINT_MAX; }
         int lex(void* yylval);
         int token() { return yyTok; }
         UChar* text(int* length);
diff --git a/WebCore/css/CSSPrimitiveValue.cpp b/WebCore/css/CSSPrimitiveValue.cpp
index 5c83e7c..065c244 100644
--- a/WebCore/css/CSSPrimitiveValue.cpp
+++ b/WebCore/css/CSSPrimitiveValue.cpp
@@ -35,7 +35,9 @@
 #include "Rect.h"
 #include "RenderStyle.h"
 #include <wtf/ASCIICType.h>
+#include <wtf/DecimalNumber.h>
 #include <wtf/StdLibExtras.h>
+#include <wtf/text/StringBuffer.h>
 
 #if ENABLE(DASHBOARD_SUPPORT)
 #include "DashboardRegion.h"
@@ -613,6 +615,17 @@ int CSSPrimitiveValue::getIdent()
     return m_value.ident;
 }
 
+static String formatNumber(double number)
+{
+    DecimalNumber decimal(number);
+    
+    StringBuffer buffer(decimal.bufferLengthForStringDecimal());
+    unsigned length = decimal.toStringDecimal(buffer.characters(), buffer.length());
+    ASSERT_UNUSED(length, length == buffer.length());
+
+    return String::adopt(buffer);
+}
+
 String CSSPrimitiveValue::cssText() const
 {
     // FIXME: return the original value instead of a generated one (e.g. color
@@ -630,61 +643,61 @@ String CSSPrimitiveValue::cssText() const
             break;
         case CSS_NUMBER:
         case CSS_PARSER_INTEGER:
-            text = String::number(m_value.num);
+            text = formatNumber(m_value.num);
             break;
         case CSS_PERCENTAGE:
-            text = String::format("%.6lg%%", m_value.num);
+            text = formatNumber(m_value.num) + "%";
             break;
         case CSS_EMS:
-            text = String::format("%.6lgem", m_value.num);
+            text = formatNumber(m_value.num) + "em";
             break;
         case CSS_EXS:
-            text = String::format("%.6lgex", m_value.num);
+            text = formatNumber(m_value.num) + "ex";
             break;
         case CSS_REMS:
-            text = String::format("%.6lgrem", m_value.num);
+            text = formatNumber(m_value.num) + "rem";
             break;
         case CSS_PX:
-            text = String::format("%.6lgpx", m_value.num);
+            text = formatNumber(m_value.num) + "px";
             break;
         case CSS_CM:
-            text = String::format("%.6lgcm", m_value.num);
+            text = formatNumber(m_value.num) + "cm";
             break;
         case CSS_MM:
-            text = String::format("%.6lgmm", m_value.num);
+            text = formatNumber(m_value.num) + "mm";
             break;
         case CSS_IN:
-            text = String::format("%.6lgin", m_value.num);
+            text = formatNumber(m_value.num) + "in";
             break;
         case CSS_PT:
-            text = String::format("%.6lgpt", m_value.num);
+            text = formatNumber(m_value.num) + "pt";
             break;
         case CSS_PC:
-            text = String::format("%.6lgpc", m_value.num);
+            text = formatNumber(m_value.num) + "pc";
             break;
         case CSS_DEG:
-            text = String::format("%.6lgdeg", m_value.num);
+            text = formatNumber(m_value.num) + "deg";
             break;
         case CSS_RAD:
-            text = String::format("%.6lgrad", m_value.num);
+            text = formatNumber(m_value.num) + "rad";
             break;
         case CSS_GRAD:
-            text = String::format("%.6lggrad", m_value.num);
+            text = formatNumber(m_value.num) + "grad";
             break;
         case CSS_MS:
-            text = String::format("%.6lgms", m_value.num);
+            text = formatNumber(m_value.num) + "ms";
             break;
         case CSS_S:
-            text = String::format("%.6lgs", m_value.num);
+            text = formatNumber(m_value.num) + "s";
             break;
         case CSS_HZ:
-            text = String::format("%.6lghz", m_value.num);
+            text = formatNumber(m_value.num) + "hz";
             break;
         case CSS_KHZ:
-            text = String::format("%.6lgkhz", m_value.num);
+            text = formatNumber(m_value.num) + "khz";
             break;
         case CSS_TURN:
-            text = String::format("%.6lgturn", m_value.num);
+            text = formatNumber(m_value.num) + "turn";
             break;
         case CSS_DIMENSION:
             // FIXME
diff --git a/WebCore/css/CSSPrimitiveValueMappings.h b/WebCore/css/CSSPrimitiveValueMappings.h
index 14afdf6..a57a882 100644
--- a/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/WebCore/css/CSSPrimitiveValueMappings.h
@@ -2003,40 +2003,40 @@ template<> inline CSSPrimitiveValue::operator TextDirection() const
     }
 }
 
-template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EBlockFlowDirection e)
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(WritingMode e)
     : m_type(CSS_IDENT)
     , m_hasCachedCSSText(false)
 {
     switch (e) {
-    case TopToBottomBlockFlow:
-        m_value.ident = CSSValueTb;
+    case TopToBottomWritingMode:
+        m_value.ident = CSSValueHorizontalTb;
         break;
-    case RightToLeftBlockFlow:
-        m_value.ident = CSSValueRl;
+    case RightToLeftWritingMode:
+        m_value.ident = CSSValueVerticalRl;
         break;
-    case LeftToRightBlockFlow:
-        m_value.ident = CSSValueLr;
+    case LeftToRightWritingMode:
+        m_value.ident = CSSValueVerticalLr;
         break;
-    case BottomToTopBlockFlow:
-        m_value.ident = CSSValueBt;
+    case BottomToTopWritingMode:
+        m_value.ident = CSSValueHorizontalBt;
         break;
     }
 }
 
-template<> inline CSSPrimitiveValue::operator EBlockFlowDirection() const
+template<> inline CSSPrimitiveValue::operator WritingMode() const
 {
     switch (m_value.ident) {
-    case CSSValueTb:
-        return TopToBottomBlockFlow;
-    case CSSValueRl:
-        return RightToLeftBlockFlow;
-    case CSSValueLr:
-        return LeftToRightBlockFlow;
-    case CSSValueBt:
-        return BottomToTopBlockFlow;
+    case CSSValueHorizontalTb:
+        return TopToBottomWritingMode;
+    case CSSValueVerticalRl:
+        return RightToLeftWritingMode;
+    case CSSValueVerticalLr:
+        return LeftToRightWritingMode;
+    case CSSValueHorizontalBt:
+        return BottomToTopWritingMode;
     default:
         ASSERT_NOT_REACHED();
-        return TopToBottomBlockFlow;
+        return TopToBottomWritingMode;
     }
 }
 
@@ -2189,25 +2189,30 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ColorSpace space)
     , m_hasCachedCSSText(false)
 {
     switch (space) {
-        case DeviceColorSpace:
-            m_value.ident = CSSValueDefault;
-            break;
-        case sRGBColorSpace:
-            m_value.ident = CSSValueSrgb;
-            break;
+    case ColorSpaceDeviceRGB:
+        m_value.ident = CSSValueDefault;
+        break;
+    case ColorSpaceSRGB:
+        m_value.ident = CSSValueSrgb;
+        break;
+    case ColorSpaceLinearRGB:
+        // CSS color correction does not support linearRGB yet.
+        ASSERT_NOT_REACHED();
+        m_value.ident = CSSValueDefault;
+        break;
     }
 }
 
 template<> inline CSSPrimitiveValue::operator ColorSpace() const
 {
     switch (m_value.ident) {
-        case CSSValueDefault:
-            return DeviceColorSpace;
-        case CSSValueSrgb:
-            return sRGBColorSpace;
-        default:
-            ASSERT_NOT_REACHED();
-            return DeviceColorSpace;
+    case CSSValueDefault:
+        return ColorSpaceDeviceRGB;
+    case CSSValueSrgb:
+        return ColorSpaceSRGB;
+    default:
+        ASSERT_NOT_REACHED();
+        return ColorSpaceDeviceRGB;
     }
 }
 
@@ -2243,6 +2248,53 @@ template<> inline CSSPrimitiveValue::operator Hyphens() const
     }
 }
 
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ESpeak e)
+    : m_type(CSS_IDENT)
+    , m_hasCachedCSSText(false)
+{
+    switch (e) {
+    case SpeakNone:
+        m_value.ident = CSSValueNone;
+        break;
+    case SpeakNormal:
+        m_value.ident = CSSValueNormal;
+        break;
+    case SpeakSpellOut:
+        m_value.ident = CSSValueSpellOut;
+        break;
+    case SpeakDigits:
+        m_value.ident = CSSValueDigits;
+        break;
+    case SpeakLiteralPunctuation:
+        m_value.ident = CSSValueLiteralPunctuation;
+        break;
+    case SpeakNoPunctuation:
+        m_value.ident = CSSValueNoPunctuation;
+        break;
+    }
+}
+    
+template<> inline CSSPrimitiveValue::operator ESpeak() const
+{
+    switch (m_value.ident) {
+    case CSSValueNone:
+        return SpeakNone;
+    case CSSValueNormal:
+        return SpeakNormal;
+    case CSSValueSpellOut:
+        return SpeakSpellOut;
+    case CSSValueDigits:
+        return SpeakDigits;
+    case CSSValueLiteralPunctuation:
+        return SpeakLiteralPunctuation;
+    case CSSValueNoPunctuation:
+        return SpeakNoPunctuation;
+    default:
+        ASSERT_NOT_REACHED();
+        return SpeakNormal;
+    }
+}
+
 #if ENABLE(SVG)
 
 template<> inline CSSPrimitiveValue::CSSPrimitiveValue(LineCap e)
@@ -2656,7 +2708,7 @@ template<> inline CSSPrimitiveValue::operator ETextAnchor() const
     }
 }
 
-template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EWritingMode e)
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(SVGWritingMode e)
     : m_type(CSS_IDENT)
     , m_hasCachedCSSText(false)
 {
@@ -2682,7 +2734,7 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EWritingMode e)
     }
 }
 
-template<> inline CSSPrimitiveValue::operator EWritingMode() const
+template<> inline CSSPrimitiveValue::operator SVGWritingMode() const
 {
     switch (m_value.ident) {
     case CSSValueLrTb:
@@ -2729,7 +2781,7 @@ template<> inline CSSPrimitiveValue::operator EVectorEffect() const
         return VE_NONE;
     }
 }
-
+    
 #endif
 
 }
diff --git a/WebCore/css/CSSProperty.cpp b/WebCore/css/CSSProperty.cpp
index 7779aad..61300a2 100644
--- a/WebCore/css/CSSProperty.cpp
+++ b/WebCore/css/CSSProperty.cpp
@@ -42,16 +42,16 @@ bool operator==(const CSSProperty& a, const CSSProperty& b)
 enum LogicalBoxSide { BeforeSide, EndSide, AfterSide, StartSide };
 enum PhysicalBoxSide { TopSide, RightSide, BottomSide, LeftSide };
 
-static int resolveToPhysicalProperty(TextDirection direction, EBlockFlowDirection blockDirection, LogicalBoxSide logicalSide, const int* properties)
+static int resolveToPhysicalProperty(TextDirection direction, WritingMode writingMode, LogicalBoxSide logicalSide, const int* properties)
 {
     if (direction == LTR) {
-        if (blockDirection == TopToBottomBlockFlow) {
+        if (writingMode == TopToBottomWritingMode) {
             // The common case. The logical and physical box sides match.
             // Left = Start, Right = End, Before = Top, After = Bottom
             return properties[logicalSide];
         }
         
-        if (blockDirection == BottomToTopBlockFlow) {
+        if (writingMode == BottomToTopWritingMode) {
             // Start = Left, End = Right, Before = Bottom, After = Top.
             switch (logicalSide) {
             case StartSide:
@@ -65,7 +65,7 @@ static int resolveToPhysicalProperty(TextDirection direction, EBlockFlowDirectio
             }
         }
         
-        if (blockDirection == LeftToRightBlockFlow) {
+        if (writingMode == LeftToRightWritingMode) {
             // Start = Top, End = Bottom, Before = Left, After = Right.
             switch (logicalSide) {
             case StartSide:
@@ -92,7 +92,7 @@ static int resolveToPhysicalProperty(TextDirection direction, EBlockFlowDirectio
         }
     }
 
-    if (blockDirection == TopToBottomBlockFlow) {
+    if (writingMode == TopToBottomWritingMode) {
         // Start = Right, End = Left, Before = Top, After = Bottom
         switch (logicalSide) {
         case StartSide:
@@ -106,7 +106,7 @@ static int resolveToPhysicalProperty(TextDirection direction, EBlockFlowDirectio
         }
     }
     
-    if (blockDirection == BottomToTopBlockFlow) {
+    if (writingMode == BottomToTopWritingMode) {
         // Start = Right, End = Left, Before = Bottom, After = Top
         switch (logicalSide) {
         case StartSide:
@@ -120,7 +120,7 @@ static int resolveToPhysicalProperty(TextDirection direction, EBlockFlowDirectio
         }
     }
     
-    if (blockDirection == LeftToRightBlockFlow) {
+    if (writingMode == LeftToRightWritingMode) {
         // Start = Bottom, End = Top, Before = Left, After = Right
         switch (logicalSide) {
         case StartSide:
@@ -149,135 +149,135 @@ static int resolveToPhysicalProperty(TextDirection direction, EBlockFlowDirectio
 
 enum LogicalExtent { LogicalWidth, LogicalHeight };
 
-static int resolveToPhysicalProperty(EBlockFlowDirection blockDirection, LogicalExtent logicalSide, const int* properties)
+static int resolveToPhysicalProperty(WritingMode writingMode, LogicalExtent logicalSide, const int* properties)
 {
-    if (blockDirection == TopToBottomBlockFlow || blockDirection == BottomToTopBlockFlow)
+    if (writingMode == TopToBottomWritingMode || writingMode == BottomToTopWritingMode)
         return properties[logicalSide];
     return logicalSide == LogicalWidth ? properties[1] : properties[0];
 }
         
-int CSSProperty::resolveDirectionAwareProperty(int propertyID, TextDirection direction, EBlockFlowDirection blockDirection)
+int CSSProperty::resolveDirectionAwareProperty(int propertyID, TextDirection direction, WritingMode writingMode)
 {
     switch (static_cast<CSSPropertyID>(propertyID)) {
     case CSSPropertyWebkitMarginEnd: {
         const int properties[4] = { CSSPropertyMarginTop, CSSPropertyMarginRight, CSSPropertyMarginBottom, CSSPropertyMarginLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, EndSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, EndSide, properties);
     }
     case CSSPropertyWebkitMarginStart: {
         const int properties[4] = { CSSPropertyMarginTop, CSSPropertyMarginRight, CSSPropertyMarginBottom, CSSPropertyMarginLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, StartSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, StartSide, properties);
     }
     case CSSPropertyWebkitMarginBefore: {
         const int properties[4] = { CSSPropertyMarginTop, CSSPropertyMarginRight, CSSPropertyMarginBottom, CSSPropertyMarginLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, BeforeSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, BeforeSide, properties);
     }
     case CSSPropertyWebkitMarginAfter: {
         const int properties[4] = { CSSPropertyMarginTop, CSSPropertyMarginRight, CSSPropertyMarginBottom, CSSPropertyMarginLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, AfterSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, AfterSide, properties);
     }
     case CSSPropertyWebkitPaddingEnd: {
         const int properties[4] = { CSSPropertyPaddingTop, CSSPropertyPaddingRight, CSSPropertyPaddingBottom, CSSPropertyPaddingLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, EndSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, EndSide, properties);
     }
     case CSSPropertyWebkitPaddingStart: {
         const int properties[4] = { CSSPropertyPaddingTop, CSSPropertyPaddingRight, CSSPropertyPaddingBottom, CSSPropertyPaddingLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, StartSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, StartSide, properties);
     }
     case CSSPropertyWebkitPaddingBefore: {
         const int properties[4] = { CSSPropertyPaddingTop, CSSPropertyPaddingRight, CSSPropertyPaddingBottom, CSSPropertyPaddingLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, BeforeSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, BeforeSide, properties);
     }
     case CSSPropertyWebkitPaddingAfter: {
         const int properties[4] = { CSSPropertyPaddingTop, CSSPropertyPaddingRight, CSSPropertyPaddingBottom, CSSPropertyPaddingLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, AfterSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, AfterSide, properties);
     }
     case CSSPropertyWebkitBorderEnd: {
         const int properties[4] = { CSSPropertyBorderTop, CSSPropertyBorderRight, CSSPropertyBorderBottom, CSSPropertyBorderLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, EndSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, EndSide, properties);
     }
     case CSSPropertyWebkitBorderStart: {
         const int properties[4] = { CSSPropertyBorderTop, CSSPropertyBorderRight, CSSPropertyBorderBottom, CSSPropertyBorderLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, StartSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, StartSide, properties);
     }
     case CSSPropertyWebkitBorderBefore: {
         const int properties[4] = { CSSPropertyBorderTop, CSSPropertyBorderRight, CSSPropertyBorderBottom, CSSPropertyBorderLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, BeforeSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, BeforeSide, properties);
     }
     case CSSPropertyWebkitBorderAfter: {
         const int properties[4] = { CSSPropertyBorderTop, CSSPropertyBorderRight, CSSPropertyBorderBottom, CSSPropertyBorderLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, AfterSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, AfterSide, properties);
     }
     case CSSPropertyWebkitBorderEndColor: {
         const int properties[4] = { CSSPropertyBorderTopColor, CSSPropertyBorderRightColor, CSSPropertyBorderBottomColor, CSSPropertyBorderLeftColor };
-        return resolveToPhysicalProperty(direction, blockDirection, EndSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, EndSide, properties);
     }
     case CSSPropertyWebkitBorderStartColor: {
         const int properties[4] = { CSSPropertyBorderTopColor, CSSPropertyBorderRightColor, CSSPropertyBorderBottomColor, CSSPropertyBorderLeftColor };
-        return resolveToPhysicalProperty(direction, blockDirection, StartSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, StartSide, properties);
     }
     case CSSPropertyWebkitBorderBeforeColor: {
         const int properties[4] = { CSSPropertyBorderTopColor, CSSPropertyBorderRightColor, CSSPropertyBorderBottomColor, CSSPropertyBorderLeftColor };
-        return resolveToPhysicalProperty(direction, blockDirection, BeforeSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, BeforeSide, properties);
     }
     case CSSPropertyWebkitBorderAfterColor: {
         const int properties[4] = { CSSPropertyBorderTopColor, CSSPropertyBorderRightColor, CSSPropertyBorderBottomColor, CSSPropertyBorderLeftColor };
-        return resolveToPhysicalProperty(direction, blockDirection, AfterSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, AfterSide, properties);
     }
     case CSSPropertyWebkitBorderEndStyle: {
         const int properties[4] = { CSSPropertyBorderTopStyle, CSSPropertyBorderRightStyle, CSSPropertyBorderBottomStyle, CSSPropertyBorderLeftStyle };
-        return resolveToPhysicalProperty(direction, blockDirection, EndSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, EndSide, properties);
     }
     case CSSPropertyWebkitBorderStartStyle: {
         const int properties[4] = { CSSPropertyBorderTopStyle, CSSPropertyBorderRightStyle, CSSPropertyBorderBottomStyle, CSSPropertyBorderLeftStyle };
-        return resolveToPhysicalProperty(direction, blockDirection, StartSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, StartSide, properties);
     }
     case CSSPropertyWebkitBorderBeforeStyle: {
         const int properties[4] = { CSSPropertyBorderTopStyle, CSSPropertyBorderRightStyle, CSSPropertyBorderBottomStyle, CSSPropertyBorderLeftStyle };
-        return resolveToPhysicalProperty(direction, blockDirection, BeforeSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, BeforeSide, properties);
     }
     case CSSPropertyWebkitBorderAfterStyle: {
         const int properties[4] = { CSSPropertyBorderTopStyle, CSSPropertyBorderRightStyle, CSSPropertyBorderBottomStyle, CSSPropertyBorderLeftStyle };
-        return resolveToPhysicalProperty(direction, blockDirection, AfterSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, AfterSide, properties);
     }
     case CSSPropertyWebkitBorderEndWidth: {
         const int properties[4] = { CSSPropertyBorderTopWidth, CSSPropertyBorderRightWidth, CSSPropertyBorderBottomWidth, CSSPropertyBorderLeftWidth };
-        return resolveToPhysicalProperty(direction, blockDirection, EndSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, EndSide, properties);
     }
     case CSSPropertyWebkitBorderStartWidth: {
         const int properties[4] = { CSSPropertyBorderTopWidth, CSSPropertyBorderRightWidth, CSSPropertyBorderBottomWidth, CSSPropertyBorderLeftWidth };
-        return resolveToPhysicalProperty(direction, blockDirection, StartSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, StartSide, properties);
     }
     case CSSPropertyWebkitBorderBeforeWidth: {
         const int properties[4] = { CSSPropertyBorderTopWidth, CSSPropertyBorderRightWidth, CSSPropertyBorderBottomWidth, CSSPropertyBorderLeftWidth };
-        return resolveToPhysicalProperty(direction, blockDirection, BeforeSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, BeforeSide, properties);
     }
     case CSSPropertyWebkitBorderAfterWidth: {
         const int properties[4] = { CSSPropertyBorderTopWidth, CSSPropertyBorderRightWidth, CSSPropertyBorderBottomWidth, CSSPropertyBorderLeftWidth };
-        return resolveToPhysicalProperty(direction, blockDirection, AfterSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, AfterSide, properties);
     }
     case CSSPropertyWebkitLogicalWidth: {
         const int properties[2] = { CSSPropertyWidth, CSSPropertyHeight };
-        return resolveToPhysicalProperty(blockDirection, LogicalWidth, properties);
+        return resolveToPhysicalProperty(writingMode, LogicalWidth, properties);
     }
     case CSSPropertyWebkitLogicalHeight: {
         const int properties[2] = { CSSPropertyWidth, CSSPropertyHeight };
-        return resolveToPhysicalProperty(blockDirection, LogicalHeight, properties);
+        return resolveToPhysicalProperty(writingMode, LogicalHeight, properties);
     }
     case CSSPropertyWebkitMinLogicalWidth: {
         const int properties[2] = { CSSPropertyMinWidth, CSSPropertyMinHeight };
-        return resolveToPhysicalProperty(blockDirection, LogicalWidth, properties);
+        return resolveToPhysicalProperty(writingMode, LogicalWidth, properties);
     }
     case CSSPropertyWebkitMinLogicalHeight: {
         const int properties[2] = { CSSPropertyMinWidth, CSSPropertyMinHeight };
-        return resolveToPhysicalProperty(blockDirection, LogicalHeight, properties);
+        return resolveToPhysicalProperty(writingMode, LogicalHeight, properties);
     }
     case CSSPropertyWebkitMaxLogicalWidth: {
         const int properties[2] = { CSSPropertyMaxWidth, CSSPropertyMaxHeight };
-        return resolveToPhysicalProperty(blockDirection, LogicalWidth, properties);
+        return resolveToPhysicalProperty(writingMode, LogicalWidth, properties);
     }
     case CSSPropertyWebkitMaxLogicalHeight: {
         const int properties[2] = { CSSPropertyMaxWidth, CSSPropertyMaxHeight };
-        return resolveToPhysicalProperty(blockDirection, LogicalHeight, properties);
+        return resolveToPhysicalProperty(writingMode, LogicalHeight, properties);
     }
     default:
         return propertyID;
diff --git a/WebCore/css/CSSProperty.h b/WebCore/css/CSSProperty.h
index 0da6050..106171d 100644
--- a/WebCore/css/CSSProperty.h
+++ b/WebCore/css/CSSProperty.h
@@ -60,7 +60,7 @@ public:
     
     String cssText() const;
 
-    static int resolveDirectionAwareProperty(int propertyID, TextDirection, EBlockFlowDirection);
+    static int resolveDirectionAwareProperty(int propertyID, TextDirection, WritingMode);
 
     friend bool operator==(const CSSProperty&, const CSSProperty&);
 
diff --git a/WebCore/css/CSSPropertyNames.in b/WebCore/css/CSSPropertyNames.in
index 8584e5f..9fd2d2c 100644
--- a/WebCore/css/CSSPropertyNames.in
+++ b/WebCore/css/CSSPropertyNames.in
@@ -20,7 +20,6 @@ font-style
 font-variant
 font-weight
 text-rendering
--webkit-block-flow
 -webkit-font-smoothing
 -webkit-text-size-adjust
 -webkit-writing-mode
@@ -123,6 +122,7 @@ resize
 right
 size
 src
+speak
 table-layout
 text-align
 text-decoration
diff --git a/WebCore/css/CSSPropertySourceData.cpp b/WebCore/css/CSSPropertySourceData.cpp
index 1628031..eb9c2c1 100644
--- a/WebCore/css/CSSPropertySourceData.cpp
+++ b/WebCore/css/CSSPropertySourceData.cpp
@@ -54,13 +54,6 @@ SourceRange::SourceRange(unsigned start, unsigned end)
 {
 }
 
-SourceRange& SourceRange::operator=(const SourceRange& other)
-{
-    this->start = other.start;
-    this->end = other.end;
-    return *this;
-}
-
 CSSPropertySourceData::CSSPropertySourceData(const String& name, const String& value, bool important, bool parsedOk, const SourceRange& range)
     : name(name)
     , value(value)
@@ -88,16 +81,6 @@ CSSPropertySourceData::CSSPropertySourceData()
 {
 }
 
-CSSPropertySourceData& CSSPropertySourceData::operator=(const CSSPropertySourceData& other)
-{
-    name = other.name;
-    value = other.value;
-    important = other.important;
-    parsedOk = other.parsedOk;
-    range = other.range;
-    return *this;
-}
-
 String CSSPropertySourceData::toString() const
 {
     DEFINE_STATIC_LOCAL(String, emptyValue, ("e"));
diff --git a/WebCore/css/CSSPropertySourceData.h b/WebCore/css/CSSPropertySourceData.h
index beae9d0..db80d46 100644
--- a/WebCore/css/CSSPropertySourceData.h
+++ b/WebCore/css/CSSPropertySourceData.h
@@ -44,7 +44,6 @@ class CSSStyleRule;
 struct SourceRange {
     SourceRange();
     SourceRange(unsigned start, unsigned end);
-    SourceRange& operator=(const SourceRange& other);
 
     unsigned start;
     unsigned end;
@@ -56,9 +55,7 @@ struct CSSPropertySourceData {
     CSSPropertySourceData(const String& name, const String& value, bool important, bool parsedOk, const SourceRange& range);
     CSSPropertySourceData(const CSSPropertySourceData& other);
     CSSPropertySourceData();
-    ALWAYS_INLINE ~CSSPropertySourceData() { }
 
-    CSSPropertySourceData& operator=(const CSSPropertySourceData& other);
     String toString() const;
     unsigned hash() const;
 
@@ -83,7 +80,18 @@ struct CSSStyleSourceData : public RefCounted<CSSStyleSourceData> {
     SourceRange styleBodyRange;
     Vector<CSSPropertySourceData> propertyData;
 };
-typedef HashMap<CSSStyleRule*, RefPtr<CSSStyleSourceData> > StyleRuleRangeMap;
+
+struct CSSRuleSourceData : public RefCounted<CSSRuleSourceData> {
+    static PassRefPtr<CSSRuleSourceData> create()
+    {
+        return adoptRef(new CSSRuleSourceData());
+    }
+
+    // Range of the selector list in the enclosing source.
+    SourceRange selectorListRange;
+    RefPtr<CSSStyleSourceData> styleSourceData;
+};
+typedef HashMap<CSSStyleRule*, RefPtr<CSSRuleSourceData> > StyleRuleRangeMap;
 
 } // namespace WebCore
 
diff --git a/WebCore/css/CSSStyleSelector.cpp b/WebCore/css/CSSStyleSelector.cpp
index bf95877..9ae0505 100644
--- a/WebCore/css/CSSStyleSelector.cpp
+++ b/WebCore/css/CSSStyleSelector.cpp
@@ -1107,8 +1107,12 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForDocument(Document* document)
     documentStyle->setZoom(frame ? frame->pageZoomFactor() : 1);
     
     Element* docElement = document->documentElement();
-    if (docElement && docElement->renderer())
-        documentStyle->setBlockFlow(docElement->renderer()->style()->blockFlow());
+    if (docElement && docElement->renderer()) {
+        // Use the direction and block-flow of the document element to set the
+        // viewport's direction and block-flow.
+        documentStyle->setWritingMode(docElement->renderer()->style()->writingMode());
+        documentStyle->setDirection(docElement->renderer()->style()->direction());
+    }
 
     FontDescription fontDescription;
     fontDescription.setUsePrinterFont(document->printing());
@@ -1722,7 +1726,7 @@ void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, RenderStyle* parent
         
         // FIXME: Don't support this mutation for pseudo styles like first-letter or first-line, since it's not completely
         // clear how that should work.
-        if (style->display() == INLINE && style->styleType() == NOPSEUDO && parentStyle && style->blockFlow() != parentStyle->blockFlow())
+        if (style->display() == INLINE && style->styleType() == NOPSEUDO && parentStyle && style->writingMode() != parentStyle->writingMode())
             style->setDisplay(INLINE_BLOCK);
         
         // After performing the display mutation, check table rows.  We do not honor position:relative on
@@ -1734,14 +1738,14 @@ void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, RenderStyle* parent
             style->setPosition(StaticPosition);
         
         // FIXME: Since we don't support block-flow on either tables or flexible boxes yet, disallow setting
-        // of block-flow to anything other than TopToBottomBlockFlow.
+        // of block-flow to anything other than TopToBottomWritingMode.
         // https://bugs.webkit.org/show_bug.cgi?id=46417 - Tables support
         // https://bugs.webkit.org/show_bug.cgi?id=46418 - Flexible box support.
-        if (style->blockFlow() != TopToBottomBlockFlow && (style->display() == TABLE || style->display() == INLINE_TABLE
+        if (style->writingMode() != TopToBottomWritingMode && (style->display() == TABLE || style->display() == INLINE_TABLE
             || style->display() == TABLE_HEADER_GROUP || style->display() == TABLE_ROW_GROUP
             || style->display() == TABLE_FOOTER_GROUP || style->display() == TABLE_ROW || style->display() == TABLE_CELL
             || style->display() == BOX || style->display() == INLINE_BOX))
-            style->setBlockFlow(TopToBottomBlockFlow);
+            style->setWritingMode(TopToBottomWritingMode);
     }
 
     // Make sure our z-index value is only applied if the object is positioned.
@@ -1960,7 +1964,7 @@ CSSStyleSelector::SelectorMatch CSSStyleSelector::SelectorChecker::checkSelector
     switch (relation) {
         case CSSSelector::Descendant:
             while (true) {
-                Node* n = e->parentNode();
+                ContainerNode* n = e->parentNode();
                 if (!n || !n->isElementNode())
                     return SelectorFailsCompletely;
                 e = static_cast<Element*>(n);
@@ -1971,7 +1975,7 @@ CSSStyleSelector::SelectorMatch CSSStyleSelector::SelectorChecker::checkSelector
             break;
         case CSSSelector::Child:
         {
-            Node* n = e->parentNode();
+            ContainerNode* n = e->parentNode();
             if (!n || !n->isElementNode())
                 return SelectorFailsCompletely;
             e = static_cast<Element*>(n);
@@ -2942,7 +2946,7 @@ void CSSStyleSelector::applyDeclarations(bool isImportant, int startIndex, int e
 
                 if (applyFirst) {
                     COMPILE_ASSERT(firstCSSProperty == CSSPropertyColor, CSS_color_is_first_property);
-                    COMPILE_ASSERT(CSSPropertyZoom == CSSPropertyColor + 14, CSS_zoom_is_end_of_first_prop_range);
+                    COMPILE_ASSERT(CSSPropertyZoom == CSSPropertyColor + 13, CSS_zoom_is_end_of_first_prop_range);
                     COMPILE_ASSERT(CSSPropertyLineHeight == CSSPropertyZoom + 1, CSS_line_height_is_after_zoom);
 
                     // give special priority to font-xxx, color properties, etc
@@ -3012,7 +3016,7 @@ void CSSStyleSelector::matchPageRulesForList(CSSRuleDataList* rules, bool isLeft
 bool CSSStyleSelector::isLeftPage(int pageIndex) const
 {
     bool isFirstPageLeft = false;
-    if (m_rootElementStyle->direction() == RTL)
+    if (!m_rootElementStyle->isLeftToRightDirection())
         isFirstPageLeft = true;
 
     return (pageIndex + (isFirstPageLeft ? 1 : 0)) % 2;
@@ -3130,7 +3134,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     bool isInherit = m_parentNode && valueType == CSSValue::CSS_INHERIT;
     bool isInitial = valueType == CSSValue::CSS_INITIAL || (!m_parentNode && valueType == CSSValue::CSS_INHERIT);
     
-    id = CSSProperty::resolveDirectionAwareProperty(id, m_style->direction(), m_style->blockFlow());
+    id = CSSProperty::resolveDirectionAwareProperty(id, m_style->direction(), m_style->writingMode());
 
     if (m_checker.m_matchVisitedPseudoClass && !isValidVisitedLinkProperty(id)) {
         // Limit the properties that can be applied to only the ones honored by :visited.
@@ -4190,9 +4194,9 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             return;
         int id = primitiveValue->getIdent();
         if (id == CSSValueStart)
-            m_style->setTextAlign(m_style->direction() == LTR ? LEFT : RIGHT);
+            m_style->setTextAlign(m_style->isLeftToRightDirection() ? LEFT : RIGHT);
         else if (id == CSSValueEnd)
-            m_style->setTextAlign(m_style->direction() == LTR ? RIGHT : LEFT);
+            m_style->setTextAlign(m_style->isLeftToRightDirection() ? RIGHT : LEFT);
         else
             m_style->setTextAlign(*primitiveValue);
         return;
@@ -5473,7 +5477,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         if (isInherit) 
             m_style->setColorSpace(m_parentStyle->colorSpace());
         else if (isInitial)
-            m_style->setColorSpace(DeviceColorSpace);
+            m_style->setColorSpace(ColorSpaceDeviceRGB);
         else {
             if (!primitiveValue)
                 return;
@@ -5483,6 +5487,12 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertySize:
         applyPageSizeProperty(value);
         return;
+    
+    case CSSPropertySpeak:
+        HANDLE_INHERIT_AND_INITIAL(speak, Speak);
+        m_style->setSpeak(*primitiveValue);
+        return;
+            
     case CSSPropertyInvalid:
         return;
 
@@ -5561,50 +5571,8 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 #endif 
 
     // CSS Text Layout Module Level 3: Vertical writing support
-    case CSSPropertyWebkitBlockFlow:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(blockFlow, BlockFlow)
-        return;
-
     case CSSPropertyWebkitWritingMode:
-        // The 'writing-mode' property is a shorthand property for the 'direction' property and the 'block-flow' property. 
-        if (isInherit) {
-            m_style->setDirection(m_parentStyle->direction());
-            m_style->setBlockFlow(m_parentStyle->blockFlow());
-        } else if (isInitial) {
-            m_style->setDirection(m_style->initialDirection());
-            m_style->setBlockFlow(m_style->initialBlockFlow());
-        } else {
-            if (!primitiveValue)
-                return;
-            switch (primitiveValue->getIdent()) {
-            case CSSValueLrTb:
-                m_style->setDirection(LTR);
-                m_style->setBlockFlow(TopToBottomBlockFlow);
-                break;
-            case CSSValueRlTb:
-                m_style->setDirection(RTL);
-                m_style->setBlockFlow(TopToBottomBlockFlow);
-                break;
-            case CSSValueTbRl:
-                m_style->setDirection(LTR);
-                m_style->setBlockFlow(RightToLeftBlockFlow);
-                break;
-            case CSSValueBtRl:
-                m_style->setDirection(RTL);
-                m_style->setBlockFlow(RightToLeftBlockFlow);
-                break;
-            case CSSValueTbLr:
-                m_style->setDirection(LTR);
-                m_style->setBlockFlow(LeftToRightBlockFlow);
-                break;
-            case CSSValueBtLr:
-                m_style->setDirection(RTL);
-                m_style->setBlockFlow(LeftToRightBlockFlow);
-                break;
-            default:
-                break;
-            }
-        }
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(writingMode, WritingMode)
         return;
 
 #ifdef ANDROID_CSS_RING
@@ -6994,7 +6962,8 @@ void CSSStyleSelector::loadPendingImages()
                 for (ContentData* contentData = const_cast<ContentData*>(m_style->contentData()); contentData; contentData = contentData->next()) {
                     if (contentData->isImage() && contentData->image()->isPendingImage()) {
                         CSSImageValue* imageValue = static_cast<StylePendingImage*>(contentData->image())->cssImageValue();
-                        contentData->setImage(imageValue->cachedImage(cachedResourceLoader));
+                        if (StyleCachedImage* cachedImage = imageValue->cachedImage(cachedResourceLoader))
+                            contentData->setImage(cachedImage);
                     }
                 }
                 break;
diff --git a/WebCore/css/CSSStyleSelector.h b/WebCore/css/CSSStyleSelector.h
index 2bca2f4..5f70e05 100644
--- a/WebCore/css/CSSStyleSelector.h
+++ b/WebCore/css/CSSStyleSelector.h
@@ -109,7 +109,7 @@ public:
     private:
         void initForStyleResolve(Element*, RenderStyle* parentStyle = 0, PseudoId = NOPSEUDO);
         void initElement(Element*);
-        RenderStyle* locateSharedStyle();
+        ALWAYS_INLINE RenderStyle* locateSharedStyle();
         Node* locateCousinList(Element* parent, unsigned depth = 1);
         bool canShareStyleWithElement(Node*);
 
diff --git a/WebCore/css/CSSValueKeywords.in b/WebCore/css/CSSValueKeywords.in
index 556d0bc..fa0a214 100644
--- a/WebCore/css/CSSValueKeywords.in
+++ b/WebCore/css/CSSValueKeywords.in
@@ -714,6 +714,14 @@ stroke
 #none
 
 #
+# CSS_PROP_SPEECH
+#
+spell-out
+digits
+literal-punctuation
+no-punctuation
+
+#
 # -webkit-font-smoothing
 #
 # auto
@@ -743,16 +751,16 @@ windowed
 manual
 # auto
 
-# -webkit-block-flow
-tb
-rl
-lr
-bt
-
 # -webkit-writing-mode
+# SVG compatibility
+lr
+rl
+tb
 lr-tb
 rl-tb
 tb-rl
-bt-rl
-tb-lr
-bt-lr
+# Standard values from CSS3
+horizontal-tb
+vertical-rl
+vertical-lr
+horizontal-bt
diff --git a/WebCore/css/MediaQuery.cpp b/WebCore/css/MediaQuery.cpp
index 77a79ad..c476a21 100644
--- a/WebCore/css/MediaQuery.cpp
+++ b/WebCore/css/MediaQuery.cpp
@@ -30,8 +30,8 @@
 #include "MediaQuery.h"
 
 #include "MediaQueryExp.h"
-#include "StringBuilder.h"
 #include <wtf/NonCopyingSort.h>
+#include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
diff --git a/WebCore/css/MediaQueryExp.cpp b/WebCore/css/MediaQueryExp.cpp
index 36a155e..e970400 100644
--- a/WebCore/css/MediaQueryExp.cpp
+++ b/WebCore/css/MediaQueryExp.cpp
@@ -32,7 +32,7 @@
 #include "CSSParser.h"
 #include "CSSPrimitiveValue.h"
 #include "CSSValueList.h"
-#include "StringBuilder.h"
+#include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
diff --git a/WebCore/css/html.css b/WebCore/css/html.css
index 5399c1c..02fa620 100644
--- a/WebCore/css/html.css
+++ b/WebCore/css/html.css
@@ -284,16 +284,19 @@ label {
 
 legend {
     display: block;
-    padding-left: 2px;
-    padding-right: 2px;
+    -webkit-padding-start: 2px;
+    -webkit-padding-end: 2px;
     border: none
 }
 
 fieldset {
     display: block;
-    margin-left: 2px;
-    margin-right: 2px;
-    padding: 0.35em 0.75em 0.625em;
+    -webkit-margin-start: 2px;
+    -webkit-margin-end: 2px;
+    -webkit-padding-before: 0.35em;
+    -webkit-padding-start: 0.75em;
+    -webkit-padding-end: 0.75em;
+    -webkit-padding-after: 0.625em;
     border: 2px groove ThreeDFace
 }
 
diff --git a/WebCore/css/mathml.css b/WebCore/css/mathml.css
index 7cf9866..b797b21 100644
--- a/WebCore/css/mathml.css
+++ b/WebCore/css/mathml.css
@@ -21,13 +21,10 @@ math[display="block"] {
     margin-right: auto;
 }
 
-math > * {
-    vertical-align: baseline;
-}
-
 mrow, mfenced {
     display: inline-block;
     white-space: nowrap;
+    vertical-align: baseline;
 }
 
 mfenced {
@@ -96,8 +93,7 @@ mo {
 }
 
 math > mo, mrow > mo, mfenced > mo {
-    padding-left: 0.05em;
-    padding-right: 0.05em;
+    padding-right: 0.1em;
 }
 
 math[mathvariant="normal"], mstyle[mathvariant="normal"], mo[mathvariant="normal"], mn[mathvariant="normal"], mi[mathvariant="normal"], mtext[mathvariant="normal"], mspace[mathvariant="normal"], ms[mathvariant="normal"] {
diff --git a/WebCore/css/themeQtMobile.css b/WebCore/css/themeQtMobile.css
index ef2d182..5cc39c8 100644
--- a/WebCore/css/themeQtMobile.css
+++ b/WebCore/css/themeQtMobile.css
@@ -31,9 +31,10 @@ input[type="reset"],
 input[type="file"]::-webkit-file-upload-button, button,
 select {
     padding: 2px 18px 3px 18px;
-    border: 1px solid black;
+    border: 1px solid gray;
     -webkit-border-radius:5px;
-    background-color: ButtonFace;
+    background: -webkit-gradient(linear, left bottom, left top, color-stop(0.0, #e5e5e5), color-stop(0.4, #ffffff));
+    color: #3e3e3e;
 }
 
 input[type="button"]:disabled,
@@ -50,8 +51,8 @@ input[type="submit"]:active,
 input[type="reset"]:active,
 input[type="file"]:active::-webkit-file-upload-button,
 button:active,
-select:active{
-    background-color: ButtonShadow;
+select:active {
+    background: ButtonShadow;
 }
 
 input[type="button"]:active:disabled,