Revert "Merge WebKit r47420"

This reverts commit d227fc870c7a697500a3c900c31baf05fb9a8524.

32 files changed, 252 insertions, 407 deletions

diff --git a/WebCore/rendering/HitTestResult.cpp b/WebCore/rendering/HitTestResult.cpp
index 0aaddc9..b7de46b 100644
--- a/WebCore/rendering/HitTestResult.cpp
+++ b/WebCore/rendering/HitTestResult.cpp
@@ -209,7 +209,7 @@ String HitTestResult::altDisplayString() const
     
     if (m_innerNonSharedNode->hasTagName(imgTag)) {
         HTMLImageElement* image = static_cast<HTMLImageElement*>(m_innerNonSharedNode.get());
-        return displayString(image->getAttribute(altAttr), m_innerNonSharedNode.get());
+        return displayString(image->alt(), m_innerNonSharedNode.get());
     }
     
     if (m_innerNonSharedNode->hasTagName(inputTag)) {
diff --git a/WebCore/rendering/InlineFlowBox.cpp b/WebCore/rendering/InlineFlowBox.cpp
index 98c5c43..543c190 100644
--- a/WebCore/rendering/InlineFlowBox.cpp
+++ b/WebCore/rendering/InlineFlowBox.cpp
@@ -29,7 +29,6 @@
 #include "RootInlineBox.h"
 #include "RenderBlock.h"
 #include "RenderInline.h"
-#include "RenderLayer.h"
 #include "RenderListMarker.h"
 #include "RenderTableCell.h"
 #include "RootInlineBox.h"
@@ -775,23 +774,18 @@ void InlineFlowBox::paintMask(RenderObject::PaintInfo& paintInfo, int tx, int ty
     int w = width();
     int h = height();
 
-    const NinePieceImage& maskNinePieceImage = renderer()->style()->maskBoxImage();
-    StyleImage* maskBoxImage = renderer()->style()->maskBoxImage().image();
-
     // Figure out if we need to push a transparency layer to render our mask.
     bool pushTransparencyLayer = false;
-    bool compositedMask = renderer()->hasLayer() && boxModelObject()->layer()->hasCompositedMask();
-    CompositeOperator compositeOp = CompositeSourceOver;
-    if (!compositedMask) {
-        if ((maskBoxImage && renderer()->style()->maskLayers()->hasImage()) || renderer()->style()->maskLayers()->next())
-            pushTransparencyLayer = true;
-        
-        compositeOp = CompositeDestinationIn;
-        if (pushTransparencyLayer) {
-            paintInfo.context->setCompositeOperation(CompositeDestinationIn);
-            paintInfo.context->beginTransparencyLayer(1.0f);
-            compositeOp = CompositeSourceOver;
-        }
+    const NinePieceImage& maskNinePieceImage = renderer()->style()->maskBoxImage();
+    StyleImage* maskBoxImage = renderer()->style()->maskBoxImage().image();
+    if ((maskBoxImage && renderer()->style()->maskLayers()->hasImage()) || renderer()->style()->maskLayers()->next())
+        pushTransparencyLayer = true;
+    
+    CompositeOperator compositeOp = CompositeDestinationIn;
+    if (pushTransparencyLayer) {
+        paintInfo.context->setCompositeOperation(CompositeDestinationIn);
+        paintInfo.context->beginTransparencyLayer(1.0f);
+        compositeOp = CompositeSourceOver;
     }
 
     paintFillLayers(paintInfo, Color(), renderer()->style()->maskLayers(), tx, ty, w, h, compositeOp);
diff --git a/WebCore/rendering/MediaControlElements.cpp b/WebCore/rendering/MediaControlElements.cpp
index 6715111..352f270 100644
--- a/WebCore/rendering/MediaControlElements.cpp
+++ b/WebCore/rendering/MediaControlElements.cpp
@@ -32,27 +32,28 @@
 
 #include "MediaControlElements.h"
 
+#include "LocalizedStrings.h"
 #include "EventNames.h"
 #include "FloatConversion.h"
 #include "Frame.h"
 #include "HTMLNames.h"
-#include "LocalizedStrings.h"
 #include "MouseEvent.h"
 #include "RenderMedia.h"
 #include "RenderSlider.h"
 #include "RenderTheme.h"
+#include "CString.h"
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
-// FIXME: These constants may need to be tweaked to better match the seeking in the QuickTime plug-in.
+// FIXME: These constants may need to be tweaked to better match the seeking in the QT plugin
 static const float cSeekRepeatDelay = 0.1f;
 static const float cStepTime = 0.07f;
 static const float cSeekTime = 0.2f;
 
-MediaControlShadowRootElement::MediaControlShadowRootElement(Document* document, HTMLMediaElement* mediaElement)
-    : HTMLDivElement(divTag, document)
+MediaControlShadowRootElement::MediaControlShadowRootElement(Document* doc, HTMLMediaElement* mediaElement) 
+    : HTMLDivElement(divTag, doc)
     , m_mediaElement(mediaElement) 
 {
     RefPtr<RenderStyle> rootStyle = RenderStyle::create();
@@ -75,9 +76,10 @@ void MediaControlShadowRootElement::updateStyle()
 }
 
 // ----------------------------
+    
 
-MediaControlElement::MediaControlElement(Document* document, PseudoId pseudo, HTMLMediaElement* mediaElement)
-    : HTMLDivElement(divTag, document)
+MediaControlElement::MediaControlElement(Document* doc, PseudoId pseudo, HTMLMediaElement* mediaElement) 
+    : HTMLDivElement(divTag, doc)
     , m_mediaElement(mediaElement)
     , m_pseudoStyleId(pseudo)
 {
@@ -163,8 +165,8 @@ void MediaControlElement::updateStyle()
 
 // ----------------------------
 
-MediaControlTimelineContainerElement::MediaControlTimelineContainerElement(Document* document, HTMLMediaElement* element)
-    : MediaControlElement(document, MEDIA_CONTROLS_TIMELINE_CONTAINER, element)
+MediaControlTimelineContainerElement::MediaControlTimelineContainerElement(Document* doc, HTMLMediaElement* element)
+: MediaControlElement(doc, MEDIA_CONTROLS_TIMELINE_CONTAINER, element)
 {
 }
 
@@ -186,9 +188,9 @@ bool MediaControlTimelineContainerElement::rendererIsNeeded(RenderStyle* style)
     
 // ----------------------------
 
-MediaControlStatusDisplayElement::MediaControlStatusDisplayElement(Document* document, HTMLMediaElement* element)
-    : MediaControlElement(document, MEDIA_CONTROLS_STATUS_DISPLAY, element)
-    , m_stateBeingDisplayed(Nothing)
+MediaControlStatusDisplayElement::MediaControlStatusDisplayElement(Document* doc, HTMLMediaElement* element)
+: MediaControlElement(doc, MEDIA_CONTROLS_STATUS_DISPLAY, element)
+, m_stateBeingDisplayed(Nothing)
 {
 }
 
@@ -233,8 +235,8 @@ bool MediaControlStatusDisplayElement::rendererIsNeeded(RenderStyle* style)
 
 // ----------------------------
     
-MediaControlInputElement::MediaControlInputElement(Document* document, PseudoId pseudo, const String& type, HTMLMediaElement* mediaElement, MediaControlElementType displayType)
-    : HTMLInputElement(inputTag, document)
+MediaControlInputElement::MediaControlInputElement(Document* doc, PseudoId pseudo, const String& type, HTMLMediaElement* mediaElement, MediaControlElementType displayType) 
+    : HTMLInputElement(inputTag, doc)
     , m_mediaElement(mediaElement)
     , m_pseudoStyleId(pseudo)
     , m_displayType(displayType)
@@ -328,8 +330,8 @@ void MediaControlInputElement::setDisplayType(MediaControlElementType displayTyp
 
 // ----------------------------
 
-MediaControlMuteButtonElement::MediaControlMuteButtonElement(Document* document, HTMLMediaElement* element)
-    : MediaControlInputElement(document, MEDIA_CONTROLS_MUTE_BUTTON, "button", element, element->muted() ? MediaUnMuteButton : MediaMuteButton)
+MediaControlMuteButtonElement::MediaControlMuteButtonElement(Document* doc, HTMLMediaElement* element)
+    : MediaControlInputElement(doc, MEDIA_CONTROLS_MUTE_BUTTON, "button", element, element->muted() ? MediaUnMuteButton : MediaMuteButton)
 {
 }
 
@@ -349,8 +351,8 @@ void MediaControlMuteButtonElement::updateDisplayType()
 
 // ----------------------------
 
-MediaControlPlayButtonElement::MediaControlPlayButtonElement(Document* document, HTMLMediaElement* element)
-    : MediaControlInputElement(document, MEDIA_CONTROLS_PLAY_BUTTON, "button", element, element->canPlay() ? MediaPlayButton : MediaPauseButton)
+MediaControlPlayButtonElement::MediaControlPlayButtonElement(Document* doc, HTMLMediaElement* element)
+    : MediaControlInputElement(doc, MEDIA_CONTROLS_PLAY_BUTTON, "button", element, element->canPlay() ? MediaPlayButton : MediaPauseButton)
 {
 }
 
@@ -370,8 +372,8 @@ void MediaControlPlayButtonElement::updateDisplayType()
 
 // ----------------------------
 
-MediaControlSeekButtonElement::MediaControlSeekButtonElement(Document* document, HTMLMediaElement* element, bool forward)
-    : MediaControlInputElement(document, forward ? MEDIA_CONTROLS_SEEK_FORWARD_BUTTON : MEDIA_CONTROLS_SEEK_BACK_BUTTON,
+MediaControlSeekButtonElement::MediaControlSeekButtonElement(Document* doc, HTMLMediaElement* element, bool forward)
+    : MediaControlInputElement(doc, forward ? MEDIA_CONTROLS_SEEK_FORWARD_BUTTON : MEDIA_CONTROLS_SEEK_BACK_BUTTON,
                                "button", element, forward ? MediaSeekForwardButton : MediaSeekBackButton)
     , m_forward(forward)
     , m_seeking(false)
@@ -430,8 +432,8 @@ void MediaControlSeekButtonElement::detach()
 
 // ----------------------------
 
-MediaControlRewindButtonElement::MediaControlRewindButtonElement(Document* document, HTMLMediaElement* element)
-    : MediaControlInputElement(document, MEDIA_CONTROLS_REWIND_BUTTON, "button", element, MediaRewindButton)
+MediaControlRewindButtonElement::MediaControlRewindButtonElement(Document* doc, HTMLMediaElement* element)
+: MediaControlInputElement(doc, MEDIA_CONTROLS_REWIND_BUTTON, "button", element, MediaRewindButton)
 {
 }
 
@@ -452,8 +454,8 @@ bool MediaControlRewindButtonElement::rendererIsNeeded(RenderStyle* style)
 
 // ----------------------------
 
-MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement(Document* document, HTMLMediaElement* element)
-    : MediaControlInputElement(document, MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON, "button", element, MediaReturnToRealtimeButton)
+MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement(Document* doc, HTMLMediaElement* element)
+: MediaControlInputElement(doc, MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON, "button", element, MediaReturnToRealtimeButton)
 {
 }
 
@@ -480,8 +482,8 @@ MediaControlTimelineElement::MediaControlTimelineElement(Document* document, HTM
 
 void MediaControlTimelineElement::defaultEventHandler(Event* event)
 {
-    // Left button is 0. Rejects mouse events not from left button.
-    if (event->isMouseEvent() && static_cast<MouseEvent*>(event)->button())
+    // Left button is 0. Accepts only if mouse event is from left button.
+    if (!event->isMouseEvent() || static_cast<MouseEvent*>(event)->button())
         return;
 
     if (event->type() == eventNames().mousedownEvent)
@@ -518,8 +520,8 @@ void MediaControlTimelineElement::update(bool updateDuration)
 
 // ----------------------------
 
-MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement(Document* document, HTMLMediaElement* element)
-    : MediaControlInputElement(document, MEDIA_CONTROLS_FULLSCREEN_BUTTON, "button", element, MediaFullscreenButton)
+MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement(Document* doc, HTMLMediaElement* element)
+    : MediaControlInputElement(doc, MEDIA_CONTROLS_FULLSCREEN_BUTTON, "button", element, MediaFullscreenButton)
 {
 }
 
@@ -539,8 +541,8 @@ bool MediaControlFullscreenButtonElement::rendererIsNeeded(RenderStyle* style)
 
 // ----------------------------
 
-MediaControlTimeDisplayElement::MediaControlTimeDisplayElement(Document* document, PseudoId pseudo, HTMLMediaElement* element)
-    : MediaControlElement(document, pseudo, element)
+MediaControlTimeDisplayElement::MediaControlTimeDisplayElement(Document* doc, PseudoId pseudo, HTMLMediaElement* element)
+    : MediaControlElement(doc, pseudo, element)
     , m_isVisible(true)
 {
 }
diff --git a/WebCore/rendering/RenderBlock.cpp b/WebCore/rendering/RenderBlock.cpp
index 03f5781..e10c331 100644
--- a/WebCore/rendering/RenderBlock.cpp
+++ b/WebCore/rendering/RenderBlock.cpp
@@ -33,7 +33,6 @@
 #include "HTMLNames.h"
 #include "HitTestResult.h"
 #include "InlineTextBox.h"
-#include "RenderFlexibleBox.h"
 #include "RenderImage.h"
 #include "RenderInline.h"
 #include "RenderMarquee.h"
@@ -735,31 +734,6 @@ void RenderBlock::updateScrollInfoAfterLayout()
     }
 }
 
-void RenderBlock::updateOverflowWithShadowAndReflection()
-{
-    if (hasOverflowClip())
-        return;
-
-    int shadowLeft;
-    int shadowRight;
-    int shadowTop;
-    int shadowBottom;
-    style()->getBoxShadowExtent(shadowTop, shadowRight, shadowBottom, shadowLeft);
-
-    m_overflowLeft = min(m_overflowLeft, shadowLeft);
-    m_overflowWidth = max(m_overflowWidth, width() + shadowRight);
-    m_overflowTop = min(m_overflowTop, shadowTop);
-    m_overflowHeight = max(m_overflowHeight, height() + shadowBottom);
-
-    if (hasReflection()) {
-        IntRect reflection(reflectionBox());
-        m_overflowLeft = min(m_overflowLeft, reflection.x());
-        m_overflowWidth = max(m_overflowWidth, reflection.right());
-        m_overflowTop = min(m_overflowTop, reflection.y());
-        m_overflowHeight = max(m_overflowHeight, reflection.bottom());
-    }
-}
-
 void RenderBlock::layout()
 {
     // Update our first letter info now.
@@ -910,7 +884,26 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
     m_overflowWidth = max(m_overflowWidth, width());
     m_overflowHeight = max(m_overflowHeight, height());
 
-    updateOverflowWithShadowAndReflection();
+    if (!hasOverflowClip()) {
+        int shadowLeft;
+        int shadowRight;
+        int shadowTop;
+        int shadowBottom;
+        style()->getBoxShadowExtent(shadowTop, shadowRight, shadowBottom, shadowLeft);
+
+        m_overflowLeft = min(m_overflowLeft, shadowLeft);
+        m_overflowWidth = max(m_overflowWidth, width() + shadowRight);
+        m_overflowTop = min(m_overflowTop, shadowTop);
+        m_overflowHeight = max(m_overflowHeight, height() + shadowBottom);
+
+        if (hasReflection()) {
+            IntRect reflection(reflectionBox());
+            m_overflowLeft = min(m_overflowLeft, reflection.x());
+            m_overflowWidth = max(m_overflowWidth, reflection.right());
+            m_overflowTop = min(m_overflowTop, reflection.y());
+            m_overflowHeight = max(m_overflowHeight, reflection.bottom());
+        }
+    }
 
     statePusher.pop();
 
@@ -1039,10 +1032,7 @@ bool RenderBlock::handleRunInChild(RenderBox* child)
     // See if we have a run-in element with inline children.  If the
     // children aren't inline, then just treat the run-in as a normal
     // block.
-    if (!child->isRunIn() || !child->childrenInline())
-        return false;
-    // FIXME: We don't handle non-block elements with run-in for now.
-    if (!child->isRenderBlock())
+    if (!child->isRunIn() || !child->childrenInline() && !child->isReplaced())
         return false;
 
     // Get the next non-positioned/non-floating RenderBlock.
@@ -3308,17 +3298,13 @@ int RenderBlock::getClearDelta(RenderBox* child, int yPos)
     // We also clear floats if we are too big to sit on the same line as a float (and wish to avoid floats by default).
     // FIXME: Note that the remaining space checks aren't quite accurate, since you should be able to clear only some floats (the minimum # needed
     // to fit) and not all (we should be using nextFloatBottomBelow and looping).
+    // Do not allow tables to wrap in quirks or even in almost strict mode 
+    // (ebay on the PLT, finance.yahoo.com in the real world, versiontracker.com forces even almost strict mode not to work)
     int result = clearSet ? max(0, bottom - yPos) : 0;
-    if (!result && child->avoidsFloats()) {
-        int oldYPos = child->y();
-        int oldWidth = child->width();
-        child->setY(yPos);
-        child->calcWidth();
-        if (child->width() > lineWidth(yPos, false) && child->minPrefWidth() <= availableWidth())
-            result = max(0, floatBottom() - yPos);
-        child->setY(oldYPos);
-        child->setWidth(oldWidth);
-    }
+    if (!result && child->avoidsFloats() && child->style()->width().isFixed() && 
+        child->minPrefWidth() > lineWidth(yPos, false) && child->minPrefWidth() <= availableWidth() && 
+        document()->inStrictMode())   
+        result = max(0, floatBottom() - yPos);
     return result;
 }
 
@@ -5135,20 +5121,13 @@ void RenderBlock::addFocusRingRects(GraphicsContext* graphicsContext, int tx, in
                                                 ty - y() + inlineContinuation()->containingBlock()->y());
 }
 
-RenderBlock* RenderBlock::createAnonymousBlock(bool isFlexibleBox) const
+RenderBlock* RenderBlock::createAnonymousBlock() const
 {
     RefPtr<RenderStyle> newStyle = RenderStyle::create();
     newStyle->inheritFrom(style());
+    newStyle->setDisplay(BLOCK);
 
-    RenderBlock* newBox = 0;
-    if (isFlexibleBox) {
-        newStyle->setDisplay(BOX);
-        newBox = new (renderArena()) RenderFlexibleBox(document() /* anonymous box */);
-    } else {
-        newStyle->setDisplay(BLOCK);
-        newBox = new (renderArena()) RenderBlock(document() /* anonymous box */);
-    }
-
+    RenderBlock* newBox = new (renderArena()) RenderBlock(document() /* anonymous box */);
     newBox->setStyle(newStyle.release());
     return newBox;
 }
diff --git a/WebCore/rendering/RenderBlock.h b/WebCore/rendering/RenderBlock.h
index 88d2386..839be16 100644
--- a/WebCore/rendering/RenderBlock.h
+++ b/WebCore/rendering/RenderBlock.h
@@ -147,7 +147,7 @@ public:
 
     // This function is a convenience helper for creating an anonymous block that inherits its
     // style from this RenderBlock.
-    RenderBlock* createAnonymousBlock(bool isFlexibleBox = false) const;
+    RenderBlock* createAnonymousBlock() const;
 
     Vector<IntRect>* columnRects() const;
     int columnGap() const;
@@ -207,9 +207,7 @@ protected:
 
     virtual bool hasLineIfEmpty() const;
     bool layoutOnlyPositionedObjects();
-
-    void updateOverflowWithShadowAndReflection();
-
+    
 private:
     virtual RenderObjectChildList* virtualChildren() { return children(); }
     virtual const RenderObjectChildList* virtualChildren() const { return children(); }
diff --git a/WebCore/rendering/RenderBox.cpp b/WebCore/rendering/RenderBox.cpp
index a1a2d9a..4c2bff0 100644
--- a/WebCore/rendering/RenderBox.cpp
+++ b/WebCore/rendering/RenderBox.cpp
@@ -416,11 +416,6 @@ bool RenderBox::scroll(ScrollDirection direction, ScrollGranularity granularity,
         return b->scroll(direction, granularity, multiplier);
     return false;
 }
-
-bool RenderBox::canBeScrolledAndHasScrollableArea() const
-{
-   return canBeProgramaticallyScrolled(false) && (scrollHeight() != clientHeight() || scrollWidth() != clientWidth());
-}
     
 bool RenderBox::canBeProgramaticallyScrolled(bool) const
 {
@@ -658,36 +653,31 @@ void RenderBox::paintMaskImages(const PaintInfo& paintInfo, int tx, int ty, int
 {
     // Figure out if we need to push a transparency layer to render our mask.
     bool pushTransparencyLayer = false;
-    bool compositedMask = hasLayer() && layer()->hasCompositedMask();
-    CompositeOperator compositeOp = CompositeSourceOver;
-
-    if (!compositedMask) {
-        StyleImage* maskBoxImage = style()->maskBoxImage().image();
-        if (maskBoxImage && style()->maskLayers()->hasImage()) {
-            pushTransparencyLayer = true;
-        } else {
-            // We have to use an extra image buffer to hold the mask. Multiple mask images need
-            // to composite together using source-over so that they can then combine into a single unified mask that
-            // can be composited with the content using destination-in.  SVG images need to be able to set compositing modes
-            // as they draw images contained inside their sub-document, so we paint all our images into a separate buffer
-            // and composite that buffer as the mask.
-            // We have to check that the mask images to be rendered contain at least one image that can be actually used in rendering
-            // before pushing the transparency layer.
-            for (const FillLayer* fillLayer = style()->maskLayers()->next(); fillLayer; fillLayer = fillLayer->next()) {
-                if (fillLayer->hasImage() && fillLayer->image()->canRender(style()->effectiveZoom())) {
-                    pushTransparencyLayer = true;
-                    // We found one image that can be used in rendering, exit the loop
-                    break;
-                }
+    StyleImage* maskBoxImage = style()->maskBoxImage().image();
+    if (maskBoxImage && style()->maskLayers()->hasImage()) {
+        pushTransparencyLayer = true;
+    } else {
+        // We have to use an extra image buffer to hold the mask. Multiple mask images need
+        // to composite together using source-over so that they can then combine into a single unified mask that
+        // can be composited with the content using destination-in.  SVG images need to be able to set compositing modes
+        // as they draw images contained inside their sub-document, so we paint all our images into a separate buffer
+        // and composite that buffer as the mask.
+        // We have to check that the mask images to be rendered contain at least one image that can be actually used in rendering
+        // before pushing the transparency layer.
+        for (const FillLayer* fillLayer = style()->maskLayers()->next(); fillLayer; fillLayer = fillLayer->next()) {
+            if (fillLayer->hasImage() && fillLayer->image()->canRender(style()->effectiveZoom())) {
+                pushTransparencyLayer = true;
+                // We found one image that can be used in rendering, exit the loop
+                break;
             }
         }
-        
-        compositeOp = CompositeDestinationIn;
-        if (pushTransparencyLayer) {
-            paintInfo.context->setCompositeOperation(CompositeDestinationIn);
-            paintInfo.context->beginTransparencyLayer(1.0f);
-            compositeOp = CompositeSourceOver;
-        }
+    }
+    
+    CompositeOperator compositeOp = CompositeDestinationIn;
+    if (pushTransparencyLayer) {
+        paintInfo.context->setCompositeOperation(CompositeDestinationIn);
+        paintInfo.context->beginTransparencyLayer(1.0f);
+        compositeOp = CompositeSourceOver;
     }
 
     paintFillLayers(paintInfo, Color(), style()->maskLayers(), tx, ty, w, h, compositeOp);
@@ -2711,6 +2701,11 @@ int RenderBox::leftmostPosition(bool /*includeOverflowInterior*/, bool includeSe
     return left;
 }
 
+bool RenderBox::isAfterContent(RenderObject* child) const
+{
+    return (child && child->style()->styleType() == AFTER && (!child->isText() || child->isBR()));
+}
+
 VisiblePosition RenderBox::positionForPoint(const IntPoint& point)
 {
     // no children...return this render object's element, if there is one, and offset 0
diff --git a/WebCore/rendering/RenderBox.h b/WebCore/rendering/RenderBox.h
index e86d073..cb2297b 100644
--- a/WebCore/rendering/RenderBox.h
+++ b/WebCore/rendering/RenderBox.h
@@ -230,7 +230,6 @@ public:
     virtual int verticalScrollbarWidth() const;
     int horizontalScrollbarHeight() const;
     virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f);
-    bool canBeScrolledAndHasScrollableArea() const;
     virtual bool canBeProgramaticallyScrolled(bool) const;
     virtual void autoscroll();
     virtual void stopAutoscroll() { }
@@ -334,6 +333,9 @@ private:
     // These include tables, positioned objects, floats and flexible boxes.
     virtual void calcPrefWidths() { setPrefWidthsDirty(false); }
 
+protected:
+    bool isAfterContent(RenderObject* child) const;
+
 private:
     // The width/height of the contents + borders + padding.  The x/y location is relative to our container (which is not always our parent).
     IntRect m_frameRect;
diff --git a/WebCore/rendering/RenderButton.cpp b/WebCore/rendering/RenderButton.cpp
index f3ae558..6d36a0f 100644
--- a/WebCore/rendering/RenderButton.cpp
+++ b/WebCore/rendering/RenderButton.cpp
@@ -52,8 +52,7 @@ void RenderButton::addChild(RenderObject* newChild, RenderObject* beforeChild)
     if (!m_inner) {
         // Create an anonymous block.
         ASSERT(!firstChild());
-        bool isFlexibleBox = style()->display() == BOX || style()->display() == INLINE_BOX;
-        m_inner = createAnonymousBlock(isFlexibleBox);
+        m_inner = createAnonymousBlock();
         setupInnerStyle(m_inner->style());
         RenderFlexibleBox::addChild(m_inner);
     }
@@ -109,7 +108,6 @@ void RenderButton::setupInnerStyle(RenderStyle* innerStyle)
     // RenderBlock::createAnonymousBlock creates a new RenderStyle, so this is
     // safe to modify.
     innerStyle->setBoxFlex(1.0f);
-    innerStyle->setBoxOrient(style()->boxOrient());
 
     innerStyle->setPaddingTop(Length(theme()->buttonInternalPaddingTop(), Fixed));
     innerStyle->setPaddingRight(Length(theme()->buttonInternalPaddingRight(), Fixed));
diff --git a/WebCore/rendering/RenderFieldset.cpp b/WebCore/rendering/RenderFieldset.cpp
index 8618d11..437991a 100644
--- a/WebCore/rendering/RenderFieldset.cpp
+++ b/WebCore/rendering/RenderFieldset.cpp
@@ -108,11 +108,10 @@ RenderBox* RenderFieldset::findLegend() const
 {
     for (RenderObject* legend = firstChild(); legend; legend = legend->nextSibling()) {
         if (!legend->isFloatingOrPositioned() && legend->node() &&
-            (legend->node()->hasTagName(legendTag)
+            legend->node()->hasTagName(legendTag)
 #if ENABLE(WML)
             || legend->node()->hasTagName(WMLNames::insertedLegendTag)
 #endif
-            )
            )
             return toRenderBox(legend);
     }
diff --git a/WebCore/rendering/RenderFlexibleBox.cpp b/WebCore/rendering/RenderFlexibleBox.cpp
index fa6d7a0..6bbcc43 100644
--- a/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/WebCore/rendering/RenderFlexibleBox.cpp
@@ -295,7 +295,26 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren)
     if (m_overflowWidth < width())
         m_overflowWidth = width();
 
-    updateOverflowWithShadowAndReflection();
+    if (!hasOverflowClip()) {
+        int shadowLeft;
+        int shadowRight;
+        int shadowTop;
+        int shadowBottom;
+        style()->getBoxShadowExtent(shadowTop, shadowRight, shadowBottom, shadowLeft);
+
+        m_overflowLeft = min(m_overflowLeft, shadowLeft);
+        m_overflowWidth = max(m_overflowWidth, width() + shadowRight);
+        m_overflowTop = min(m_overflowTop, shadowTop);
+        m_overflowHeight = max(m_overflowHeight, height() + shadowBottom);
+
+        if (hasReflection()) {
+            IntRect reflection(reflectionBox());
+            m_overflowTop = min(m_overflowTop, reflection.y());
+            m_overflowHeight = max(m_overflowHeight, reflection.bottom());
+            m_overflowLeft = min(m_overflowLeft, reflection.x());
+            m_overflowHeight = max(m_overflowWidth, reflection.right());
+        }
+    }
 
     statePusher.pop();
 
@@ -1142,8 +1161,6 @@ const char *RenderFlexibleBox::renderName() const
         return "RenderFlexibleBox (floating)";
     if (isPositioned())
         return "RenderFlexibleBox (positioned)";
-    if (isAnonymous())
-        return "RenderFlexibleBox (generated)";
     if (isRelPositioned())
         return "RenderFlexibleBox (relative positioned)";
     return "RenderFlexibleBox";
diff --git a/WebCore/rendering/RenderHTMLCanvas.cpp b/WebCore/rendering/RenderHTMLCanvas.cpp
index 3a776ba..1fc07f0 100644
--- a/WebCore/rendering/RenderHTMLCanvas.cpp
+++ b/WebCore/rendering/RenderHTMLCanvas.cpp
@@ -55,13 +55,10 @@ void RenderHTMLCanvas::canvasSizeChanged()
     IntSize canvasSize = static_cast<HTMLCanvasElement*>(node())->size();
     IntSize zoomedSize(canvasSize.width() * style()->effectiveZoom(), canvasSize.height() * style()->effectiveZoom());
 
-    if (zoomedSize == intrinsicSize())
+    if (canvasSize == intrinsicSize())
         return;
 
-    setIntrinsicSize(zoomedSize);
-
-    if (!parent())
-        return;
+    setIntrinsicSize(canvasSize);
 
     if (!prefWidthsDirty())
         setPrefWidthsDirty(true);
diff --git a/WebCore/rendering/RenderImage.cpp b/WebCore/rendering/RenderImage.cpp
index 9692a09..5c11e41 100644
--- a/WebCore/rendering/RenderImage.cpp
+++ b/WebCore/rendering/RenderImage.cpp
@@ -440,7 +440,7 @@ int RenderImage::minimumReplacedHeight() const
 HTMLMapElement* RenderImage::imageMap()
 {
     HTMLImageElement* i = node() && node()->hasTagName(imgTag) ? static_cast<HTMLImageElement*>(node()) : 0;
-    return i ? i->document()->getImageMap(i->getAttribute(usemapAttr)) : 0;
+    return i ? i->document()->getImageMap(i->useMap()) : 0;
 }
 
 bool RenderImage::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty, HitTestAction hitTestAction)
diff --git a/WebCore/rendering/RenderInline.cpp b/WebCore/rendering/RenderInline.cpp
index 664af93..53962d2 100644
--- a/WebCore/rendering/RenderInline.cpp
+++ b/WebCore/rendering/RenderInline.cpp
@@ -131,6 +131,18 @@ void RenderInline::styleDidChange(StyleDifference diff, const RenderStyle* oldSt
     }
 }
 
+static inline bool isAfterContent(RenderObject* child)
+{
+    if (!child)
+        return false;
+    if (child->style()->styleType() != AFTER)
+        return false;
+    // Text nodes don't have their own styles, so ignore the style on a text node.
+    if (child->isText() && !child->isBR())
+        return false;
+    return true;
+}
+
 void RenderInline::addChild(RenderObject* newChild, RenderObject* beforeChild)
 {
     if (continuation())
diff --git a/WebCore/rendering/RenderLayer.cpp b/WebCore/rendering/RenderLayer.cpp
index ca6e5a6..ab78f40 100644
--- a/WebCore/rendering/RenderLayer.cpp
+++ b/WebCore/rendering/RenderLayer.cpp
@@ -207,8 +207,12 @@ RenderLayer::~RenderLayer()
     // Make sure we have no lingering clip rects.
     ASSERT(!m_clipRects);
     
-    if (m_reflection)
-        removeReflection();
+    if (m_reflection) {
+        if (!m_reflection->documentBeingDestroyed())
+            m_reflection->removeLayers(this);
+        m_reflection->setParent(0);
+        m_reflection->destroy();
+    }
     
     if (m_scrollCorner)
         m_scrollCorner->destroy();
@@ -993,9 +997,6 @@ void RenderLayer::panScrollFromPoint(const IntPoint& sourcePoint)
 
 void RenderLayer::scrollByRecursively(int xDelta, int yDelta)
 {
-    if (!xDelta && !yDelta)
-        return;
-
     bool restrictedByLineClamp = false;
     if (renderer()->parent())
         restrictedByLineClamp = renderer()->parent()->style()->lineClamp() >= 0;
@@ -1005,30 +1006,17 @@ void RenderLayer::scrollByRecursively(int xDelta, int yDelta)
         int newOffsetY = scrollYOffset() + yDelta;
         scrollToOffset(newOffsetX, newOffsetY);
 
-        // If this layer can't do the scroll we ask the next layer up that can scroll to try
+        // If this layer can't do the scroll we ask its parent
         int leftToScrollX = newOffsetX - scrollXOffset();
         int leftToScrollY = newOffsetY - scrollYOffset();
         if ((leftToScrollX || leftToScrollY) && renderer()->parent()) {
-            RenderObject* nextRenderer = renderer()->parent();
-            while (nextRenderer) {
-                if (nextRenderer->isBox() && toRenderBox(nextRenderer)->canBeScrolledAndHasScrollableArea()) {
-                    nextRenderer->enclosingLayer()->scrollByRecursively(leftToScrollX, leftToScrollY);
-                    break;
-                }
-                nextRenderer = nextRenderer->parent();
-            }
-
+            renderer()->parent()->enclosingLayer()->scrollByRecursively(leftToScrollX, leftToScrollY);
             Frame* frame = renderer()->document()->frame();
             if (frame)
                 frame->eventHandler()->updateAutoscrollRenderer();
         }
-    } else if (renderer()->view()->frameView()) {
-        // If we are here, we were called on a renderer that can be programatically scrolled, but doesn't
-        // have an overflow clip. Which means that it is a document node that can be scrolled.
+    } else if (renderer()->view()->frameView())
         renderer()->view()->frameView()->scrollBy(IntSize(xDelta, yDelta));
-        // FIXME: If we didn't scroll the whole way, do we want to try looking at the frames ownerElement? 
-        // https://bugs.webkit.org/show_bug.cgi?id=28237
-    }
 }
 
 
@@ -2885,11 +2873,6 @@ void RenderLayer::clearBacking()
 {
     m_backing.clear();
 }
-
-bool RenderLayer::hasCompositedMask() const
-{
-    return m_backing && m_backing->hasMaskLayer();
-}
 #endif
 
 void RenderLayer::setParent(RenderLayer* parent)
@@ -3200,9 +3183,10 @@ void RenderLayer::styleChanged(StyleDifference diff, const RenderStyle*)
         m_marquee = 0;
     }
     
-    if (!hasReflection() && m_reflection)
-        removeReflection();
-    else if (hasReflection()) {
+    if (!hasReflection() && m_reflection) {
+        m_reflection->destroy();
+        m_reflection = 0;
+    } else if (hasReflection()) {
         if (!m_reflection)
             createReflection();
         updateReflectionStyle();
@@ -3276,16 +3260,6 @@ void RenderLayer::createReflection()
     m_reflection->setParent(renderer()); // We create a 1-way connection.
 }
 
-void RenderLayer::removeReflection()
-{
-    if (!m_reflection->documentBeingDestroyed())
-        m_reflection->removeLayers(this);
-
-    m_reflection->setParent(0);
-    m_reflection->destroy();
-    m_reflection = 0;
-}
-
 void RenderLayer::updateReflectionStyle()
 {
     RefPtr<RenderStyle> newStyle = RenderStyle::create();
diff --git a/WebCore/rendering/RenderLayer.h b/WebCore/rendering/RenderLayer.h
index 16ad4d4..1772c66 100644
--- a/WebCore/rendering/RenderLayer.h
+++ b/WebCore/rendering/RenderLayer.h
@@ -415,13 +415,11 @@ public:
 
 #if USE(ACCELERATED_COMPOSITING)
     bool isComposited() const { return m_backing != 0; }
-    bool hasCompositedMask() const;
     RenderLayerBacking* backing() const { return m_backing.get(); }
     RenderLayerBacking* ensureBacking();
     void clearBacking();
 #else
     bool isComposited() const { return false; }
-    bool hasCompositedMask() const { return false; }
 #endif
 
     bool paintsWithTransparency() const
@@ -509,8 +507,6 @@ private:
     Node* enclosingElement() const;
 
     void createReflection();
-    void removeReflection();
-
     void updateReflectionStyle();
     bool paintingInsideReflection() const { return m_paintingInsideReflection; }
     void setPaintingInsideReflection(bool b) { m_paintingInsideReflection = b; }
diff --git a/WebCore/rendering/RenderLayerBacking.cpp b/WebCore/rendering/RenderLayerBacking.cpp
index b60e18f..e98c458 100644
--- a/WebCore/rendering/RenderLayerBacking.cpp
+++ b/WebCore/rendering/RenderLayerBacking.cpp
@@ -47,14 +47,16 @@ using namespace std;
 
 namespace WebCore {
 
-using namespace HTMLNames;
-
 static bool hasBorderOutlineOrShadow(const RenderStyle*);
 static bool hasBoxDecorations(const RenderStyle*);
 static bool hasBoxDecorationsWithBackgroundImage(const RenderStyle*);
 
 RenderLayerBacking::RenderLayerBacking(RenderLayer* layer)
     : m_owningLayer(layer)
+    , m_ancestorClippingLayer(0)
+    , m_graphicsLayer(0)
+    , m_foregroundLayer(0)
+    , m_clippingLayer(0)
     , m_hasDirectlyCompositedContent(false)
 {
     createGraphicsLayer();
@@ -64,13 +66,12 @@ RenderLayerBacking::~RenderLayerBacking()
 {
     updateClippingLayers(false, false);
     updateForegroundLayer(false);
-    updateMaskLayer(false);
     destroyGraphicsLayer();
 }
 
 void RenderLayerBacking::createGraphicsLayer()
 {
-    m_graphicsLayer = GraphicsLayer::create(this);
+    m_graphicsLayer = GraphicsLayer::createGraphicsLayer(this);
     
 #ifndef NDEBUG
     if (renderer()->node()) {
@@ -78,7 +79,7 @@ void RenderLayerBacking::createGraphicsLayer()
             m_graphicsLayer->setName("Document Node");
         else {
             if (renderer()->node()->isHTMLElement() && renderer()->node()->hasID())
-                m_graphicsLayer->setName(renderer()->renderName() + String(" ") + static_cast<HTMLElement*>(renderer()->node())->getAttribute(idAttr));
+                m_graphicsLayer->setName(renderer()->renderName() + String(" ") + static_cast<HTMLElement*>(renderer()->node())->id());
             else
                 m_graphicsLayer->setName(renderer()->renderName());
         }
@@ -95,10 +96,14 @@ void RenderLayerBacking::destroyGraphicsLayer()
     if (m_graphicsLayer)
         m_graphicsLayer->removeFromParent();
 
+    delete m_graphicsLayer;
     m_graphicsLayer = 0;
+
+    delete m_foregroundLayer;
     m_foregroundLayer = 0;
+
+    delete m_clippingLayer;
     m_clippingLayer = 0;
-    m_maskLayer = 0;
 }
 
 void RenderLayerBacking::updateLayerOpacity()
@@ -153,9 +158,6 @@ bool RenderLayerBacking::updateGraphicsLayerConfiguration()
     if (updateClippingLayers(compositor->clippedByAncestor(m_owningLayer), compositor->clipsCompositingDescendants(m_owningLayer)))
         layerConfigChanged = true;
 
-    if (updateMaskLayer(m_owningLayer->renderer()->hasMask()))
-        m_graphicsLayer->setMaskLayer(m_maskLayer.get());
-
     m_hasDirectlyCompositedContent = false;
     if (canUseDirectCompositing()) {
         if (renderer()->isImage()) {
@@ -249,19 +251,13 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
     }
 
     // If we have a layer that clips children, position it.
-    IntRect clippingBox;
     if (m_clippingLayer) {
-        clippingBox = toRenderBox(renderer())->overflowClipRect(0, 0);
+        IntRect clippingBox = toRenderBox(renderer())->overflowClipRect(0, 0);
         m_clippingLayer->setPosition(FloatPoint() + (clippingBox.location() - localCompositingBounds.location()));
         m_clippingLayer->setSize(clippingBox.size());
         m_clippingLayer->setOffsetFromRenderer(clippingBox.location() - IntPoint());
     }
     
-    if (m_maskLayer) {
-        m_maskLayer->setSize(m_graphicsLayer->size());
-        m_maskLayer->setPosition(FloatPoint());
-    }
-    
     if (m_owningLayer->hasTransform()) {
         const IntRect borderBox = toRenderBox(renderer())->borderBoxRect();
 
@@ -297,20 +293,10 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
     }
 
     if (m_foregroundLayer) {
-        FloatPoint foregroundPosition;
-        FloatSize foregroundSize = newSize;
-        IntSize foregroundOffset = m_graphicsLayer->offsetFromRenderer();
-        // If we have a clipping layer (which clips descendants), then the foreground layer is a child of it,
-        // so that it gets correctly sorted with children. In that case, position relative to the clipping layer.
-        if (m_clippingLayer) {
-            foregroundPosition = FloatPoint() + (localCompositingBounds.location() - clippingBox.location());
-            foregroundSize = FloatSize(clippingBox.size());
-            foregroundOffset = clippingBox.location() - IntPoint();
-        }
-
-        m_foregroundLayer->setPosition(foregroundPosition);
-        m_foregroundLayer->setSize(foregroundSize);
-        m_foregroundLayer->setOffsetFromRenderer(foregroundOffset);
+        // The contents layer is always coincidental with the graphicsLayer for now.
+        m_foregroundLayer->setPosition(IntPoint(0, 0));
+        m_foregroundLayer->setSize(newSize);
+        m_foregroundLayer->setOffsetFromRenderer(m_graphicsLayer->offsetFromRenderer());
     }
 
     m_graphicsLayer->setContentsRect(contentsBox());
@@ -325,12 +311,12 @@ void RenderLayerBacking::updateInternalHierarchy()
     if (m_ancestorClippingLayer) {
         m_ancestorClippingLayer->removeAllChildren();
         m_graphicsLayer->removeFromParent();
-        m_ancestorClippingLayer->addChild(m_graphicsLayer.get());
+        m_ancestorClippingLayer->addChild(m_graphicsLayer);
     }
 
     if (m_clippingLayer) {
         m_clippingLayer->removeFromParent();
-        m_graphicsLayer->addChild(m_clippingLayer.get());
+        m_graphicsLayer->addChild(m_clippingLayer);
     }
 }
 
@@ -341,7 +327,7 @@ bool RenderLayerBacking::updateClippingLayers(bool needsAncestorClip, bool needs
 
     if (needsAncestorClip) {
         if (!m_ancestorClippingLayer) {
-            m_ancestorClippingLayer = GraphicsLayer::create(this);
+            m_ancestorClippingLayer = GraphicsLayer::createGraphicsLayer(this);
 #ifndef NDEBUG
             m_ancestorClippingLayer->setName("Ancestor clipping Layer");
 #endif
@@ -350,13 +336,14 @@ bool RenderLayerBacking::updateClippingLayers(bool needsAncestorClip, bool needs
         }
     } else if (m_ancestorClippingLayer) {
         m_ancestorClippingLayer->removeFromParent();
+        delete m_ancestorClippingLayer;
         m_ancestorClippingLayer = 0;
         layersChanged = true;
     }
     
     if (needsDescendantClip) {
         if (!m_clippingLayer) {
-            m_clippingLayer = GraphicsLayer::create(0);
+            m_clippingLayer = GraphicsLayer::createGraphicsLayer(0);
 #ifndef NDEBUG
             m_clippingLayer->setName("Child clipping Layer");
 #endif
@@ -365,6 +352,7 @@ bool RenderLayerBacking::updateClippingLayers(bool needsAncestorClip, bool needs
         }
     } else if (m_clippingLayer) {
         m_clippingLayer->removeFromParent();
+        delete m_clippingLayer;
         m_clippingLayer = 0;
         layersChanged = true;
     }
@@ -380,61 +368,25 @@ bool RenderLayerBacking::updateForegroundLayer(bool needsForegroundLayer)
     bool layerChanged = false;
     if (needsForegroundLayer) {
         if (!m_foregroundLayer) {
-            m_foregroundLayer = GraphicsLayer::create(this);
+            m_foregroundLayer = GraphicsLayer::createGraphicsLayer(this);
 #ifndef NDEBUG
-            m_foregroundLayer->setName("Foreground");
+            m_foregroundLayer->setName("Contents");
 #endif
             m_foregroundLayer->setDrawsContent(true);
-            m_foregroundLayer->setPaintingPhase(GraphicsLayerPaintForeground);
+            m_foregroundLayer->setDrawingPhase(GraphicsLayerPaintForegroundMask);
+            m_graphicsLayer->setDrawingPhase(GraphicsLayerPaintBackgroundMask);
             layerChanged = true;
         }
     } else if (m_foregroundLayer) {
         m_foregroundLayer->removeFromParent();
+        delete m_foregroundLayer;
         m_foregroundLayer = 0;
+        m_graphicsLayer->setDrawingPhase(GraphicsLayerPaintAllMask);
         layerChanged = true;
     }
-
-    if (layerChanged)
-        m_graphicsLayer->setPaintingPhase(paintingPhaseForPrimaryLayer());
-
-    return layerChanged;
-}
-
-bool RenderLayerBacking::updateMaskLayer(bool needsMaskLayer)
-{
-    bool layerChanged = false;
-    if (needsMaskLayer) {
-        if (!m_maskLayer) {
-            m_maskLayer = GraphicsLayer::create(this);
-#ifndef NDEBUG
-            m_maskLayer->setName("Mask");
-#endif
-            m_maskLayer->setDrawsContent(true);
-            m_maskLayer->setPaintingPhase(GraphicsLayerPaintMask);
-            layerChanged = true;
-        }
-    } else if (m_maskLayer) {
-        m_maskLayer = 0;
-        layerChanged = true;
-    }
-
-    if (layerChanged)
-        m_graphicsLayer->setPaintingPhase(paintingPhaseForPrimaryLayer());
-
     return layerChanged;
 }
 
-GraphicsLayerPaintingPhase RenderLayerBacking::paintingPhaseForPrimaryLayer() const
-{
-    unsigned phase = GraphicsLayerPaintBackground;
-    if (!m_foregroundLayer)
-        phase |= GraphicsLayerPaintForeground;
-    if (!m_maskLayer)
-        phase |= GraphicsLayerPaintMask;
-
-    return static_cast<GraphicsLayerPaintingPhase>(phase);
-}
-
 float RenderLayerBacking::compositingOpacity(float rendererOpacity) const
 {
     float finalOpacity = rendererOpacity;
@@ -548,7 +500,7 @@ bool RenderLayerBacking::isSimpleContainerCompositingLayer() const
         
         // Now look at the body's renderer.
         HTMLElement* body = renderObject->document()->body();
-        RenderObject* bodyObject = (body && body->hasLocalName(bodyTag)) ? body->renderer() : 0;
+        RenderObject* bodyObject = (body && body->hasLocalName(HTMLNames::bodyTag)) ? body->renderer() : 0;
         if (!bodyObject)
             return false;
         
@@ -753,16 +705,13 @@ void RenderLayerBacking::setContentsNeedDisplay()
     
     if (m_foregroundLayer && m_foregroundLayer->drawsContent())
         m_foregroundLayer->setNeedsDisplay();
-
-    if (m_maskLayer && m_maskLayer->drawsContent())
-        m_maskLayer->setNeedsDisplay();
 }
 
 // r is in the coordinate space of the layer's render object
 void RenderLayerBacking::setContentsNeedDisplayInRect(const IntRect& r)
 {
     if (m_graphicsLayer && m_graphicsLayer->drawsContent()) {
-        FloatPoint dirtyOrigin = contentsToGraphicsLayerCoordinates(m_graphicsLayer.get(), FloatPoint(r.x(), r.y()));
+        FloatPoint dirtyOrigin = contentsToGraphicsLayerCoordinates(m_graphicsLayer, FloatPoint(r.x(), r.y()));
         FloatRect dirtyRect(dirtyOrigin, r.size());
         FloatRect bounds(FloatPoint(), m_graphicsLayer->size());
         if (bounds.intersects(dirtyRect))
@@ -773,11 +722,6 @@ void RenderLayerBacking::setContentsNeedDisplayInRect(const IntRect& r)
         // FIXME: do incremental repaint
         m_foregroundLayer->setNeedsDisplay();
     }
-
-    if (m_maskLayer && m_maskLayer->drawsContent()) {
-        // FIXME: do incremental repaint
-        m_maskLayer->setNeedsDisplay();
-    }
 }
 
 static void setClip(GraphicsContext* p, const IntRect& paintDirtyRect, const IntRect& clipRect)
@@ -835,7 +779,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
 
     bool shouldPaint = m_owningLayer->hasVisibleContent() && m_owningLayer->isSelfPaintingLayer();
 
-    if (shouldPaint && (paintingPhase & GraphicsLayerPaintBackground)) {
+    if (shouldPaint && (paintingPhase & GraphicsLayerPaintBackgroundMask)) {
         // If this is the root then we need to send in a bigger bounding box
         // because we'll be painting the background as well (see RenderBox::paintRootBoxDecorations()).
         IntRect paintBox = clipRectToApply;
@@ -879,10 +823,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
         restoreClip(context, paintDirtyRect, damageRect);
     }
                 
-    bool forceBlackText = paintRestriction == PaintRestrictionSelectionOnlyBlackText;
-    bool selectionOnly  = paintRestriction == PaintRestrictionSelectionOnly || paintRestriction == PaintRestrictionSelectionOnlyBlackText;
-
-    if (shouldPaint && (paintingPhase & GraphicsLayerPaintForeground)) {
+    if (shouldPaint && (paintingPhase & GraphicsLayerPaintForegroundMask)) {
         // Now walk the sorted list of children with negative z-indices. Only RenderLayers without compositing layers will paint.
         // FIXME: should these be painted as background?
         Vector<RenderLayer*>* negZOrderList = m_owningLayer->negZOrderList();
@@ -891,6 +832,9 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
                 it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintRestriction, paintingRoot);
         }
 
+        bool forceBlackText = paintRestriction == PaintRestrictionSelectionOnlyBlackText;
+        bool selectionOnly  = paintRestriction == PaintRestrictionSelectionOnly || paintRestriction == PaintRestrictionSelectionOnlyBlackText;
+
         // Set up the clip used when painting our children.
         setClip(context, paintDirtyRect, clipRectToApply);
         RenderObject::PaintInfo paintInfo(context, clipRectToApply, 
@@ -933,9 +877,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
             for (Vector<RenderLayer*>::iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it)
                 it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintRestriction, paintingRoot);
         }
-    }
-    
-    if (shouldPaint && (paintingPhase & GraphicsLayerPaintMask)) {
+        
         if (renderer()->hasMask() && !selectionOnly && !damageRect.isEmpty()) {
             setClip(context, paintDirtyRect, damageRect);
 
@@ -952,7 +894,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
 }
 
 // Up-call from compositing layer drawing callback.
-void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& context, GraphicsLayerPaintingPhase paintingPhase, const IntRect& clip)
+void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& context, GraphicsLayerPaintingPhase drawingPhase, const IntRect& clip)
 {
     // We have to use the same root as for hit testing, because both methods
     // can compute and cache clipRects.
@@ -970,7 +912,7 @@ void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& co
     IntRect dirtyRect = enclosingBBox;
     dirtyRect.intersect(clipRect);
 
-    paintIntoLayer(m_owningLayer, &context, dirtyRect, PaintRestrictionNone, paintingPhase, renderer());
+    paintIntoLayer(m_owningLayer, &context, dirtyRect, PaintRestrictionNone, drawingPhase, renderer());
 }
 
 bool RenderLayerBacking::startAnimation(double beginTime, const Animation* anim, const KeyframeList& keyframes)
diff --git a/WebCore/rendering/RenderLayerBacking.h b/WebCore/rendering/RenderLayerBacking.h
index 731e741..b027685 100644
--- a/WebCore/rendering/RenderLayerBacking.h
+++ b/WebCore/rendering/RenderLayerBacking.h
@@ -63,23 +63,21 @@ public:
     // Update contents and clipping structure.
     void updateInternalHierarchy(); // make private
     
-    GraphicsLayer* graphicsLayer() const { return m_graphicsLayer.get(); }
+    GraphicsLayer* graphicsLayer() const { return m_graphicsLayer; }
 
     // Layer to clip children
     bool hasClippingLayer() const { return m_clippingLayer != 0; }
-    GraphicsLayer* clippingLayer() const { return m_clippingLayer.get(); }
+    GraphicsLayer* clippingLayer() const { return m_clippingLayer; }
 
     // Layer to get clipped by ancestor
     bool hasAncestorClippingLayer() const { return m_ancestorClippingLayer != 0; }
-    GraphicsLayer* ancestorClippingLayer() const { return m_ancestorClippingLayer.get(); }
+    GraphicsLayer* ancestorClippingLayer() const { return m_ancestorClippingLayer; }
 
     bool hasContentsLayer() const { return m_foregroundLayer != 0; }
-    GraphicsLayer* foregroundLayer() const { return m_foregroundLayer.get(); }
+    GraphicsLayer* foregroundLayer() const { return m_foregroundLayer; }
     
-    bool hasMaskLayer() const { return m_maskLayer != 0; }
-
-    GraphicsLayer* parentForSublayers() const { return m_clippingLayer ? m_clippingLayer.get() : m_graphicsLayer.get(); }
-    GraphicsLayer* childForSuperlayers() const { return m_ancestorClippingLayer ? m_ancestorClippingLayer.get() : m_graphicsLayer.get(); }
+    GraphicsLayer* parentForSublayers() const { return m_clippingLayer ? m_clippingLayer : m_graphicsLayer; }
+    GraphicsLayer* childForSuperlayers() const { return m_ancestorClippingLayer ? m_ancestorClippingLayer : m_graphicsLayer; }
 
     // RenderLayers with backing normally short-circuit paintLayer() because
     // their content is rendered via callbacks from GraphicsLayer. However, the document
@@ -129,10 +127,7 @@ private:
 
     bool updateClippingLayers(bool needsAncestorClip, bool needsDescendantClip);
     bool updateForegroundLayer(bool needsForegroundLayer);
-    bool updateMaskLayer(bool needsMaskLayer);
 
-    GraphicsLayerPaintingPhase paintingPhaseForPrimaryLayer() const;
-    
     IntSize contentOffsetInCompostingLayer() const;
     // Result is transform origin in pixels.
     FloatPoint3D computeTransformOrigin(const IntRect& borderBox) const;
@@ -167,11 +162,10 @@ private:
 private:
     RenderLayer* m_owningLayer;
 
-    OwnPtr<GraphicsLayer> m_ancestorClippingLayer; // only used if we are clipped by an ancestor which is not a stacking context
-    OwnPtr<GraphicsLayer> m_graphicsLayer;
-    OwnPtr<GraphicsLayer> m_foregroundLayer;       // only used in cases where we need to draw the foreground separately
-    OwnPtr<GraphicsLayer> m_clippingLayer;         // only used if we have clipping on a stacking context, with compositing children
-    OwnPtr<GraphicsLayer> m_maskLayer;             // only used if we have a mask
+    GraphicsLayer* m_ancestorClippingLayer; // only used if we are clipped by an ancestor which is not a stacking context
+    GraphicsLayer* m_graphicsLayer;
+    GraphicsLayer* m_foregroundLayer;       // only used in cases where we need to draw the foreground separately
+    GraphicsLayer* m_clippingLayer;         // only used if we have clipping on a stacking context, with compositing children
 
     IntRect m_compositedBounds;
 
diff --git a/WebCore/rendering/RenderLayerCompositor.cpp b/WebCore/rendering/RenderLayerCompositor.cpp
index 10da951..fb15800 100644
--- a/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/WebCore/rendering/RenderLayerCompositor.cpp
@@ -92,6 +92,7 @@ RenderLayerCompositor::RenderLayerCompositor(RenderView* renderView)
 RenderLayerCompositor::~RenderLayerCompositor()
 {
     ASSERT(!m_rootLayerAttached);
+    delete m_rootPlatformLayer;
 }
 
 void RenderLayerCompositor::enableCompositingMode(bool enable /* = true */)
@@ -502,7 +503,8 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
     // If we have a software transform, and we have layers under us, we need to also
     // be composited. Also, if we have opacity < 1, then we need to be a layer so that
     // the child layers are opaque, then rendered with opacity on this layer.
-    if (childState.m_subtreeIsCompositing && requiresCompositingWhenDescendantsAreCompositing(layer->renderer())) {
+    if (childState.m_subtreeIsCompositing &&
+        (layer->renderer()->hasTransform() || layer->renderer()->style()->opacity() < 1)) {
         layer->setMustOverlapCompositedLayers(true);
         if (overlapMap)
             addToOverlapMap(*overlapMap, layer, absBounds, haveComputedBounds);
@@ -571,7 +573,7 @@ bool RenderLayerCompositor::canAccelerateVideoRendering(RenderVideo* o) const
 {
     // FIXME: ideally we need to look at all ancestors for mask or video. But for now,
     // just bail on the obvious cases.
-    if (o->hasReflection() || !m_hasAcceleratedCompositing)
+    if (o->hasMask() || o->hasReflection() || !m_hasAcceleratedCompositing)
         return false;
 
     return o->supportsAcceleratedRendering();
@@ -630,10 +632,10 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
         }
 
         if (updateHierarchy && layerBacking && layerBacking->foregroundLayer()) {
+            // we only have a contents layer if we have an m_layer
             layerBacking->foregroundLayer()->removeFromParent();
-            
-            // The foreground layer has to be correctly sorted with child layers, so needs to become a child of the clipping layer.
-            GraphicsLayer* hostingLayer = layerBacking->parentForSublayers();
+
+            GraphicsLayer* hostingLayer = layerBacking->clippingLayer() ? layerBacking->clippingLayer() : layerBacking->graphicsLayer();
             hostingLayer->addChild(layerBacking->foregroundLayer());
         }
     }
@@ -757,7 +759,7 @@ RenderLayer* RenderLayerCompositor::rootRenderLayer() const
 
 GraphicsLayer* RenderLayerCompositor::rootPlatformLayer() const
 {
-    return m_rootPlatformLayer.get();
+    return m_rootPlatformLayer;
 }
 
 void RenderLayerCompositor::didMoveOnscreen()
@@ -770,7 +772,7 @@ void RenderLayerCompositor::didMoveOnscreen()
     if (!page)
         return;
 
-    page->chrome()->client()->attachRootGraphicsLayer(frame, m_rootPlatformLayer.get());
+    page->chrome()->client()->attachRootGraphicsLayer(frame, m_rootPlatformLayer);
     m_rootLayerAttached = true;
 }
 
@@ -904,11 +906,6 @@ bool RenderLayerCompositor::requiresCompositingForAnimation(RenderObject* render
     return false;
 }
 
-bool RenderLayerCompositor::requiresCompositingWhenDescendantsAreCompositing(RenderObject* renderer) const
-{
-    return renderer->hasTransform() || renderer->isTransparent() || renderer->hasMask();
-}
-
 // If an element has negative z-index children, those children render in front of the 
 // layer background, so we need an extra 'contents' layer for the foreground of the layer
 // object.
@@ -922,7 +919,7 @@ void RenderLayerCompositor::ensureRootPlatformLayer()
     if (m_rootPlatformLayer)
         return;
 
-    m_rootPlatformLayer = GraphicsLayer::create(0);
+    m_rootPlatformLayer = GraphicsLayer::createGraphicsLayer(0);
     m_rootPlatformLayer->setSize(FloatSize(m_renderView->overflowWidth(), m_renderView->overflowHeight()));
     m_rootPlatformLayer->setPosition(FloatPoint(0, 0));
     // The root layer does flipping if we need it on this platform.
@@ -940,6 +937,7 @@ void RenderLayerCompositor::destroyRootPlatformLayer()
         return;
 
     willMoveOffscreen();
+    delete m_rootPlatformLayer;
     m_rootPlatformLayer = 0;
 }
 
diff --git a/WebCore/rendering/RenderLayerCompositor.h b/WebCore/rendering/RenderLayerCompositor.h
index 8dd689c..02929dc 100644
--- a/WebCore/rendering/RenderLayerCompositor.h
+++ b/WebCore/rendering/RenderLayerCompositor.h
@@ -164,11 +164,10 @@ private:
     bool requiresCompositingForAnimation(RenderObject*) const;
     bool requiresCompositingForTransform(RenderObject*) const;
     bool requiresCompositingForVideo(RenderObject*) const;
-    bool requiresCompositingWhenDescendantsAreCompositing(RenderObject*) const;
 
 private:
     RenderView* m_renderView;
-    OwnPtr<GraphicsLayer> m_rootPlatformLayer;
+    GraphicsLayer* m_rootPlatformLayer;
     bool m_hasAcceleratedCompositing;
     bool m_compositingConsultsOverlap;
     bool m_compositing;
diff --git a/WebCore/rendering/RenderListItem.h b/WebCore/rendering/RenderListItem.h
index c4c41dc..21544f9 100644
--- a/WebCore/rendering/RenderListItem.h
+++ b/WebCore/rendering/RenderListItem.h
@@ -44,8 +44,6 @@ public:
     void setNotInList(bool notInList) { m_notInList = notInList; }
     bool notInList() const { return m_notInList; }
 
-    const String& markerText() const;
-
 private:
     virtual const char* renderName() const { return "RenderListItem"; }
 
@@ -61,6 +59,8 @@ private:
 
     virtual void positionListMarker();
 
+    const String& markerText() const;
+
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
     void updateMarkerLocation();
diff --git a/WebCore/rendering/RenderMarquee.cpp b/WebCore/rendering/RenderMarquee.cpp
index bb917f8..31a8305 100644
--- a/WebCore/rendering/RenderMarquee.cpp
+++ b/WebCore/rendering/RenderMarquee.cpp
@@ -1,6 +1,5 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
@@ -153,11 +152,7 @@ int RenderMarquee::computePosition(EMarqueeDirection dir, bool stopAtContentEdge
 
 void RenderMarquee::start()
 {
-    if (m_timer.isActive() || m_layer->renderer()->style()->marqueeIncrement().isZero()
-#if ENABLE(WCSS) && ENABLE(XHTMLMP)
-        || (m_layer->renderer()->document()->isXHTMLMPDocument() && !m_layer->renderer()->style()->marqueeLoopCount())
-#endif
-       )
+    if (m_timer.isActive() || m_layer->renderer()->style()->marqueeIncrement().isZero())
         return;
 
     // We may end up propagating a scroll event. It is important that we suspend events until 
diff --git a/WebCore/rendering/RenderObject.cpp b/WebCore/rendering/RenderObject.cpp
index 728ff7a..5137338 100644
--- a/WebCore/rendering/RenderObject.cpp
+++ b/WebCore/rendering/RenderObject.cpp
@@ -4,7 +4,6 @@
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -146,12 +145,6 @@ RenderObject* RenderObject::createObject(Node* node, RenderStyle* style)
             o = new (arena) RenderTableCell(node);
             break;
         case TABLE_CAPTION:
-#if ENABLE(WCSS)
-        // As per the section 17.1 of the spec WAP-239-WCSS-20011026-a.pdf, 
-        // the marquee box inherits and extends the characteristics of the 
-        // principal block box ([CSS2] section 9.2.1).
-        case WAP_MARQUEE:
-#endif
             o = new (arena) RenderBlock(node);
             break;
         case BOX:
@@ -1619,20 +1612,15 @@ void RenderObject::styleDidChange(StyleDifference diff, const RenderStyle*)
 
 void RenderObject::updateFillImages(const FillLayer* oldLayers, const FillLayer* newLayers)
 {
-    // Optimize the common case
-    if (oldLayers && !oldLayers->next() && newLayers && !newLayers->next() && (oldLayers->image() == newLayers->image()))
-        return;
-    
-    // Go through the new layers and addClients first, to avoid removing all clients of an image.
-    for (const FillLayer* currNew = newLayers; currNew; currNew = currNew->next()) {
-        if (currNew->image())
-            currNew->image()->addClient(this);
-    }
-
+    // FIXME: This will be slow when a large number of images is used.  Fix by using a dict.
     for (const FillLayer* currOld = oldLayers; currOld; currOld = currOld->next()) {
-        if (currOld->image())
+        if (currOld->image() && (!newLayers || !newLayers->containsImage(currOld->image())))
             currOld->image()->removeClient(this);
     }
+    for (const FillLayer* currNew = newLayers; currNew; currNew = currNew->next()) {
+        if (currNew->image() && (!oldLayers || !oldLayers->containsImage(currNew->image())))
+            currNew->image()->addClient(this);
+    }
 }
 
 void RenderObject::updateImage(StyleImage* oldImage, StyleImage* newImage)
diff --git a/WebCore/rendering/RenderObject.h b/WebCore/rendering/RenderObject.h
index eb558f6..911169d 100644
--- a/WebCore/rendering/RenderObject.h
+++ b/WebCore/rendering/RenderObject.h
@@ -285,9 +285,6 @@ public:
 
     bool isHTMLMarquee() const;
 
-    inline bool isAfterContent() const;
-    static inline bool isAfterContent(const RenderObject* obj) { return obj && obj->isAfterContent(); }
-
     bool childrenInline() const { return m_childrenInline; }
     void setChildrenInline(bool b = true) { m_childrenInline = b; }
     bool hasColumns() const { return m_hasColumns; }
@@ -861,16 +858,6 @@ inline bool RenderObject::documentBeingDestroyed() const
     return !document()->renderer();
 }
 
-inline bool RenderObject::isAfterContent() const
-{
-    if (style()->styleType() != AFTER)
-        return false;
-    // Text nodes don't have their own styles, so ignore the style on a text node.
-    if (isText() && !isBR())
-        return false;
-    return true;
-}
-
 inline void RenderObject::setNeedsLayout(bool b, bool markParents)
 {
     bool alreadyNeededLayout = m_needsLayout;
diff --git a/WebCore/rendering/RenderReplaced.cpp b/WebCore/rendering/RenderReplaced.cpp
index 0ab11b6..692a66e 100644
--- a/WebCore/rendering/RenderReplaced.cpp
+++ b/WebCore/rendering/RenderReplaced.cpp
@@ -66,7 +66,7 @@ void RenderReplaced::styleDidChange(StyleDifference diff, const RenderStyle* old
 
     bool hadStyle = (oldStyle != 0);
     float oldZoom = hadStyle ? oldStyle->effectiveZoom() : RenderStyle::initialZoom();
-    if (style() && style()->effectiveZoom() != oldZoom)
+    if (hadStyle && style() && style()->effectiveZoom() != oldZoom)
         intrinsicSizeChanged();
 }
 
diff --git a/WebCore/rendering/RenderTable.cpp b/WebCore/rendering/RenderTable.cpp
index ebd7fbe..7599999 100644
--- a/WebCore/rendering/RenderTable.cpp
+++ b/WebCore/rendering/RenderTable.cpp
@@ -456,7 +456,26 @@ void RenderTable::layout()
     // FIXME: Only pass true if width or height changed.
     layoutPositionedObjects(true);
 
-    updateOverflowWithShadowAndReflection();
+    if (!hasOverflowClip()) {
+        int shadowLeft;
+        int shadowRight;
+        int shadowTop;
+        int shadowBottom;
+        style()->getBoxShadowExtent(shadowTop, shadowRight, shadowBottom, shadowLeft);
+
+        m_overflowLeft = min(m_overflowLeft, shadowLeft);
+        m_overflowWidth = max(m_overflowWidth, width() + shadowRight);
+        m_overflowTop = min(m_overflowTop, shadowTop);
+        m_overflowHeight = max(m_overflowHeight, height() + shadowBottom);
+
+        if (hasReflection()) {
+            IntRect reflection(reflectionBox());
+            m_overflowTop = min(m_overflowTop, reflection.y());
+            m_overflowHeight = max(m_overflowHeight, reflection.bottom());
+            m_overflowLeft = min(m_overflowLeft, reflection.x());
+            m_overflowHeight = max(m_overflowWidth, reflection.right());
+        }
+    }
 
     statePusher.pop();
 
diff --git a/WebCore/rendering/RenderText.cpp b/WebCore/rendering/RenderText.cpp
index 383a394..ada3961 100644
--- a/WebCore/rendering/RenderText.cpp
+++ b/WebCore/rendering/RenderText.cpp
@@ -207,7 +207,7 @@ void RenderText::deleteTextBoxes()
 PassRefPtr<StringImpl> RenderText::originalText() const
 {
     Node* e = node();
-    return e ? static_cast<Text*>(e)->dataImpl() : 0;
+    return e ? static_cast<Text*>(e)->string() : 0;
 }
 
 void RenderText::absoluteRects(Vector<IntRect>& rects, int tx, int ty)
diff --git a/WebCore/rendering/RenderTextFragment.cpp b/WebCore/rendering/RenderTextFragment.cpp
index 9ff1106..7da9e5a 100644
--- a/WebCore/rendering/RenderTextFragment.cpp
+++ b/WebCore/rendering/RenderTextFragment.cpp
@@ -47,7 +47,7 @@ RenderTextFragment::RenderTextFragment(Node* node, StringImpl* str)
 PassRefPtr<StringImpl> RenderTextFragment::originalText() const
 {
     Node* e = node();
-    RefPtr<StringImpl> result = (e ? static_cast<Text*>(e)->dataImpl() : contentString());
+    RefPtr<StringImpl> result = (e ? static_cast<Text*>(e)->string() : contentString());
     if (result && (start() > 0 || start() < result->length()))
         result = result->substring(start(), end());
     return result.release();
@@ -76,7 +76,7 @@ UChar RenderTextFragment::previousCharacter()
 {
     if (start()) {
         Node* e = node();
-        StringImpl*  original = (e ? static_cast<Text*>(e)->dataImpl() : contentString());
+        StringImpl*  original = (e ? static_cast<Text*>(e)->string() : contentString());
         if (original)
             return (*original)[start() - 1];
     }
diff --git a/WebCore/rendering/RenderThemeChromiumMac.h b/WebCore/rendering/RenderThemeChromiumMac.h
index 0c417a2..ffb2548 100644
--- a/WebCore/rendering/RenderThemeChromiumMac.h
+++ b/WebCore/rendering/RenderThemeChromiumMac.h
@@ -156,7 +156,6 @@ namespace WebCore {
         IntSize sizeForSystemFont(RenderStyle*, const IntSize* sizes) const;
         void setFontFromControlSize(CSSStyleSelector*, RenderStyle*, NSControlSize) const;
 
-        void updateActiveState(NSCell*, const RenderObject*);
         void updateCheckedState(NSCell*, const RenderObject*);
         void updateEnabledState(NSCell*, const RenderObject*);
         void updateFocusedState(NSCell*, const RenderObject*);
diff --git a/WebCore/rendering/RenderThemeChromiumMac.mm b/WebCore/rendering/RenderThemeChromiumMac.mm
index 42e2aca..23201c9 100644
--- a/WebCore/rendering/RenderThemeChromiumMac.mm
+++ b/WebCore/rendering/RenderThemeChromiumMac.mm
@@ -549,25 +549,6 @@ IntRect RenderThemeChromiumMac::inflateRect(const IntRect& r, const IntSize& siz
     return result;
 }
 
-// Updates the control tint (a.k.a. active state) of |cell| (from |o|).
-// In the Chromium port, the renderer runs as a background process and controls'
-// NSCell(s) lack a parent NSView. Therefore controls don't have their tint
-// color updated correctly when the application is activated/deactivated.
-// FocusController's setActive() is called when the application is
-// activated/deactivated, which causes a repaint at which time this code is
-// called.
-// This function should be called before drawing any NSCell-derived controls,
-// unless you're sure it isn't needed.
-void RenderThemeChromiumMac::updateActiveState(NSCell* cell, const RenderObject* o)
-{
-    NSControlTint oldTint = [cell controlTint];
-    NSControlTint tint = isActive(o) ? [NSColor currentControlTint] :
-                                       NSClearControlTint;
-
-    if (tint != oldTint)
-        [cell setControlTint:tint];
-}
-
 void RenderThemeChromiumMac::updateCheckedState(NSCell* cell, const RenderObject* o)
 {
     bool oldIndeterminate = [cell state] == NSMixedState;
@@ -784,7 +765,6 @@ void RenderThemeChromiumMac::setCheckboxCellState(const RenderObject* o, const I
     setControlSize(checkbox, checkboxSizes(), r.size(), o->style()->effectiveZoom());
 
     // Update the various states we respond to.
-    updateActiveState(checkbox, o);
     updateCheckedState(checkbox, o);
     updateEnabledState(checkbox, o);
     updatePressedState(checkbox, o);
@@ -866,7 +846,6 @@ void RenderThemeChromiumMac::setRadioCellState(const RenderObject* o, const IntR
     setControlSize(radio, radioSizes(), r.size(), o->style()->effectiveZoom());
 
     // Update the various states we respond to.
-    updateActiveState(radio, o);
     updateCheckedState(radio, o);
     updateEnabledState(radio, o);
     updatePressedState(radio, o);
@@ -997,7 +976,6 @@ void RenderThemeChromiumMac::setButtonCellState(const RenderObject* o, const Int
     [button setKeyEquivalent:(isDefaultButton ? @"\r" : @"")];
 
     // Update the various states we respond to.
-    updateActiveState(button, o);
     updateCheckedState(button, o);
     updateEnabledState(button, o);
     updatePressedState(button, o);
@@ -1436,7 +1414,6 @@ void RenderThemeChromiumMac::setPopupButtonCellState(const RenderObject* o, cons
     setControlSize(popupButton, popupButtonSizes(), r.size(), o->style()->effectiveZoom());
 
     // Update the various states we respond to.
-    updateActiveState(popupButton, o);
     updateCheckedState(popupButton, o);
     updateEnabledState(popupButton, o);
     updatePressedState(popupButton, o);
@@ -1519,7 +1496,6 @@ bool RenderThemeChromiumMac::paintSliderThumb(RenderObject* o, const RenderObjec
     LocalCurrentGraphicsContext localContext(paintInfo.context);
 
     // Update the various states we respond to.
-    updateActiveState(sliderThumbCell, o);
     updateEnabledState(sliderThumbCell, o->parent());
     updateFocusedState(sliderThumbCell, o->parent());
 
@@ -1631,7 +1607,6 @@ void RenderThemeChromiumMac::setSearchCellState(RenderObject* o, const IntRect&
     [search setControlSize:controlSizeForFont(o->style())];
 
     // Update the various states we respond to.
-    updateActiveState(search, o);
     updateEnabledState(search, o);
     updateFocusedState(search, o);
 }
@@ -1692,7 +1667,6 @@ bool RenderThemeChromiumMac::paintSearchFieldCancelButton(RenderObject* o, const
 
     NSSearchFieldCell* search = this->search();
 
-    updateActiveState([search cancelButtonCell], o);
     updatePressedState([search cancelButtonCell], o);
 
     paintInfo.context->save();
@@ -1768,8 +1742,6 @@ bool RenderThemeChromiumMac::paintSearchFieldResultsDecoration(RenderObject* o,
 
     NSSearchFieldCell* search = this->search();
 
-    updateActiveState([search searchButtonCell], o);
-
     if ([search searchMenuTemplate] != nil)
         [search setSearchMenuTemplate:nil];
 
@@ -1797,8 +1769,6 @@ bool RenderThemeChromiumMac::paintSearchFieldResultsButton(RenderObject* o, cons
 
     NSSearchFieldCell* search = this->search();
 
-    updateActiveState([search searchButtonCell], o);
-
     if (![search searchMenuTemplate])
         [search setSearchMenuTemplate:searchMenuTemplate()];
 
diff --git a/WebCore/rendering/RenderThemeChromiumSkia.cpp b/WebCore/rendering/RenderThemeChromiumSkia.cpp
index c8875dc..79804ac 100644
--- a/WebCore/rendering/RenderThemeChromiumSkia.cpp
+++ b/WebCore/rendering/RenderThemeChromiumSkia.cpp
@@ -610,10 +610,6 @@ bool RenderThemeChromiumSkia::paintMediaPlayButton(RenderObject* object, const R
 
     static Image* mediaPlay = Image::loadPlatformResource("mediaPlay").releaseRef();
     static Image* mediaPause = Image::loadPlatformResource("mediaPause").releaseRef();
-    static Image* mediaPlayDisabled = Image::loadPlatformResource("mediaPlayDisabled").releaseRef();
-
-    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE)
-        return paintMediaButtonInternal(paintInfo.context, rect, mediaPlayDisabled);
 
     return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->paused() ? mediaPlay : mediaPause);
 #else
diff --git a/WebCore/rendering/style/FillLayer.h b/WebCore/rendering/style/FillLayer.h
index aad7900..c3944ad 100644
--- a/WebCore/rendering/style/FillLayer.h
+++ b/WebCore/rendering/style/FillLayer.h
@@ -63,14 +63,14 @@ public:
     bool isSizeSet() const { return m_sizeSet; }
     
     void setImage(StyleImage* i) { m_image = i; m_imageSet = true; }
-    void setXPosition(Length l) { m_xPosition = l; m_xPosSet = true; }
-    void setYPosition(Length l) { m_yPosition = l; m_yPosSet = true; }
+    void setXPosition(const Length& l) { m_xPosition = l; m_xPosSet = true; }
+    void setYPosition(const Length& l) { m_yPosition = l; m_yPosSet = true; }
     void setAttachment(EFillAttachment attachment) { m_attachment = attachment; m_attachmentSet = true; }
     void setClip(EFillBox b) { m_clip = b; m_clipSet = true; }
     void setOrigin(EFillBox b) { m_origin = b; m_originSet = true; }
     void setRepeat(EFillRepeat r) { m_repeat = r; m_repeatSet = true; }
     void setComposite(CompositeOperator c) { m_composite = c; m_compositeSet = true; }
-    void setSize(LengthSize b) { m_size = b; m_sizeSet = true; }
+    void setSize(const LengthSize& b) { m_size = b; m_sizeSet = true; }
     
     void clearImage() { m_imageSet = false; }
     void clearXPosition() { m_xPosSet = false; }
diff --git a/WebCore/rendering/style/RenderStyleConstants.h b/WebCore/rendering/style/RenderStyleConstants.h
index 013d335..c491816 100644
--- a/WebCore/rendering/style/RenderStyleConstants.h
+++ b/WebCore/rendering/style/RenderStyleConstants.h
@@ -4,7 +4,6 @@
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Graham Dennis (graham.dennis@gmail.com)
- * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -299,11 +298,7 @@ enum EDisplay {
     TABLE, INLINE_TABLE, TABLE_ROW_GROUP,
     TABLE_HEADER_GROUP, TABLE_FOOTER_GROUP, TABLE_ROW,
     TABLE_COLUMN_GROUP, TABLE_COLUMN, TABLE_CELL,
-    TABLE_CAPTION, BOX, INLINE_BOX, 
-#if ENABLE(WCSS)
-    WAP_MARQUEE,
-#endif
-    NONE
+    TABLE_CAPTION, BOX, INLINE_BOX, NONE
 };
 
 enum EPointerEvents {