Merge WebKit at r65615 : Initial merge by git.

Change-Id: Ifbf384f4531e3b58475a662e38195c2d9152ae79

32 files changed, 378 insertions, 224 deletions

diff --git a/WebCore/page/Console.cpp b/WebCore/page/Console.cpp
index 3d8a7de..9cc8d5d 100644
--- a/WebCore/page/Console.cpp
+++ b/WebCore/page/Console.cpp
@@ -185,7 +185,7 @@ void Console::addMessage(MessageType type, MessageLevel level, ScriptCallStack*
         page->chrome()->client()->addMessageToConsole(JSMessageSource, type, level, message, lastCaller.lineNumber(), lastCaller.sourceURL().prettyURL());
 
 #if ENABLE(INSPECTOR)
-    page->inspectorController()->addMessageToConsole(JSMessageSource, type, level, callStack);
+    page->inspectorController()->addMessageToConsole(JSMessageSource, type, level, callStack, message);
 #endif
 
     if (!Console::shouldPrintExceptions())
diff --git a/WebCore/page/DOMSelection.cpp b/WebCore/page/DOMSelection.cpp
index d62051e..106dd13 100644
--- a/WebCore/page/DOMSelection.cpp
+++ b/WebCore/page/DOMSelection.cpp
@@ -427,6 +427,8 @@ void DOMSelection::deleteFromDocument()
         selection->modify(SelectionController::AlterationExtend, SelectionController::DirectionBackward, CharacterGranularity);
 
     RefPtr<Range> selectedRange = selection->selection().toNormalizedRange();
+    if (!selectedRange)
+        return;
 
     ExceptionCode ec = 0;
     selectedRange->deleteContents(ec);
diff --git a/WebCore/page/DOMWindow.cpp b/WebCore/page/DOMWindow.cpp
index 71ad7cb..86708de 100644
--- a/WebCore/page/DOMWindow.cpp
+++ b/WebCore/page/DOMWindow.cpp
@@ -331,20 +331,20 @@ void DOMWindow::parseModalDialogFeatures(const String& featuresArg, HashMap<Stri
     Vector<String>::const_iterator end = features.end();
     for (Vector<String>::const_iterator it = features.begin(); it != end; ++it) {
         String s = *it;
-        int pos = s.find('=');
-        int colonPos = s.find(':');
-        if (pos >= 0 && colonPos >= 0)
+        size_t pos = s.find('=');
+        size_t colonPos = s.find(':');
+        if (pos != notFound && colonPos != notFound)
             continue; // ignore any strings that have both = and :
-        if (pos < 0)
+        if (pos == notFound)
             pos = colonPos;
-        if (pos < 0) {
+        if (pos == notFound) {
             // null string for value means key without value
             map.set(s.stripWhiteSpace().lower(), String());
         } else {
             String key = s.left(pos).stripWhiteSpace().lower();
             String val = s.substring(pos + 1).stripWhiteSpace().lower();
-            int spacePos = val.find(' ');
-            if (spacePos != -1)
+            size_t spacePos = val.find(' ');
+            if (spacePos != notFound)
                 val = val.left(spacePos);
             map.set(key, val);
         }
diff --git a/WebCore/page/DOMWindow.idl b/WebCore/page/DOMWindow.idl
index a65739b..cabe68a 100644
--- a/WebCore/page/DOMWindow.idl
+++ b/WebCore/page/DOMWindow.idl
@@ -478,17 +478,6 @@ module window {
         attribute [JSCCustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] Uint32ArrayConstructor Uint32Array; // Usable with new operator
         attribute [JSCCustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] Float32ArrayConstructor Float32Array; // Usable with new operator
 
-        // Temporary aliases to keep current WebGL content working during transition period to TypedArray spec.
-        // To be removed before WebGL spec is finalized. (FIXME)
-        attribute [CustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] ArrayBufferConstructor WebGLArrayBuffer; // Usable with new operator
-        attribute [CustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] Int8ArrayConstructor WebGLByteArray; // Usable with new operator
-        attribute [CustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] Uint8ArrayConstructor WebGLUnsignedByteArray; // Usable with new operator
-        attribute [CustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] Int16ArrayConstructor WebGLShortArray; // Usable with new operator
-        attribute [CustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] Uint16ArrayConstructor WebGLUnsignedShortArray; // Usable with new operator
-        attribute [CustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] Int32ArrayConstructor WebGLIntArray; // Usable with new operator
-        attribute [CustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] Uint32ArrayConstructor WebGLUnsignedIntArray; // Usable with new operator
-        attribute [CustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] Float32ArrayConstructor WebGLFloatArray; // Usable with new operator
-
         attribute EventConstructor Event;
         attribute BeforeLoadEventConstructor BeforeLoadEvent;
         attribute KeyboardEventConstructor KeyboardEvent;
diff --git a/WebCore/page/DragController.cpp b/WebCore/page/DragController.cpp
index d93a256..bbf4fed 100644
--- a/WebCore/page/DragController.cpp
+++ b/WebCore/page/DragController.cpp
@@ -63,6 +63,7 @@
 #include "SelectionController.h"
 #include "Settings.h"
 #include "Text.h"
+#include "TextEvent.h"
 #include "htmlediting.h"
 #include "markup.h"
 #include <wtf/CurrentTime.h>
@@ -363,6 +364,15 @@ static bool setSelectionToDragCaret(Frame* frame, VisibleSelection& dragCaret, R
     return !frame->selection()->isNone() && frame->selection()->isContentEditable();
 }
 
+bool DragController::dispatchTextInputEventFor(Frame* innerFrame, DragData* dragData)
+{
+    VisibleSelection dragCaret(m_page->dragCaretController()->selection());
+    String text = dragCaret.isContentRichlyEditable() ? "" : dragData->asPlainText();
+    Node* target = innerFrame->editor()->findEventTargetFrom(dragCaret);
+    ExceptionCode ec = 0;
+    return target->dispatchEvent(TextEvent::createForDrop(innerFrame->domWindow(), text), ec);
+}
+
 bool DragController::concludeEditDrag(DragData* dragData)
 {
     ASSERT(dragData);
@@ -376,12 +386,13 @@ bool DragController::concludeEditDrag(DragData* dragData)
     Frame* innerFrame = element->ownerDocument()->frame();
     ASSERT(innerFrame);
 
+    if (!dispatchTextInputEventFor(innerFrame, dragData))
+        return true;
+
     if (dragData->containsColor()) {
         Color color = dragData->asColor();
         if (!color.isValid())
             return false;
-        if (!innerFrame)
-            return false;
         RefPtr<Range> innerRange = innerFrame->selection()->toNormalizedRange();
         RefPtr<CSSStyleDeclaration> style = m_documentUnderMouse->createCSSStyleDeclaration();
         ExceptionCode ec;
diff --git a/WebCore/page/DragController.h b/WebCore/page/DragController.h
index 712f9ab..0e90a52 100644
--- a/WebCore/page/DragController.h
+++ b/WebCore/page/DragController.h
@@ -90,6 +90,7 @@ namespace WebCore {
         static const float DragImageAlpha;
 
     private:
+        bool dispatchTextInputEventFor(Frame*, DragData*);
         bool canProcessDrag(DragData*);
         bool concludeEditDrag(DragData*);
         DragOperation dragEnteredOrUpdated(DragData*);
diff --git a/WebCore/page/EventHandler.cpp b/WebCore/page/EventHandler.cpp
index adcaadc..6263a4b 100644
--- a/WebCore/page/EventHandler.cpp
+++ b/WebCore/page/EventHandler.cpp
@@ -2656,6 +2656,7 @@ bool EventHandler::handleTextInputEvent(const String& text, Event* underlyingEve
     // Platforms should differentiate real commands like selectAll from text input in disguise (like insertNewline),
     // and avoid dispatching text input events from keydown default handlers.
     ASSERT(!underlyingEvent || !underlyingEvent->isKeyboardEvent() || static_cast<KeyboardEvent*>(underlyingEvent)->type() == eventNames().keypressEvent);
+    ASSERT(!(isLineBreak && isBackTab));
 
     if (!m_frame)
         return false;
@@ -2671,10 +2672,9 @@ bool EventHandler::handleTextInputEvent(const String& text, Event* underlyingEve
     if (FrameView* view = m_frame->view())
         view->resetDeferredRepaintDelay();
 
-    RefPtr<TextEvent> event = TextEvent::create(m_frame->domWindow(), text);
+    RefPtr<TextEvent> event = TextEvent::create(m_frame->domWindow(), text, TextEvent::selectInputType(isLineBreak, isBackTab));
     event->setUnderlyingEvent(underlyingEvent);
-    event->setIsLineBreak(isLineBreak);
-    event->setIsBackTab(isBackTab);
+
     ExceptionCode ec;
     target->dispatchEvent(event, ec);
     return event->defaultHandled();
diff --git a/WebCore/page/FrameTree.h b/WebCore/page/FrameTree.h
index 9ab999f..b97aab6 100644
--- a/WebCore/page/FrameTree.h
+++ b/WebCore/page/FrameTree.h
@@ -20,7 +20,7 @@
 #ifndef FrameTree_h
 #define FrameTree_h
 
-#include "AtomicString.h"
+#include <wtf/text/AtomicString.h>
 
 namespace WebCore {
 
diff --git a/WebCore/page/FrameView.cpp b/WebCore/page/FrameView.cpp
index 04fef3b..441e543 100644
--- a/WebCore/page/FrameView.cpp
+++ b/WebCore/page/FrameView.cpp
@@ -1148,13 +1148,13 @@ void FrameView::setScrollPosition(const IntPoint& scrollPoint)
 
 void FrameView::scrollPositionChangedViaPlatformWidget()
 {
+    repaintFixedElementsAfterScrolling();
     scrollPositionChanged();
 }
 
 void FrameView::scrollPositionChanged()
 {
     frame()->eventHandler()->sendScrollEvent();
-    repaintFixedElementsAfterScrolling();
 
 #if USE(ACCELERATED_COMPOSITING)
     if (RenderView* root = m_frame->contentRenderer()) {
diff --git a/WebCore/page/Geolocation.cpp b/WebCore/page/Geolocation.cpp
index 523c21d..0847769 100644
--- a/WebCore/page/Geolocation.cpp
+++ b/WebCore/page/Geolocation.cpp
@@ -50,6 +50,9 @@ namespace WebCore {
 
 static const char permissionDeniedErrorMessage[] = "User denied Geolocation";
 static const char failedToStartServiceErrorMessage[] = "Failed to start Geolocation service";
+static const char framelessDocumentErrorMessage[] = "Geolocation cannot be used in frameless documents";
+
+static const int firstAvailableWatchId = 1;
 
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
 
@@ -97,9 +100,15 @@ Geolocation::GeoNotifier::GeoNotifier(Geolocation* geolocation, PassRefPtr<Posit
 
 void Geolocation::GeoNotifier::setFatalError(PassRefPtr<PositionError> error)
 {
-    // This method is called at most once on a given GeoNotifier object.
-    ASSERT(!m_fatalError);
+    // If a fatal error has already been set, stick with it. This makes sure that
+    // when permission is denied, this is the error reported, as required by the
+    // spec.
+    if (m_fatalError)
+        return;
+
     m_fatalError = error;
+    // An existing timer may not have a zero timeout.
+    m_timer.stop();
     m_timer.startOneShot(0);
 }
 
@@ -133,6 +142,8 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
     // could be deleted by a call to clearWatch in a callback.
     RefPtr<GeoNotifier> protect(this);
 
+    // Test for fatal error first. This is required for the case where the Frame is
+    // disconnected and requests are cancelled.
     if (m_fatalError) {
         if (m_errorCallback)
             m_errorCallback->handleEvent(m_fatalError.get());
@@ -158,6 +169,7 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
 
 void Geolocation::Watchers::set(int id, PassRefPtr<GeoNotifier> prpNotifier)
 {
+    ASSERT(id > 0);
     RefPtr<GeoNotifier> notifier = prpNotifier;
 
     m_idToNotifierMap.set(id, notifier.get());
@@ -166,6 +178,7 @@ void Geolocation::Watchers::set(int id, PassRefPtr<GeoNotifier> prpNotifier)
 
 void Geolocation::Watchers::remove(int id)
 {
+    ASSERT(id > 0);
     IdToNotifierMap::iterator iter = m_idToNotifierMap.find(id);
     if (iter == m_idToNotifierMap.end())
         return;
@@ -234,10 +247,14 @@ void Geolocation::disconnectFrame()
 {
     if (m_frame && m_frame->page() && m_allowGeolocation == InProgress)
         m_frame->page()->chrome()->cancelGeolocationPermissionRequestForFrame(m_frame, this);
+<<<<<<< HEAD
 #if PLATFORM(ANDROID)
     // See Geolocation::stop()
 #else
     stopTimers();
+=======
+    cancelAllRequests();
+>>>>>>> WebKit at r65615
     stopUpdating();
 #endif // PLATFORM(ANDROID)
     if (m_frame && m_frame->document())
@@ -265,6 +282,9 @@ Geoposition* Geolocation::lastPosition()
 
 void Geolocation::getCurrentPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
+    if (!m_frame)
+        return;
+
     RefPtr<GeoNotifier> notifier = startRequest(successCallback, errorCallback, options);
     ASSERT(notifier);
 
@@ -273,10 +293,13 @@ void Geolocation::getCurrentPosition(PassRefPtr<PositionCallback> successCallbac
 
 int Geolocation::watchPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
+    if (!m_frame)
+        return 0;
+
     RefPtr<GeoNotifier> notifier = startRequest(successCallback, errorCallback, options);
     ASSERT(notifier);
 
-    static int nextAvailableWatchId = 1;
+    static int nextAvailableWatchId = firstAvailableWatchId;
     // In case of overflow, make sure the ID remains positive, but reuse the ID values.
     if (nextAvailableWatchId < 1)
         nextAvailableWatchId = 1;
@@ -294,13 +317,18 @@ PassRefPtr<Geolocation::GeoNotifier> Geolocation::startRequest(PassRefPtr<Positi
         notifier->setFatalError(PositionError::create(PositionError::PERMISSION_DENIED, permissionDeniedErrorMessage));
     else if (haveSuitableCachedPosition(notifier->m_options.get()))
         notifier->setUseCachedPosition();
-    else if (notifier->hasZeroTimeout() || startUpdating(notifier.get())) {
+    else if (notifier->hasZeroTimeout())
+        notifier->startTimerIfNeeded();
 #if USE(PREEMPT_GEOLOCATION_PERMISSION)
-        // Only start timer if we're not waiting for user permission.
-        if (!m_startRequestPermissionNotifier)
-#endif            
-            notifier->startTimerIfNeeded();
-    } else
+    else if (!isAllowed()) {
+        // if we don't yet have permission, request for permission before calling startUpdating()
+        m_pendingForPermissionNotifiers.add(notifier);
+        requestPermission();
+    }
+#endif
+    else if (startUpdating(notifier.get()))
+        notifier->startTimerIfNeeded();
+    else
         notifier->setFatalError(PositionError::create(PositionError::POSITION_UNAVAILABLE, failedToStartServiceErrorMessage));
 
     return notifier.release();
@@ -388,6 +416,9 @@ bool Geolocation::haveSuitableCachedPosition(PositionOptions* options)
 
 void Geolocation::clearWatch(int watchId)
 {
+    if (watchId < firstAvailableWatchId)
+        return;
+
     m_watchers.remove(watchId);
     
     if (!hasListeners())
@@ -417,28 +448,10 @@ void Geolocation::setIsAllowed(bool allowed)
     m_allowGeolocation = allowed ? Yes : No;
     
 #if USE(PREEMPT_GEOLOCATION_PERMISSION)
-    if (m_startRequestPermissionNotifier) {
-        if (isAllowed()) {
-            // Permission request was made during the startUpdating process
-            m_startRequestPermissionNotifier->startTimerIfNeeded();
-            // The notifier is always ref'ed by m_oneShots or m_watchers.
-            GeoNotifier* notifier = m_startRequestPermissionNotifier.get();
-            m_startRequestPermissionNotifier = 0;
-#if ENABLE(CLIENT_BASED_GEOLOCATION)
-            if (!m_frame)
-                return;
-            Page* page = m_frame->page();
-            if (!page)
-                return;
-            page->geolocationController()->addObserver(this, notifier->m_options->enableHighAccuracy());
-#else
-            // TODO: Handle startUpdate() for non-client based implementations using pre-emptive policy
-#endif
-        } else {
-            m_startRequestPermissionNotifier->setFatalError(PositionError::create(PositionError::PERMISSION_DENIED, permissionDeniedErrorMessage));
-            m_oneShots.add(m_startRequestPermissionNotifier);
-            m_startRequestPermissionNotifier = 0;
-        }
+    // Permission request was made during the startRequest process
+    if (!m_pendingForPermissionNotifiers.isEmpty()) {
+        handlePendingPermissionNotifiers();
+        m_pendingForPermissionNotifiers.clear();
         return;
     }
 #endif
@@ -513,6 +526,22 @@ void Geolocation::stopTimers()
     stopTimersForWatchers();
 }
 
+void Geolocation::cancelRequests(Vector<RefPtr<GeoNotifier> >& notifiers)
+{
+    Vector<RefPtr<GeoNotifier> >::const_iterator end = notifiers.end();
+    for (Vector<RefPtr<GeoNotifier> >::const_iterator it = notifiers.begin(); it != end; ++it)
+        (*it)->setFatalError(PositionError::create(PositionError::POSITION_UNAVAILABLE, framelessDocumentErrorMessage));
+}
+
+void Geolocation::cancelAllRequests()
+{
+    Vector<RefPtr<GeoNotifier> > copy;
+    copyToVector(m_oneShots, copy);
+    cancelRequests(copy);
+    m_watchers.getNotifiersVector(copy);
+    cancelRequests(copy);
+}
+
 void Geolocation::handleError(PositionError* error)
 {
     ASSERT(error);
@@ -634,14 +663,6 @@ void Geolocation::geolocationServiceErrorOccurred(GeolocationService* service)
 
 bool Geolocation::startUpdating(GeoNotifier* notifier)
 {
-#if USE(PREEMPT_GEOLOCATION_PERMISSION)
-    if (!isAllowed()) {
-        m_startRequestPermissionNotifier = notifier;
-        requestPermission();
-        return true;
-    }
-#endif
-
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
     if (!m_frame)
         return false;
@@ -686,6 +707,38 @@ void Geolocation::stopUpdating()
 
 }
 
+#if USE(PREEMPT_GEOLOCATION_PERMISSION)
+void Geolocation::handlePendingPermissionNotifiers()
+{
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+    if (!m_frame)
+        return;
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+#endif
+
+    // While we iterate through the list, we need not worry about list being modified as the permission 
+    // is already set to Yes/No and no new listeners will be added to the pending list
+    GeoNotifierSet::const_iterator end = m_pendingForPermissionNotifiers.end();
+    for (GeoNotifierSet::const_iterator iter = m_pendingForPermissionNotifiers.begin(); iter != end; ++iter) {
+        GeoNotifier* notifier = iter->get();
+
+        if (isAllowed()) {
+            // start all pending notification requests as permission granted.
+            // The notifier is always ref'ed by m_oneShots or m_watchers.
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+            notifier->startTimerIfNeeded();
+            page->geolocationController()->addObserver(this, notifier->m_options->enableHighAccuracy());
+#else
+            // TODO: Handle startUpdate() for non-client based implementations using pre-emptive policy
+#endif
+        } else
+            notifier->setFatalError(PositionError::create(PositionError::PERMISSION_DENIED, permissionDeniedErrorMessage));
+    }
+}
+#endif
+
 } // namespace WebCore
 
 #else
diff --git a/WebCore/page/Geolocation.h b/WebCore/page/Geolocation.h
index af10632..a4a0c5a 100644
--- a/WebCore/page/Geolocation.h
+++ b/WebCore/page/Geolocation.h
@@ -139,6 +139,9 @@ private:
     void stopTimersForWatchers();
     void stopTimers();
 
+    void cancelRequests(Vector<RefPtr<GeoNotifier> >&);
+    void cancelAllRequests();
+
     void positionChangedInternal();
     void makeSuccessCallbacks();
     void handleError(PositionError*);
@@ -148,6 +151,10 @@ private:
     bool startUpdating(GeoNotifier*);
     void stopUpdating();
 
+#if USE(PREEMPT_GEOLOCATION_PERMISSION)
+    void handlePendingPermissionNotifiers();
+#endif
+
 #if !ENABLE(CLIENT_BASED_GEOLOCATION) && ENABLE(GEOLOCATION)
     // GeolocationServiceClient
     virtual void geolocationServicePositionChanged(GeolocationService*);
@@ -171,7 +178,7 @@ private:
     OwnPtr<GeolocationService> m_service;
 #endif
 #if USE(PREEMPT_GEOLOCATION_PERMISSION)
-    RefPtr<GeoNotifier> m_startRequestPermissionNotifier;
+    GeoNotifierSet m_pendingForPermissionNotifiers;
 #endif
     RefPtr<Geoposition> m_lastPosition;
 
diff --git a/WebCore/page/GroupSettings.cpp b/WebCore/page/GroupSettings.cpp
new file mode 100644
index 0000000..58ab74d
--- /dev/null
+++ b/WebCore/page/GroupSettings.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "GroupSettings.h"
+
+namespace WebCore {
+
+GroupSettings::GroupSettings()
+    : m_localStorageQuotaBytes(5 * 1024 * 1024) // Suggested by the HTML5 spec.
+{
+}
+
+void GroupSettings::setLocalStorageQuotaBytes(unsigned quota)
+{
+    m_localStorageQuotaBytes = quota;
+}
+
+void GroupSettings::setIndexedDBDatabasePath(const String& path)
+{
+    m_indexedDBDatabasePath = path;
+}
+
+} // namespace WebCore
diff --git a/WebCore/page/GroupSettings.h b/WebCore/page/GroupSettings.h
new file mode 100644
index 0000000..62a5dd2
--- /dev/null
+++ b/WebCore/page/GroupSettings.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ 
+#ifndef GroupSettings_h
+#define GroupSettings_h
+
+#include "PlatformString.h"
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+class PageGroup;
+
+class GroupSettings : public Noncopyable {
+public:
+    static PassOwnPtr<GroupSettings> create()
+    {
+        return adoptPtr(new GroupSettings());
+    }
+
+    void setLocalStorageQuotaBytes(unsigned);
+    unsigned localStorageQuotaBytes() const { return m_localStorageQuotaBytes; }
+
+    void setIndexedDBDatabasePath(const String&);
+    const String& indexedDBDatabasePath() const { return m_indexedDBDatabasePath; }
+
+private:
+    GroupSettings();
+
+    unsigned m_localStorageQuotaBytes;
+    String m_indexedDBDatabasePath;
+};
+
+} // namespace WebCore
+
+#endif // GroupSettings_h
diff --git a/WebCore/page/Page.cpp b/WebCore/page/Page.cpp
index f808928..63decd7 100644
--- a/WebCore/page/Page.cpp
+++ b/WebCore/page/Page.cpp
@@ -65,12 +65,12 @@
 #include "SharedBuffer.h"
 #include "SpeechInput.h"
 #include "SpeechInputClient.h"
-#include "StringHash.h"
 #include "TextResourceDecoder.h"
 #include "Widget.h"
 #include <wtf/HashMap.h>
 #include <wtf/RefCountedLeakCounter.h>
 #include <wtf/StdLibExtras.h>
+#include <wtf/text/StringHash.h>
 
 #if ENABLE(DOM_STORAGE)
 #include "StorageArea.h"
@@ -359,6 +359,9 @@ void Page::goBackOrForward(int distance)
 
 void Page::goToItem(HistoryItem* item, FrameLoadType type)
 {
+    if (defersLoading())
+        return;
+    
     // Abort any current load unless we're navigating the current document to a new state object
     HistoryItem* currentItem = m_mainFrame->loader()->history()->currentItem();
     if (!item->stateObject() || !currentItem || item->documentSequenceNumber() != currentItem->documentSequenceNumber() || item == currentItem) {
@@ -445,7 +448,10 @@ void Page::refreshPlugins(bool reload)
         Page* page = *it;
         
         // Clear out the page's plug-in data.
-        page->m_pluginData = 0;
+        if (page->m_pluginData) {
+            page->m_pluginData->disconnectPage();
+            page->m_pluginData = 0;
+        }
 
         if (!reload)
             continue;
diff --git a/WebCore/page/PageGroup.cpp b/WebCore/page/PageGroup.cpp
index 12b1a41..aecd550 100644
--- a/WebCore/page/PageGroup.cpp
+++ b/WebCore/page/PageGroup.cpp
@@ -30,6 +30,7 @@
 #include "ChromeClient.h"
 #include "Document.h"
 #include "Frame.h"
+#include "GroupSettings.h"
 #include "IDBFactoryBackendInterface.h"
 #include "Page.h"
 #include "Settings.h"
@@ -55,12 +56,14 @@ PageGroup::PageGroup(const String& name)
     : m_name(name)
     , m_visitedLinksPopulated(false)
     , m_identifier(getUniqueIdentifier())
+    , m_groupSettings(GroupSettings::create())
 {
 }
 
 PageGroup::PageGroup(Page* page)
     : m_visitedLinksPopulated(false)
     , m_identifier(getUniqueIdentifier())
+    , m_groupSettings(GroupSettings::create())
 {
     ASSERT(page);
     addPage(page);
@@ -200,7 +203,7 @@ StorageNamespace* PageGroup::localStorage()
         // at this point we're stuck with it.
         Page* page = *m_pages.begin();
         const String& path = page->settings()->localStorageDatabasePath();
-        unsigned quota = page->settings()->localStorageQuota();
+        unsigned quota = m_groupSettings->localStorageQuotaBytes();
         m_localStorage = StorageNamespace::localStorageNamespace(path, quota);
     }
 
@@ -236,11 +239,12 @@ void PageGroup::addUserScriptToWorld(DOMWrapperWorld* world, const String& sourc
 
 void PageGroup::addUserStyleSheetToWorld(DOMWrapperWorld* world, const String& source, const KURL& url,
                                          PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
-                                         UserContentInjectedFrames injectedFrames)
+                                         UserContentInjectedFrames injectedFrames,
+                                         UserStyleSheet::Level level)
 {
     ASSERT_ARG(world, world);
 
-    OwnPtr<UserStyleSheet> userStyleSheet(new UserStyleSheet(source, url, whitelist, blacklist, injectedFrames));
+    OwnPtr<UserStyleSheet> userStyleSheet(new UserStyleSheet(source, url, whitelist, blacklist, injectedFrames, level));
     if (!m_userStyleSheets)
         m_userStyleSheets.set(new UserStyleSheetMap);
     UserStyleSheetVector*& styleSheetsInWorld = m_userStyleSheets->add(world, 0).first->second;
diff --git a/WebCore/page/PageGroup.h b/WebCore/page/PageGroup.h
index 08b03d7..6a3518e 100644
--- a/WebCore/page/PageGroup.h
+++ b/WebCore/page/PageGroup.h
@@ -29,13 +29,14 @@
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include "LinkHash.h"
-#include "StringHash.h"
 #include "UserScript.h"
 #include "UserStyleSheet.h"
+#include <wtf/text/StringHash.h>
 
 namespace WebCore {
 
     class KURL;
+    class GroupSettings;
     class IDBFactoryBackendInterface;
     class Page;
     class StorageNamespace;
@@ -80,7 +81,8 @@ namespace WebCore {
                                   UserScriptInjectionTime, UserContentInjectedFrames);
         void addUserStyleSheetToWorld(DOMWrapperWorld*, const String& source, const KURL&,
                                       PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
-                                      UserContentInjectedFrames);
+                                      UserContentInjectedFrames,
+                                      UserStyleSheet::Level level = UserStyleSheet::UserLevel);
 
         void removeUserScriptFromWorld(DOMWrapperWorld*, const KURL&);
         void removeUserStyleSheetFromWorld(DOMWrapperWorld*, const KURL&);
@@ -93,6 +95,8 @@ namespace WebCore {
         const UserScriptMap* userScripts() const { return m_userScripts.get(); }
         const UserStyleSheetMap* userStyleSheets() const { return m_userStyleSheets.get(); }
 
+        GroupSettings* groupSettings() const { return m_groupSettings.get(); }
+
     private:
         void addVisitedLink(LinkHash stringHash);
         void resetUserStyleCacheInAllFrames();
@@ -114,6 +118,8 @@ namespace WebCore {
 
         OwnPtr<UserScriptMap> m_userScripts;
         OwnPtr<UserStyleSheetMap> m_userStyleSheets;
+
+        OwnPtr<GroupSettings> m_groupSettings;
     };
 
 } // namespace WebCore
diff --git a/WebCore/page/SecurityOrigin.cpp b/WebCore/page/SecurityOrigin.cpp
index 87b3ed2..f759402 100644
--- a/WebCore/page/SecurityOrigin.cpp
+++ b/WebCore/page/SecurityOrigin.cpp
@@ -30,6 +30,7 @@
 #include "SecurityOrigin.h"
 
 #include "Document.h"
+#include "FileSystem.h"
 #include "KURL.h"
 #include "OriginAccessEntry.h"
 #include "SchemeRegistry.h"
@@ -367,13 +368,13 @@ static const char SeparatorCharacter = '_';
 PassRefPtr<SecurityOrigin> SecurityOrigin::createFromDatabaseIdentifier(const String& databaseIdentifier)
 { 
     // Make sure there's a first separator
-    int separator1 = databaseIdentifier.find(SeparatorCharacter);
-    if (separator1 == -1)
+    size_t separator1 = databaseIdentifier.find(SeparatorCharacter);
+    if (separator1 == notFound)
         return create(KURL());
         
     // Make sure there's a second separator
-    int separator2 = databaseIdentifier.reverseFind(SeparatorCharacter);
-    if (separator2 == -1)
+    size_t separator2 = databaseIdentifier.reverseFind(SeparatorCharacter);
+    if (separator2 == notFound)
         return create(KURL());
         
     // Ensure there were at least 2 separator characters. Some hostnames on intranets have
@@ -384,7 +385,7 @@ PassRefPtr<SecurityOrigin> SecurityOrigin::createFromDatabaseIdentifier(const St
     // Make sure the port section is a valid port number or doesn't exist
     bool portOkay;
     int port = databaseIdentifier.right(databaseIdentifier.length() - separator2 - 1).toInt(&portOkay);
-    bool portAbsent = (separator2 == static_cast<int>(databaseIdentifier.length()) - 1);
+    bool portAbsent = (separator2 == databaseIdentifier.length() - 1);
     if (!(portOkay || portAbsent))
         return create(KURL());
     
@@ -399,85 +400,12 @@ PassRefPtr<SecurityOrigin> SecurityOrigin::createFromDatabaseIdentifier(const St
     return create(KURL(KURL(), protocol + "://" + host + ":" + String::number(port)));
 }
 
-// The following lower-ASCII characters need escaping to be used in a filename
-// across all systems, including Windows:
-//     - Unprintable ASCII (00-1F)
-//     - Space             (20)
-//     - Double quote      (22)
-//     - Percent           (25) (escaped because it is our escape character)
-//     - Asterisk          (2A)
-//     - Slash             (2F)
-//     - Colon             (3A)
-//     - Less-than         (3C)
-//     - Greater-than      (3E)
-//     - Question Mark     (3F)
-//     - Backslash         (5C)
-//     - Pipe              (7C)
-//     - Delete            (7F)
-
-static const bool needsEscaping[128] = {
-    /* 00-07 */ true,  true,  true,  true,  true,  true,  true,  true, 
-    /* 08-0F */ true,  true,  true,  true,  true,  true,  true,  true, 
-
-    /* 10-17 */ true,  true,  true,  true,  true,  true,  true,  true, 
-    /* 18-1F */ true,  true,  true,  true,  true,  true,  true,  true, 
-
-    /* 20-27 */ true,  false, true,  false, false, true,  false, false, 
-    /* 28-2F */ false, false, true,  false, false, false, false, true, 
-    
-    /* 30-37 */ false, false, false, false, false, false, false, false, 
-    /* 38-3F */ false, false, true,  false, true,  false, true,  true, 
-    
-    /* 40-47 */ false, false, false, false, false, false, false, false, 
-    /* 48-4F */ false, false, false, false, false, false, false, false,
-    
-    /* 50-57 */ false, false, false, false, false, false, false, false, 
-    /* 58-5F */ false, false, false, false, true,  false, false, false,
-    
-    /* 60-67 */ false, false, false, false, false, false, false, false, 
-    /* 68-6F */ false, false, false, false, false, false, false, false,
-    
-    /* 70-77 */ false, false, false, false, false, false, false, false, 
-    /* 78-7F */ false, false, false, false, true,  false, false, true, 
-};
-
-static inline bool shouldEscapeUChar(UChar c)
-{
-    return c > 127 ? false : needsEscaping[c];
-}
-
-static const char hexDigits[17] = "0123456789ABCDEF";
-
-static String encodedHost(const String& host)
-{
-    unsigned length = host.length();
-    Vector<UChar, 512> buffer(length * 3 + 1);
-    UChar* p = buffer.data();
-
-    const UChar* str = host.characters();
-    const UChar* strEnd = str + length;
-
-    while (str < strEnd) {
-        UChar c = *str++;
-        if (shouldEscapeUChar(c)) {
-            *p++ = '%';
-            *p++ = hexDigits[(c >> 4) & 0xF];
-            *p++ = hexDigits[c & 0xF];
-        } else
-            *p++ = c;
-    }
-
-    ASSERT(p - buffer.data() <= static_cast<int>(buffer.size()));
-
-    return String(buffer.data(), p - buffer.data());
-}
-
 String SecurityOrigin::databaseIdentifier() const 
 {
     String separatorString(&SeparatorCharacter, 1);
 
     if (m_encodedHost.isEmpty())
-        m_encodedHost = encodedHost(m_host);
+        m_encodedHost = encodeForFileName(m_host);
 
     return m_protocol + separatorString + m_encodedHost + separatorString + String::number(m_port); 
 }
diff --git a/WebCore/page/SecurityOrigin.h b/WebCore/page/SecurityOrigin.h
index fa5b1e4..266ade0 100644
--- a/WebCore/page/SecurityOrigin.h
+++ b/WebCore/page/SecurityOrigin.h
@@ -33,10 +33,10 @@
 #include <wtf/RefCounted.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/Threading.h>
+#include <wtf/text/StringHash.h>
 
 #include "FrameLoaderTypes.h"
 #include "PlatformString.h"
-#include "StringHash.h"
 
 namespace WebCore {
 
diff --git a/WebCore/page/Settings.cpp b/WebCore/page/Settings.cpp
index 6ec65c2..24563af 100644
--- a/WebCore/page/Settings.cpp
+++ b/WebCore/page/Settings.cpp
@@ -76,8 +76,7 @@ Settings::Settings(Page* page)
     , m_blockNetworkImage(false)
 #endif
     , m_maximumDecodedImageSize(numeric_limits<size_t>::max())
-#if ENABLE(DOM_STORAGE)            
-    , m_localStorageQuota(5 * 1024 * 1024)  // Suggested by the HTML5 spec.
+#if ENABLE(DOM_STORAGE)
     , m_sessionStorageQuota(StorageMap::noQuota)
 #endif
     , m_pluginAllowedRunTime(numeric_limits<unsigned>::max())
@@ -315,12 +314,7 @@ void Settings::setLocalStorageEnabled(bool localStorageEnabled)
     m_localStorageEnabled = localStorageEnabled;
 }
 
-#if ENABLE(DOM_STORAGE)        
-void Settings::setLocalStorageQuota(unsigned localStorageQuota)
-{
-    m_localStorageQuota = localStorageQuota;
-}
-
+#if ENABLE(DOM_STORAGE)
 void Settings::setSessionStorageQuota(unsigned sessionStorageQuota)
 {
     m_sessionStorageQuota = sessionStorageQuota;
diff --git a/WebCore/page/Settings.h b/WebCore/page/Settings.h
index c5a13b2..bca23b0 100644
--- a/WebCore/page/Settings.h
+++ b/WebCore/page/Settings.h
@@ -27,11 +27,11 @@
 #ifndef Settings_h
 #define Settings_h
 
-#include "AtomicString.h"
 #include "EditingBehaviorTypes.h"
 #include "FontRenderingMode.h"
 #include "KURL.h"
 #include "ZoomMode.h"
+#include <wtf/text/AtomicString.h>
 
 namespace WebCore {
 
@@ -157,10 +157,7 @@ namespace WebCore {
         void setLocalStorageEnabled(bool);
         bool localStorageEnabled() const { return m_localStorageEnabled; }
 
-#if ENABLE(DOM_STORAGE)        
-        void setLocalStorageQuota(unsigned);
-        unsigned localStorageQuota() const { return m_localStorageQuota; }
-
+#if ENABLE(DOM_STORAGE)
         // Allow clients concerned with memory consumption to set a quota on session storage
         // since the memory used won't be released until the Page is destroyed.
         // Default is noQuota.
@@ -457,8 +454,7 @@ namespace WebCore {
         bool m_blockNetworkImage : 1;
 #endif
         size_t m_maximumDecodedImageSize;
-#if ENABLE(DOM_STORAGE)        
-        unsigned m_localStorageQuota;
+#if ENABLE(DOM_STORAGE)
         unsigned m_sessionStorageQuota;
 #endif
         unsigned m_pluginAllowedRunTime;
diff --git a/WebCore/page/SpeechInput.cpp b/WebCore/page/SpeechInput.cpp
index 4f37988..24b52d2 100644
--- a/WebCore/page/SpeechInput.cpp
+++ b/WebCore/page/SpeechInput.cpp
@@ -41,46 +41,74 @@ namespace WebCore {
 
 SpeechInput::SpeechInput(SpeechInputClient* client)
     : m_client(client)
-    , m_listener(0)
+    , m_nextListenerId(1)
 {
+    m_client->setListener(this);
 }
 
-void SpeechInput::didCompleteRecording()
+SpeechInput::~SpeechInput()
 {
-    ASSERT(m_listener);
-    m_listener->didCompleteRecording();
+    m_client->setListener(0);
 }
 
-void SpeechInput::didCompleteRecognition()
+int SpeechInput::registerListener(SpeechInputListener* listener)
 {
-    ASSERT(m_listener);
-    m_listener->didCompleteRecognition();
-    m_listener = 0;
+#if defined(DEBUG)
+    // Check if already present.
+    for (HashMap<int, SpeechInputListener*>::iterator it = m_listeners.begin(); it != m_listeners.end(); ++it)
+      ASSERT(it->second != listener);
+#endif
+
+    m_listeners.add(m_nextListenerId, listener);
+    return m_nextListenerId++;
+}
+
+void SpeechInput::unregisterListener(int listenerId)
+{
+    if (m_listeners.contains(listenerId))
+        m_listeners.remove(listenerId);
+}
+
+void SpeechInput::didCompleteRecording(int listenerId)
+{
+    // Don't assert if not present as the element might have been removed by the page while
+    // this event was on the way.
+    if (m_listeners.contains(listenerId))
+        m_listeners.get(listenerId)->didCompleteRecording(listenerId);
+}
+
+void SpeechInput::didCompleteRecognition(int listenerId)
+{
+    // Don't assert if not present as the element might have been removed by the page while
+    // this event was on the way.
+    if (m_listeners.contains(listenerId))
+        m_listeners.get(listenerId)->didCompleteRecognition(listenerId);
+}
+
+void SpeechInput::setRecognitionResult(int listenerId, const String& result)
+{
+    // Don't assert if not present as the element might have been removed by the page while
+    // this event was on the way.
+    if (m_listeners.contains(listenerId))
+        m_listeners.get(listenerId)->setRecognitionResult(listenerId, result);
 }
 
-void SpeechInput::setRecognitionResult(const String& result)
+bool SpeechInput::startRecognition(int listenerId)
 {
-    ASSERT(m_listener);
-    m_listener->setRecognitionResult(result);
+    ASSERT(m_listeners.contains(listenerId));
+    return m_client->startRecognition(listenerId);
 }
 
-bool SpeechInput::startRecognition(SpeechInputListener* listener)
+void SpeechInput::stopRecording(int listenerId)
 {
-    // Cancel any ongoing recognition first.
-    if (m_listener) {
-        m_listener->didCompleteRecognition();
-        m_listener = 0;
-        m_client->cancelRecognition();
-    }
-
-    m_listener = listener;
-    return m_client->startRecognition(this);
+    ASSERT(m_listeners.contains(listenerId));
+    m_client->stopRecording(listenerId);
 }
 
-void SpeechInput::stopRecording()
+void SpeechInput::cancelRecognition(int listenerId)
 {
-    ASSERT(m_listener);
-    m_client->stopRecording();
+    ASSERT(m_listeners.contains(listenerId));
+    m_client->cancelRecognition(listenerId);
 }
 
 } // namespace WebCore
diff --git a/WebCore/page/SpeechInput.h b/WebCore/page/SpeechInput.h
index 58f4efe..f36194c 100644
--- a/WebCore/page/SpeechInput.h
+++ b/WebCore/page/SpeechInput.h
@@ -35,6 +35,7 @@
 
 #include "SpeechInputListener.h"
 #include <wtf/Forward.h>
+#include <wtf/HashMap.h>
 #include <wtf/Noncopyable.h>
 
 namespace WebCore {
@@ -48,20 +49,30 @@ class SpeechInputListener;
 class SpeechInput : public Noncopyable, public SpeechInputListener {
 public:
     SpeechInput(SpeechInputClient*);
-    virtual ~SpeechInput() { }
+    virtual ~SpeechInput();
+
+    // Generates a unique ID for the given listener to be used for speech requests.
+    // This should be the first call made by listeners before anything else.
+    int registerListener(SpeechInputListener*);
+
+    // Invoked when the listener is done with recording or getting destroyed.
+    // Failure to unregister may result in crashes if there were any pending speech events.
+    void unregisterListener(int);
 
     // Methods invoked by the input elements.
-    bool startRecognition(SpeechInputListener* listener);
-    void stopRecording();
+    bool startRecognition(int);
+    void stopRecording(int);
+    void cancelRecognition(int);
 
     // SpeechInputListener methods.
-    virtual void didCompleteRecording();
-    virtual void didCompleteRecognition();
-    virtual void setRecognitionResult(const String&);
+    virtual void didCompleteRecording(int);
+    virtual void didCompleteRecognition(int);
+    virtual void setRecognitionResult(int, const String&);
 
 private:
     SpeechInputClient* m_client;
-    SpeechInputListener* m_listener;
+    HashMap<int, SpeechInputListener*> m_listeners;
+    int m_nextListenerId;
 };
 
 } // namespace WebCore
diff --git a/WebCore/page/SpeechInputClient.h b/WebCore/page/SpeechInputClient.h
index f6c61cf..87ff7b9 100644
--- a/WebCore/page/SpeechInputClient.h
+++ b/WebCore/page/SpeechInputClient.h
@@ -40,15 +40,22 @@ class SpeechInputListener;
 // Provides an interface for SpeechInput to call into the embedder.
 class SpeechInputClient {
 public:
-    virtual bool startRecognition(SpeechInputListener* listener) = 0;
+    // This is the first call made by a listener, registering itself for future callbacks.
+    // When the listener no longer needs speech input (for e.g. when it gets destroyed),
+    // it should set a null listener to stop receiving callbacks.
+    // The client does not take ownership of the pointer.
+    virtual void setListener(SpeechInputListener*) = 0;
+
+    // Starts speech recognition and audio recording.
+    virtual bool startRecognition(int requestId) = 0;
 
     // Stops audio recording and performs recognition with the audio recorded until now
     // (does not discard audio).
-    virtual void stopRecording() = 0;
+    virtual void stopRecording(int requestId) = 0;
 
     // Cancels an ongoing recognition and discards any audio recorded so far. No partial
     // recognition results are returned to the listener.
-    virtual void cancelRecognition() = 0;
+    virtual void cancelRecognition(int requestId) = 0;
 
 protected:
     virtual ~SpeechInputClient() { }
diff --git a/WebCore/page/SpeechInputListener.h b/WebCore/page/SpeechInputListener.h
index 143984d..36060fc 100644
--- a/WebCore/page/SpeechInputListener.h
+++ b/WebCore/page/SpeechInputListener.h
@@ -41,19 +41,19 @@ namespace WebCore {
 class SpeechInputListener {
 public:
     // Informs that audio recording has completed and recognition is underway.
-    virtual void didCompleteRecording() = 0;
+    virtual void didCompleteRecording(int requestId) = 0;
 
     // Informs that speech recognition has completed. This gets invoked irrespective of whether
     // recognition was succesful or not, whether setRecognitionResult() was invoked or not. The
     // handler typically frees up any temporary resources allocated and waits for the next speech
     // recognition request.
-    virtual void didCompleteRecognition() = 0;
+    virtual void didCompleteRecognition(int requestId) = 0;
 
     // Gives results from speech recognition, either partial or the final results.
     // This method can potentially get called multiple times if there are partial results
     // available as the user keeps speaking. If the speech could not be recognized properly
     // or if there was any other errors in the process, this method may never be called.
-    virtual void setRecognitionResult(const String& result) = 0;
+    virtual void setRecognitionResult(int requestId, const String& result) = 0;
 
 protected:
     virtual ~SpeechInputListener() { }
diff --git a/WebCore/page/UserContentURLPattern.cpp b/WebCore/page/UserContentURLPattern.cpp
index 09eb678..272284a 100644
--- a/WebCore/page/UserContentURLPattern.cpp
+++ b/WebCore/page/UserContentURLPattern.cpp
@@ -63,14 +63,14 @@ bool UserContentURLPattern::parse(const String& pattern)
 {
     DEFINE_STATIC_LOCAL(const String, schemeSeparator, ("://"));
 
-    int schemeEndPos = pattern.find(schemeSeparator);
-    if (schemeEndPos == -1)
+    size_t schemeEndPos = pattern.find(schemeSeparator);
+    if (schemeEndPos == notFound)
         return false;
 
     m_scheme = pattern.left(schemeEndPos);
 
-    int hostStartPos = schemeEndPos + schemeSeparator.length();
-    if (hostStartPos >= static_cast<int>(pattern.length()))
+    unsigned hostStartPos = schemeEndPos + schemeSeparator.length();
+    if (hostStartPos >= pattern.length())
         return false;
 
     int pathStartPos = 0;
@@ -78,8 +78,8 @@ bool UserContentURLPattern::parse(const String& pattern)
     if (equalIgnoringCase(m_scheme, "file"))
         pathStartPos = hostStartPos;
     else {
-        int hostEndPos = pattern.find("/", hostStartPos);
-        if (hostEndPos == -1)
+        size_t hostEndPos = pattern.find("/", hostStartPos);
+        if (hostEndPos == notFound)
             return false;
 
         m_host = pattern.substring(hostStartPos, hostEndPos - hostStartPos);
@@ -96,7 +96,7 @@ bool UserContentURLPattern::parse(const String& pattern)
         }
 
         // No other '*' can occur in the host.
-        if (m_host.find("*") != -1)
+        if (m_host.find("*") != notFound)
             return false;
 
         pathStartPos = hostEndPos;
diff --git a/WebCore/page/UserStyleSheet.h b/WebCore/page/UserStyleSheet.h
index 4c6d708..1acd296 100644
--- a/WebCore/page/UserStyleSheet.h
+++ b/WebCore/page/UserStyleSheet.h
@@ -37,14 +37,20 @@ namespace WebCore {
 
 class UserStyleSheet : public Noncopyable {
 public:
+    enum Level {
+        UserLevel,
+        AuthorLevel
+    };
+
     UserStyleSheet(const String& source, const KURL& url,
                    PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
-                   UserContentInjectedFrames injectedFrames)
+                   UserContentInjectedFrames injectedFrames, Level level)
         : m_source(source)
         , m_url(url)
         , m_whitelist(whitelist)
         , m_blacklist(blacklist)
         , m_injectedFrames(injectedFrames)
+        , m_level(level)
     {
     }
 
@@ -53,6 +59,7 @@ public:
     const Vector<String>* whitelist() const { return m_whitelist.get(); }
     const Vector<String>* blacklist() const { return m_blacklist.get(); }
     UserContentInjectedFrames injectedFrames() const { return m_injectedFrames; }
+    Level level() const { return m_level; }
 
 private:
     String m_source;
@@ -60,6 +67,7 @@ private:
     OwnPtr<Vector<String> > m_whitelist;
     OwnPtr<Vector<String> > m_blacklist;
     UserContentInjectedFrames m_injectedFrames;
+    Level m_level;
 };
 
 } // namespace WebCore
diff --git a/WebCore/page/WindowFeatures.cpp b/WebCore/page/WindowFeatures.cpp
index 1654ff5..82e36b9 100644
--- a/WebCore/page/WindowFeatures.cpp
+++ b/WebCore/page/WindowFeatures.cpp
@@ -24,10 +24,10 @@
 #include "WindowFeatures.h"
 
 #include "PlatformString.h"
-#include "StringHash.h"
 #include <wtf/Assertions.h>
 #include <wtf/HashMap.h>
 #include <wtf/MathExtras.h>
+#include <wtf/text/StringHash.h>
 
 namespace WebCore {
 
diff --git a/WebCore/page/XSSAuditor.cpp b/WebCore/page/XSSAuditor.cpp
index 22506b2..fb0e1c0 100644
--- a/WebCore/page/XSSAuditor.cpp
+++ b/WebCore/page/XSSAuditor.cpp
@@ -34,8 +34,8 @@
 #include "DocumentLoader.h"
 #include "DOMWindow.h"
 #include "Frame.h"
+#include "HTMLEntityParser.h"
 #include "KURL.h"
-#include "LegacyPreloadScanner.h"
 #include "ResourceResponseBase.h"
 #include "ScriptSourceCode.h"
 #include "Settings.h"
@@ -277,7 +277,7 @@ String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodabl
         if (leaveUndecodableEntitiesUntouched)
             sourceShadow = source;
         bool notEnoughCharacters = false;
-        unsigned entity = LegacyPreloadScanner::consumeEntity(source, notEnoughCharacters);
+        unsigned entity = consumeHTMLEntity(source, notEnoughCharacters);
         // We ignore notEnoughCharacters because we might as well use this loop
         // to copy the remaining characters into |result|.
 
@@ -405,10 +405,10 @@ bool XSSAuditor::findInRequest(Frame* frame, const FindTask& task) const
 
     String decodedPageURL = m_pageURLCache.canonicalizeURL(pageURL, frame->document()->decoder()->encoding(), task.decodeEntities, task.decodeURLEscapeSequencesTwice);
 
-    if (task.allowRequestIfNoIllegalURICharacters && !hasFormData && decodedPageURL.find(&isIllegalURICharacter, 0) == -1)
+    if (task.allowRequestIfNoIllegalURICharacters && !hasFormData && decodedPageURL.find(&isIllegalURICharacter, 0) == notFound)
         return false; // Injection is impossible because the request does not contain any illegal URI characters.
 
-    if (decodedPageURL.find(canonicalizedString, 0, false) != -1)
+    if (decodedPageURL.find(canonicalizedString, 0, false) != notFound)
         return true; // We've found the string in the GET data.
 
     if (hasFormData) {
@@ -423,7 +423,7 @@ bool XSSAuditor::findInRequest(Frame* frame, const FindTask& task) const
         if (m_formDataSuffixTree && !m_formDataSuffixTree->mightContain(canonicalizedString))
             return false;
 
-        if (decodedFormData.find(canonicalizedString, 0, false) != -1)
+        if (decodedFormData.find(canonicalizedString, 0, false) != notFound)
             return true; // We found the string in the POST data.
     }
 
diff --git a/WebCore/page/XSSAuditor.h b/WebCore/page/XSSAuditor.h
index 20e0a53..2b781f1 100644
--- a/WebCore/page/XSSAuditor.h
+++ b/WebCore/page/XSSAuditor.h
@@ -66,7 +66,7 @@ namespace WebCore {
     // * ScriptController::executeIfJavaScriptURL - used to evaluate JavaScript URLs.
     // * ScriptEventListener::createAttributeEventListener - used to create JavaScript event handlers.
     // * HTMLBaseElement::process - used to set the document base URL.
-    // * LegacyHTMLDocumentParser::parseTag - used to load external JavaScript scripts.
+    // * HTMLDocumentParser::shouldLoadExternalScriptFromSrc - used to load external JavaScript scripts.
     // * SubframeLoader::requestObject - used to load <object>/<embed> elements.
     //
     class XSSAuditor : public Noncopyable {
diff --git a/WebCore/page/animation/AnimationBase.h b/WebCore/page/animation/AnimationBase.h
index 33a0b1d..182cb3c 100644
--- a/WebCore/page/animation/AnimationBase.h
+++ b/WebCore/page/animation/AnimationBase.h
@@ -29,8 +29,8 @@
 #ifndef AnimationBase_h
 #define AnimationBase_h
 
-#include "AtomicString.h"
 #include <wtf/HashMap.h>
+#include <wtf/text/AtomicString.h>
 
 namespace WebCore {
 
diff --git a/WebCore/page/animation/AnimationControllerPrivate.h b/WebCore/page/animation/AnimationControllerPrivate.h
index 3ae15a5..3305e24 100644
--- a/WebCore/page/animation/AnimationControllerPrivate.h
+++ b/WebCore/page/animation/AnimationControllerPrivate.h
@@ -29,7 +29,6 @@
 #ifndef AnimationControllerPrivate_h
 #define AnimationControllerPrivate_h
 
-#include "AtomicString.h"
 #include "CSSPropertyNames.h"
 #include "PlatformString.h"
 #include "Timer.h"
@@ -37,6 +36,7 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
+#include <wtf/text/AtomicString.h>
 
 namespace WebCore {
 
diff --git a/WebCore/page/animation/CompositeAnimation.h b/WebCore/page/animation/CompositeAnimation.h
index 51ba565..a0ac455 100644
--- a/WebCore/page/animation/CompositeAnimation.h
+++ b/WebCore/page/animation/CompositeAnimation.h
@@ -29,12 +29,11 @@
 #ifndef CompositeAnimation_h
 #define CompositeAnimation_h
 
-#include "AtomicString.h"
-
 #include "ImplicitAnimation.h"
 #include "KeyframeAnimation.h"
 #include <wtf/HashMap.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/text/AtomicString.h>
 
 namespace WebCore {