Merge webkit.org at R49305 : Automatic merge by git.

Change-Id: I8968561bc1bfd72b8923b7118d3728579c6dbcc7

9 files changed, 322 insertions, 331 deletions

diff --git a/WebCore/platform/graphics/cg/ColorCG.cpp b/WebCore/platform/graphics/cg/ColorCG.cpp
index 0465c0b..40aacc5 100644
--- a/WebCore/platform/graphics/cg/ColorCG.cpp
+++ b/WebCore/platform/graphics/cg/ColorCG.cpp
@@ -29,6 +29,7 @@
 #if PLATFORM(CG)
 
 #include <wtf/Assertions.h>
+#include <wtf/RetainPtr.h>
 #include <ApplicationServices/ApplicationServices.h>
 
 namespace WebCore {
@@ -75,13 +76,12 @@ CGColorRef createCGColor(const Color& c)
     CMProfileRef prof = NULL;
     CMGetSystemProfile(&prof);
 
-    CGColorSpaceRef rgbSpace = CGColorSpaceCreateWithPlatformColorSpace(prof);
+    RetainPtr<CGColorSpaceRef> rgbSpace(AdoptCF, CGColorSpaceCreateWithPlatformColorSpace(prof));
 
-    if (rgbSpace != NULL)
-    {
-        float components[4] = {c.red() / 255.0f, c.green() / 255.0f, c.blue() / 255.0f, c.alpha() / 255.0f};
-        color = CGColorCreate(rgbSpace, components);
-        CGColorSpaceRelease(rgbSpace);
+    if (rgbSpace) {
+        CGFloat components[4] = { static_cast<CGFloat>(c.red()) / 255, static_cast<CGFloat>(c.green()) / 255,
+                                  static_cast<CGFloat>(c.blue()) / 255, static_cast<CGFloat>(c.alpha()) / 255 };
+        color = CGColorCreate(rgbSpace.get(), components);
     }
 
     CMCloseProfile(prof);
diff --git a/WebCore/platform/graphics/cg/GradientCG.cpp b/WebCore/platform/graphics/cg/GradientCG.cpp
index c189fd5..05a0aad 100644
--- a/WebCore/platform/graphics/cg/GradientCG.cpp
+++ b/WebCore/platform/graphics/cg/GradientCG.cpp
@@ -58,17 +58,14 @@ CGShadingRef Gradient::platformGradient()
     const CGFloat intervalRanges[2] = { 0, 1 };
     const CGFloat colorComponentRanges[4 * 2] = { 0, 1, 0, 1, 0, 1, 0, 1 };
     const CGFunctionCallbacks gradientCallbacks = { 0, gradientCallback, 0 };
-    CGFunctionRef colorFunction = CGFunctionCreate(this, 1, intervalRanges, 4, colorComponentRanges, &gradientCallbacks);
+    RetainPtr<CGFunctionRef> colorFunction(AdoptCF, CGFunctionCreate(this, 1, intervalRanges, 4, colorComponentRanges, &gradientCallbacks));
 
-    CGColorSpaceRef colorSpace = CGColorSpaceCreateDeviceRGB();
+    static CGColorSpaceRef colorSpace = CGColorSpaceCreateDeviceRGB();
 
     if (m_radial)
-        m_gradient = CGShadingCreateRadial(colorSpace, m_p0, m_r0, m_p1, m_r1, colorFunction, true, true);
+        m_gradient = CGShadingCreateRadial(colorSpace, m_p0, m_r0, m_p1, m_r1, colorFunction.get(), true, true);
     else
-        m_gradient = CGShadingCreateAxial(colorSpace, m_p0, m_p1, colorFunction, true, true);
-
-    CGColorSpaceRelease(colorSpace);
-    CGFunctionRelease(colorFunction);
+        m_gradient = CGShadingCreateAxial(colorSpace, m_p0, m_p1, colorFunction.get(), true, true);
 
     return m_gradient;
 }
diff --git a/WebCore/platform/graphics/cg/GraphicsContextCG.cpp b/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
index ab8eb3c..1b843e4 100644
--- a/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
+++ b/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
@@ -28,14 +28,15 @@
 #include "config.h"
 #include "GraphicsContext.h"
 
-#include "TransformationMatrix.h"
 #include "FloatConversion.h"
-#include "GraphicsContextPrivate.h"
 #include "GraphicsContextPlatformPrivateCG.h"
+#include "GraphicsContextPrivate.h"
 #include "ImageBuffer.h"
 #include "KURL.h"
 #include "Path.h"
 #include "Pattern.h"
+#include "TransformationMatrix.h"
+
 #include <CoreGraphics/CGBitmapContext.h>
 #include <CoreGraphics/CGPDFContext.h>
 #include <wtf/MathExtras.h>
@@ -86,7 +87,7 @@ CGContextRef GraphicsContext::platformContext() const
 {
     ASSERT(!paintingDisabled());
     ASSERT(m_data->m_cgContext);
-    return m_data->m_cgContext;
+    return m_data->m_cgContext.get();
 }
 
 void GraphicsContext::savePlatformState()
@@ -178,19 +179,19 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
     
     int patWidth = 0;
     switch (strokeStyle()) {
-        case NoStroke:
-        case SolidStroke:
-            break;
-        case DottedStroke:
-            patWidth = (int)width;
-            break;
-        case DashedStroke:
-            patWidth = 3 * (int)width;
-            break;
+    case NoStroke:
+    case SolidStroke:
+        break;
+    case DottedStroke:
+        patWidth = (int)width;
+        break;
+    case DashedStroke:
+        patWidth = 3 * (int)width;
+        break;
     }
 
     CGContextRef context = platformContext();
-    
+
     if (shouldAntialias())
         CGContextSetShouldAntialias(context, false);
 
@@ -221,7 +222,7 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
         if (patWidth == 1)
             patternOffset = 1.0f;
         else {
-            bool evenNumberOfSegments = numSegments % 2 == 0;
+            bool evenNumberOfSegments = !(numSegments % 2);
             if (remainder)
                 evenNumberOfSegments = !evenNumberOfSegments;
             if (evenNumberOfSegments) {
@@ -235,7 +236,7 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
                     patternOffset = (patWidth - remainder)/2;
             }
         }
-        
+
         const CGFloat dottedLine[2] = { patWidth, patWidth };
         CGContextSetLineDash(context, patternOffset, dottedLine, 2);
     }
@@ -248,7 +249,7 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
 
     if (patWidth)
         CGContextRestoreGState(context);
-        
+
     if (shouldAntialias())
         CGContextSetShouldAntialias(context, true);
 }
@@ -263,7 +264,7 @@ void GraphicsContext::drawEllipse(const IntRect& rect)
 
     if (paintingDisabled())
         return;
-        
+
     CGContextRef context = platformContext();
     CGContextBeginPath(context);
     float r = (float)rect.width() / 2;
@@ -275,25 +276,25 @@ void GraphicsContext::drawEllipse(const IntRect& rect)
 
 
 void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSpan)
-{ 
+{
     if (paintingDisabled() || strokeStyle() == NoStroke || strokeThickness() <= 0.0f)
         return;
-    
+
     CGContextRef context = platformContext();
     CGContextSaveGState(context);
     CGContextBeginPath(context);
     CGContextSetShouldAntialias(context, false);
-    
+
     int x = rect.x();
     int y = rect.y();
     float w = (float)rect.width();
     float h = (float)rect.height();
     float scaleFactor = h / w;
     float reverseScaleFactor = w / h;
-    
+
     if (w != h)
         scale(FloatSize(1, scaleFactor));
-    
+
     float hRadius = w / 2;
     float vRadius = h / 2;
     float fa = startAngle;
@@ -304,22 +305,21 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
 
     if (w != h)
         scale(FloatSize(1, reverseScaleFactor));
-    
-    
+
     float width = strokeThickness();
     int patWidth = 0;
-    
+
     switch (strokeStyle()) {
-        case DottedStroke:
-            patWidth = (int)(width / 2);
-            break;
-        case DashedStroke:
-            patWidth = 3 * (int)(width / 2);
-            break;
-        default:
-            break;
+    case DottedStroke:
+        patWidth = (int)(width / 2);
+        break;
+    case DashedStroke:
+        patWidth = 3 * (int)(width / 2);
+        break;
+    default:
+        break;
     }
-    
+
     if (patWidth) {
         // Example: 80 pixels with a width of 30 pixels.
         // Remainder is 20.  The maximum pixels of line we could paint
@@ -329,7 +329,7 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
             distance = static_cast<int>((piFloat * hRadius) / 2.0f);
         else // We are elliptical and will have to estimate the distance
             distance = static_cast<int>((piFloat * sqrtf((hRadius * hRadius + vRadius * vRadius) / 2.0f)) / 2.0f);
-        
+
         int remainder = distance % patWidth;
         int coverage = distance - remainder;
         int numSegments = coverage / patWidth;
@@ -339,7 +339,7 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
         if (patWidth == 1)
             patternOffset = 1.0f;
         else {
-            bool evenNumberOfSegments = numSegments % 2 == 0;
+            bool evenNumberOfSegments = !(numSegments % 2);
             if (remainder)
                 evenNumberOfSegments = !evenNumberOfSegments;
             if (evenNumberOfSegments) {
@@ -353,13 +353,13 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
                     patternOffset = (patWidth - remainder) / 2.0f;
             }
         }
-    
+
         const CGFloat dottedLine[2] = { patWidth, patWidth };
         CGContextSetLineDash(context, patternOffset, dottedLine, 2);
     }
 
     CGContextStrokePath(context);
-    
+
     CGContextRestoreGState(context);
 }
 
@@ -375,7 +375,7 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
 
     if (antialiased != shouldAntialias())
         CGContextSetShouldAntialias(context, antialiased);
-    
+
     CGContextBeginPath(context);
     CGContextMoveToPoint(context, points[0].x(), points[0].y());
     for (size_t i = 1; i < npoints; i++)
@@ -383,7 +383,7 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
     CGContextClosePath(context);
 
     drawPath();
-    
+
     if (antialiased != shouldAntialias())
         CGContextSetShouldAntialias(context, shouldAntialias());
 }
@@ -391,35 +391,31 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
 void GraphicsContext::applyStrokePattern()
 {
     CGContextRef cgContext = platformContext();
-    
-    CGPatternRef platformPattern = m_common->state.strokePattern.get()->createPlatformPattern(getCTM());
+
+    RetainPtr<CGPatternRef> platformPattern(AdoptCF, m_common->state.strokePattern.get()->createPlatformPattern(getCTM()));
     if (!platformPattern)
         return;
 
-    CGColorSpaceRef patternSpace = CGColorSpaceCreatePattern(0);
-    CGContextSetStrokeColorSpace(cgContext, patternSpace);
-    CGColorSpaceRelease(patternSpace);
+    RetainPtr<CGColorSpaceRef> patternSpace(AdoptCF, CGColorSpaceCreatePattern(0));
+    CGContextSetStrokeColorSpace(cgContext, patternSpace.get());
 
     const CGFloat patternAlpha = 1;
-    CGContextSetStrokePattern(cgContext, platformPattern, &patternAlpha);
-    CGPatternRelease(platformPattern);
+    CGContextSetStrokePattern(cgContext, platformPattern.get(), &patternAlpha);
 }
 
 void GraphicsContext::applyFillPattern()
 {
     CGContextRef cgContext = platformContext();
 
-    CGPatternRef platformPattern = m_common->state.fillPattern.get()->createPlatformPattern(getCTM());
+    RetainPtr<CGPatternRef> platformPattern(AdoptCF, m_common->state.fillPattern.get()->createPlatformPattern(getCTM()));
     if (!platformPattern)
         return;
 
-    CGColorSpaceRef patternSpace = CGColorSpaceCreatePattern(0);
-    CGContextSetFillColorSpace(cgContext, patternSpace);
-    CGColorSpaceRelease(patternSpace);
+    RetainPtr<CGColorSpaceRef> patternSpace(AdoptCF, CGColorSpaceCreatePattern(0));
+    CGContextSetFillColorSpace(cgContext, patternSpace.get());
 
     const CGFloat patternAlpha = 1;
-    CGContextSetFillPattern(cgContext, platformPattern, &patternAlpha);
-    CGPatternRelease(platformPattern);
+    CGContextSetFillPattern(cgContext, platformPattern.get(), &patternAlpha);
 }
 
 static inline bool calculateDrawingMode(const GraphicsContextState& state, CGPathDrawingMode& mode)
@@ -463,7 +459,7 @@ void GraphicsContext::drawPath()
         strokePath();
         return;
     }
-    
+
     if (state.fillColorSpace == PatternColorSpace)
         applyFillPattern();
     if (state.strokeColorSpace == PatternColorSpace)
@@ -599,7 +595,7 @@ void GraphicsContext::clipOut(const IntRect& rect)
 {
     if (paintingDisabled())
         return;
-        
+
     CGRect rects[2] = { CGContextGetClipBoundingBox(platformContext()), rect };
     CGContextBeginPath(platformContext());
     CGContextAddRects(platformContext(), rects, 2);
@@ -610,7 +606,7 @@ void GraphicsContext::clipOutEllipseInRect(const IntRect& rect)
 {
     if (paintingDisabled())
         return;
-        
+
     CGContextBeginPath(platformContext());
     CGContextAddRect(platformContext(), CGContextGetClipBoundingBox(platformContext()));
     CGContextAddEllipseInRect(platformContext(), rect);
@@ -639,13 +635,13 @@ void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect, int thickness
 
     clip(rect);
     CGContextRef context = platformContext();
-    
+
     // Add outer ellipse
     CGContextAddEllipseInRect(context, CGRectMake(rect.x(), rect.y(), rect.width(), rect.height()));
     // Add inner ellipse.
     CGContextAddEllipseInRect(context, CGRectMake(rect.x() + thickness, rect.y() + thickness,
         rect.width() - (thickness * 2), rect.height() - (thickness * 2)));
-    
+
     CGContextEOClip(context);
 }
 
@@ -653,7 +649,7 @@ void GraphicsContext::clipToImageBuffer(const FloatRect& rect, const ImageBuffer
 {
     if (paintingDisabled())
         return;
-    
+
     CGContextTranslateCTM(platformContext(), rect.x(), rect.y() + rect.height());
     CGContextScaleCTM(platformContext(), 1, -1);
     CGContextClipToMask(platformContext(), FloatRect(FloatPoint(), rect.size()), imageBuffer->image()->getCGImageRef());
@@ -731,12 +727,11 @@ void GraphicsContext::setPlatformShadow(const IntSize& size, int blur, const Col
     if (!color.isValid())
         CGContextSetShadow(context, CGSizeMake(width, height), blurRadius);
     else {
-        CGColorRef colorCG = createCGColor(color);
+        RetainPtr<CGColorRef> colorCG(AdoptCF, createCGColor(color));
         CGContextSetShadowWithColor(context,
                                     CGSizeMake(width, height),
-                                    blurRadius, 
-                                    colorCG);
-        CGColorRelease(colorCG);
+                                    blurRadius,
+                                    colorCG.get());
     }
 }
 
@@ -799,15 +794,15 @@ void GraphicsContext::setLineCap(LineCap cap)
     if (paintingDisabled())
         return;
     switch (cap) {
-        case ButtCap:
-            CGContextSetLineCap(platformContext(), kCGLineCapButt);
-            break;
-        case RoundCap:
-            CGContextSetLineCap(platformContext(), kCGLineCapRound);
-            break;
-        case SquareCap:
-            CGContextSetLineCap(platformContext(), kCGLineCapSquare);
-            break;
+    case ButtCap:
+        CGContextSetLineCap(platformContext(), kCGLineCapButt);
+        break;
+    case RoundCap:
+        CGContextSetLineCap(platformContext(), kCGLineCapRound);
+        break;
+    case SquareCap:
+        CGContextSetLineCap(platformContext(), kCGLineCapSquare);
+        break;
     }
 }
 
@@ -821,15 +816,15 @@ void GraphicsContext::setLineJoin(LineJoin join)
     if (paintingDisabled())
         return;
     switch (join) {
-        case MiterJoin:
-            CGContextSetLineJoin(platformContext(), kCGLineJoinMiter);
-            break;
-        case RoundJoin:
-            CGContextSetLineJoin(platformContext(), kCGLineJoinRound);
-            break;
-        case BevelJoin:
-            CGContextSetLineJoin(platformContext(), kCGLineJoinBevel);
-            break;
+    case MiterJoin:
+        CGContextSetLineJoin(platformContext(), kCGLineJoinMiter);
+        break;
+    case RoundJoin:
+        CGContextSetLineJoin(platformContext(), kCGLineJoinRound);
+        break;
+    case BevelJoin:
+        CGContextSetLineJoin(platformContext(), kCGLineJoinBevel);
+        break;
     }
 }
 
@@ -858,7 +853,7 @@ void GraphicsContext::clipOut(const Path& path)
 {
     if (paintingDisabled())
         return;
-        
+
     CGContextBeginPath(platformContext());
     CGContextAddRect(platformContext(), CGContextGetClipBoundingBox(platformContext()));
     CGContextAddPath(platformContext(), path.platformPath());
@@ -909,9 +904,9 @@ TransformationMatrix GraphicsContext::getCTM() const
 
 FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& rect)
 {
-    // It is not enough just to round to pixels in device space. The rotation part of the 
+    // It is not enough just to round to pixels in device space. The rotation part of the
     // affine transform matrix to device space can mess with this conversion if we have a
-    // rotating image like the hands of the world clock widget. We just need the scale, so 
+    // rotating image like the hands of the world clock widget. We just need the scale, so
     // we get the affine transform matrix and extract the scale.
 
     if (m_data->m_userToDeviceTransformKnownToBeIdentity)
@@ -934,11 +929,11 @@ FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& rect)
     deviceOrigin.y = roundf(deviceOrigin.y);
     deviceLowerRight.x = roundf(deviceLowerRight.x);
     deviceLowerRight.y = roundf(deviceLowerRight.y);
-    
+
     // Don't let the height or width round to 0 unless either was originally 0
-    if (deviceOrigin.y == deviceLowerRight.y && rect.height() != 0)
+    if (deviceOrigin.y == deviceLowerRight.y && rect.height())
         deviceLowerRight.y += 1;
-    if (deviceOrigin.x == deviceLowerRight.x && rect.width() != 0)
+    if (deviceOrigin.x == deviceLowerRight.x && rect.width())
         deviceLowerRight.x += 1;
 
     FloatPoint roundedOrigin = FloatPoint(deviceOrigin.x / deviceScaleX, deviceOrigin.y / deviceScaleY);
@@ -984,13 +979,13 @@ void GraphicsContext::drawLineForText(const IntPoint& point, int width, bool pri
             }
         }
     }
-    
+
     if (fillColor() != strokeColor())
         setCGFillColor(platformContext(), strokeColor());
     CGContextFillRect(platformContext(), CGRectMake(x, y, lineLength, thickness));
     if (fillColor() != strokeColor())
         setCGFillColor(platformContext(), fillColor());
-        
+
     if (restoreAntialiasMode)
         CGContextSetShouldAntialias(platformContext(), true);
 }
@@ -999,51 +994,50 @@ void GraphicsContext::setURLForRect(const KURL& link, const IntRect& destRect)
 {
     if (paintingDisabled())
         return;
-        
-    CFURLRef urlRef = link.createCFURL();
-    if (urlRef) {
-        CGContextRef context = platformContext();
-        
-        // Get the bounding box to handle clipping.
-        CGRect box = CGContextGetClipBoundingBox(context);
-
-        IntRect intBox((int)box.origin.x, (int)box.origin.y, (int)box.size.width, (int)box.size.height);
-        IntRect rect = destRect;
-        rect.intersect(intBox);
-
-        CGPDFContextSetURLForRect(context, urlRef,
-            CGRectApplyAffineTransform(rect, CGContextGetCTM(context)));
-
-        CFRelease(urlRef);
-    }
+
+    RetainPtr<CFURLRef> urlRef(AdoptCF, link.createCFURL());
+    if (!urlRef)
+        return;
+
+    CGContextRef context = platformContext();
+
+    // Get the bounding box to handle clipping.
+    CGRect box = CGContextGetClipBoundingBox(context);
+
+    IntRect intBox((int)box.origin.x, (int)box.origin.y, (int)box.size.width, (int)box.size.height);
+    IntRect rect = destRect;
+    rect.intersect(intBox);
+
+    CGPDFContextSetURLForRect(context, urlRef.get(),
+        CGRectApplyAffineTransform(rect, CGContextGetCTM(context)));
 }
 
 void GraphicsContext::setImageInterpolationQuality(InterpolationQuality mode)
 {
     if (paintingDisabled())
         return;
-    
+
     CGInterpolationQuality quality = kCGInterpolationDefault;
     switch (mode) {
-        case InterpolationDefault:
-            quality = kCGInterpolationDefault;
-            break;
-        case InterpolationNone:
-            quality = kCGInterpolationNone;
-            break;
-        case InterpolationLow:
-            quality = kCGInterpolationLow;
-            break;
-
-        // Fall through to InterpolationHigh if kCGInterpolationMedium is not available
-        case InterpolationMedium:
+    case InterpolationDefault:
+        quality = kCGInterpolationDefault;
+        break;
+    case InterpolationNone:
+        quality = kCGInterpolationNone;
+        break;
+    case InterpolationLow:
+        quality = kCGInterpolationLow;
+        break;
+
+    // Fall through to InterpolationHigh if kCGInterpolationMedium is not available
+    case InterpolationMedium:
 #if HAVE(CG_INTERPOLATION_MEDIUM)
-            quality = kCGInterpolationMedium;
-            break;
+        quality = kCGInterpolationMedium;
+        break;
 #endif
-        case InterpolationHigh:
-            quality = kCGInterpolationHigh;
-            break;
+    case InterpolationHigh:
+        quality = kCGInterpolationHigh;
+        break;
     }
     CGContextSetInterpolationQuality(platformContext(), quality);
 }
@@ -1055,18 +1049,18 @@ InterpolationQuality GraphicsContext::imageInterpolationQuality() const
 
     CGInterpolationQuality quality = CGContextGetInterpolationQuality(platformContext());
     switch (quality) {
-        case kCGInterpolationDefault:
-            return InterpolationDefault;
-        case kCGInterpolationNone:
-            return InterpolationNone;
-        case kCGInterpolationLow:
-            return InterpolationLow;
+    case kCGInterpolationDefault:
+        return InterpolationDefault;
+    case kCGInterpolationNone:
+        return InterpolationNone;
+    case kCGInterpolationLow:
+        return InterpolationLow;
 #if HAVE(CG_INTERPOLATION_MEDIUM)
-        case kCGInterpolationMedium:
-            return InterpolationMedium;
+    case kCGInterpolationMedium:
+        return InterpolationMedium;
 #endif
-        case kCGInterpolationHigh:
-            return InterpolationHigh;
+    case kCGInterpolationHigh:
+        return InterpolationHigh;
     }
     return InterpolationDefault;
 }
@@ -1079,32 +1073,32 @@ void GraphicsContext::setPlatformTextDrawingMode(int mode)
     // Wow, wish CG had used bits here.
     CGContextRef context = platformContext();
     switch (mode) {
-        case cTextInvisible: // Invisible
-            CGContextSetTextDrawingMode(context, kCGTextInvisible);
-            break;
-        case cTextFill: // Fill
-            CGContextSetTextDrawingMode(context, kCGTextFill);
-            break;
-        case cTextStroke: // Stroke
-            CGContextSetTextDrawingMode(context, kCGTextStroke);
-            break;
-        case 3: // Fill | Stroke
-            CGContextSetTextDrawingMode(context, kCGTextFillStroke);
-            break;
-        case cTextClip: // Clip
-            CGContextSetTextDrawingMode(context, kCGTextClip);
-            break;
-        case 5: // Fill | Clip
-            CGContextSetTextDrawingMode(context, kCGTextFillClip);
-            break;
-        case 6: // Stroke | Clip
-            CGContextSetTextDrawingMode(context, kCGTextStrokeClip);
-            break;
-        case 7: // Fill | Stroke | Clip
-            CGContextSetTextDrawingMode(context, kCGTextFillStrokeClip);
-            break;
-        default:
-            break;
+    case cTextInvisible: // Invisible
+        CGContextSetTextDrawingMode(context, kCGTextInvisible);
+        break;
+    case cTextFill: // Fill
+        CGContextSetTextDrawingMode(context, kCGTextFill);
+        break;
+    case cTextStroke: // Stroke
+        CGContextSetTextDrawingMode(context, kCGTextStroke);
+        break;
+    case 3: // Fill | Stroke
+        CGContextSetTextDrawingMode(context, kCGTextFillStroke);
+        break;
+    case cTextClip: // Clip
+        CGContextSetTextDrawingMode(context, kCGTextClip);
+        break;
+    case 5: // Fill | Clip
+        CGContextSetTextDrawingMode(context, kCGTextFillClip);
+        break;
+    case 6: // Stroke | Clip
+        CGContextSetTextDrawingMode(context, kCGTextStrokeClip);
+        break;
+    case 7: // Fill | Stroke | Clip
+        CGContextSetTextDrawingMode(context, kCGTextFillStrokeClip);
+        break;
+    default:
+        break;
     }
 }
 
@@ -1138,54 +1132,54 @@ void GraphicsContext::setPlatformShouldAntialias(bool enable)
 
 #ifndef BUILDING_ON_TIGER // Tiger's setCompositeOperation() is defined in GraphicsContextMac.mm.
 void GraphicsContext::setCompositeOperation(CompositeOperator mode)
-{   
+{
     if (paintingDisabled())
         return;
 
-    CGBlendMode target = kCGBlendModeNormal;   
+    CGBlendMode target = kCGBlendModeNormal;
     switch (mode) {
-        case CompositeClear:
-            target = kCGBlendModeClear;
-            break;
-        case CompositeCopy:
-            target = kCGBlendModeCopy;
-            break;
-        case CompositeSourceOver:
-            //kCGBlendModeNormal
-            break;
-        case CompositeSourceIn:
-            target = kCGBlendModeSourceIn;
-            break;
-        case CompositeSourceOut:
-            target = kCGBlendModeSourceOut;
-            break;
-        case CompositeSourceAtop:
-            target = kCGBlendModeSourceAtop; 
-            break;
-        case CompositeDestinationOver:
-            target = kCGBlendModeDestinationOver;
-            break;
-        case CompositeDestinationIn:
-            target = kCGBlendModeDestinationIn;
-            break;
-        case CompositeDestinationOut:
-            target = kCGBlendModeDestinationOut;
-            break;
-        case CompositeDestinationAtop:
-            target = kCGBlendModeDestinationAtop;
-            break;
-        case CompositeXOR:
-            target = kCGBlendModeXOR;
-            break;
-        case CompositePlusDarker:
-            target = kCGBlendModePlusDarker;
-            break;
-        case CompositeHighlight:
-            // currently unsupported
-            break;
-        case CompositePlusLighter:
-            target = kCGBlendModePlusLighter;
-            break;
+    case CompositeClear:
+        target = kCGBlendModeClear;
+        break;
+    case CompositeCopy:
+        target = kCGBlendModeCopy;
+        break;
+    case CompositeSourceOver:
+        //kCGBlendModeNormal
+        break;
+    case CompositeSourceIn:
+        target = kCGBlendModeSourceIn;
+        break;
+    case CompositeSourceOut:
+        target = kCGBlendModeSourceOut;
+        break;
+    case CompositeSourceAtop:
+        target = kCGBlendModeSourceAtop;
+        break;
+    case CompositeDestinationOver:
+        target = kCGBlendModeDestinationOver;
+        break;
+    case CompositeDestinationIn:
+        target = kCGBlendModeDestinationIn;
+        break;
+    case CompositeDestinationOut:
+        target = kCGBlendModeDestinationOut;
+        break;
+    case CompositeDestinationAtop:
+        target = kCGBlendModeDestinationAtop;
+        break;
+    case CompositeXOR:
+        target = kCGBlendModeXOR;
+        break;
+    case CompositePlusDarker:
+        target = kCGBlendModePlusDarker;
+        break;
+    case CompositeHighlight:
+        // currently unsupported
+        break;
+    case CompositePlusLighter:
+        target = kCGBlendModePlusLighter;
+        break;
     }
     CGContextSetBlendMode(platformContext(), target);
 }
diff --git a/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h b/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
index f63a8dd..38c5506 100644
--- a/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
+++ b/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
@@ -38,12 +38,10 @@ public:
 #endif
         , m_userToDeviceTransformKnownToBeIdentity(false)
     {
-        CGContextRetain(m_cgContext);
     }
     
     ~GraphicsContextPlatformPrivate()
     {
-        CGContextRelease(m_cgContext);
     }
 
 #if PLATFORM(MAC) || PLATFORM(CHROMIUM)
@@ -80,7 +78,7 @@ public:
     bool m_shouldIncludeChildWindows;
 #endif
 
-    CGContextRef m_cgContext;
+    RetainPtr<CGContextRef> m_cgContext;
     bool m_userToDeviceTransformKnownToBeIdentity;
 };
 
diff --git a/WebCore/platform/graphics/cg/ImageBufferCG.cpp b/WebCore/platform/graphics/cg/ImageBufferCG.cpp
index 6db7e88..b1896f8 100644
--- a/WebCore/platform/graphics/cg/ImageBufferCG.cpp
+++ b/WebCore/platform/graphics/cg/ImageBufferCG.cpp
@@ -65,37 +65,37 @@ ImageBuffer::ImageBuffer(const IntSize& size, ImageColorSpace imageColorSpace, b
         bytesPerRow *= 4;
     }
 
-    m_data.m_data = tryFastCalloc(size.height(), bytesPerRow);
+    if (!tryFastCalloc(size.height(), bytesPerRow).getValue(m_data.m_data))
+        return;
+
     ASSERT((reinterpret_cast<size_t>(m_data.m_data) & 2) == 0);
 
-    CGColorSpaceRef colorSpace;
+    RetainPtr<CGColorSpaceRef> colorSpace;
     switch(imageColorSpace) {
         case DeviceRGB:
-            colorSpace = CGColorSpaceCreateDeviceRGB();
+            colorSpace.adoptCF(CGColorSpaceCreateDeviceRGB());
             break;
         case GrayScale:
-            colorSpace = CGColorSpaceCreateDeviceGray();
+            colorSpace.adoptCF(CGColorSpaceCreateDeviceGray());
             break;
 #if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER)
         case LinearRGB:
-            colorSpace = CGColorSpaceCreateWithName(kCGColorSpaceGenericRGBLinear);
+            colorSpace.adoptCF(CGColorSpaceCreateWithName(kCGColorSpaceGenericRGBLinear));
             break;
 #endif
         default:
-            colorSpace = CGColorSpaceCreateDeviceRGB();
+            colorSpace.adoptCF(CGColorSpaceCreateDeviceRGB());
             break;
     }
 
-    CGContextRef cgContext = CGBitmapContextCreate(m_data.m_data, size.width(), size.height(), 8, bytesPerRow,
-        colorSpace, (imageColorSpace == GrayScale) ? kCGImageAlphaNone : kCGImageAlphaPremultipliedLast);
-    CGColorSpaceRelease(colorSpace);
+    RetainPtr<CGContextRef> cgContext(AdoptCF, CGBitmapContextCreate(m_data.m_data, size.width(), size.height(), 8, bytesPerRow,
+        colorSpace.get(), (imageColorSpace == GrayScale) ? kCGImageAlphaNone : kCGImageAlphaPremultipliedLast));
     if (!cgContext)
         return;
 
-    m_context.set(new GraphicsContext(cgContext));
+    m_context.set(new GraphicsContext(cgContext.get()));
     m_context->scale(FloatSize(1, -1));
     m_context->translate(0, -size.height());
-    CGContextRelease(cgContext);
     success = true;
 }
 
@@ -122,12 +122,13 @@ Image* ImageBuffer::image() const
     return m_image.get();
 }
 
-PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
+template <Multiply multiplied>
+PassRefPtr<ImageData> getImageData(const IntRect& rect, const ImageBufferData& imageData, const IntSize& size)
 {
     PassRefPtr<ImageData> result = ImageData::create(rect.width(), rect.height());
     unsigned char* data = result->data()->data()->data();
 
-    if (rect.x() < 0 || rect.y() < 0 || (rect.x() + rect.width()) > m_size.width() || (rect.y() + rect.height()) > m_size.height())
+    if (rect.x() < 0 || rect.y() < 0 || (rect.x() + rect.width()) > size.width() || (rect.y() + rect.height()) > size.height())
         memset(data, 0, result->data()->length());
 
     int originx = rect.x();
@@ -137,8 +138,8 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
         originx = 0;
     }
     int endx = rect.x() + rect.width();
-    if (endx > m_size.width())
-        endx = m_size.width();
+    if (endx > size.width())
+        endx = size.width();
     int numColumns = endx - originx;
 
     int originy = rect.y();
@@ -148,20 +149,21 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
         originy = 0;
     }
     int endy = rect.y() + rect.height();
-    if (endy > m_size.height())
-        endy = m_size.height();
+    if (endy > size.height())
+        endy = size.height();
     int numRows = endy - originy;
 
-    unsigned srcBytesPerRow = 4 * m_size.width();
+    unsigned srcBytesPerRow = 4 * size.width();
     unsigned destBytesPerRow = 4 * rect.width();
 
     // ::create ensures that all ImageBuffers have valid data, so we don't need to check it here.
-    unsigned char* srcRows = reinterpret_cast<unsigned char*>(m_data.m_data) + originy * srcBytesPerRow + originx * 4;
+    unsigned char* srcRows = reinterpret_cast<unsigned char*>(imageData.m_data) + originy * srcBytesPerRow + originx * 4;
     unsigned char* destRows = data + desty * destBytesPerRow + destx * 4;
     for (int y = 0; y < numRows; ++y) {
         for (int x = 0; x < numColumns; x++) {
             int basex = x * 4;
-            if (unsigned char alpha = srcRows[basex + 3]) {
+            unsigned char alpha = srcRows[basex + 3];
+            if (multiplied == Unmultiplied && alpha) {
                 destRows[basex] = (srcRows[basex] * 255) / alpha;
                 destRows[basex + 1] = (srcRows[basex + 1] * 255) / alpha;
                 destRows[basex + 2] = (srcRows[basex + 2] * 255) / alpha;
@@ -175,7 +177,18 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
     return result;
 }
 
-void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+PassRefPtr<ImageData> ImageBuffer::getUnmultipliedImageData(const IntRect& rect) const
+{
+    return getImageData<Unmultiplied>(rect, m_data, m_size);
+}
+
+PassRefPtr<ImageData> ImageBuffer::getPremultipliedImageData(const IntRect& rect) const
+{
+    return getImageData<Premultiplied>(rect, m_data, m_size);
+}
+
+template <Multiply multiplied>
+void putImageData(ImageData*& source, const IntRect& sourceRect, const IntPoint& destPoint, ImageBufferData& imageData, const IntSize& size)
 {
     ASSERT(sourceRect.width() > 0);
     ASSERT(sourceRect.height() > 0);
@@ -183,36 +196,36 @@ void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect, con
     int originx = sourceRect.x();
     int destx = destPoint.x() + sourceRect.x();
     ASSERT(destx >= 0);
-    ASSERT(destx < m_size.width());
+    ASSERT(destx < size.width());
     ASSERT(originx >= 0);
     ASSERT(originx <= sourceRect.right());
 
     int endx = destPoint.x() + sourceRect.right();
-    ASSERT(endx <= m_size.width());
+    ASSERT(endx <= size.width());
 
     int numColumns = endx - destx;
 
     int originy = sourceRect.y();
     int desty = destPoint.y() + sourceRect.y();
     ASSERT(desty >= 0);
-    ASSERT(desty < m_size.height());
+    ASSERT(desty < size.height());
     ASSERT(originy >= 0);
     ASSERT(originy <= sourceRect.bottom());
 
     int endy = destPoint.y() + sourceRect.bottom();
-    ASSERT(endy <= m_size.height());
+    ASSERT(endy <= size.height());
     int numRows = endy - desty;
 
     unsigned srcBytesPerRow = 4 * source->width();
-    unsigned destBytesPerRow = 4 * m_size.width();
+    unsigned destBytesPerRow = 4 * size.width();
 
     unsigned char* srcRows = source->data()->data()->data() + originy * srcBytesPerRow + originx * 4;
-    unsigned char* destRows = reinterpret_cast<unsigned char*>(m_data.m_data) + desty * destBytesPerRow + destx * 4;
+    unsigned char* destRows = reinterpret_cast<unsigned char*>(imageData.m_data) + desty * destBytesPerRow + destx * 4;
     for (int y = 0; y < numRows; ++y) {
         for (int x = 0; x < numColumns; x++) {
             int basex = x * 4;
             unsigned char alpha = srcRows[basex + 3];
-            if (alpha != 255) {
+            if (multiplied == Unmultiplied && alpha != 255) {
                 destRows[basex] = (srcRows[basex] * alpha + 254) / 255;
                 destRows[basex + 1] = (srcRows[basex + 1] * alpha + 254) / 255;
                 destRows[basex + 2] = (srcRows[basex + 2] * alpha + 254) / 255;
@@ -225,6 +238,16 @@ void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect, con
     }
 }
 
+void ImageBuffer::putUnmultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<Unmultiplied>(source, sourceRect, destPoint, m_data, m_size);
+}
+
+void ImageBuffer::putPremultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<Premultiplied>(source, sourceRect, destPoint, m_data, m_size);
+}
+
 static RetainPtr<CFStringRef> utiFromMIMEType(const String& mimeType)
 {
 #if PLATFORM(MAC)
diff --git a/WebCore/platform/graphics/cg/ImageCG.cpp b/WebCore/platform/graphics/cg/ImageCG.cpp
index a5620e8..4da7018 100644
--- a/WebCore/platform/graphics/cg/ImageCG.cpp
+++ b/WebCore/platform/graphics/cg/ImageCG.cpp
@@ -101,30 +101,29 @@ BitmapImage::BitmapImage(CGImageRef cgImage, ImageObserver* observer)
 void BitmapImage::checkForSolidColor()
 {
     m_checkedForSolidColor = true;
-    if (frameCount() > 1)
+    if (frameCount() > 1) {
         m_isSolidColor = false;
-    else {
-        CGImageRef image = frameAtIndex(0);
-        
-        // Currently we only check for solid color in the important special case of a 1x1 image.
-        if (image && CGImageGetWidth(image) == 1 && CGImageGetHeight(image) == 1) {
-            unsigned char pixel[4]; // RGBA
-            CGColorSpaceRef space = CGColorSpaceCreateDeviceRGB();
-            CGContextRef bmap = CGBitmapContextCreate(pixel, 1, 1, 8, sizeof(pixel), space,
-                kCGImageAlphaPremultipliedLast | kCGBitmapByteOrder32Big);
-            if (bmap) {
-                GraphicsContext(bmap).setCompositeOperation(CompositeCopy);
-                CGRect dst = { {0, 0}, {1, 1} };
-                CGContextDrawImage(bmap, dst, image);
-                if (pixel[3] == 0)
-                    m_solidColor = Color(0, 0, 0, 0);
-                else
-                    m_solidColor = Color(pixel[0] * 255 / pixel[3], pixel[1] * 255 / pixel[3], pixel[2] * 255 / pixel[3], pixel[3]);
-                m_isSolidColor = true;
-                CFRelease(bmap);
-            } 
-            CFRelease(space);
-        }
+        return;
+    }
+
+    CGImageRef image = frameAtIndex(0);
+    
+    // Currently we only check for solid color in the important special case of a 1x1 image.
+    if (image && CGImageGetWidth(image) == 1 && CGImageGetHeight(image) == 1) {
+        unsigned char pixel[4]; // RGBA
+        static CGColorSpaceRef space = CGColorSpaceCreateDeviceRGB();
+        RetainPtr<CGContextRef> bmap(AdoptCF, CGBitmapContextCreate(pixel, 1, 1, 8, sizeof(pixel), space,
+            kCGImageAlphaPremultipliedLast | kCGBitmapByteOrder32Big));
+        if (!bmap)
+            return;
+        GraphicsContext(bmap.get()).setCompositeOperation(CompositeCopy);
+        CGRect dst = { {0, 0}, {1, 1} };
+        CGContextDrawImage(bmap.get(), dst, image);
+        if (pixel[3] == 0)
+            m_solidColor = Color(0, 0, 0, 0);
+        else
+            m_solidColor = Color(pixel[0] * 255 / pixel[3], pixel[1] * 255 / pixel[3], pixel[2] * 255 / pixel[3], pixel[3]);
+        m_isSolidColor = true;
     }
 }
 
@@ -252,14 +251,14 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const
     CGImageRef tileImage = nativeImageForCurrentFrame();
     float h = CGImageGetHeight(tileImage);
 
-    CGImageRef subImage;
+    RetainPtr<CGImageRef> subImage;
     if (tileRect.size() == size())
         subImage = tileImage;
     else {
         // Copying a sub-image out of a partially-decoded image stops the decoding of the original image. It should never happen
         // because sub-images are only used for border-image, which only renders when the image is fully decoded.
         ASSERT(h == height());
-        subImage = CGImageCreateWithImageInRect(tileImage, tileRect);
+        subImage.adoptCF(CGImageCreateWithImageInRect(tileImage, tileRect));
     }
     
 #ifndef BUILDING_ON_TIGER
@@ -275,7 +274,7 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const
 #else
     if (w == size().width() && h == size().height())
 #endif
-        CGContextDrawTiledImage(context, FloatRect(adjustedX, adjustedY, scaledTileWidth, scaledTileHeight), subImage);
+        CGContextDrawTiledImage(context, FloatRect(adjustedX, adjustedY, scaledTileWidth, scaledTileHeight), subImage.get());
     else {
 #endif
 
@@ -288,39 +287,31 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const
     matrix = CGAffineTransformConcat(matrix, CGContextGetCTM(context));
     // The top of a partially-decoded image is drawn at the bottom of the tile. Map it to the top.
     matrix = CGAffineTransformTranslate(matrix, 0, size().height() - h);
-    CGPatternRef pattern = CGPatternCreate(subImage, CGRectMake(0, 0, tileRect.width(), tileRect.height()),
-                                           matrix, tileRect.width(), tileRect.height(), 
-                                           kCGPatternTilingConstantSpacing, true, &patternCallbacks);
-    if (pattern == NULL) {
-        if (subImage != tileImage)
-            CGImageRelease(subImage);
+    RetainPtr<CGPatternRef> pattern(AdoptCF, CGPatternCreate(subImage.get(), CGRectMake(0, 0, tileRect.width(), tileRect.height()),
+                                             matrix, tileRect.width(), tileRect.height(), 
+                                             kCGPatternTilingConstantSpacing, true, &patternCallbacks));
+    if (!pattern) {
         ctxt->restore();
         return;
     }
 
-    CGColorSpaceRef patternSpace = CGColorSpaceCreatePattern(NULL);
+    RetainPtr<CGColorSpaceRef> patternSpace(AdoptCF, CGColorSpaceCreatePattern(0));
     
     CGFloat alpha = 1;
-    CGColorRef color = CGColorCreateWithPattern(patternSpace, pattern, &alpha);
-    CGContextSetFillColorSpace(context, patternSpace);
-    CGColorSpaceRelease(patternSpace);
-    CGPatternRelease(pattern);
+    RetainPtr<CGColorRef> color(AdoptCF, CGColorCreateWithPattern(patternSpace.get(), pattern.get(), &alpha));
+    CGContextSetFillColorSpace(context, patternSpace.get());
 
     // FIXME: Really want a public API for this.  It is just CGContextSetBaseCTM(context, CGAffineTransformIdentiy).
     wkSetPatternBaseCTM(context, CGAffineTransformIdentity);
     CGContextSetPatternPhase(context, CGSizeZero);
 
-    CGContextSetFillColorWithColor(context, color);
+    CGContextSetFillColorWithColor(context, color.get());
     CGContextFillRect(context, CGContextGetClipBoundingBox(context));
-    
-    CGColorRelease(color);
-    
+
 #ifndef BUILDING_ON_TIGER
     }
 #endif
 
-    if (subImage != tileImage)
-        CGImageRelease(subImage);
     ctxt->restore();
 
     if (imageObserver())
diff --git a/WebCore/platform/graphics/cg/ImageSourceCG.cpp b/WebCore/platform/graphics/cg/ImageSourceCG.cpp
index b716060..66246fe 100644
--- a/WebCore/platform/graphics/cg/ImageSourceCG.cpp
+++ b/WebCore/platform/graphics/cg/ImageSourceCG.cpp
@@ -109,18 +109,16 @@ void ImageSource::setData(SharedBuffer* data, bool allDataReceived)
 #if PLATFORM(MAC)
     // On Mac the NSData inside the SharedBuffer can be secretly appended to without the SharedBuffer's knowledge.  We use SharedBuffer's ability
     // to wrap itself inside CFData to get around this, ensuring that ImageIO is really looking at the SharedBuffer.
-    CFDataRef cfData = data->createCFData();
+    RetainPtr<CFDataRef> cfData(AdoptCF, data->createCFData());
 #else
     // If no NSData is available, then we know SharedBuffer will always just be a vector.  That means no secret changes can occur to it behind the
     // scenes.  We use CFDataCreateWithBytesNoCopy in that case. Ensure that the SharedBuffer lives as long as the CFDataRef.
     data->ref();
     CFAllocatorContext context = {0, data, 0, 0, 0, 0, 0, &sharedBufferDerefCallback, 0};
-    CFAllocatorRef derefAllocator = CFAllocatorCreate(kCFAllocatorDefault, &context);
-    CFDataRef cfData = CFDataCreateWithBytesNoCopy(0, reinterpret_cast<const UInt8*>(data->data()), data->size(), derefAllocator);
-    CFRelease(derefAllocator);
+    RetainPtr<CFAllocatorRef> derefAllocator(AdoptCF, CFAllocatorCreate(kCFAllocatorDefault, &context));
+    RetainPtr<CFDataRef> cfData(AdoptCF, CFDataCreateWithBytesNoCopy(0, reinterpret_cast<const UInt8*>(data->data()), data->size(), derefAllocator.get()));
 #endif
-    CGImageSourceUpdateData(m_decoder, cfData, allDataReceived);
-    CFRelease(cfData);
+    CGImageSourceUpdateData(m_decoder, cfData.get(), allDataReceived);
 }
 
 String ImageSource::filenameExtension() const
@@ -138,12 +136,11 @@ bool ImageSource::isSizeAvailable()
 
     // Ragnaros yells: TOO SOON! You have awakened me TOO SOON, Executus!
     if (imageSourceStatus >= kCGImageStatusIncomplete) {
-        CFDictionaryRef image0Properties = CGImageSourceCopyPropertiesAtIndex(m_decoder, 0, imageSourceOptions());
+        RetainPtr<CFDictionaryRef> image0Properties(AdoptCF, CGImageSourceCopyPropertiesAtIndex(m_decoder, 0, imageSourceOptions()));
         if (image0Properties) {
-            CFNumberRef widthNumber = (CFNumberRef)CFDictionaryGetValue(image0Properties, kCGImagePropertyPixelWidth);
-            CFNumberRef heightNumber = (CFNumberRef)CFDictionaryGetValue(image0Properties, kCGImagePropertyPixelHeight);
+            CFNumberRef widthNumber = (CFNumberRef)CFDictionaryGetValue(image0Properties.get(), kCGImagePropertyPixelWidth);
+            CFNumberRef heightNumber = (CFNumberRef)CFDictionaryGetValue(image0Properties.get(), kCGImagePropertyPixelHeight);
             result = widthNumber && heightNumber;
-            CFRelease(image0Properties);
         }
     }
     
@@ -153,17 +150,16 @@ bool ImageSource::isSizeAvailable()
 IntSize ImageSource::frameSizeAtIndex(size_t index) const
 {
     IntSize result;
-    CFDictionaryRef properties = CGImageSourceCopyPropertiesAtIndex(m_decoder, index, imageSourceOptions());
+    RetainPtr<CFDictionaryRef> properties(AdoptCF, CGImageSourceCopyPropertiesAtIndex(m_decoder, index, imageSourceOptions()));
     if (properties) {
         int w = 0, h = 0;
-        CFNumberRef num = (CFNumberRef)CFDictionaryGetValue(properties, kCGImagePropertyPixelWidth);
+        CFNumberRef num = (CFNumberRef)CFDictionaryGetValue(properties.get(), kCGImagePropertyPixelWidth);
         if (num)
             CFNumberGetValue(num, kCFNumberIntType, &w);
-        num = (CFNumberRef)CFDictionaryGetValue(properties, kCGImagePropertyPixelHeight);
+        num = (CFNumberRef)CFDictionaryGetValue(properties.get(), kCGImagePropertyPixelHeight);
         if (num)
             CFNumberGetValue(num, kCFNumberIntType, &h);
         result = IntSize(w, h);
-        CFRelease(properties);
     }
     return result;
 }
@@ -180,17 +176,15 @@ int ImageSource::repetitionCount()
         return result;
 
     // A property with value 0 means loop forever.
-    CFDictionaryRef properties = CGImageSourceCopyProperties(m_decoder, imageSourceOptions());
+    RetainPtr<CFDictionaryRef> properties(AdoptCF, CGImageSourceCopyProperties(m_decoder, imageSourceOptions()));
     if (properties) {
-        CFDictionaryRef gifProperties = (CFDictionaryRef)CFDictionaryGetValue(properties, kCGImagePropertyGIFDictionary);
+        CFDictionaryRef gifProperties = (CFDictionaryRef)CFDictionaryGetValue(properties.get(), kCGImagePropertyGIFDictionary);
         if (gifProperties) {
             CFNumberRef num = (CFNumberRef)CFDictionaryGetValue(gifProperties, kCGImagePropertyGIFLoopCount);
             if (num)
                 CFNumberGetValue(num, kCFNumberIntType, &result);
         } else
             result = cAnimationNone; // Turns out we're not a GIF after all, so we don't animate.
-        
-        CFRelease(properties);
     }
     
     return result;
@@ -206,20 +200,19 @@ CGImageRef ImageSource::createFrameAtIndex(size_t index)
     if (!initialized())
         return 0;
 
-    CGImageRef image = CGImageSourceCreateImageAtIndex(m_decoder, index, imageSourceOptions());
+    RetainPtr<CGImageRef> image(AdoptCF, CGImageSourceCreateImageAtIndex(m_decoder, index, imageSourceOptions()));
     CFStringRef imageUTI = CGImageSourceGetType(m_decoder);
     static const CFStringRef xbmUTI = CFSTR("public.xbitmap-image");
     if (!imageUTI || !CFEqual(imageUTI, xbmUTI))
-        return image;
+        return image.releaseRef();
     
     // If it is an xbm image, mask out all the white areas to render them transparent.
     const CGFloat maskingColors[6] = {255, 255,  255, 255, 255, 255};
-    CGImageRef maskedImage = CGImageCreateWithMaskingColors(image, maskingColors);
+    RetainPtr<CGImageRef> maskedImage(AdoptCF, CGImageCreateWithMaskingColors(image.get(), maskingColors));
     if (!maskedImage)
-        return image;
-        
-    CGImageRelease(image);
-    return maskedImage; 
+        return image.releaseRef();
+
+    return maskedImage.releaseRef();
 }
 
 bool ImageSource::frameIsCompleteAtIndex(size_t index)
@@ -233,15 +226,14 @@ float ImageSource::frameDurationAtIndex(size_t index)
         return 0;
 
     float duration = 0;
-    CFDictionaryRef properties = CGImageSourceCopyPropertiesAtIndex(m_decoder, index, imageSourceOptions());
+    RetainPtr<CFDictionaryRef> properties(AdoptCF, CGImageSourceCopyPropertiesAtIndex(m_decoder, index, imageSourceOptions()));
     if (properties) {
-        CFDictionaryRef typeProperties = (CFDictionaryRef)CFDictionaryGetValue(properties, kCGImagePropertyGIFDictionary);
+        CFDictionaryRef typeProperties = (CFDictionaryRef)CFDictionaryGetValue(properties.get(), kCGImagePropertyGIFDictionary);
         if (typeProperties) {
             CFNumberRef num = (CFNumberRef)CFDictionaryGetValue(typeProperties, kCGImagePropertyGIFDelayTime);
             if (num)
                 CFNumberGetValue(num, kCFNumberFloatType, &duration);
         }
-        CFRelease(properties);
     }
 
     // Many annoying ads specify a 0 duration to make an image flash as quickly as possible.
diff --git a/WebCore/platform/graphics/cg/PDFDocumentImage.cpp b/WebCore/platform/graphics/cg/PDFDocumentImage.cpp
index 858b18e..2f5c15e 100644
--- a/WebCore/platform/graphics/cg/PDFDocumentImage.cpp
+++ b/WebCore/platform/graphics/cg/PDFDocumentImage.cpp
@@ -68,16 +68,14 @@ bool PDFDocumentImage::dataChanged(bool allDataReceived)
 #if PLATFORM(MAC)
         // On Mac the NSData inside the SharedBuffer can be secretly appended to without the SharedBuffer's knowledge.  We use SharedBuffer's ability
         // to wrap itself inside CFData to get around this, ensuring that ImageIO is really looking at the SharedBuffer.
-        CFDataRef data = this->data()->createCFData();
+        RetainPtr<CFDataRef> data(AdoptCF, this->data()->createCFData());
 #else
         // If no NSData is available, then we know SharedBuffer will always just be a vector.  That means no secret changes can occur to it behind the
         // scenes.  We use CFDataCreateWithBytesNoCopy in that case.
-        CFDataRef data = CFDataCreateWithBytesNoCopy(0, reinterpret_cast<const UInt8*>(this->data()->data()), this->data()->size(), kCFAllocatorNull);
+        RetainPtr<CFDataRef> data(AdoptCF, CFDataCreateWithBytesNoCopy(0, reinterpret_cast<const UInt8*>(this->data()->data()), this->data()->size(), kCFAllocatorNull));
 #endif
-        CGDataProviderRef dataProvider = CGDataProviderCreateWithCFData(data);
-        CFRelease(data);
-        m_document = CGPDFDocumentCreateWithProvider(dataProvider);
-        CGDataProviderRelease(dataProvider);
+        RetainPtr<CGDataProviderRef> dataProvider(AdoptCF, CGDataProviderCreateWithCFData(data.get()));
+        m_document = CGPDFDocumentCreateWithProvider(dataProvider.get());
         setCurrentPage(0);
     }
     return m_document; // return true if size is available
diff --git a/WebCore/platform/graphics/cg/PathCG.cpp b/WebCore/platform/graphics/cg/PathCG.cpp
index 5812cea..3b05641 100644
--- a/WebCore/platform/graphics/cg/PathCG.cpp
+++ b/WebCore/platform/graphics/cg/PathCG.cpp
@@ -49,9 +49,8 @@ static size_t putBytesNowhere(void*, const void*, size_t count)
 static CGContextRef createScratchContext()
 {
     CGDataConsumerCallbacks callbacks = { putBytesNowhere, 0 };
-    CGDataConsumerRef consumer = CGDataConsumerCreate(0, &callbacks);
-    CGContextRef context = CGPDFContextCreate(consumer, 0, 0);
-    CGDataConsumerRelease(consumer);
+    RetainPtr<CGDataConsumerRef> consumer(AdoptCF, CGDataConsumerCreate(0, &callbacks));
+    CGContextRef context = CGPDFContextCreate(consumer.get(), 0, 0);
 
     CGFloat black[4] = { 0, 0, 0, 1 };
     CGContextSetFillColor(context, black);
@@ -129,9 +128,8 @@ bool Path::contains(const FloatPoint &point, WindRule rule) const
         return false;
 
     // CGPathContainsPoint returns false for non-closed paths, as a work-around, we copy and close the path first.  Radar 4758998 asks for a better CG API to use
-    CGMutablePathRef path = copyCGPathClosingSubpaths(m_path);
-    bool ret = CGPathContainsPoint(path, 0, point, rule == RULE_EVENODD ? true : false);
-    CGPathRelease(path);
+    RetainPtr<CGMutablePathRef> path(AdoptCF, copyCGPathClosingSubpaths(m_path));
+    bool ret = CGPathContainsPoint(path.get(), 0, point, rule == RULE_EVENODD ? true : false);
     return ret;
 }