Merge WebKit at r68651 : Initial merge by git.

Change-Id: I3d6bff59f17eedd6722723354f386fec9be8ad12

92 files changed, 3614 insertions, 321 deletions

diff --git a/WebCore/html/BaseTextInputType.cpp b/WebCore/html/BaseTextInputType.cpp
new file mode 100644
index 0000000..3e57ace
--- /dev/null
+++ b/WebCore/html/BaseTextInputType.cpp
@@ -0,0 +1,52 @@
+/*
+ * This file is part of the WebKit project.
+ *
+ * Copyright (C) 2009 Michelangelo De Simone <micdesim@gmail.com>
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "BaseTextInputType.h"
+
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "RegularExpression.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+bool BaseTextInputType::isTextType() const
+{
+    return true;
+}
+
+bool BaseTextInputType::patternMismatch(const String& value) const
+{
+    const AtomicString& pattern = element()->fastGetAttribute(patternAttr);
+    // Empty values can't be mismatched
+    if (pattern.isEmpty() || value.isEmpty())
+        return false;
+    int matchLength = 0;
+    int valueLength = value.length();
+    int matchOffset = RegularExpression(pattern, TextCaseSensitive).match(value, 0, &matchLength);
+    return matchOffset || matchLength != valueLength;
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/BaseTextInputType.h b/WebCore/html/BaseTextInputType.h
new file mode 100644
index 0000000..9bd6c6d
--- /dev/null
+++ b/WebCore/html/BaseTextInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BaseTextInputType_h
+#define BaseTextInputType_h
+
+#include "TextFieldInputType.h"
+
+namespace WebCore {
+
+// Base of email, password, search, tel, text, and URL types.
+// They support maxlength, selection functions, and so on.
+class BaseTextInputType : public TextFieldInputType {
+protected:
+    BaseTextInputType(HTMLInputElement* element) : TextFieldInputType(element) { }
+    virtual bool isTextType() const;
+    virtual bool patternMismatch(const String&) const;
+};
+
+} // namespace WebCore
+
+#endif // BaseTextInputType_h
diff --git a/WebCore/html/ButtonInputType.cpp b/WebCore/html/ButtonInputType.cpp
new file mode 100644
index 0000000..7f56970
--- /dev/null
+++ b/WebCore/html/ButtonInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ButtonInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> ButtonInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new ButtonInputType(element));
+}
+
+const AtomicString& ButtonInputType::formControlType() const
+{
+    return InputTypeNames::button();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/ButtonInputType.h b/WebCore/html/ButtonInputType.h
new file mode 100644
index 0000000..99b3574
--- /dev/null
+++ b/WebCore/html/ButtonInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ButtonInputType_h
+#define ButtonInputType_h
+
+#include "InputType.h"
+
+namespace WebCore {
+
+class ButtonInputType : public InputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    ButtonInputType(HTMLInputElement* element) : InputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // ButtonInputType_h
diff --git a/WebCore/html/CheckboxInputType.cpp b/WebCore/html/CheckboxInputType.cpp
new file mode 100644
index 0000000..1c7ea4b
--- /dev/null
+++ b/WebCore/html/CheckboxInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CheckboxInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> CheckboxInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new CheckboxInputType(element));
+}
+
+const AtomicString& CheckboxInputType::formControlType() const
+{
+    return InputTypeNames::checkbox();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/CheckboxInputType.h b/WebCore/html/CheckboxInputType.h
new file mode 100644
index 0000000..6a152e9
--- /dev/null
+++ b/WebCore/html/CheckboxInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CheckboxInputType_h
+#define CheckboxInputType_h
+
+#include "InputType.h"
+
+namespace WebCore {
+
+class CheckboxInputType : public InputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    CheckboxInputType(HTMLInputElement* element) : InputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // CheckboxInputType_h
diff --git a/WebCore/html/ColorInputType.cpp b/WebCore/html/ColorInputType.cpp
new file mode 100644
index 0000000..c68acea
--- /dev/null
+++ b/WebCore/html/ColorInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ColorInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> ColorInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new ColorInputType(element));
+}
+
+const AtomicString& ColorInputType::formControlType() const
+{
+    return InputTypeNames::color();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/ColorInputType.h b/WebCore/html/ColorInputType.h
new file mode 100644
index 0000000..7259346
--- /dev/null
+++ b/WebCore/html/ColorInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ColorInputType_h
+#define ColorInputType_h
+
+#include "TextFieldInputType.h"
+
+namespace WebCore {
+
+class ColorInputType : public TextFieldInputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    ColorInputType(HTMLInputElement* element) : TextFieldInputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // ButtonInputType_h
diff --git a/WebCore/html/DOMTokenList.cpp b/WebCore/html/DOMTokenList.cpp
new file mode 100644
index 0000000..8ee45a2
--- /dev/null
+++ b/WebCore/html/DOMTokenList.cpp
@@ -0,0 +1,206 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DOMTokenList.h"
+
+#include "Element.h"
+#include "HTMLNames.h"
+#include "SpaceSplitString.h"
+#include "StringBuilder.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+static bool validateToken(const AtomicString& token, ExceptionCode& ec)
+{
+    if (token.isEmpty()) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    unsigned length = token.length();
+    for (unsigned i = 0; i < length; ++i) {
+        if (isClassWhitespace(token[i])) {
+            ec = INVALID_CHARACTER_ERR;
+            return false;
+        }
+    }
+
+    return true;
+}
+
+DOMTokenList::DOMTokenList(Element* element)
+    : m_element(element)
+{
+    if (m_element->document()->inQuirksMode())
+        m_classNamesForQuirksMode.set(m_element->fastGetAttribute(classAttr), false);
+}
+
+void DOMTokenList::ref()
+{
+    m_element->ref();
+}
+
+void DOMTokenList::deref()
+{
+    m_element->deref();
+}
+
+unsigned DOMTokenList::length() const
+{
+    return classNames().size();
+}
+
+const AtomicString DOMTokenList::item(unsigned index) const
+{
+    if (index >= length())
+        return AtomicString();
+    return classNames()[index];
+}
+
+bool DOMTokenList::contains(const AtomicString& token, ExceptionCode& ec) const
+{
+    if (!validateToken(token, ec))
+        return false;
+    return containsInternal(token);
+}
+
+bool DOMTokenList::containsInternal(const AtomicString& token) const
+{
+    return classNames().contains(token);
+}
+
+void DOMTokenList::add(const AtomicString& token, ExceptionCode& ec)
+{
+    if (!validateToken(token, ec))
+        return;
+    addInternal(token);
+}
+
+void DOMTokenList::addInternal(const AtomicString& token) const
+{
+    const AtomicString& oldClassName(m_element->fastGetAttribute(classAttr));
+    if (oldClassName.isEmpty())
+        m_element->setAttribute(classAttr, token);
+    else if (!containsInternal(token)) {
+        StringBuilder builder;
+        builder.append(oldClassName);
+        if (oldClassName[oldClassName.length() - 1] != ' ')
+            builder.append(' ');
+        builder.append(token);
+        m_element->setAttribute(classAttr, builder.toString());
+    }
+}
+
+void DOMTokenList::remove(const AtomicString& token, ExceptionCode& ec)
+{
+    if (!validateToken(token, ec))
+        return;
+    removeInternal(token);
+}
+
+void DOMTokenList::removeInternal(const AtomicString& token) const
+{
+    // Check using contains first since it uses AtomicString comparisons instead
+    // of character by character testing.
+    if (!containsInternal(token))
+        return;
+
+    // Algorithm defined at http://www.whatwg.org/specs/web-apps/current-work/multipage/common-microsyntaxes.html#remove-a-token-from-a-string
+
+    const AtomicString& input = m_element->fastGetAttribute(classAttr);
+    unsigned inputLength = input.length();
+    Vector<UChar> output; // 3
+    output.reserveCapacity(inputLength);
+    unsigned position = 0; // 4
+
+    // Step 5
+    while (position < inputLength) {
+        if (isClassWhitespace(input[position])) { // 6
+            output.append(input[position++]); // 6.1, 6.2
+            continue; // 6.3
+        }
+
+        // Step 7
+        Vector<UChar> s;
+        while (position < inputLength && !isClassWhitespace(input[position]))
+            s.append(input[position++]);
+
+        // Step 8
+        if (s == token) {
+            // Step 8.1
+            while (position < inputLength && isClassWhitespace(input[position]))
+                ++position;
+
+            // Step 8.2
+            size_t j = output.size();
+            while (j > 0 && isClassWhitespace(output[j - 1]))
+                --j;
+            output.resize(j);
+
+            // Step 8.3
+            if (position < inputLength && !output.isEmpty())
+                output.append(' ');
+        } else
+            output.append(s); // Step 9
+    }
+
+    output.shrinkToFit();
+    m_element->setAttribute(classAttr, String::adopt(output));
+}
+
+bool DOMTokenList::toggle(const AtomicString& token, ExceptionCode& ec)
+{
+    if (!validateToken(token, ec))
+        return false;
+
+    if (containsInternal(token)) {
+        removeInternal(token);
+        return false;
+    }
+    addInternal(token);
+    return true;
+}
+
+String DOMTokenList::toString() const
+{
+    return m_element->fastGetAttribute(classAttr);
+}
+
+void DOMTokenList::reset(const String& newClassName)
+{
+    if (!m_classNamesForQuirksMode.isNull())
+        m_classNamesForQuirksMode.set(newClassName, false);
+}
+
+const SpaceSplitString& DOMTokenList::classNames() const
+{
+    if (!m_classNamesForQuirksMode.isNull())
+        return m_classNamesForQuirksMode;
+    return m_element->attributeMap()->classNames();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/DOMTokenList.h b/WebCore/html/DOMTokenList.h
new file mode 100644
index 0000000..fad69ca
--- /dev/null
+++ b/WebCore/html/DOMTokenList.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DOMTokenList_h
+#define DOMTokenList_h
+
+#include "ExceptionCode.h"
+#include "SpaceSplitString.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+class Element;
+
+class DOMTokenList : public Noncopyable {
+public:
+    static PassOwnPtr<DOMTokenList> create(Element* element)
+    {
+        return adoptPtr(new DOMTokenList(element));
+    }
+
+    void ref();
+    void deref();
+
+    unsigned length() const;
+    const AtomicString item(unsigned index) const;
+    bool contains(const AtomicString&, ExceptionCode&) const;
+    void add(const AtomicString&, ExceptionCode&);
+    void remove(const AtomicString&, ExceptionCode&);
+    bool toggle(const AtomicString&, ExceptionCode&);
+    String toString() const;
+
+    void reset(const String&);
+
+    Element* element() { return m_element; }
+
+private:
+    DOMTokenList(Element*);
+
+    void addInternal(const AtomicString&) const;
+    bool containsInternal(const AtomicString&) const;
+    void removeInternal(const AtomicString&) const;
+
+    const SpaceSplitString& classNames() const;
+
+    Element* m_element;
+    SpaceSplitString m_classNamesForQuirksMode;
+};
+
+} // namespace WebCore
+
+#endif // DOMTokenList_h
diff --git a/WebCore/html/DOMTokenList.idl b/WebCore/html/DOMTokenList.idl
new file mode 100644
index 0000000..a46900e
--- /dev/null
+++ b/WebCore/html/DOMTokenList.idl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+
+    interface [
+        GenerateConstructor,
+        HasIndexGetter
+    ] DOMTokenList {
+        readonly attribute unsigned long length;
+        [ConvertNullStringTo=Null] DOMString item(in unsigned long index);
+        boolean contains(in DOMString token) raises(DOMException);
+        void add(in DOMString token) raises(DOMException);
+        void remove(in DOMString token) raises(DOMException);
+        boolean toggle(in DOMString token) raises(DOMException);
+
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+        [DontEnum] DOMString toString();
+#endif
+    };
+
+}
diff --git a/WebCore/html/DateInputType.cpp b/WebCore/html/DateInputType.cpp
new file mode 100644
index 0000000..0605846
--- /dev/null
+++ b/WebCore/html/DateInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DateInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> DateInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new DateInputType(element));
+}
+
+const AtomicString& DateInputType::formControlType() const
+{
+    return InputTypeNames::date();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/DateInputType.h b/WebCore/html/DateInputType.h
new file mode 100644
index 0000000..e6f60d7
--- /dev/null
+++ b/WebCore/html/DateInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DateInputType_h
+#define DateInputType_h
+
+#include "TextFieldInputType.h"
+
+namespace WebCore {
+
+class DateInputType : public TextFieldInputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    DateInputType(HTMLInputElement* element) : TextFieldInputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // DateInputType_h
diff --git a/WebCore/html/DateTimeInputType.cpp b/WebCore/html/DateTimeInputType.cpp
new file mode 100644
index 0000000..0bf5e04
--- /dev/null
+++ b/WebCore/html/DateTimeInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DateTimeInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> DateTimeInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new DateTimeInputType(element));
+}
+
+const AtomicString& DateTimeInputType::formControlType() const
+{
+    return InputTypeNames::datetime();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/DateTimeInputType.h b/WebCore/html/DateTimeInputType.h
new file mode 100644
index 0000000..f24ebfb
--- /dev/null
+++ b/WebCore/html/DateTimeInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DateTimeInputType_h
+#define DateTimeInputType_h
+
+#include "TextFieldInputType.h"
+
+namespace WebCore {
+
+class DateTimeInputType : public TextFieldInputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    DateTimeInputType(HTMLInputElement* element) : TextFieldInputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // DateTimeInputType_h
diff --git a/WebCore/html/DateTimeLocalInputType.cpp b/WebCore/html/DateTimeLocalInputType.cpp
new file mode 100644
index 0000000..33c6cfa
--- /dev/null
+++ b/WebCore/html/DateTimeLocalInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DateTimeLocalInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> DateTimeLocalInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new DateTimeLocalInputType(element));
+}
+
+const AtomicString& DateTimeLocalInputType::formControlType() const
+{
+    return InputTypeNames::datetimelocal();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/DateTimeLocalInputType.h b/WebCore/html/DateTimeLocalInputType.h
new file mode 100644
index 0000000..1a3d866
--- /dev/null
+++ b/WebCore/html/DateTimeLocalInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DateTimeLocalInputType_h
+#define DateTimeLocalInputType_h
+
+#include "TextFieldInputType.h"
+
+namespace WebCore {
+
+class DateTimeLocalInputType : public TextFieldInputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    DateTimeLocalInputType(HTMLInputElement* element) : TextFieldInputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // DateTimeLocalInputType_h
diff --git a/WebCore/html/DocTypeStrings.gperf b/WebCore/html/DocTypeStrings.gperf
index 5c213b0..22488eb 100644
--- a/WebCore/html/DocTypeStrings.gperf
+++ b/WebCore/html/DocTypeStrings.gperf
@@ -1,23 +1,14 @@
 %struct-type
-struct PubIDInfo {
-    enum eMode { 
-        eQuirks,         
-        eQuirks3,       
-        eAlmostStandards
-    };
-
-    const char* name;
-    eMode mode_if_no_sysid;
-    eMode mode_if_sysid;
-}
-%language=ANSI-C
+struct PubIDInfo;
+%omit-struct-type
+%language=C++
 %readonly-tables
 %global-table
 %compare-strncmp
+%define class-name DocTypeStringsHash
 %define initializer-suffix ,PubIDInfo::eAlmostStandards,PubIDInfo::eAlmostStandards
-%define lookup-function-name findDoctypeEntry
+%define lookup-function-name findDoctypeEntryImpl
 %define hash-function-name doctype_hash_function
-%includes
 %enum
 %%
 "+//silmaril//dtd html pro v0r11 19970101//en", PubIDInfo::eQuirks3, PubIDInfo::eQuirks3
diff --git a/WebCore/html/EmailInputType.cpp b/WebCore/html/EmailInputType.cpp
new file mode 100644
index 0000000..4472310
--- /dev/null
+++ b/WebCore/html/EmailInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "EmailInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> EmailInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new EmailInputType(element));
+}
+
+const AtomicString& EmailInputType::formControlType() const
+{
+    return InputTypeNames::email();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/EmailInputType.h b/WebCore/html/EmailInputType.h
new file mode 100644
index 0000000..bbf6f73
--- /dev/null
+++ b/WebCore/html/EmailInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef EmailInputType_h
+#define EmailInputType_h
+
+#include "BaseTextInputType.h"
+
+namespace WebCore {
+
+class EmailInputType : public BaseTextInputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    EmailInputType(HTMLInputElement* element) : BaseTextInputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // ButtonInputType_h
diff --git a/WebCore/html/FileInputType.cpp b/WebCore/html/FileInputType.cpp
new file mode 100644
index 0000000..0e08362
--- /dev/null
+++ b/WebCore/html/FileInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FileInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> FileInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new FileInputType(element));
+}
+
+const AtomicString& FileInputType::formControlType() const
+{
+    return InputTypeNames::file();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/FileInputType.h b/WebCore/html/FileInputType.h
new file mode 100644
index 0000000..cebfab7
--- /dev/null
+++ b/WebCore/html/FileInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef FileInputType_h
+#define FileInputType_h
+
+#include "InputType.h"
+
+namespace WebCore {
+
+class FileInputType : public InputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    FileInputType(HTMLInputElement* element) : InputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // FileInputType_h
diff --git a/WebCore/html/HTMLAnchorElement.cpp b/WebCore/html/HTMLAnchorElement.cpp
index 995552e..8beccc2 100644
--- a/WebCore/html/HTMLAnchorElement.cpp
+++ b/WebCore/html/HTMLAnchorElement.cpp
@@ -33,6 +33,7 @@
 #include "KeyboardEvent.h"
 #include "MouseEvent.h"
 #include "Page.h"
+#include "PingLoader.h"
 #include "RenderImage.h"
 #include "ResourceHandle.h"
 #include "Settings.h"
@@ -147,6 +148,7 @@ void HTMLAnchorElement::defaultEventHandler(Event* event)
             String url = deprecatedParseURL(getAttribute(hrefAttr));
             appendServerMapMousePosition(url, event);
             handleLinkClick(event, document(), url, getAttribute(targetAttr), hasRel(RelationNoReferrer));
+            sendPings(document()->completeURL(url));
             return;
         }
 
@@ -440,6 +442,12 @@ String HTMLAnchorElement::search() const
     return query.isEmpty() ? "" : "?" + query;
 }
 
+String HTMLAnchorElement::origin() const
+{
+    RefPtr<SecurityOrigin> origin = SecurityOrigin::create(href());
+    return origin->toString();
+}
+
 void HTMLAnchorElement::setSearch(const String& value)
 {
     KURL url = href();
@@ -465,6 +473,16 @@ bool HTMLAnchorElement::isLiveLink() const
     return isLink() && treatLinkAsLiveForEventType(m_wasShiftKeyDownOnMouseDown ? MouseEventWithShiftKey : MouseEventWithoutShiftKey);
 }
 
+void HTMLAnchorElement::sendPings(const KURL& destinationURL)
+{
+    if (!hasAttribute(pingAttr) || !document()->settings()->hyperlinkAuditingEnabled())
+        return;
+
+    SpaceSplitString pingURLs(getAttribute(pingAttr), true);
+    for (unsigned i = 0; i < pingURLs.size(); i++)
+        PingLoader::sendPing(document()->frame(), document()->completeURL(pingURLs[i]), destinationURL);
+}
+
 HTMLAnchorElement::EventType HTMLAnchorElement::eventType(Event* event)
 {
     if (!event->isMouseEvent())
diff --git a/WebCore/html/HTMLAnchorElement.h b/WebCore/html/HTMLAnchorElement.h
index 16baff1..a7e7eec 100644
--- a/WebCore/html/HTMLAnchorElement.h
+++ b/WebCore/html/HTMLAnchorElement.h
@@ -82,6 +82,8 @@ public:
     String search() const;
     void setSearch(const String&);
 
+    String origin() const;
+
     String text() const;
 
     String toString() const;
@@ -109,6 +111,8 @@ private:
     virtual short tabIndex() const;
     virtual bool draggable() const;
 
+    void sendPings(const KURL& destinationURL);
+
     enum EventType {
         MouseEventWithoutShiftKey,
         MouseEventWithShiftKey,
diff --git a/WebCore/html/HTMLAnchorElement.idl b/WebCore/html/HTMLAnchorElement.idl
index f5e1bd9..c918fde 100644
--- a/WebCore/html/HTMLAnchorElement.idl
+++ b/WebCore/html/HTMLAnchorElement.idl
@@ -49,6 +49,8 @@ module html {
         attribute [ConvertNullToNullString] DOMString port;
         attribute [ConvertNullToNullString] DOMString protocol;
         attribute [ConvertNullToNullString] DOMString search;
+
+        readonly attribute [ConvertNullToNullString] DOMString origin;
 #endif
 
         readonly attribute DOMString text;
diff --git a/WebCore/html/HTMLAttributeNames.in b/WebCore/html/HTMLAttributeNames.in
index 103d2c6..7a80c13 100644
--- a/WebCore/html/HTMLAttributeNames.in
+++ b/WebCore/html/HTMLAttributeNames.in
@@ -229,6 +229,7 @@ optimum
 pattern
 placeholder
 pluginurl
+ping
 poster
 precision
 preload
@@ -257,7 +258,7 @@ size
 sortable
 sortdirection
 span
-speech
+webkitspeech
 spellcheck
 src
 standby
diff --git a/WebCore/html/HTMLCanvasElement.cpp b/WebCore/html/HTMLCanvasElement.cpp
index 6f46ab4..634fe13 100644
--- a/WebCore/html/HTMLCanvasElement.cpp
+++ b/WebCore/html/HTMLCanvasElement.cpp
@@ -377,7 +377,7 @@ void HTMLCanvasElement::createImageBuffer() const
         return;
     m_imageBuffer->context()->scale(FloatSize(size.width() / unscaledSize.width(), size.height() / unscaledSize.height()));
     m_imageBuffer->context()->setShadowsIgnoreTransforms(true);
-    m_imageBuffer->context()->setImageInterpolationQuality(CanvasInterpolationQuality);
+    m_imageBuffer->context()->setImageInterpolationQuality(DefaultInterpolationQuality);
 }
 
 GraphicsContext* HTMLCanvasElement::drawingContext() const
diff --git a/WebCore/html/HTMLCanvasElement.h b/WebCore/html/HTMLCanvasElement.h
index 01665c8..e6c0155 100644
--- a/WebCore/html/HTMLCanvasElement.h
+++ b/WebCore/html/HTMLCanvasElement.h
@@ -32,6 +32,14 @@
 #include "HTMLElement.h"
 #include "IntSize.h"
 
+#if PLATFORM(CHROMIUM)
+#define DefaultInterpolationQuality InterpolationMedium
+#elif PLATFORM(CG)
+#define DefaultInterpolationQuality InterpolationLow
+#else
+#define DefaultInterpolationQuality InterpolationDefault
+#endif
+
 namespace WebCore {
 
 class CanvasContextAttributes;
diff --git a/WebCore/html/HTMLDocument.cpp b/WebCore/html/HTMLDocument.cpp
index f9efc4f..e20e729 100644
--- a/WebCore/html/HTMLDocument.cpp
+++ b/WebCore/html/HTMLDocument.cpp
@@ -64,6 +64,7 @@
 #include "FrameLoader.h"
 #include "FrameTree.h"
 #include "FrameView.h"
+#include "HashTools.h"
 #include "HTMLDocumentParser.h"
 #include "HTMLBodyElement.h"
 #include "HTMLElementFactory.h"
@@ -74,8 +75,6 @@
 #include "Settings.h"
 #include <wtf/text/CString.h>
 
-#include "DocTypeStrings.cpp"
-
 namespace WebCore {
 
 using namespace HTMLNames;
diff --git a/WebCore/html/HTMLElement.idl b/WebCore/html/HTMLElement.idl
index 863f28c..b127c51 100644
--- a/WebCore/html/HTMLElement.idl
+++ b/WebCore/html/HTMLElement.idl
@@ -31,6 +31,7 @@ module html {
                  attribute [Reflect] DOMString lang;
                  attribute [Reflect] DOMString dir;
                  attribute [Reflect=class] DOMString className;
+                 readonly attribute DOMTokenList classList;
 
                  attribute long              tabIndex;
                  attribute boolean           draggable;
diff --git a/WebCore/html/HTMLImageElement.cpp b/WebCore/html/HTMLImageElement.cpp
index d223b1e..29ea592 100644
--- a/WebCore/html/HTMLImageElement.cpp
+++ b/WebCore/html/HTMLImageElement.cpp
@@ -180,7 +180,7 @@ String HTMLImageElement::altText() const
 
 RenderObject* HTMLImageElement::createRenderer(RenderArena* arena, RenderStyle* style)
 {
-     if (style->contentData())
+    if (style->contentData())
         return RenderObject::createObject(this, style);
 
     RenderImage* image = new (arena) RenderImage(this);
diff --git a/WebCore/html/HTMLInputElement.cpp b/WebCore/html/HTMLInputElement.cpp
index 67b0c03..7e01de5 100644
--- a/WebCore/html/HTMLInputElement.cpp
+++ b/WebCore/html/HTMLInputElement.cpp
@@ -51,6 +51,7 @@
 #include "HTMLNames.h"
 #include "HTMLOptionElement.h"
 #include "HTMLParserIdioms.h"
+#include "InputType.h"
 #include "KeyboardEvent.h"
 #include "LocalizedStrings.h"
 #include "MouseEvent.h"
@@ -164,6 +165,7 @@ HTMLInputElement::HTMLInputElement(const QualifiedName& tagName, Document* docum
     , m_autocomplete(Uninitialized)
     , m_autofilled(false)
     , m_inited(false)
+    , m_inputType(InputType::createText(this))
 {
     ASSERT(hasTagName(inputTag) || hasTagName(isindexTag));
 }
@@ -348,17 +350,7 @@ bool HTMLInputElement::valueMissing(const String& value) const
 
 bool HTMLInputElement::patternMismatch(const String& value) const
 {
-    if (!isTextType())
-        return false;
-    const AtomicString& pattern = getAttribute(patternAttr);
-    // Empty values can't be mismatched
-    if (pattern.isEmpty() || value.isEmpty())
-        return false;
-    RegularExpression patternRegExp(pattern, TextCaseSensitive);
-    int matchLength = 0;
-    int valueLength = value.length();
-    int matchOffset = patternRegExp.match(value, 0, &matchLength);
-    return matchOffset || matchLength != valueLength;
+    return m_inputType->patternMismatch(value);
 }
 
 bool HTMLInputElement::tooLong(const String& value, NeedsToCheckDirtyFlag check) const
@@ -918,6 +910,7 @@ void HTMLInputElement::updateType()
             bool wasPasswordField = deprecatedInputType() == PASSWORD;
             bool didRespectHeightAndWidth = respectHeightAndWidthAttrs();
             m_deprecatedTypeNumber = newType;
+            m_inputType = InputType::create(this, typeString);
             setNeedsWillValidateCheck();
             bool willStoreValue = storesValueSeparateFromAttribute();
             bool isPasswordField = deprecatedInputType() == PASSWORD;
@@ -966,42 +959,9 @@ void HTMLInputElement::updateType()
         m_imageLoader.clear();
 }
 
-static const AtomicString* createFormControlTypes()
-{
-    AtomicString* types = new AtomicString[HTMLInputElement::deprecatedNumberOfTypes];
-    // The values must be lowercased because they will be the return values of
-    //  input.type and it must be lowercase according to DOM Level 2.
-    types[HTMLInputElement::BUTTON] = "button";
-    types[HTMLInputElement::CHECKBOX] = "checkbox";
-    types[HTMLInputElement::COLOR] = "color";
-    types[HTMLInputElement::DATE] = "date";
-    types[HTMLInputElement::DATETIME] = "datetime";
-    types[HTMLInputElement::DATETIMELOCAL] = "datetime-local";
-    types[HTMLInputElement::EMAIL] = "email";
-    types[HTMLInputElement::FILE] = "file";
-    types[HTMLInputElement::HIDDEN] = "hidden";
-    types[HTMLInputElement::IMAGE] = "image";
-    types[HTMLInputElement::ISINDEX] = emptyAtom;
-    types[HTMLInputElement::MONTH] = "month";
-    types[HTMLInputElement::NUMBER] = "number";
-    types[HTMLInputElement::PASSWORD] = "password";
-    types[HTMLInputElement::RADIO] = "radio";
-    types[HTMLInputElement::RANGE] = "range";
-    types[HTMLInputElement::RESET] = "reset";
-    types[HTMLInputElement::SEARCH] = "search";
-    types[HTMLInputElement::SUBMIT] = "submit";
-    types[HTMLInputElement::TELEPHONE] = "tel";
-    types[HTMLInputElement::TEXT] = "text";
-    types[HTMLInputElement::TIME] = "time";
-    types[HTMLInputElement::URL] = "url";
-    types[HTMLInputElement::WEEK] = "week";
-    return types;
-}
-
 const AtomicString& HTMLInputElement::formControlType() const
 {
-    static const AtomicString* formControlTypes = createFormControlTypes();
-    return formControlTypes[deprecatedInputType()];
+    return m_inputType->formControlType();
 }
 
 bool HTMLInputElement::saveFormControlState(String& result) const
@@ -1255,7 +1215,7 @@ void HTMLInputElement::parseMappedAttribute(Attribute* attr)
         // FIXME: we need to tell this change to a renderer if the attribute affects the appearance.
 #endif
 #if ENABLE(INPUT_SPEECH)
-    else if (attr->name() == speechAttr) {
+    else if (attr->name() == webkitspeechAttr) {
       if (renderer())
           renderer()->updateFromElement();
       setNeedsStyleRecalc();
@@ -1488,70 +1448,12 @@ void HTMLInputElement::reset()
 
 bool HTMLInputElement::isTextField() const
 {
-    switch (deprecatedInputType()) {
-    case COLOR:
-    case DATE:
-    case DATETIME:
-    case DATETIMELOCAL:
-    case EMAIL:
-    case ISINDEX:
-    case MONTH:
-    case NUMBER:
-    case PASSWORD:
-    case SEARCH:
-    case TELEPHONE:
-    case TEXT:
-    case TIME:
-    case URL:
-    case WEEK:
-        return true;
-    case BUTTON:
-    case CHECKBOX:
-    case FILE:
-    case HIDDEN:
-    case IMAGE:
-    case RADIO:
-    case RANGE:
-    case RESET:
-    case SUBMIT:
-        return false;
-    }
-    ASSERT_NOT_REACHED();
-    return false;
+    return m_inputType->isTextField();
 }
 
 bool HTMLInputElement::isTextType() const
 {
-    switch (deprecatedInputType()) {
-    case EMAIL:
-    case PASSWORD:
-    case SEARCH:
-    case TELEPHONE:
-    case TEXT:
-    case URL:
-        return true;
-    case BUTTON:
-    case CHECKBOX:
-    case COLOR:
-    case DATE:
-    case DATETIME:
-    case DATETIMELOCAL:
-    case FILE:
-    case HIDDEN:
-    case IMAGE:
-    case ISINDEX:
-    case MONTH:
-    case NUMBER:
-    case RADIO:
-    case RANGE:
-    case RESET:
-    case SUBMIT:
-    case TIME:
-    case WEEK:
-        return false;
-    }
-    ASSERT_NOT_REACHED();
-    return false;
+    return m_inputType->isTextType();
 }
 
 void HTMLInputElement::setChecked(bool nowChecked, bool sendChangeEvent)
@@ -2277,6 +2179,11 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
             return;
         }
     }
+    if (deprecatedInputType() == RANGE && evt->isKeyboardEvent()) {
+        handleKeyEventForRange(static_cast<KeyboardEvent*>(evt));
+        if (evt->defaultHandled())
+            return;
+    }
  
    if (isTextField()
             && evt->type() == eventNames().keydownEvent
@@ -2583,6 +2490,47 @@ void HTMLInputElement::handleBeforeTextInsertedEvent(Event* event)
     InputElement::handleBeforeTextInsertedEvent(m_data, this, this, event);
 }
 
+void HTMLInputElement::handleKeyEventForRange(KeyboardEvent* event)
+{
+    if (event->type() != eventNames().keydownEvent)
+        return;
+    String key = event->keyIdentifier();
+    if (key != "Up" && key != "Right" && key != "Down" && key != "Left")
+        return;
+
+    ExceptionCode ec;
+    if (equalIgnoringCase(getAttribute(stepAttr), "any")) {
+        double min = minimum();
+        double max = maximum();
+        // FIXME: Is 1/100 reasonable?
+        double step = (max - min) / 100;
+        double current = parseToDouble(value(), numeric_limits<double>::quiet_NaN());
+        ASSERT(isfinite(current));
+        double newValue;
+        if (key == "Up" || key == "Right") {
+            newValue = current + step;
+            if (newValue > max)
+                newValue = max;
+        } else {
+            newValue = current - step;
+            if (newValue < min)
+                newValue = min;
+        }
+        if (newValue != current) {
+            setValueAsNumber(newValue, ec);
+            dispatchFormControlChangeEvent();
+        }
+    } else {
+        int stepMagnification = (key == "Up" || key == "Right") ? 1 : -1;
+        String lastStringValue = value();
+        stepUp(stepMagnification, ec);
+        if (lastStringValue != value())
+            dispatchFormControlChangeEvent();
+    }
+    event->setDefaultHandled();
+    return;
+}
+
 PassRefPtr<HTMLFormElement> HTMLInputElement::createTemporaryFormForIsIndex()
 {
     RefPtr<HTMLFormElement> form = HTMLFormElement::create(document());
@@ -3010,7 +2958,7 @@ bool HTMLInputElement::isSpeechEnabled() const
     case SEARCH:
     case TELEPHONE:
     case TEXT:
-        return hasAttribute(speechAttr);
+        return hasAttribute(webkitspeechAttr);
     case BUTTON:
     case CHECKBOX:
     case COLOR:
diff --git a/WebCore/html/HTMLInputElement.h b/WebCore/html/HTMLInputElement.h
index 7e601ca..88e2bf7 100644
--- a/WebCore/html/HTMLInputElement.h
+++ b/WebCore/html/HTMLInputElement.h
@@ -35,6 +35,7 @@ class FileList;
 class HTMLDataListElement;
 class HTMLImageLoader;
 class HTMLOptionElement;
+class InputType;
 class KURL;
 class VisibleSelection;
 
@@ -65,9 +66,7 @@ public:
         MONTH,
         TIME,
         WEEK,
-        // If you add new types or change the order of enum values, update deprecatedNumberOfTypes below.
     };
-    static const int deprecatedNumberOfTypes = WEEK + 1;
 
     static PassRefPtr<HTMLInputElement> create(const QualifiedName&, Document*, HTMLFormElement*);
     virtual ~HTMLInputElement();
@@ -325,6 +324,7 @@ private:
     void updateCheckedRadioButtons();
     
     void handleBeforeTextInsertedEvent(Event*);
+    void handleKeyEventForRange(KeyboardEvent*);
     PassRefPtr<HTMLFormElement> createTemporaryFormForIsIndex();
     // Helper for getAllowedValueStep();
     bool getStepParameters(double* defaultStep, double* stepScaleFactor) const;
@@ -374,6 +374,7 @@ private:
 #if ENABLE(DATALIST)
     bool m_hasNonEmptyList : 1;
 #endif
+    OwnPtr<InputType> m_inputType;
 };
 
 } //namespace
diff --git a/WebCore/html/HTMLInputElement.idl b/WebCore/html/HTMLInputElement.idl
index 19e4226..19dfa5a 100644
--- a/WebCore/html/HTMLInputElement.idl
+++ b/WebCore/html/HTMLInputElement.idl
@@ -100,7 +100,7 @@ module html {
         readonly attribute NodeList labels;
 
 #if defined(ENABLE_INPUT_SPEECH) && ENABLE_INPUT_SPEECH
-        attribute [Reflect, EnabledAtRuntime] boolean speech;
+        attribute [Reflect, EnabledAtRuntime] boolean webkitspeech;
 #endif
     };
 
diff --git a/WebCore/html/HTMLMediaElement.cpp b/WebCore/html/HTMLMediaElement.cpp
index f753183..6399f60 100644
--- a/WebCore/html/HTMLMediaElement.cpp
+++ b/WebCore/html/HTMLMediaElement.cpp
@@ -969,22 +969,16 @@ void HTMLMediaElement::setReadyState(MediaPlayer::ReadyState state)
         return;
 
     if (m_seeking) {
-        // 4.8.10.10, step 8
+        // 4.8.10.9, step 11
         if (wasPotentiallyPlaying && m_readyState < HAVE_FUTURE_DATA)
             scheduleEvent(eventNames().waitingEvent);
 
-        // 4.8.10.10, step 9
-        if (m_readyState < HAVE_CURRENT_DATA) {
-            if (oldState >= HAVE_CURRENT_DATA)
-                scheduleEvent(eventNames().seekingEvent);
-        } else {
-            // 4.8.10.10 step 12 & 13.
+        // 4.8.10.10 step 14 & 15.
+        if (m_readyState >= HAVE_CURRENT_DATA)
             finishSeek();
-        }
-
     } else {
         if (wasPotentiallyPlaying && m_readyState < HAVE_FUTURE_DATA) {
-            // 4.8.10.9
+            // 4.8.10.8
             scheduleTimeupdateEvent(false);
             scheduleEvent(eventNames().waitingEvent);
         }
@@ -1107,27 +1101,39 @@ void HTMLMediaElement::seek(float time, ExceptionCode& ec)
     // Get the current time before setting m_seeking, m_lastSeekTime is returned once it is set.
     float now = currentTime();
 
+    // 2 - If the element's seeking IDL attribute is true, then another instance of this algorithm is
+    // already running. Abort that other instance of the algorithm without waiting for the step that
+    // it is running to complete.
+    // Nothing specific to be done here.
+
     // 3 - Set the seeking IDL attribute to true.
-    // The flag will be cleared when the engine tells is the time has actually changed
+    // The flag will be cleared when the engine tells us the time has actually changed.
     m_seeking = true;
 
-    // 4 - Queue a task to fire a simple event named timeupdate at the element.
-    scheduleTimeupdateEvent(false);
-
-    // 6 - If the new playback position is later than the end of the media resource, then let it be the end 
+    // 5 - If the new playback position is later than the end of the media resource, then let it be the end 
     // of the media resource instead.
     time = min(time, duration());
 
-    // 7 - If the new playback position is less than the earliest possible position, let it be that position instead.
+    // 6 - If the new playback position is less than the earliest possible position, let it be that position instead.
     float earliestTime = m_player->startTime();
     time = max(time, earliestTime);
 
-    // 8 - If the (possibly now changed) new playback position is not in one of the ranges given in the 
+    // 7 - If the (possibly now changed) new playback position is not in one of the ranges given in the 
     // seekable attribute, then let it be the position in one of the ranges given in the seekable attribute 
     // that is the nearest to the new playback position. ... If there are no ranges given in the seekable
     // attribute then set the seeking IDL attribute to false and abort these steps.
     RefPtr<TimeRanges> seekableRanges = seekable();
-    if (!seekableRanges->length() || time == now) {
+
+    // Short circuit seeking to the current time by just firing the events if no seek is required.
+    // Don't skip calling the media engine if we are in poster mode because a seek should always 
+    // cancel poster display.
+    bool noSeekRequired = !seekableRanges->length() || (time == now && displayMode() != Poster);
+    if (noSeekRequired) {
+        if (time == now) {
+            scheduleEvent(eventNames().seekingEvent);
+            scheduleTimeupdateEvent(false);
+            scheduleEvent(eventNames().seekedEvent);
+        }
         m_seeking = false;
         return;
     }
@@ -1140,20 +1146,26 @@ void HTMLMediaElement::seek(float time, ExceptionCode& ec)
     m_lastSeekTime = time;
     m_sentEndEvent = false;
 
-    // 9 - Set the current playback position to the given new playback position
+    // 8 - Set the current playback position to the given new playback position
     m_player->seek(time);
 
-    // 10-15 are handled, if necessary, when the engine signals a readystate change.
+    // 9 - Queue a task to fire a simple event named seeking at the element.
+    scheduleEvent(eventNames().seekingEvent);
+
+    // 10 - Queue a task to fire a simple event named timeupdate at the element.
+    scheduleTimeupdateEvent(false);
+
+    // 11-15 are handled, if necessary, when the engine signals a readystate change.
 }
 
 void HTMLMediaElement::finishSeek()
 {
     LOG(Media, "HTMLMediaElement::finishSeek");
 
-    // 4.8.10.10 Seeking step 12
+    // 4.8.10.9 Seeking step 14
     m_seeking = false;
 
-    // 4.8.10.10 Seeking step 13
+    // 4.8.10.9 Seeking step 15
     scheduleEvent(eventNames().seekedEvent);
 
     setDisplayMode(Video);
@@ -1666,8 +1678,8 @@ void HTMLMediaElement::mediaPlayerTimeChanged(MediaPlayer*)
     // movie time.
     scheduleTimeupdateEvent(false);
 
-    // 4.8.10.10 step 12 & 13.  Needed if no ReadyState change is associated with the seek.
-    if (m_readyState >= HAVE_CURRENT_DATA && m_seeking)
+    // 4.8.10.9 step 14 & 15.  Needed if no ReadyState change is associated with the seek.
+    if (m_seeking && m_readyState >= HAVE_CURRENT_DATA)
         finishSeek();
     
     float now = currentTime();
diff --git a/WebCore/html/HTMLTextAreaElement.cpp b/WebCore/html/HTMLTextAreaElement.cpp
index ad6c1b3..a5e7d1e 100644
--- a/WebCore/html/HTMLTextAreaElement.cpp
+++ b/WebCore/html/HTMLTextAreaElement.cpp
@@ -291,12 +291,20 @@ String HTMLTextAreaElement::value() const
 
 void HTMLTextAreaElement::setValue(const String& value)
 {
-    setNonDirtyValue(value);
+    setValueCommon(value);
     m_isDirty = true;
+    setNeedsValidityCheck();
 }
 
 void HTMLTextAreaElement::setNonDirtyValue(const String& value)
 {
+    setValueCommon(value);
+    m_isDirty = false;
+    setNeedsValidityCheck();
+}
+
+void HTMLTextAreaElement::setValueCommon(const String& value)
+{
     // Code elsewhere normalizes line endings added by the user via the keyboard or pasting.
     // We normalize line endings coming from JavaScript here.
     String normalizedValue = value.isNull() ? "" : value;
@@ -311,8 +319,6 @@ void HTMLTextAreaElement::setNonDirtyValue(const String& value)
     m_value = normalizedValue;
     updatePlaceholderVisibility(false);
     setNeedsStyleRecalc();
-    setNeedsValidityCheck();
-    m_isDirty = false;
     setFormControlValueMatchesRenderer(true);
 
     // Set the caret to the end of the text value.
diff --git a/WebCore/html/HTMLTextAreaElement.h b/WebCore/html/HTMLTextAreaElement.h
index 28d0b61..d951c02 100644
--- a/WebCore/html/HTMLTextAreaElement.h
+++ b/WebCore/html/HTMLTextAreaElement.h
@@ -67,6 +67,7 @@ private:
     static String sanitizeUserInputValue(const String&, unsigned maxLength);
     void updateValue() const;
     void setNonDirtyValue(const String&);
+    void setValueCommon(const String&);
 
     virtual bool supportsPlaceholder() const { return true; }
     virtual bool isEmptyValue() const { return value().isEmpty(); }
diff --git a/WebCore/html/HiddenInputType.cpp b/WebCore/html/HiddenInputType.cpp
new file mode 100644
index 0000000..d97fe3a
--- /dev/null
+++ b/WebCore/html/HiddenInputType.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "HiddenInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> HiddenInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new HiddenInputType(element));
+}
+
+const AtomicString& HiddenInputType::formControlType() const {
+    return InputTypeNames::hidden();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/HiddenInputType.h b/WebCore/html/HiddenInputType.h
new file mode 100644
index 0000000..564f99e
--- /dev/null
+++ b/WebCore/html/HiddenInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HiddenInputType_h
+#define HiddenInputType_h
+
+#include "InputType.h"
+
+namespace WebCore {
+
+class HiddenInputType : public InputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    HiddenInputType(HTMLInputElement* element) : InputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // HiddenInputType_h
diff --git a/WebCore/html/ImageInputType.cpp b/WebCore/html/ImageInputType.cpp
new file mode 100644
index 0000000..78b3981
--- /dev/null
+++ b/WebCore/html/ImageInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ImageInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> ImageInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new ImageInputType(element));
+}
+
+const AtomicString& ImageInputType::formControlType() const
+{
+    return InputTypeNames::image();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/ImageInputType.h b/WebCore/html/ImageInputType.h
new file mode 100644
index 0000000..00ac77b
--- /dev/null
+++ b/WebCore/html/ImageInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ImageInputType_h
+#define ImageInputType_h
+
+#include "InputType.h"
+
+namespace WebCore {
+
+class ImageInputType : public InputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    ImageInputType(HTMLInputElement* element) : InputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // ImageInputType_h
diff --git a/WebCore/html/InputType.cpp b/WebCore/html/InputType.cpp
new file mode 100644
index 0000000..c3435f7
--- /dev/null
+++ b/WebCore/html/InputType.cpp
@@ -0,0 +1,277 @@
+/*
+ * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
+ *           (C) 1999 Antti Koivisto (koivisto@kde.org)
+ *           (C) 2001 Dirk Mueller (mueller@kde.org)
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
+ * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "InputType.h"
+
+#include "ButtonInputType.h"
+#include "CheckboxInputType.h"
+#include "ColorInputType.h"
+#include "DateInputType.h"
+#include "DateTimeInputType.h"
+#include "DateTimeLocalInputType.h"
+#include "EmailInputType.h"
+#include "FileInputType.h"
+#include "HTMLInputElement.h"
+#include "HiddenInputType.h"
+#include "ImageInputType.h"
+#include "IsIndexInputType.h"
+#include "MonthInputType.h"
+#include "NumberInputType.h"
+#include "PasswordInputType.h"
+#include "RadioInputType.h"
+#include "RangeInputType.h"
+#include "RegularExpression.h"
+#include "ResetInputType.h"
+#include "SearchInputType.h"
+#include "SubmitInputType.h"
+#include "TelephoneInputType.h"
+#include "TextInputType.h"
+#include "TimeInputType.h"
+#include "URLInputType.h"
+#include "WeekInputType.h"
+#include <wtf/HashMap.h>
+#include <wtf/text/StringHash.h>
+
+namespace WebCore {
+
+typedef HashMap<String, PassOwnPtr<InputType> (*)(HTMLInputElement*), CaseFoldingHash> InputTypeFactoryMap;
+static PassOwnPtr<InputTypeFactoryMap> createInputTypeFactoryMap()
+{
+    OwnPtr<InputTypeFactoryMap> map = adoptPtr(new InputTypeFactoryMap);
+    map->add(InputTypeNames::button(), ButtonInputType::create);
+    map->add(InputTypeNames::checkbox(), CheckboxInputType::create);
+    map->add(InputTypeNames::color(), ColorInputType::create);
+    map->add(InputTypeNames::date(), DateInputType::create);
+    map->add(InputTypeNames::datetime(), DateTimeInputType::create);
+    map->add(InputTypeNames::datetimelocal(), DateTimeLocalInputType::create);
+    map->add(InputTypeNames::email(), EmailInputType::create);
+    map->add(InputTypeNames::file(), FileInputType::create);
+    map->add(InputTypeNames::hidden(), HiddenInputType::create);
+    map->add(InputTypeNames::image(), ImageInputType::create);
+    map->add(InputTypeNames::isindex(), IsIndexInputType::create);
+    map->add(InputTypeNames::month(), MonthInputType::create);
+    map->add(InputTypeNames::number(), NumberInputType::create);
+    map->add(InputTypeNames::password(), PasswordInputType::create);
+    map->add(InputTypeNames::radio(), RadioInputType::create);
+    map->add(InputTypeNames::range(), RangeInputType::create);
+    map->add(InputTypeNames::reset(), ResetInputType::create);
+    map->add(InputTypeNames::search(), SearchInputType::create);
+    map->add(InputTypeNames::submit(), SubmitInputType::create);
+    map->add(InputTypeNames::telephone(), TelephoneInputType::create);
+    map->add(InputTypeNames::time(), TimeInputType::create);
+    map->add(InputTypeNames::url(), URLInputType::create);
+    map->add(InputTypeNames::week(), WeekInputType::create);
+    // No need to register "text" because it is the default type.
+    return map.release();
+}
+
+PassOwnPtr<InputType> InputType::create(HTMLInputElement* element, const AtomicString& typeName)
+{
+    static const InputTypeFactoryMap* factoryMap = createInputTypeFactoryMap().leakPtr();
+    PassOwnPtr<InputType> (*factory)(HTMLInputElement*) = typeName.isEmpty() ? 0 : factoryMap->get(typeName);
+    if (!factory)
+        factory = TextInputType::create;
+    return factory(element);
+}
+
+PassOwnPtr<InputType> InputType::createText(HTMLInputElement* element)
+{
+    return TextInputType::create(element);
+}
+
+InputType::~InputType()
+{
+}
+
+bool InputType::isTextField() const
+{
+    return false;
+}
+
+bool InputType::isTextType() const
+{
+    return false;
+}
+
+bool InputType::patternMismatch(const String&) const
+{
+    return false;
+}
+
+namespace InputTypeNames {
+
+// The type names must be lowercased because they will be the return values of
+// input.type and input.type must be lowercase according to DOM Level 2.
+
+const AtomicString& button()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("button"));
+    return name;
+}
+
+const AtomicString& checkbox()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("checkbox"));
+    return name;
+}
+
+const AtomicString& color()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("color"));
+    return name;
+}
+
+const AtomicString& date()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("date"));
+    return name;
+}
+
+const AtomicString& datetime()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("datetime"));
+    return name;
+}
+
+const AtomicString& datetimelocal()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("datetime-local"));
+    return name;
+}
+
+const AtomicString& email()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("email"));
+    return name;
+}
+
+const AtomicString& file()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("file"));
+    return name;
+}
+
+const AtomicString& hidden()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("hidden"));
+    return name;
+}
+
+const AtomicString& image()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("image"));
+    return name;
+}
+
+const AtomicString& isindex()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("khtml_isindex"));
+    return name;
+}
+
+const AtomicString& month()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("month"));
+    return name;
+}
+
+const AtomicString& number()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("number"));
+    return name;
+}
+
+const AtomicString& password()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("password"));
+    return name;
+}
+
+const AtomicString& radio()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("radio"));
+    return name;
+}
+
+const AtomicString& range()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("range"));
+    return name;
+}
+
+const AtomicString& reset()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("reset"));
+    return name;
+}
+
+const AtomicString& search()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("search"));
+    return name;
+}
+
+const AtomicString& submit()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("submit"));
+    return name;
+}
+
+const AtomicString& telephone()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("tel"));
+    return name;
+}
+
+const AtomicString& text()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("text"));
+    return name;
+}
+
+const AtomicString& time()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("time"));
+    return name;
+}
+
+const AtomicString& url()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("url"));
+    return name;
+}
+
+const AtomicString& week()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("week"));
+    return name;
+}
+
+} // namespace WebCore::InpuTypeNames
+
+} // namespace WebCore
+
diff --git a/WebCore/html/InputType.h b/WebCore/html/InputType.h
new file mode 100644
index 0000000..3141f34
--- /dev/null
+++ b/WebCore/html/InputType.h
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InputType_h
+#define InputType_h
+
+#include <wtf/Forward.h>
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+class HTMLInputElement;
+
+class InputType : public Noncopyable {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*, const AtomicString&);
+    static PassOwnPtr<InputType> createText(HTMLInputElement*);
+    virtual ~InputType();
+
+    virtual bool isTextField() const;
+    virtual bool isTextType() const;
+    virtual const AtomicString& formControlType() const = 0;
+
+    virtual bool patternMismatch(const String&) const;
+
+protected:
+    InputType(HTMLInputElement* element) : m_element(element) { }
+    HTMLInputElement* element() const { return m_element; }
+
+private:
+    // Raw pointer because the HTMLInputElement object owns this InputType object.
+    HTMLInputElement* m_element;
+};
+
+namespace InputTypeNames {
+
+const AtomicString& button();
+const AtomicString& checkbox();
+const AtomicString& color();
+const AtomicString& date();
+const AtomicString& datetime();
+const AtomicString& datetimelocal();
+const AtomicString& email();
+const AtomicString& file();
+const AtomicString& hidden();
+const AtomicString& image();
+const AtomicString& isindex();
+const AtomicString& month();
+const AtomicString& number();
+const AtomicString& password();
+const AtomicString& radio();
+const AtomicString& range();
+const AtomicString& reset();
+const AtomicString& search();
+const AtomicString& submit();
+const AtomicString& telephone();
+const AtomicString& text();
+const AtomicString& time();
+const AtomicString& url();
+const AtomicString& week();
+
+} // namespace WebCore::InputTypeNames
+
+} // namespace WebCore
+
+#endif
diff --git a/WebCore/html/IsIndexInputType.cpp b/WebCore/html/IsIndexInputType.cpp
new file mode 100644
index 0000000..80e0617
--- /dev/null
+++ b/WebCore/html/IsIndexInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IsIndexInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> IsIndexInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new IsIndexInputType(element));
+}
+
+const AtomicString& IsIndexInputType::formControlType() const
+{
+    return emptyAtom;
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/IsIndexInputType.h b/WebCore/html/IsIndexInputType.h
new file mode 100644
index 0000000..93a1c08
--- /dev/null
+++ b/WebCore/html/IsIndexInputType.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef IsIndexInputType_h
+#define IsIndexInputType_h
+
+#include "TextFieldInputType.h"
+#include <wtf/text/AtomicString.h>
+
+namespace WebCore {
+
+class IsIndexInputType : public TextFieldInputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    IsIndexInputType(HTMLInputElement* element) : TextFieldInputType(element) { };
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // IsIndexInputType_h
diff --git a/WebCore/html/MonthInputType.cpp b/WebCore/html/MonthInputType.cpp
new file mode 100644
index 0000000..54f78c6
--- /dev/null
+++ b/WebCore/html/MonthInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "MonthInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> MonthInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new MonthInputType(element));
+}
+
+const AtomicString& MonthInputType::formControlType() const
+{
+    return InputTypeNames::month();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/MonthInputType.h b/WebCore/html/MonthInputType.h
new file mode 100644
index 0000000..d605ffa
--- /dev/null
+++ b/WebCore/html/MonthInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef MonthInputType_h
+#define MonthInputType_h
+
+#include "TextFieldInputType.h"
+
+namespace WebCore {
+
+class MonthInputType : public TextFieldInputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    MonthInputType(HTMLInputElement* element) : TextFieldInputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // MonthInputType_h
diff --git a/WebCore/html/NumberInputType.cpp b/WebCore/html/NumberInputType.cpp
new file mode 100644
index 0000000..9aba5c3
--- /dev/null
+++ b/WebCore/html/NumberInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "NumberInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> NumberInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new NumberInputType(element));
+}
+
+const AtomicString& NumberInputType::formControlType() const
+{
+    return InputTypeNames::number();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/NumberInputType.h b/WebCore/html/NumberInputType.h
new file mode 100644
index 0000000..5347249
--- /dev/null
+++ b/WebCore/html/NumberInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NumberInputType_h
+#define NumberInputType_h
+
+#include "TextFieldInputType.h"
+
+namespace WebCore {
+
+class NumberInputType : public TextFieldInputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    NumberInputType(HTMLInputElement* element) : TextFieldInputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // NumberInputType_h
diff --git a/WebCore/html/PasswordInputType.cpp b/WebCore/html/PasswordInputType.cpp
new file mode 100644
index 0000000..a645f96
--- /dev/null
+++ b/WebCore/html/PasswordInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PasswordInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> PasswordInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new PasswordInputType(element));
+}
+
+const AtomicString& PasswordInputType::formControlType() const
+{
+    return InputTypeNames::password();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/PasswordInputType.h b/WebCore/html/PasswordInputType.h
new file mode 100644
index 0000000..db13449
--- /dev/null
+++ b/WebCore/html/PasswordInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PasswordInputType_h
+#define PasswordInputType_h
+
+#include "BaseTextInputType.h"
+
+namespace WebCore {
+
+class PasswordInputType : public BaseTextInputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    PasswordInputType(HTMLInputElement* element) : BaseTextInputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // PasswordInputType_h
diff --git a/WebCore/html/RadioInputType.cpp b/WebCore/html/RadioInputType.cpp
new file mode 100644
index 0000000..a1c8d04
--- /dev/null
+++ b/WebCore/html/RadioInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RadioInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> RadioInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new RadioInputType(element));
+}
+
+const AtomicString& RadioInputType::formControlType() const
+{
+    return InputTypeNames::radio();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/RadioInputType.h b/WebCore/html/RadioInputType.h
new file mode 100644
index 0000000..180c6dd
--- /dev/null
+++ b/WebCore/html/RadioInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RadioInputType_h
+#define RadioInputType_h
+
+#include "InputType.h"
+
+namespace WebCore {
+
+class RadioInputType : public InputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    RadioInputType(HTMLInputElement* element) : InputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // RadioInputType_h
diff --git a/WebCore/html/RangeInputType.cpp b/WebCore/html/RangeInputType.cpp
new file mode 100644
index 0000000..f5f7322
--- /dev/null
+++ b/WebCore/html/RangeInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RangeInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> RangeInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new RangeInputType(element));
+}
+
+const AtomicString& RangeInputType::formControlType() const
+{
+    return InputTypeNames::range();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/RangeInputType.h b/WebCore/html/RangeInputType.h
new file mode 100644
index 0000000..d42c617
--- /dev/null
+++ b/WebCore/html/RangeInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RangeInputType_h
+#define RangeInputType_h
+
+#include "InputType.h"
+
+namespace WebCore {
+
+class RangeInputType : public InputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    RangeInputType(HTMLInputElement* element) : InputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // RangeInputType_h
diff --git a/WebCore/html/ResetInputType.cpp b/WebCore/html/ResetInputType.cpp
new file mode 100644
index 0000000..8b18a8d
--- /dev/null
+++ b/WebCore/html/ResetInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ResetInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> ResetInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new ResetInputType(element));
+}
+
+const AtomicString& ResetInputType::formControlType() const
+{
+    return InputTypeNames::reset();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/ResetInputType.h b/WebCore/html/ResetInputType.h
new file mode 100644
index 0000000..e0d8997
--- /dev/null
+++ b/WebCore/html/ResetInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ResetInputType_h
+#define ResetInputType_h
+
+#include "InputType.h"
+
+namespace WebCore {
+
+class ResetInputType : public InputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    ResetInputType(HTMLInputElement* element) : InputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // ResetInputType_h
diff --git a/WebCore/html/SearchInputType.cpp b/WebCore/html/SearchInputType.cpp
new file mode 100644
index 0000000..6f3a01c
--- /dev/null
+++ b/WebCore/html/SearchInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SearchInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> SearchInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new SearchInputType(element));
+}
+
+const AtomicString& SearchInputType::formControlType() const
+{
+    return InputTypeNames::search();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/SearchInputType.h b/WebCore/html/SearchInputType.h
new file mode 100644
index 0000000..edffdb0
--- /dev/null
+++ b/WebCore/html/SearchInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SearchInputType_h
+#define SearchInputType_h
+
+#include "BaseTextInputType.h"
+
+namespace WebCore {
+
+class SearchInputType : public BaseTextInputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    SearchInputType(HTMLInputElement* element) : BaseTextInputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // SearchInputType_h
diff --git a/WebCore/html/SubmitInputType.cpp b/WebCore/html/SubmitInputType.cpp
new file mode 100644
index 0000000..dd13e6b
--- /dev/null
+++ b/WebCore/html/SubmitInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SubmitInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> SubmitInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new SubmitInputType(element));
+}
+
+const AtomicString& SubmitInputType::formControlType() const
+{
+    return InputTypeNames::submit();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/SubmitInputType.h b/WebCore/html/SubmitInputType.h
new file mode 100644
index 0000000..7ea448e
--- /dev/null
+++ b/WebCore/html/SubmitInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SubmitInputType_h
+#define SubmitInputType_h
+
+#include "InputType.h"
+
+namespace WebCore {
+
+class SubmitInputType : public InputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    SubmitInputType(HTMLInputElement* element) : InputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // SubmitInputType_h
diff --git a/WebCore/html/TelephoneInputType.cpp b/WebCore/html/TelephoneInputType.cpp
new file mode 100644
index 0000000..27d66ce
--- /dev/null
+++ b/WebCore/html/TelephoneInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TelephoneInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> TelephoneInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new TelephoneInputType(element));
+}
+
+const AtomicString& TelephoneInputType::formControlType() const
+{
+    return InputTypeNames::telephone();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/TelephoneInputType.h b/WebCore/html/TelephoneInputType.h
new file mode 100644
index 0000000..9458f50
--- /dev/null
+++ b/WebCore/html/TelephoneInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TelephoneInputType_h
+#define TelephoneInputType_h
+
+#include "BaseTextInputType.h"
+
+namespace WebCore {
+
+class TelephoneInputType : public BaseTextInputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    TelephoneInputType(HTMLInputElement* element) : BaseTextInputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // TelephoneInputType_h
diff --git a/WebCore/html/TextFieldInputType.cpp b/WebCore/html/TextFieldInputType.cpp
new file mode 100644
index 0000000..e681b40
--- /dev/null
+++ b/WebCore/html/TextFieldInputType.cpp
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TextFieldInputType.h"
+
+namespace WebCore {
+
+bool TextFieldInputType::isTextField() const
+{
+    return true;
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/TextFieldInputType.h b/WebCore/html/TextFieldInputType.h
new file mode 100644
index 0000000..fb33a01
--- /dev/null
+++ b/WebCore/html/TextFieldInputType.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TextFieldInputType_h
+#define TextFieldInputType_h
+
+#include "InputType.h"
+
+namespace WebCore {
+
+// The class represents types of which UI contain text fields.
+// It supports not only the types for BaseTextInputType but also type=number.
+class TextFieldInputType : public InputType {
+protected:
+    TextFieldInputType(HTMLInputElement* element) : InputType(element) { }
+    virtual bool isTextField() const;
+};
+
+} // namespace WebCore
+
+#endif // TextFieldInputType_h
diff --git a/WebCore/html/TextInputType.cpp b/WebCore/html/TextInputType.cpp
new file mode 100644
index 0000000..23a8679
--- /dev/null
+++ b/WebCore/html/TextInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TextInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> TextInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new TextInputType(element));
+}
+
+const AtomicString& TextInputType::formControlType() const
+{
+    return InputTypeNames::text();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/TextInputType.h b/WebCore/html/TextInputType.h
new file mode 100644
index 0000000..89fd9b0
--- /dev/null
+++ b/WebCore/html/TextInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TextInputType_h
+#define TextInputType_h
+
+#include "BaseTextInputType.h"
+
+namespace WebCore {
+
+class TextInputType : public BaseTextInputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    TextInputType(HTMLInputElement* element) : BaseTextInputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // TextInputType_h
diff --git a/WebCore/html/TimeInputType.cpp b/WebCore/html/TimeInputType.cpp
new file mode 100644
index 0000000..1564bc5
--- /dev/null
+++ b/WebCore/html/TimeInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TimeInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> TimeInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new TimeInputType(element));
+}
+
+const AtomicString& TimeInputType::formControlType() const
+{
+    return InputTypeNames::time();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/TimeInputType.h b/WebCore/html/TimeInputType.h
new file mode 100644
index 0000000..9530f7d
--- /dev/null
+++ b/WebCore/html/TimeInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TimeInputType_h
+#define TimeInputType_h
+
+#include "TextFieldInputType.h"
+
+namespace WebCore {
+
+class TimeInputType : public TextFieldInputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    TimeInputType(HTMLInputElement* element) : TextFieldInputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // TimeInputType_h
diff --git a/WebCore/html/URLInputType.cpp b/WebCore/html/URLInputType.cpp
new file mode 100644
index 0000000..2afdcde
--- /dev/null
+++ b/WebCore/html/URLInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "URLInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> URLInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new URLInputType(element));
+}
+
+const AtomicString& URLInputType::formControlType() const
+{
+    return InputTypeNames::url();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/URLInputType.h b/WebCore/html/URLInputType.h
new file mode 100644
index 0000000..85d4f9f
--- /dev/null
+++ b/WebCore/html/URLInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef URLInputType_h
+#define URLInputType_h
+
+#include "BaseTextInputType.h"
+
+namespace WebCore {
+
+class URLInputType : public BaseTextInputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    URLInputType(HTMLInputElement* element) : BaseTextInputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // URLInputType_h
diff --git a/WebCore/html/WeekInputType.cpp b/WebCore/html/WeekInputType.cpp
new file mode 100644
index 0000000..0b4ab30
--- /dev/null
+++ b/WebCore/html/WeekInputType.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WeekInputType.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+PassOwnPtr<InputType> WeekInputType::create(HTMLInputElement* element)
+{
+    return adoptPtr(new WeekInputType(element));
+}
+
+const AtomicString& WeekInputType::formControlType() const
+{
+    return InputTypeNames::week();
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/WeekInputType.h b/WebCore/html/WeekInputType.h
new file mode 100644
index 0000000..7b6ee23
--- /dev/null
+++ b/WebCore/html/WeekInputType.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WeekInputType_h
+#define WeekInputType_h
+
+#include "TextFieldInputType.h"
+
+namespace WebCore {
+
+class WeekInputType : public TextFieldInputType {
+public:
+    static PassOwnPtr<InputType> create(HTMLInputElement*);
+
+private:
+    WeekInputType(HTMLInputElement* element) : TextFieldInputType(element) { }
+    virtual const AtomicString& formControlType() const;
+};
+
+} // namespace WebCore
+
+#endif // WeekInputType_h
diff --git a/WebCore/html/canvas/CanvasRenderingContext.cpp b/WebCore/html/canvas/CanvasRenderingContext.cpp
index e019332..c814c66 100644
--- a/WebCore/html/canvas/CanvasRenderingContext.cpp
+++ b/WebCore/html/canvas/CanvasRenderingContext.cpp
@@ -25,7 +25,14 @@
 
 #include "config.h"
 #include "CanvasRenderingContext.h"
+
+#include "CachedImage.h"
+#include "CanvasPattern.h"
 #include "HTMLCanvasElement.h"
+#include "HTMLImageElement.h"
+#include "HTMLVideoElement.h"
+#include "KURL.h"
+#include "SecurityOrigin.h"
 
 namespace WebCore {
 
@@ -44,4 +51,48 @@ void CanvasRenderingContext::deref()
     m_canvas->deref(); 
 }
 
+void CanvasRenderingContext::checkOrigin(const CanvasPattern* pattern)
+{
+    if (canvas()->originClean() && pattern && !pattern->originClean())
+        canvas()->setOriginTainted();
+}
+
+void CanvasRenderingContext::checkOrigin(const HTMLCanvasElement* sourceCanvas)
+{
+    if (canvas()->originClean() && sourceCanvas && !sourceCanvas->originClean())
+        canvas()->setOriginTainted();
+}
+
+void CanvasRenderingContext::checkOrigin(const HTMLImageElement* image)
+{
+    if (!image || !canvas()->originClean())
+        return;
+
+    CachedImage* cachedImage = image->cachedImage();
+    checkOrigin(cachedImage->response().url());
+
+    if (canvas()->originClean() && !cachedImage->image()->hasSingleSecurityOrigin())
+        canvas()->setOriginTainted();
+}
+
+void CanvasRenderingContext::checkOrigin(const HTMLVideoElement* video)
+{
+#if ENABLE(VIDEO)
+    checkOrigin(KURL(KURL(), video->currentSrc()));
+    if (canvas()->originClean() && video && !video->hasSingleSecurityOrigin())
+        canvas()->setOriginTainted();
+#endif
+}
+
+void CanvasRenderingContext::checkOrigin(const KURL& url)
+{
+    if (!canvas()->originClean() || m_cleanOrigins.contains(url.string()))
+        return;
+
+    if (canvas()->securityOrigin().taintsCanvas(url))
+        canvas()->setOriginTainted();
+    else
+        m_cleanOrigins.add(url.string());
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/canvas/CanvasRenderingContext.h b/WebCore/html/canvas/CanvasRenderingContext.h
index 8499b47..a25e8a1 100644
--- a/WebCore/html/canvas/CanvasRenderingContext.h
+++ b/WebCore/html/canvas/CanvasRenderingContext.h
@@ -28,38 +28,52 @@
 
 #include "GraphicsLayer.h"
 
+#include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/text/StringHash.h>
 
 namespace WebCore {
 
-    class WebGLObject;
-    class HTMLCanvasElement;
+class CanvasPattern;
+class HTMLCanvasElement;
+class HTMLImageElement;
+class HTMLVideoElement;
+class KURL;
+class WebGLObject;
 
-    class CanvasRenderingContext : public Noncopyable {
-    public:
-        CanvasRenderingContext(HTMLCanvasElement*);
-        virtual ~CanvasRenderingContext() { }
-        
-        // Ref and deref the m_canvas
-        void ref();
-        void deref();
-        
-        HTMLCanvasElement* canvas() const { return m_canvas; }
-        
-        virtual bool is2d() const { return false; }
-        virtual bool is3d() const { return false; }
-        virtual bool isAccelerated() const { return false; }
-        
-        virtual void paintRenderingResultsToCanvas() {}
-        virtual bool paintsIntoCanvasBuffer() const { return true; }
+class CanvasRenderingContext : public Noncopyable {
+public:
+    CanvasRenderingContext(HTMLCanvasElement*);
+    virtual ~CanvasRenderingContext() { }
+
+    // Ref and deref the m_canvas
+    void ref();
+    void deref();
+
+    HTMLCanvasElement* canvas() const { return m_canvas; }
+
+    virtual bool is2d() const { return false; }
+    virtual bool is3d() const { return false; }
+    virtual bool isAccelerated() const { return false; }
+
+    virtual void paintRenderingResultsToCanvas() {}
+    virtual bool paintsIntoCanvasBuffer() const { return true; }
 
 #if USE(ACCELERATED_COMPOSITING)
-        virtual PlatformLayer* platformLayer() const { return 0; }
+    virtual PlatformLayer* platformLayer() const { return 0; }
 #endif
 
-    private:
-        HTMLCanvasElement* m_canvas;
-    };
+protected:
+    void checkOrigin(const CanvasPattern*);
+    void checkOrigin(const HTMLCanvasElement*);
+    void checkOrigin(const HTMLImageElement*);
+    void checkOrigin(const HTMLVideoElement*);
+    void checkOrigin(const KURL&);
+
+private:
+    HTMLCanvasElement* m_canvas;
+    HashSet<String> m_cleanOrigins;
+};
 
 } // namespace WebCore
 
diff --git a/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index 0fb7ed5..161a891 100644
--- a/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -249,12 +249,7 @@ void CanvasRenderingContext2D::setStrokeStyle(PassRefPtr<CanvasStyle> style)
     if (state().m_strokeStyle && state().m_strokeStyle->isEquivalentColor(*style))
         return;
 
-    if (canvas()->originClean()) {
-        if (CanvasPattern* pattern = style->canvasPattern()) {
-            if (!pattern->originClean())
-                canvas()->setOriginTainted();
-        }
-    }
+    checkOrigin(style->canvasPattern());
 
     state().m_strokeStyle = style;
     GraphicsContext* c = drawingContext();
@@ -277,12 +272,7 @@ void CanvasRenderingContext2D::setFillStyle(PassRefPtr<CanvasStyle> style)
     if (state().m_fillStyle && state().m_fillStyle->isEquivalentColor(*style))
         return;
 
-    if (canvas()->originClean()) {
-        if (CanvasPattern* pattern = style->canvasPattern()) {
-            if (!pattern->originClean())
-                canvas()->setOriginTainted();
-        }
-    }
+    checkOrigin(style->canvasPattern());
 
     state().m_fillStyle = style;
     GraphicsContext* c = drawingContext();
@@ -1121,25 +1111,6 @@ static inline FloatRect normalizeRect(const FloatRect& rect)
         max(rect.height(), -rect.height()));
 }
 
-void CanvasRenderingContext2D::checkOrigin(const KURL& url)
-{
-    if (m_cleanOrigins.contains(url.string()))
-        return;
-
-    if (canvas()->securityOrigin().taintsCanvas(url))
-        canvas()->setOriginTainted();
-    else
-        m_cleanOrigins.add(url.string());
-}
-
-void CanvasRenderingContext2D::checkOrigin(const String& url)
-{
-    if (m_cleanOrigins.contains(url))
-        return;
-
-    checkOrigin(KURL(KURL(), url));
-}
-
 void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, float x, float y, ExceptionCode& ec)
 {
     if (!image) {
@@ -1186,18 +1157,21 @@ void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, const FloatRec
         || !isfinite(srcRect.x()) || !isfinite(srcRect.y()) || !isfinite(srcRect.width()) || !isfinite(srcRect.height()))
         return;
 
+    if (!dstRect.width() || !dstRect.height())
+        return;
+
     if (!image->complete())
         return;
 
+    FloatRect normalizedSrcRect = normalizeRect(srcRect);
+    FloatRect normalizedDstRect = normalizeRect(dstRect);
+
     FloatRect imageRect = FloatRect(FloatPoint(), size(image));
-    if (!imageRect.contains(normalizeRect(srcRect)) || !srcRect.width() || !srcRect.height()) {
+    if (!imageRect.contains(normalizedSrcRect) || !srcRect.width() || !srcRect.height()) {
         ec = INDEX_SIZE_ERR;
         return;
     }
 
-    if (!dstRect.width() || !dstRect.height())
-        return;
-
     GraphicsContext* c = drawingContext();
     if (!c)
         return;
@@ -1208,14 +1182,10 @@ void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, const FloatRec
     if (!cachedImage)
         return;
 
-    if (canvas()->originClean())
-        checkOrigin(cachedImage->response().url());
-
-    if (canvas()->originClean() && !cachedImage->image()->hasSingleSecurityOrigin())
-        canvas()->setOriginTainted();
+    checkOrigin(image);
 
-    FloatRect sourceRect = c->roundToDevicePixels(srcRect);
-    FloatRect destRect = c->roundToDevicePixels(dstRect);
+    FloatRect sourceRect = c->roundToDevicePixels(normalizedSrcRect);
+    FloatRect destRect = c->roundToDevicePixels(normalizedDstRect);
     c->drawImage(cachedImage->image(), DeviceColorSpace, destRect, sourceRect, state().m_globalComposite);
     didDraw(destRect);
 }
@@ -1285,8 +1255,7 @@ void CanvasRenderingContext2D::drawImage(HTMLCanvasElement* sourceCanvas, const
     if (!buffer)
         return;
 
-    if (!sourceCanvas->originClean())
-        canvas()->setOriginTainted();
+    checkOrigin(sourceCanvas);
 
 #if ENABLE(ACCELERATED_2D_CANVAS)
     // If we're drawing from one accelerated canvas 2d to another, avoid calling sourceCanvas->makeRenderingResultsAvailable()
@@ -1360,11 +1329,7 @@ void CanvasRenderingContext2D::drawImage(HTMLVideoElement* video, const FloatRec
     if (!state().m_invertibleCTM)
         return;
 
-    if (canvas()->originClean())
-        checkOrigin(video->currentSrc());
-
-    if (canvas()->originClean() && !video->hasSingleSecurityOrigin())
-        canvas()->setOriginTainted();
+    checkOrigin(video);
 
     FloatRect sourceRect = c->roundToDevicePixels(srcRect);
     FloatRect destRect = c->roundToDevicePixels(dstRect);
@@ -1393,11 +1358,7 @@ void CanvasRenderingContext2D::drawImageFromRect(HTMLImageElement* image,
     if (!cachedImage)
         return;
 
-    if (canvas()->originClean())
-        checkOrigin(cachedImage->response().url());
-
-    if (canvas()->originClean() && !cachedImage->image()->hasSingleSecurityOrigin())
-        canvas()->setOriginTainted();
+    checkOrigin(image);
 
     GraphicsContext* c = drawingContext();
     if (!c)
@@ -1689,6 +1650,7 @@ void CanvasRenderingContext2D::setFont(const String& newFont)
     RefPtr<RenderStyle> newStyle = RenderStyle::create();
     if (RenderStyle* computedStyle = canvas()->computedStyle())
         newStyle->setFontDescription(computedStyle->fontDescription());
+    newStyle->font().update(newStyle->font().fontSelector());
 
     // Now map the font property into the style.
     CSSStyleSelector* styleSelector = canvas()->styleSelector();
diff --git a/WebCore/html/canvas/CanvasRenderingContext2D.h b/WebCore/html/canvas/CanvasRenderingContext2D.h
index 91b6549..2c88a31 100644
--- a/WebCore/html/canvas/CanvasRenderingContext2D.h
+++ b/WebCore/html/canvas/CanvasRenderingContext2D.h
@@ -36,7 +36,6 @@
 #include "PlatformString.h"
 
 #include <wtf/Vector.h>
-#include <wtf/text/StringHash.h>
 
 #if PLATFORM(CG)
 #include <ApplicationServices/ApplicationServices.h>
@@ -57,7 +56,6 @@ class HTMLCanvasElement;
 class HTMLImageElement;
 class HTMLVideoElement;
 class ImageData;
-class KURL;
 class TextMetrics;
 
 #if ENABLE(ACCELERATED_2D_CANVAS)
@@ -289,11 +287,6 @@ private:
 
     void prepareGradientForDashboard(CanvasGradient* gradient) const;
 
-    HashSet<String> m_cleanOrigins;
-
-    void checkOrigin(const KURL&);
-    void checkOrigin(const String&);
-
     Vector<State, 1> m_stateStack;
     bool m_usesCSSCompatibilityParseMode;
 #if ENABLE(DASHBOARD_SUPPORT)
diff --git a/WebCore/html/canvas/WebGLBuffer.cpp b/WebCore/html/canvas/WebGLBuffer.cpp
index d43868d..99d9cad 100644
--- a/WebCore/html/canvas/WebGLBuffer.cpp
+++ b/WebCore/html/canvas/WebGLBuffer.cpp
@@ -52,7 +52,8 @@ WebGLBuffer::WebGLBuffer(WebGLRenderingContext* ctx)
 
 void WebGLBuffer::deleteObjectImpl(Platform3DObject object)
 {
-    context()->graphicsContext3D()->deleteBuffer(object);
+    if (!isDeleted())
+        context()->graphicsContext3D()->deleteBuffer(object);
 }
 
 bool WebGLBuffer::associateBufferDataImpl(ArrayBuffer* array, unsigned byteOffset, unsigned byteLength)
diff --git a/WebCore/html/canvas/WebGLFramebuffer.cpp b/WebCore/html/canvas/WebGLFramebuffer.cpp
index 6291705..a709341 100644
--- a/WebCore/html/canvas/WebGLFramebuffer.cpp
+++ b/WebCore/html/canvas/WebGLFramebuffer.cpp
@@ -40,10 +40,6 @@ PassRefPtr<WebGLFramebuffer> WebGLFramebuffer::create(WebGLRenderingContext* ctx
 
 WebGLFramebuffer::WebGLFramebuffer(WebGLRenderingContext* ctx)
     : WebGLObject(ctx)
-    , m_colorAttachment(0)
-    , m_depthAttachment(0)
-    , m_stencilAttachment(0)
-    , m_depthStencilAttachment(0)
 {
     setObject(context()->graphicsContext3D()->createFramebuffer());
 }
@@ -73,6 +69,23 @@ void WebGLFramebuffer::setAttachment(unsigned long attachment, WebGLObject* atta
     initializeRenderbuffers();
 }
 
+void WebGLFramebuffer::removeAttachment(WebGLObject* attachment)
+{
+    if (!object())
+        return;
+    if (attachment == m_colorAttachment.get())
+        m_colorAttachment = 0;
+    else if (attachment == m_depthAttachment.get())
+        m_depthAttachment = 0;
+    else if (attachment == m_stencilAttachment.get())
+        m_stencilAttachment = 0;
+    else if (attachment == m_depthStencilAttachment.get())
+        m_depthStencilAttachment = 0;
+    else
+        return;
+    initializeRenderbuffers();
+}
+
 void WebGLFramebuffer::onBind()
 {
     initializeRenderbuffers();
@@ -83,8 +96,8 @@ void WebGLFramebuffer::onAttachedObjectChange(WebGLObject* object)
     // Currently object == 0 is not considered, but this might change if the
     // lifespan of WebGLObject changes.
     if (object
-        && (object == m_colorAttachment || object == m_depthAttachment
-            || object == m_stencilAttachment || object == m_depthStencilAttachment))
+        && (object == m_colorAttachment.get() || object == m_depthAttachment.get()
+            || object == m_stencilAttachment.get() || object == m_depthStencilAttachment.get()))
         initializeRenderbuffers();
 }
 
@@ -92,7 +105,7 @@ unsigned long WebGLFramebuffer::getColorBufferFormat()
 {
     if (object() && m_colorAttachment && m_colorAttachment->object()) {
         if (m_colorAttachment->isRenderbuffer()) {
-            unsigned long format = (reinterpret_cast<WebGLRenderbuffer*>(m_colorAttachment))->getInternalFormat();
+            unsigned long format = (reinterpret_cast<WebGLRenderbuffer*>(m_colorAttachment.get()))->getInternalFormat();
             switch (format) {
             case GraphicsContext3D::RGBA4:
             case GraphicsContext3D::RGB5_A1:
@@ -101,14 +114,19 @@ unsigned long WebGLFramebuffer::getColorBufferFormat()
                 return GraphicsContext3D::RGB;
             }
         } else if (m_colorAttachment->isTexture())
-            return (reinterpret_cast<WebGLTexture*>(m_colorAttachment))->getInternalFormat(0);
+            return (reinterpret_cast<WebGLTexture*>(m_colorAttachment.get()))->getInternalFormat(0);
     }
     return 0;
 }
 
 void WebGLFramebuffer::deleteObjectImpl(Platform3DObject object)
 {
-    context()->graphicsContext3D()->deleteFramebuffer(object);
+    if (!isDeleted())
+        context()->graphicsContext3D()->deleteFramebuffer(object);
+    m_colorAttachment = 0;
+    m_depthAttachment = 0;
+    m_stencilAttachment = 0;
+    m_depthStencilAttachment = 0;
 }
 
 bool WebGLFramebuffer::isUninitialized(WebGLObject* attachedObject)
@@ -131,19 +149,19 @@ void WebGLFramebuffer::initializeRenderbuffers()
         return;
     bool initColor = false, initDepth = false, initStencil = false;
     unsigned long mask = 0;
-    if (isUninitialized(m_colorAttachment)) {
+    if (isUninitialized(m_colorAttachment.get())) {
         initColor = true;
         mask |= GraphicsContext3D::COLOR_BUFFER_BIT;
     }
-    if (isUninitialized(m_depthAttachment)) {
+    if (isUninitialized(m_depthAttachment.get())) {
         initDepth = true;
         mask |= GraphicsContext3D::DEPTH_BUFFER_BIT;
     }
-    if (isUninitialized(m_stencilAttachment)) {
+    if (isUninitialized(m_stencilAttachment.get())) {
         initStencil = true;
         mask |= GraphicsContext3D::STENCIL_BUFFER_BIT;
     }
-    if (isUninitialized(m_depthStencilAttachment)) {
+    if (isUninitialized(m_depthStencilAttachment.get())) {
         initDepth = true;
         initStencil = true;
         mask |= (GraphicsContext3D::DEPTH_BUFFER_BIT | GraphicsContext3D::STENCIL_BUFFER_BIT);
@@ -209,14 +227,14 @@ void WebGLFramebuffer::initializeRenderbuffers()
         g3d->disable(GraphicsContext3D::DITHER);
 
     if (initColor)
-        setInitialized(m_colorAttachment);
+        setInitialized(m_colorAttachment.get());
     if (initDepth && initStencil && m_depthStencilAttachment)
-        setInitialized(m_depthStencilAttachment);
+        setInitialized(m_depthStencilAttachment.get());
     else {
         if (initDepth)
-            setInitialized(m_depthAttachment);
+            setInitialized(m_depthAttachment.get());
         if (initStencil)
-            setInitialized(m_stencilAttachment);
+            setInitialized(m_stencilAttachment.get());
     }
 }
 
diff --git a/WebCore/html/canvas/WebGLFramebuffer.h b/WebCore/html/canvas/WebGLFramebuffer.h
index ac945dd..1892694 100644
--- a/WebCore/html/canvas/WebGLFramebuffer.h
+++ b/WebCore/html/canvas/WebGLFramebuffer.h
@@ -44,6 +44,8 @@ public:
     bool isDepthStencilAttached() const { return (m_depthStencilAttachment && m_depthStencilAttachment->object()); }
 
     void setAttachment(unsigned long, WebGLObject*);
+    // If an object is attached to the framebuffer, remove it.
+    void removeAttachment(WebGLObject*);
 
     // This function is called right after a framebuffer is bound.
     // Because renderbuffers and textures attached to the framebuffer might
@@ -71,12 +73,10 @@ private:
     void setInitialized(WebGLObject*);
     void initializeRenderbuffers();
 
-    // These objects are kept alive by the global table in
-    // WebGLRenderingContext.
-    WebGLObject* m_colorAttachment;
-    WebGLObject* m_depthAttachment;
-    WebGLObject* m_stencilAttachment;
-    WebGLObject* m_depthStencilAttachment;
+    RefPtr<WebGLObject> m_colorAttachment;
+    RefPtr<WebGLObject> m_depthAttachment;
+    RefPtr<WebGLObject> m_stencilAttachment;
+    RefPtr<WebGLObject> m_depthStencilAttachment;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/canvas/WebGLObject.cpp b/WebCore/html/canvas/WebGLObject.cpp
index 5fd5534..8aa4663 100644
--- a/WebCore/html/canvas/WebGLObject.cpp
+++ b/WebCore/html/canvas/WebGLObject.cpp
@@ -49,10 +49,8 @@ WebGLObject::~WebGLObject()
 
 void WebGLObject::setObject(Platform3DObject object)
 {
-    if (object == m_object)
-        return;
-        
-    deleteObject();
+    // object==0 && m_deleted==false indicating an uninitialized state;
+    ASSERT(!m_object && !m_deleted);
     m_object = object;
 }
 
diff --git a/WebCore/html/canvas/WebGLObject.h b/WebCore/html/canvas/WebGLObject.h
index 18d4cf9..82b8079 100644
--- a/WebCore/html/canvas/WebGLObject.h
+++ b/WebCore/html/canvas/WebGLObject.h
@@ -40,7 +40,6 @@ public:
     virtual ~WebGLObject();
 
     Platform3DObject object() const { return m_object; }
-    void setObject(Platform3DObject);
     void deleteObject();
 
     void detachContext()
@@ -64,13 +63,22 @@ public:
         if (m_attachmentCount)
             --m_attachmentCount;
         if (!m_attachmentCount && m_deleted)
-            m_object = 0;
+            deleteObject();
     }
     unsigned getAttachmentCount() { return m_attachmentCount; }
 
 protected:
     WebGLObject(WebGLRenderingContext*);
+
+    // setObject should be only called once right after creating a WebGLObject.
+    void setObject(Platform3DObject);
+
+    // deleteObjectImpl() may be called multiple times for the same object;
+    // isDeleted() needs to be tested in implementations when deciding whether
+    // to delete the OpenGL resource.
     virtual void deleteObjectImpl(Platform3DObject) = 0;
+    bool isDeleted() { return m_deleted; }
+    void setDeteled() { m_deleted = true; }
 
 private:
     Platform3DObject m_object;
diff --git a/WebCore/html/canvas/WebGLProgram.cpp b/WebCore/html/canvas/WebGLProgram.cpp
index 8cf3c42..0853b67 100644
--- a/WebCore/html/canvas/WebGLProgram.cpp
+++ b/WebCore/html/canvas/WebGLProgram.cpp
@@ -47,12 +47,17 @@ WebGLProgram::WebGLProgram(WebGLRenderingContext* ctx)
 
 void WebGLProgram::deleteObjectImpl(Platform3DObject obj)
 {
-    context()->graphicsContext3D()->deleteProgram(obj);
-    if (!object()) {
-        if (m_vertexShader)
+    if (!isDeleted())
+        context()->graphicsContext3D()->deleteProgram(obj);
+    if (!getAttachmentCount()) {
+        if (m_vertexShader) {
             m_vertexShader->onDetached();
-        if (m_fragmentShader)
+            m_vertexShader = 0;
+        }
+        if (m_fragmentShader) {
             m_fragmentShader->onDetached();
+            m_fragmentShader = 0;
+        }
     }
 }
 
diff --git a/WebCore/html/canvas/WebGLRenderbuffer.cpp b/WebCore/html/canvas/WebGLRenderbuffer.cpp
index 7bc2eec..4772873 100644
--- a/WebCore/html/canvas/WebGLRenderbuffer.cpp
+++ b/WebCore/html/canvas/WebGLRenderbuffer.cpp
@@ -48,7 +48,8 @@ WebGLRenderbuffer::WebGLRenderbuffer(WebGLRenderingContext* ctx)
 
 void WebGLRenderbuffer::deleteObjectImpl(Platform3DObject object)
 {
-    context()->graphicsContext3D()->deleteRenderbuffer(object);
+    if (!isDeleted())
+        context()->graphicsContext3D()->deleteRenderbuffer(object);
 }
 
 }
diff --git a/WebCore/html/canvas/WebGLRenderingContext.cpp b/WebCore/html/canvas/WebGLRenderingContext.cpp
index 68a6954..d1bb0cd 100644
--- a/WebCore/html/canvas/WebGLRenderingContext.cpp
+++ b/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -635,7 +635,11 @@ void WebGLRenderingContext::deleteFramebuffer(WebGLFramebuffer* framebuffer)
 {
     if (!framebuffer)
         return;
-    
+    if (framebuffer == m_framebufferBinding) {
+        m_framebufferBinding = 0;
+        // Have to call bindFramebuffer here to bind back to internal fbo.
+        m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, 0);
+    }
     framebuffer->deleteObject();
 }
 
@@ -656,10 +660,11 @@ void WebGLRenderingContext::deleteRenderbuffer(WebGLRenderbuffer* renderbuffer)
 {
     if (!renderbuffer)
         return;
-    
+    if (renderbuffer == m_renderbufferBinding)
+        m_renderbufferBinding = 0;
     renderbuffer->deleteObject();
     if (m_framebufferBinding)
-        m_framebufferBinding->onAttachedObjectChange(renderbuffer);
+        m_framebufferBinding->removeAttachment(renderbuffer);
 }
 
 void WebGLRenderingContext::deleteShader(WebGLShader* shader)
@@ -677,7 +682,7 @@ void WebGLRenderingContext::deleteTexture(WebGLTexture* texture)
     
     texture->deleteObject();
     if (m_framebufferBinding)
-        m_framebufferBinding->onAttachedObjectChange(texture);
+        m_framebufferBinding->removeAttachment(texture);
 }
 
 void WebGLRenderingContext::depthFunc(unsigned long func)
@@ -775,30 +780,31 @@ bool WebGLRenderingContext::validateIndexArrayConservative(unsigned long type, l
     // index, skips the expensive per-draw-call iteration in
     // validateIndexArrayPrecise.
 
+    if (!m_boundElementArrayBuffer)
+        return false;
+
+    unsigned numElements = m_boundElementArrayBuffer->byteLength();
+    // The case count==0 is already dealt with in drawElements before validateIndexArrayConservative.
+    if (!numElements)
+        return false;
+    const ArrayBuffer* buffer = m_boundElementArrayBuffer->elementArrayBuffer();
+    ASSERT(buffer);
+
     long maxIndex = m_boundElementArrayBuffer->getCachedMaxIndex(type);
     if (maxIndex < 0) {
         // Compute the maximum index in the entire buffer for the given type of index.
         switch (type) {
         case GraphicsContext3D::UNSIGNED_BYTE: {
-            unsigned numElements = m_boundElementArrayBuffer->byteLength();
-            if (!numElements)
-                maxIndex = 0;
-            else {
-                const unsigned char* p = static_cast<const unsigned char*>(m_boundElementArrayBuffer->elementArrayBuffer()->data());
-                for (unsigned i = 0; i < numElements; i++)
-                    maxIndex = max(maxIndex, static_cast<long>(p[i]));
-            }
+            const unsigned char* p = static_cast<const unsigned char*>(buffer->data());
+            for (unsigned i = 0; i < numElements; i++)
+                maxIndex = max(maxIndex, static_cast<long>(p[i]));
             break;
         }
         case GraphicsContext3D::UNSIGNED_SHORT: {
-            unsigned numElements = m_boundElementArrayBuffer->byteLength() / sizeof(unsigned short);
-            if (!numElements)
-                maxIndex = 0;
-            else {
-                const unsigned short* p = static_cast<const unsigned short*>(m_boundElementArrayBuffer->elementArrayBuffer()->data());
-                for (unsigned i = 0; i < numElements; i++)
-                    maxIndex = max(maxIndex, static_cast<long>(p[i]));
-            }
+            numElements /= sizeof(unsigned short);
+            const unsigned short* p = static_cast<const unsigned short*>(buffer->data());
+            for (unsigned i = 0; i < numElements; i++)
+                maxIndex = max(maxIndex, static_cast<long>(p[i]));
             break;
         }
         default:
@@ -824,6 +830,14 @@ bool WebGLRenderingContext::validateIndexArrayPrecise(unsigned long count, unsig
     if (!m_boundElementArrayBuffer)
         return false;
 
+    if (!count) {
+        numElementsRequired = 0;
+        return true;
+    }
+
+    if (!m_boundElementArrayBuffer->elementArrayBuffer())
+        return false;
+
     unsigned long uoffset = static_cast<unsigned long>(offset);
     unsigned long n = count;
 
@@ -968,6 +982,8 @@ void WebGLRenderingContext::drawElements(unsigned long mode, long count, unsigne
             m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
             return;
         }
+        if (!count)
+            return;
         if (!validateIndexArrayConservative(type, numElements) || !validateRenderingState(numElements)) {
             if (!validateIndexArrayPrecise(count, type, offset, numElements) || !validateRenderingState(numElements)) {
                 m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
@@ -1379,6 +1395,8 @@ WebGLGetInfo WebGLRenderingContext::getParameter(unsigned long pname, ExceptionC
         return getLongParameter(pname);
     case GraphicsContext3D::RENDERBUFFER_BINDING:
         return WebGLGetInfo(PassRefPtr<WebGLRenderbuffer>(m_renderbufferBinding));
+    case GraphicsContext3D::RENDERER:
+        return WebGLGetInfo(m_context->getString(GraphicsContext3D::RENDERER));
     case GraphicsContext3D::SAMPLE_BUFFERS:
         return getLongParameter(pname);
     case GraphicsContext3D::SAMPLE_COVERAGE_INVERT:
@@ -1391,6 +1409,8 @@ WebGLGetInfo WebGLRenderingContext::getParameter(unsigned long pname, ExceptionC
         return getWebGLIntArrayParameter(pname);
     case GraphicsContext3D::SCISSOR_TEST:
         return getBooleanParameter(pname);
+    case GraphicsContext3D::SHADING_LANGUAGE_VERSION:
+        return WebGLGetInfo("WebGL GLSL ES 1.0 (" + m_context->getString(GraphicsContext3D::SHADING_LANGUAGE_VERSION) + ")");
     case GraphicsContext3D::STENCIL_BACK_FAIL:
         return getUnsignedLongParameter(pname);
     case GraphicsContext3D::STENCIL_BACK_FUNC:
@@ -1438,6 +1458,10 @@ WebGLGetInfo WebGLRenderingContext::getParameter(unsigned long pname, ExceptionC
         return WebGLGetInfo(m_unpackFlipY);
     case GraphicsContext3D::UNPACK_PREMULTIPLY_ALPHA_WEBGL:
         return WebGLGetInfo(m_unpackPremultiplyAlpha);
+    case GraphicsContext3D::VENDOR:
+        return WebGLGetInfo("Webkit (" + m_context->getString(GraphicsContext3D::VENDOR) + ")");
+    case GraphicsContext3D::VERSION:
+        return WebGLGetInfo("WebGL 1.0 (" + m_context->getString(GraphicsContext3D::VERSION) + ")");
     case GraphicsContext3D::VIEWPORT:
         return getWebGLIntArrayParameter(pname);
     default:
@@ -1563,12 +1587,6 @@ String WebGLRenderingContext::getShaderSource(WebGLShader* shader, ExceptionCode
     return m_context->getShaderSource(objectOrZero(shader));
 }
 
-String WebGLRenderingContext::getString(unsigned long name)
-{
-    WebGLStateRestorer(this, false);
-    return m_context->getString(name);
-}
-
 WebGLGetInfo WebGLRenderingContext::getTexParameter(unsigned long target, unsigned long pname, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
@@ -1922,8 +1940,12 @@ void WebGLRenderingContext::polygonOffset(double factor, double units)
     cleanupAfterGraphicsCall(false);
 }
 
-void WebGLRenderingContext::readPixels(long x, long y, long width, long height, unsigned long format, unsigned long type, ArrayBufferView* pixels)
+void WebGLRenderingContext::readPixels(long x, long y, long width, long height, unsigned long format, unsigned long type, ArrayBufferView* pixels, ExceptionCode& ec)
 {
+    if (!canvas()->originClean()) {
+        ec = SECURITY_ERR;
+        return;
+    }
     // Validate input parameters.
     unsigned long componentsPerPixel, bytesPerComponent;
     if (!m_context->computeFormatAndTypeParameters(format, type, &componentsPerPixel, &bytesPerComponent)) {
@@ -2165,6 +2187,7 @@ void WebGLRenderingContext::texImage2D(unsigned target, unsigned level, unsigned
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
         return;
     }
+    checkOrigin(image);
     texImage2DImpl(target, level, internalformat, format, type, image->cachedImage()->image(),
                    m_unpackFlipY, m_unpackPremultiplyAlpha, ec);
 }
@@ -2177,7 +2200,7 @@ void WebGLRenderingContext::texImage2D(unsigned target, unsigned level, unsigned
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
         return;
     }
-    
+    checkOrigin(canvas);
     texImage2DImpl(target, level, internalformat, format, type, canvas->copiedImage(),
                    m_unpackFlipY, m_unpackPremultiplyAlpha, ec);
 }
@@ -2194,6 +2217,7 @@ PassRefPtr<Image> WebGLRenderingContext::videoFrameToImage(HTMLVideoElement* vid
         m_context->synthesizeGLError(GraphicsContext3D::OUT_OF_MEMORY);
         return 0;
     }
+    checkOrigin(video);
     IntRect destRect(0, 0, size.width(), size.height());
     // FIXME: Turn this into a GPU-GPU texture copy instead of CPU readback.
     video->paintCurrentFrameInContext(buf->context(), destRect);
@@ -2326,6 +2350,7 @@ void WebGLRenderingContext::texSubImage2D(unsigned target, unsigned level, unsig
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
         return;
     }
+    checkOrigin(image);
     texSubImage2DImpl(target, level, xoffset, yoffset, format, type, image->cachedImage()->image(),
                       m_unpackFlipY, m_unpackPremultiplyAlpha, ec);
 }
@@ -2338,7 +2363,7 @@ void WebGLRenderingContext::texSubImage2D(unsigned target, unsigned level, unsig
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
         return;
     }
-    
+    checkOrigin(canvas);
     texSubImage2DImpl(target, level, xoffset, yoffset, format, type, canvas->copiedImage(),
                       m_unpackFlipY, m_unpackPremultiplyAlpha, ec);
 }
@@ -2703,7 +2728,7 @@ void WebGLRenderingContext::useProgram(WebGLProgram* program, ExceptionCode& ec)
             m_currentProgram->onDetached();
         m_currentProgram = program;
         m_context->useProgram(objectOrZero(program));
-        if (program)
+        if (program && program->object())
             program->onAttached();
     }
     cleanupAfterGraphicsCall(false);
diff --git a/WebCore/html/canvas/WebGLRenderingContext.h b/WebCore/html/canvas/WebGLRenderingContext.h
index d812c69..f507054 100644
--- a/WebCore/html/canvas/WebGLRenderingContext.h
+++ b/WebCore/html/canvas/WebGLRenderingContext.h
@@ -163,7 +163,6 @@ public:
     // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
 
     String getShaderSource(WebGLShader*, ExceptionCode&);
-    String getString(unsigned long name);
 
     WebGLGetInfo getTexParameter(unsigned long target, unsigned long pname, ExceptionCode&);
 
@@ -187,7 +186,7 @@ public:
     void linkProgram(WebGLProgram*, ExceptionCode&);
     void pixelStorei(unsigned long pname, long param);
     void polygonOffset(double factor, double units);
-    void readPixels(long x, long y, long width, long height, unsigned long format, unsigned long type, ArrayBufferView* pixels);
+    void readPixels(long x, long y, long width, long height, unsigned long format, unsigned long type, ArrayBufferView* pixels, ExceptionCode&);
     void releaseShaderCompiler();
     void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
     void sampleCoverage(double value, bool invert);
diff --git a/WebCore/html/canvas/WebGLRenderingContext.idl b/WebCore/html/canvas/WebGLRenderingContext.idl
index 7a63752..f76646d 100644
--- a/WebCore/html/canvas/WebGLRenderingContext.idl
+++ b/WebCore/html/canvas/WebGLRenderingContext.idl
@@ -563,7 +563,6 @@ module html {
         // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
 
         [StrictTypeChecking] DOMString    getShaderSource(in WebGLShader shader) raises(DOMException);
-        [StrictTypeChecking] DOMString    getString(in unsigned long name);
 
         // any getTexParameter(in unsigned long target, in unsigned long pname) raises(DOMException);
         [StrictTypeChecking, Custom] void getTexParameter();
@@ -591,7 +590,7 @@ module html {
         [StrictTypeChecking] void         pixelStorei(in unsigned long pname, in long param);
         [StrictTypeChecking] void         polygonOffset(in double factor, in double units);
 
-        [StrictTypeChecking] void         readPixels(in long x, in long y, in long width, in long height, in unsigned long format, in unsigned long type, in ArrayBufferView pixels);
+        [StrictTypeChecking] void         readPixels(in long x, in long y, in long width, in long height, in unsigned long format, in unsigned long type, in ArrayBufferView pixels) raises(DOMException);
         
         [StrictTypeChecking] void         releaseShaderCompiler();
         [StrictTypeChecking] void         renderbufferStorage(in unsigned long target, in unsigned long internalformat, in unsigned long width, in unsigned long height);
diff --git a/WebCore/html/canvas/WebGLShader.cpp b/WebCore/html/canvas/WebGLShader.cpp
index 4f8bf68..1ccaad8 100644
--- a/WebCore/html/canvas/WebGLShader.cpp
+++ b/WebCore/html/canvas/WebGLShader.cpp
@@ -47,7 +47,8 @@ WebGLShader::WebGLShader(WebGLRenderingContext* ctx, GraphicsContext3D::WebGLEnu
 
 void WebGLShader::deleteObjectImpl(Platform3DObject object)
 {
-    context()->graphicsContext3D()->deleteShader(object);
+    if (!isDeleted())
+        context()->graphicsContext3D()->deleteShader(object);
 }
 
 }
diff --git a/WebCore/html/canvas/WebGLTexture.cpp b/WebCore/html/canvas/WebGLTexture.cpp
index 7fc84ad..c2b1c10 100644
--- a/WebCore/html/canvas/WebGLTexture.cpp
+++ b/WebCore/html/canvas/WebGLTexture.cpp
@@ -29,6 +29,7 @@
 
 #include "WebGLTexture.h"
 
+#include "WebGLFramebuffer.h"
 #include "WebGLRenderingContext.h"
 
 namespace WebCore {
@@ -201,7 +202,8 @@ bool WebGLTexture::needToUseBlackTexture() const
 
 void WebGLTexture::deleteObjectImpl(Platform3DObject object)
 {
-    context()->graphicsContext3D()->deleteTexture(object);
+    if (!isDeleted())
+        context()->graphicsContext3D()->deleteTexture(object);
 }
 
 int WebGLTexture::mapTargetToIndex(unsigned long target)
diff --git a/WebCore/html/parser/HTMLDocumentParser.cpp b/WebCore/html/parser/HTMLDocumentParser.cpp
index 2da403f..dc19c96 100644
--- a/WebCore/html/parser/HTMLDocumentParser.cpp
+++ b/WebCore/html/parser/HTMLDocumentParser.cpp
@@ -86,7 +86,7 @@ HTMLDocumentParser::HTMLDocumentParser(HTMLDocument* document, bool reportErrors
     : ScriptableDocumentParser(document)
     , m_tokenizer(HTMLTokenizer::create(usePreHTML5ParserQuirks(document)))
     , m_scriptRunner(HTMLScriptRunner::create(document, this))
-    , m_treeBuilder(HTMLTreeBuilder::create(m_tokenizer.get(), document, reportErrors))
+    , m_treeBuilder(HTMLTreeBuilder::create(m_tokenizer.get(), document, reportErrors, usePreHTML5ParserQuirks(document)))
     , m_parserScheduler(HTMLParserScheduler::create(this))
     , m_endWasDelayed(false)
     , m_writeNestingLevel(0)
@@ -98,7 +98,7 @@ HTMLDocumentParser::HTMLDocumentParser(HTMLDocument* document, bool reportErrors
 HTMLDocumentParser::HTMLDocumentParser(DocumentFragment* fragment, Element* contextElement, FragmentScriptingPermission scriptingPermission)
     : ScriptableDocumentParser(fragment->document())
     , m_tokenizer(HTMLTokenizer::create(usePreHTML5ParserQuirks(fragment->document())))
-    , m_treeBuilder(HTMLTreeBuilder::create(m_tokenizer.get(), fragment, contextElement, scriptingPermission))
+    , m_treeBuilder(HTMLTreeBuilder::create(m_tokenizer.get(), fragment, contextElement, scriptingPermission, usePreHTML5ParserQuirks(fragment->document())))
     , m_endWasDelayed(false)
     , m_writeNestingLevel(0)
 {
diff --git a/WebCore/html/parser/HTMLTreeBuilder.cpp b/WebCore/html/parser/HTMLTreeBuilder.cpp
index afac2a0..355dc8d 100644
--- a/WebCore/html/parser/HTMLTreeBuilder.cpp
+++ b/WebCore/html/parser/HTMLTreeBuilder.cpp
@@ -323,7 +323,7 @@ private:
 };
 
 
-HTMLTreeBuilder::HTMLTreeBuilder(HTMLTokenizer* tokenizer, HTMLDocument* document, bool reportErrors)
+HTMLTreeBuilder::HTMLTreeBuilder(HTMLTokenizer* tokenizer, HTMLDocument* document, bool reportErrors, bool usePreHTML5ParserQuirks)
     : m_framesetOk(true)
     , m_document(document)
     , m_tree(document, FragmentScriptingAllowed, false)
@@ -335,12 +335,13 @@ HTMLTreeBuilder::HTMLTreeBuilder(HTMLTokenizer* tokenizer, HTMLDocument* documen
     , m_tokenizer(tokenizer)
     , m_scriptToProcessStartLine(uninitializedLineNumberValue)
     , m_lastScriptElementStartLine(uninitializedLineNumberValue)
+    , m_usePreHTML5ParserQuirks(usePreHTML5ParserQuirks)
 {
 }
 
 // FIXME: Member variables should be grouped into self-initializing structs to
 // minimize code duplication between these constructors.
-HTMLTreeBuilder::HTMLTreeBuilder(HTMLTokenizer* tokenizer, DocumentFragment* fragment, Element* contextElement, FragmentScriptingPermission scriptingPermission)
+HTMLTreeBuilder::HTMLTreeBuilder(HTMLTokenizer* tokenizer, DocumentFragment* fragment, Element* contextElement, FragmentScriptingPermission scriptingPermission, bool usePreHTML5ParserQuirks)
     : m_framesetOk(true)
     , m_fragmentContext(fragment, contextElement, scriptingPermission)
     , m_document(m_fragmentContext.document())
@@ -353,6 +354,7 @@ HTMLTreeBuilder::HTMLTreeBuilder(HTMLTokenizer* tokenizer, DocumentFragment* fra
     , m_tokenizer(tokenizer)
     , m_scriptToProcessStartLine(uninitializedLineNumberValue)
     , m_lastScriptElementStartLine(uninitializedLineNumberValue)
+    , m_usePreHTML5ParserQuirks(usePreHTML5ParserQuirks)
 {
     if (contextElement) {
         // Steps 4.2-4.6 of the HTML5 Fragment Case parsing algorithm:
@@ -2204,6 +2206,13 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
             if (isParsingFragment() && m_fragmentContext.scriptingPermission() == FragmentScriptingNotAllowed)
                 m_scriptToProcess->removeAllChildren();
             setInsertionMode(m_originalInsertionMode);
+
+            // This token will not have been created by the tokenizer if a
+            // self-closing script tag was encountered and pre-HTML5 parser
+            // quirks are enabled. We must set the tokenizer's state to
+            // DataState explicitly if the tokenizer didn't have a chance to.
+            ASSERT(m_tokenizer->state() == HTMLTokenizer::DataState || m_usePreHTML5ParserQuirks);
+            m_tokenizer->setState(HTMLTokenizer::DataState);
             return;
         }
         m_tree.openElements()->pop();
@@ -2706,6 +2715,8 @@ bool HTMLTreeBuilder::processStartTagForInHead(AtomicHTMLToken& token)
     }
     if (token.name() == scriptTag) {
         processScriptStartTag(token);
+        if (m_usePreHTML5ParserQuirks && token.selfClosing())
+            processFakeEndTag(scriptTag);
         return true;
     }
     if (token.name() == headTag) {
diff --git a/WebCore/html/parser/HTMLTreeBuilder.h b/WebCore/html/parser/HTMLTreeBuilder.h
index d522ea8..e61fe73 100644
--- a/WebCore/html/parser/HTMLTreeBuilder.h
+++ b/WebCore/html/parser/HTMLTreeBuilder.h
@@ -51,13 +51,13 @@ class Node;
 
 class HTMLTreeBuilder : public Noncopyable {
 public:
-    static PassOwnPtr<HTMLTreeBuilder> create(HTMLTokenizer* tokenizer, HTMLDocument* document, bool reportErrors)
+    static PassOwnPtr<HTMLTreeBuilder> create(HTMLTokenizer* tokenizer, HTMLDocument* document, bool reportErrors, bool usePreHTML5ParserQuirks)
     {
-        return adoptPtr(new HTMLTreeBuilder(tokenizer, document, reportErrors));
+        return adoptPtr(new HTMLTreeBuilder(tokenizer, document, reportErrors, usePreHTML5ParserQuirks));
     }
-    static PassOwnPtr<HTMLTreeBuilder> create(HTMLTokenizer* tokenizer, DocumentFragment* fragment, Element* contextElement, FragmentScriptingPermission scriptingPermission)
+    static PassOwnPtr<HTMLTreeBuilder> create(HTMLTokenizer* tokenizer, DocumentFragment* fragment, Element* contextElement, FragmentScriptingPermission scriptingPermission, bool usePreHTML5ParserQuirks)
     {
-        return adoptPtr(new HTMLTreeBuilder(tokenizer, fragment, contextElement, scriptingPermission));
+        return adoptPtr(new HTMLTreeBuilder(tokenizer, fragment, contextElement, scriptingPermission, usePreHTML5ParserQuirks));
     }
     ~HTMLTreeBuilder();
 
@@ -110,8 +110,8 @@ private:
         AfterAfterFramesetMode,
     };
 
-    HTMLTreeBuilder(HTMLTokenizer*, HTMLDocument*, bool reportErrors);
-    HTMLTreeBuilder(HTMLTokenizer*, DocumentFragment*, Element* contextElement, FragmentScriptingPermission);
+    HTMLTreeBuilder(HTMLTokenizer*, HTMLDocument*, bool reportErrors, bool usePreHTML5ParserQuirks);
+    HTMLTreeBuilder(HTMLTokenizer*, DocumentFragment*, Element* contextElement, FragmentScriptingPermission, bool usePreHTML5ParserQuirks);
 
     bool isParsingFragment() const { return !!m_fragmentContext.fragment(); }
 
@@ -252,6 +252,8 @@ private:
     // created to service the legacy tree builder, but it seems to be used for
     // some other things now.
     int m_lastScriptElementStartLine;
+    
+    bool m_usePreHTML5ParserQuirks;
 };
 
 }